Last updated: 10 July 2026

Privacy Policy

1. Introduction

This Privacy Policy explains how Career Compass collects, uses, and protects your personal data. Career Compass is operated by eLearningMinds Sdn Bhd (Company No. 1074743-T, "eLearningMinds", "we", "us") and is subject to Malaysia's Personal Data Protection Act 2010 ("PDPA").

For privacy questions or to exercise your rights under this Policy, contact our Data Protection Officer at dpo@epitome.global.

2. What we collect

We collect the following categories of personal data:

  • Account: email address and a hashed password (we never store passwords in plain text)
  • Profile: your name, education level, field of study, institution, and graduation year (some fields optional)
  • CV (optional): if you upload a CV, the file itself and the structured information we extract from it (summary, skills, work history, education)
  • Assessment: your responses to the 34 assessment items, the computed results, AI-generated career suggestions, and personalised insights
  • AI Career Advisor: the chat history of your conversations with the Advisor
  • AI usage: per-call token counts so we can manage capacity
  • Billing (paid subscriptions only):the payer's details collected at checkout for Malaysian e-invoicing — the payer is usually a parent, guardian, or company, and may be a different person from the account holder. This includes the payer's name, NRIC or passport number (individuals) or business registration number (companies), tax identification number (TIN), SST number where applicable, billing address, phone number, and email
  • Payment records: transaction details for each payment (amount, date, programme, payment and refund status) together with the payer details above as captured at the time of payment. We never see or store card numbers — card details are entered directly with our payment processor

3. How we use it

We use your data to:

  • Operate the Service and your account
  • Score your assessment and generate career suggestions
  • Power the AI Career Advisor with personalised context
  • Process subscription payments, issue receipts, reconcile transactions, and support Malaysian (LHDN) e-invoicing — including issuing a validated e-Invoice when the payer requests one
  • Respond to support requests
  • Improve the Service (in aggregate, anonymised)
  • Comply with legal obligations

4. AI processing & sub-processors

To provide AI features, we share specific data with the following sub-processors:

  • Anthropic (Claude) — receives your assessment results and chat messages to generate the AI Career Advisor responses, career suggestions, and personalised insights
  • OpenAI (GPT-4o) — receives your CV file content for parsing into structured fields, and acts as a fallback for career suggestions and insights
  • Convex — provides our database, authentication, and file storage; processes all the data above as our infrastructure provider
  • Resend — receives your email address and the contents of verification, password reset, and welcome emails to deliver them. When a payer requests a validated e-Invoice, Resend also delivers an email to the eLearningMinds finance team containing that transaction's details and the payer billing details described in section 2. Email content does not include AI-generated outputs or assessment data.
  • Stripe— our payment processor, operating under eLearningMinds' merchant account. Stripe receives card details directly (we never hold them), together with the payer's name, email, phone number, and billing address on the Stripe Customer record. Sensitive compliance identifiers such as NRIC/passport and TIN are not placed in Stripe metadata; the eLearningMinds finance team accesses those fields through the Service's authenticated reporting and e-invoice tools.

These sub-processors may retain request logs per their own data retention policies (typically up to 30 days for abuse detection). They do not use your data to train their models for our use case.

5. Cross-border data transfer

Our database (Convex) currently hosts in the United States. Some operational support is provided by Epitome Global Pte Ltd (Singapore), who built and maintains the platform on behalf of eLearningMinds. By using the Service, you consent to your data being transferred to and processed in these jurisdictions, with the safeguards described in this Policy.

6. Data sharing

We do not share your personal data with marketing partners, advertising networks, or other third parties beyond the sub-processors named in section 4. We do not sell personal data. We will disclose personal data only if required by law (such as in response to a valid court order from a Malaysian court).

7. Retention

We retain your personal data for as long as your account is active. When you delete your account, your profile, assessment, chat, CV, and payer billing-profile data are permanently removed from our active systems, and any active subscription is cancelled immediately (no refund is issued for the remaining period). Backup copies may persist in our infrastructure for a limited window before being purged. Aggregated, anonymised data (data that cannot identify you) may be retained indefinitely for product improvement.

Payment records are the exception: transaction records — including the payer billing details captured at the time of each payment — are retained after account deletion because Malaysian law requires businesses to keep financial records. We retain them for seven (7) years from the transaction date, in line with LHDN record-keeping requirements, after which they are deleted.

8. Your PDPA rights

Under the PDPA 2010, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Withdraw consent for processing (subject to legal/contractual obligations)
  • Request deletion of your account and personal data
  • Receive a copy of your data in a portable format (where technically feasible)

To exercise these rights, email dpo@epitome.global. We may ask for verification of your identity before responding. We aim to respond within 21 days, in line with PDPA guidance.

9. Children & parents

Career Compass is open to users aged 13 and above. If you are under 18, you must have a parent or guardian's consent to use the Service. Parents may request access to or deletion of a minor's account by emailing dpo@epitome.global from an address they can verify with us.

10. Cookies & analytics

We use essential authentication cookies to keep you signed in. We may in the future use privacy-respecting analytics tools to understand how the Service is used. We will update this Policy and notify users before any third-party tracking is enabled.

11. Security

We use industry-standard safeguards including TLS encryption in transit and encryption at rest via our infrastructure provider. However, no system is perfectly secure; you acknowledge that there is inherent risk in transmitting data over the internet.

12. Data breach notification

If we become aware of a data breach affecting your personal data, we will notify affected users without undue delay. Where required by the PDPA, we will also notify the Personal Data Protection Commissioner.

13. Changes to this policy

We may update this Policy from time to time. Material changes will be communicated by email or in-app notification. The "Last updated" date at the top of the page reflects the most recent change.

14. Contact

For privacy questions, requests, or to exercise your rights:

Data Protection Officer
eLearningMinds Sdn Bhd (Company No. 1074743-T)
Email: dpo@epitome.global