Last updated: 9 May 2026

Privacy Policy

1. Introduction

This Privacy Policy explains how Career Compass collects, uses, and protects your personal data. Career Compass is operated by eLearningMinds Sdn Bhd (Company No. 1074743-T, "eLearningMinds", "we", "us") and is subject to Malaysia's Personal Data Protection Act 2010 ("PDPA").

For privacy questions or to exercise your rights under this Policy, contact our Data Protection Officer at dpo@epitome.global.

2. What we collect

We collect the following categories of personal data:

  • Account: email address and a hashed password (we never store passwords in plain text)
  • Profile: your name, education level, field of study, institution, and graduation year (some fields optional)
  • CV (optional): if you upload a CV, the file itself and the structured information we extract from it (summary, skills, work history, education)
  • Assessment: your responses to the 34 assessment items, the computed results, AI-generated career suggestions, and personalised insights
  • AI Career Advisor: the chat history of your conversations with the Advisor
  • AI usage: per-call token counts so we can manage capacity

3. How we use it

We use your data to:

  • Operate the Service and your account
  • Score your assessment and generate career suggestions
  • Power the AI Career Advisor with personalised context
  • Respond to support requests
  • Improve the Service (in aggregate, anonymised)
  • Comply with legal obligations

4. AI processing & sub-processors

To provide AI features, we share specific data with the following sub-processors:

  • Anthropic (Claude) — receives your assessment results and chat messages to generate the AI Career Advisor responses, career suggestions, and personalised insights
  • OpenAI (GPT-4o) — receives your CV file content for parsing into structured fields, and acts as a fallback for career suggestions and insights
  • Convex — provides our database, authentication, and file storage; processes all the data above as our infrastructure provider
  • Resend — receives your email address and the contents of verification, password reset, and welcome emails to deliver them. Email content does not include AI-generated outputs or assessment data.

These sub-processors may retain request logs per their own data retention policies (typically up to 30 days for abuse detection). They do not use your data to train their models for our use case.

5. Cross-border data transfer

Our database (Convex) currently hosts in the United States. Some operational support is provided by Epitome Global Pte Ltd (Singapore), who built and maintains the platform on behalf of eLearningMinds. By using the Service, you consent to your data being transferred to and processed in these jurisdictions, with the safeguards described in this Policy.

6. Data sharing

We do not share your personal data with marketing partners, advertising networks, or other third parties beyond the sub-processors named in section 4. We do not sell personal data. We will disclose personal data only if required by law (such as in response to a valid court order from a Malaysian court).

7. Retention

We retain your personal data for as long as your account is active. When you delete your account, your data is permanently removed from our active systems. Backup copies may persist in our infrastructure for a limited window before being purged. Aggregated, anonymised data (data that cannot identify you) may be retained indefinitely for product improvement.

8. Your PDPA rights

Under the PDPA 2010, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Withdraw consent for processing (subject to legal/contractual obligations)
  • Request deletion of your account and personal data
  • Receive a copy of your data in a portable format (where technically feasible)

To exercise these rights, email dpo@epitome.global. We may ask for verification of your identity before responding. We aim to respond within 21 days, in line with PDPA guidance.

9. Children & parents

Career Compass is open to users aged 13 and above. If you are under 18, you must have a parent or guardian's consent to use the Service. Parents may request access to or deletion of a minor's account by emailing dpo@epitome.global from an address they can verify with us.

10. Cookies & analytics

We use essential authentication cookies to keep you signed in. We may in the future use privacy-respecting analytics tools to understand how the Service is used. We will update this Policy and notify users before any third-party tracking is enabled.

11. Security

We use industry-standard safeguards including TLS encryption in transit and encryption at rest via our infrastructure provider. However, no system is perfectly secure; you acknowledge that there is inherent risk in transmitting data over the internet.

12. Data breach notification

If we become aware of a data breach affecting your personal data, we will notify affected users without undue delay. Where required by the PDPA, we will also notify the Personal Data Protection Commissioner.

13. Changes to this policy

We may update this Policy from time to time. Material changes will be communicated by email or in-app notification. The "Last updated" date at the top of the page reflects the most recent change.

14. Contact

For privacy questions, requests, or to exercise your rights:

Data Protection Officer
eLearningMinds Sdn Bhd (Company No. 1074743-T)
Email: dpo@epitome.global