Privacy Policy (English)
1. Who we are
VECTRA (vectra.arsyadarref.com) is a Final Year Project (PSM) at Universiti Teknikal Malaysia Melaka, operated by Arsyad Arref, who is responsible for your personal data on VECTRA. Contact: arsyadarref.official@gmail.com.
2. What we collect
From you
- Account: your name, email address and password (stored only as a secure hash by our authentication provider), and the role you choose (student, lecturer or company). If you sign in with Google, we receive your name, email address and profile picture link from Google.
- Profile (students and graduates): username, headline, about text, university, programme, year of study, career stage, internship availability dates and, only if you add it, your CGPA.
- Your work: skills, projects, work experience, and evidence you attach (PDF or image files up to 10 MB, or links).
- Activity: applications and the note you send with them, saved roles, companies you follow, company reviews, endorsement requests (including the lecturer's name and email you enter), and your privacy choices with the date each was changed.
- Companies: company details, photos, perks and openings, team members' names and work emails, and notes your team writes about applicants.
From others
- Your university: its career office may upload your academic record (matric number, student email, name, faculty, programme, CGPA, study status and expected graduation). It is linked to your account when your confirmed student email matches.
- Lecturers: when a lecturer reviews your request, we record their decision, comment and date.
- Companies: when a company opens your profile or moves your application, we record which company, when, and the application stage.
Automatically
- A sign-in session cookie, and technical data our hosting and security providers process to run the site and stop abuse, such as your IP address, browser type and request times.
Your name, email address, password and role are required to create an account; without them we can't provide one. Everything else is optional: leaving it out only means that part of your profile is empty.
3. How we use it
- To create and secure your account, and to sign you in.
- To show your profile and verification badges to the people you choose (see section 4).
- To let you apply to openings, and to let companies review applications sent to them.
- To let universities verify academic records and lecturers endorse skills and projects.
- To send emails you need, such as sign-in links, password resets and endorsement requests.
- To show in-app notifications, your profile strength and role suggestions.
- To keep VECTRA safe: preventing spam and bots, and logging admin changes.
We do not sell your personal data, show you advertising, or use advertising or analytics trackers.
4. Who can see your information
- Your profile starts private. If you turn on Make my profile public, anyone with the link can see your skills, projects, experience and evidence. Search engines are asked not to list profiles.
- Companies you apply to see your full profile and the note you send, together with a record of your consent at the time.
- Companies with a licence for your university can find you and open your full profile only if you turn on Let licensed companies find me in search.
- Your CGPA is shown to others only if you turn on Show my CGPA. Your email address is shown to companies only if you turn on Show my email to companies that can see my profile.
- Lecturers you ask see that skill or project, its evidence and your basic profile.
- Your university's admins see the academic records their university uploaded.
- Company reviews are shown as “Past intern · your university”, without your name.
- VECTRA's administrators can access data when needed to run, support and secure the service.
- We may disclose data when required by Malaysian law or a lawful order.
5. Service providers and transfers outside Malaysia
We use these providers to run VECTRA. They process data on our behalf:
- Supabase: database, sign-in and file storage, and sending account emails. Its servers for VECTRA are in Japan.
- Hostinger: web hosting. Its servers for VECTRA are in Singapore.
- Cloudflare Turnstile: the “Verify you are human” check on sign-in and sign-up forms.
- Google: only if you choose “Continue with Google”.
- Resend: email delivery for endorsement requests, when it is enabled.
- YouTube and Vimeo: only when you view a video a company has added to its page.
Because some providers store or process data outside Malaysia, by using VECTRA you consent to that transfer. We choose providers that protect data to a standard comparable to the PDPA.
6. Cookies
VECTRA uses only strictly necessary cookies: the ones that keep you signed in. We don't use advertising or analytics cookies. The “Verify you are human” check and Google sign-in may set their own cookies when you use them.
7. How long we keep it
We keep your data for as long as your account exists. When you delete your account, your personal data is removed from our live database straight away. Copies in our providers' backups and logs are removed when those are overwritten on the providers' normal schedules. Records that belong to others stay without your account linked, as described in section 8.
8. Your rights and choices
- Access and correct: you can see and edit most of your data yourself on your profile and in Settings. To ask for a copy of your data or to correct something you can't edit (such as a university record), email arsyadarref.official@gmail.com.
- Withdraw consent and limit processing: turn off Make my profile public, Let licensed companies find me in search, Show my CGPA or Show my email at any time; every change is logged in your consent history.
- Delete your account: go to Settings → Delete account. This removes your profile, skills, projects, experience, evidence files, applications and their history, endorsement requests you sent, follows, reviews, notifications and consent history. A university's own copy of your academic record, a lecturer's past decisions and admin log entries stay, without your account linked. Company owners must hand over or close their company first.
We reply to access and correction requests within 21 days, as the PDPA requires.
9. Security
Data is encrypted in transit (HTTPS). Database rules let each person read only what they are allowed to, every admin change is logged, and evidence files are opened through links that expire after 10 minutes. No system is perfectly secure; if a breach affects you, we will tell you.
10. Age
VECTRA is for people aged 18 and over. If you are under 18, you may use it only with the consent of a parent or guardian.
11. Demo data
VECTRA is a student project. The companies, openings, reviews and talent shown as examples are fictional and labelled as demo data. Universities named on the site are examples, not partners.
12. Changes to this policy
If we change this policy, we will update the date at the top and, for significant changes, tell signed-in users in VECTRA.
13. Contact
Questions or requests about your personal data: arsyadarref.official@gmail.com.