Privacy Policy

This policy explains what Degreemate (“we”, “us”) collects about you when you use degreemate.my, why we collect it, and what choices you have. Degreemate helps Malaysian students and parents compare post-SPM pathways, universities and careers.

Account details. If you sign up, we collect your email address and, if you use email/password sign-up, a password (stored as a salted hash by our authentication provider, Supabase; we never see or store it in plain text). If you sign up with Google, we receive your name, email and profile picture from Google, and nothing else.

Profile and plan data. Your SPM results, onboarding answers, saved pathways, shortlisted programmes, saved careers and any other inputs you give the recommendation engine. This is what lets the engine and your plan work. It is used to generate your recommendations and is not sold or rented to any third party, including universities.

Survey responses. If you take one of our research surveys, your answers are used only for product research. If you were signed in when you submitted, the response is linked to your account so you aren’t asked again; deleting your account removes that link and any contact details you gave for a reward.

Chats with Mira and other AI features. What you type to Mira, our AI counsellor, is sent with a short summary of your plan to generate a reply. Mira may remember a few facts you told it (for example the field you are interested in) so it doesn’t ask again. Transcripts are kept for up to 180 days. A photo of a result slip that you choose to upload is read once to fill in your grades and is not stored.

Contact details you send us. If you email or WhatsApp us, we keep that correspondence to respond to you and improve the product.

Usage analytics. We record visit and page-view events (which pages are viewed, in what order, which buttons are used) to understand how the site is used and to improve it. We use PostHog for this, and keep a short copy in our own database for up to 13 months. Web addresses are cleaned before they are sent, so share links and class codes are not recorded. Events never carry your name or email.

By default, analytics run without cookies: nothing that identifies your browser is kept between visits, and no session recordings are made. If you choose “Allow” on the analytics notice, PostHog may store an identifier in a cookie and in local storage so repeat visits can be counted, may link your visits to your account by its internal id (never your email) when you are signed in, and may record sessions with all typed text and personal pages masked. You can change your choice at any time by clearing this site’s data in your browser, which brings the notice back.

Cookies and local storage. We use your browser’s local storage to keep your plan, your sign-in session and your analytics choice on your device, and a small cookie to remember your chosen language (English or Bahasa Malaysia). We do not use advertising cookies.

Error reports. When a page breaks, an error report (the page address with secrets removed, the browser type and what failed) is sent to Sentry so we can fix it. Reports do not include your name, email or plan.

Subscription payments are processed by Curlec, a licensed Malaysian payment gateway. Your card or bank details are entered directly into Curlec’s checkout and never pass through or get stored on our servers; we only receive confirmation that a payment succeeded, an order/subscription reference, and the plan you paid for.

We do not sell your data. We share the minimum necessary with the service providers that run Degreemate, each of which processes it only to provide their service to us:

• Supabase: database, sign-in and file storage.
• Vercel: hosting the website.
• PostHog: usage analytics, as described above.
• Google (Gemini API): writing Mira’s replies and the plain-language explanations of your pathway matches, and reading a result slip you upload. Your messages and a summary of your plan are sent for that purpose only.
• Sentry: error reports.
• Curlec: payment processing.

Some of these providers process data outside Malaysia. We do not share your profile, plan or survey answers with universities, colleges or employers; that independence is the point of the product (see How we work).

We may disclose information if required by Malaysian law or a valid legal request.

We keep account and plan data for as long as your account exists. When you delete your account, it is removed straight away (see below). Other data has its own limit: Mira transcripts and remembered facts up to 180 days, parent report links 180 days, offer share links 90 days, analytics events 13 months, and survey contact details 30 days after any reward is paid. Survey answers are kept for the duration of the research programme they support.

Under Malaysia’s Personal Data Protection Act 2010, you can ask us to access, correct or delete the personal data we hold about you, or withdraw consent for us to process it. If you have an account, you can do most of this yourself on the Settings page:

• Download my data gives you a file (JSON) of everything stored with your account: profile, saved plan, linked parent accounts, what Mira remembers, email preferences and any payments.
• Delete my account removes your account and everything linked to it, your email from our mailing list, and the anonymous data this browser created (Mira chats, share links, reviews and quiz submissions). It cannot be undone.
• Emails lets you stop deadline reminders or all email from us.

Anything you did without an account, on another device, is stored only in that browser or under that browser’s anonymous id; email us from the address you used and tell us what to look for, and we will find and remove it. For anything else, email degreemate.work@gmail.com.

Degreemate is built for post-SPM students, most of whom are minors under Malaysian law. We collect only what is needed to produce a pathway recommendation, and a parent or guardian may contact us to review or delete a minor’s data at any time.

If we make a material change to this policy, we will update the date above and, where appropriate, let you know in the product.

Questions about this policy or your data: degreemate.work@gmail.com.