1. Who we are
This policy applies to the NUS ScaleUP client website and the supporting services used to provide its account, course discovery, learner profile, corporate, application, payment, support, AI assistance, and calendar features. It explains what we access, collect, use, store, share, and delete.
The project is operated by its student capstone team, independently of NUS. References to NUS SCALE courses, branding, or external websites do not mean that NUS operates this project. Our privacy contact is Ang Yak Hng at angyakhng8000@gmail.com.
2. Information we collect
We receive information you enter or upload, information an authorized corporate representative supplies about employees, information generated through your use of the service, and Google information you authorize us to access. Depending on the features you use, this includes:
- Account and contact details: name, email address, authentication information managed by Firebase Authentication, account identifiers, roles, approval status, and account timestamps. Passwords are handled by our authentication provider; they are not stored as plaintext in our application profile records.
- Learner particulars: address, date of birth, citizenship, birthplace, gender, race, contact details, emergency contact details, and identity document type and number, such as NRIC, FIN, or passport information, where requested.
- Documents and career information: profile photos, identity documents, qualification certificates, resumes, education and employment history, skills, interests, and selected job roles. Uploaded documents may be reviewed for verification.
- Corporate information: company and representative details, employee account imports, employer associations, invitations, and records needed to manage corporate participation.
- Learning and transaction records: course and intake choices, applications, enrolment and completion information, payment identifiers, amounts, currencies, payment status, and related administrative records. Payment details entered into Stripe’s payment interface are processed by Stripe.
- Interactions: bookmarks, notifications, enquiry and support messages, case records, chatbot messages and conversation context, and resume information submitted for extraction.
- Technical information: requests, timestamps, errors, and operational logs associated with running the website and backend. Hosting and payment providers may process network and device information to deliver and protect their services.
Google account and calendar information is described separately below. Providing information is tied to the feature you choose; without required information, we may be unable to provide that feature. Please avoid uploading unnecessary personal information.
3. How we use information
We use information to create and authenticate accounts; maintain learner profiles; review identity and qualification submissions; identify skills and relevant courses; manage corporate employee participation; process applications and payments; display learning records and notifications; respond to enquiries; and provide the chatbot, resume import, and optional calendar features.
We also use necessary information to troubleshoot failures, secure the service, prevent abuse, resolve disputes, and meet applicable legal obligations. Google-derived information is subject to the additional purpose and sharing restrictions below.
4. Google Calendar access
Connecting Google Calendar is optional and separate from your NUS ScaleUP login. We connect the Google account you select, identify that connection, let you choose readable calendars, and display events from your selected calendars and upcoming events in your learner calendar.
We request these permissions:
openid: verify the connected Google account’s identity and obtain its account identifier.email: obtain its verified email address and show which account is connected.https://www.googleapis.com/auth/calendar.calendarlist.readonly: read your calendar list so you can select calendars, including calendar IDs, names, time zones, and colours.https://www.googleapis.com/auth/calendar.events.readonly: read events from the calendars you select for display.
The event fields we request include event IDs, titles, status, start and end dates/times and time zones, locations, Google Calendar links, recurring-event identifiers, and free/busy availability metadata. We do not request event descriptions or attendee lists in our event retrieval. Google permissions authorize a broader ability to read events, but our feature retrieves events from the calendars you select for the displayed date range and upcoming-events view.
This integration is read-only. It cannot create, edit, or delete your Google Calendar events. We do not obtain your Google password.
We retain your Google account identifier and email, selected calendar metadata, granted scopes, connection/update timestamps, and encrypted OAuth credentials, including access and refresh tokens, in Firestore. Credentials allow our server to renew access when the calendar feature needs to load data without asking you to reconnect each time. Imported event information is fetched through our server and displayed in your browser; it is not persisted in our application database. Calendar responses are marked private and not to be cached.
To manage the connection, open the Google calendars dialog in your learner calendar. Select or deselect calendars and save your choices. Deselecting a calendar stops its events being requested for display but does not revoke the Google connection. Choose Disconnect to delete the local connection record, including stored credentials and selected calendar metadata, and stop further access through that connection. We also attempt to revoke Google access. If Google cannot be reached or revocation fails, the app advises you to remove access yourself.
You can revoke access at any time through your Google account’s connections settings. Revoking access there stops authorized Google API access but does not itself guarantee deletion of the connection metadata already held by our app; disconnect here or contact us to request its deletion. Disconnecting does not delete events from Google Calendar.
5. Google data and Limited Use
NUS ScaleUP’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements. These restrictions also apply to information derived from Google data.
We use Google information only to provide or improve the prominent, user-facing calendar connection and display features described in this policy. We do not sell Google data, disclose it to data brokers, use it for advertising or retargeting, use it to determine creditworthiness or lending eligibility, or use it to create, train, or improve general-purpose AI or machine-learning models.
Google data may be transferred only as permitted by those policies: to provide or improve these visible user-facing features with your consent, for necessary security purposes, to comply with applicable law, or as part of an operator merger, acquisition, or asset sale after obtaining your explicit prior consent. Our cloud infrastructure processes connection data to deliver the feature. Your Google calendar is not made available to employers or instructors through this integration.
We do not permit people to read Google user data except with your documented affirmative consent to access specific data, when necessary for security investigations or legal compliance, or for permitted internal operations using aggregated and anonymized information in accordance with applicable law. These restrictions apply to team members and anyone acting on our behalf.
6. Chatbot and resume assistance
The chatbot sends your current message and recent conversation context through the application backend to the configured Ollama language-model service to answer questions and retrieve course information. Resume assistance processes submitted resume text or PDF contents using extraction tools and the configured language-model backend to suggest profile fields for you to review. The model service may run on the project’s machine or a configured hosted endpoint; this processing does not necessarily happen on your device.
Chat conversation state is stored in your browser’s local storage and sent with subsequent messages. The agent does not maintain a persistent conversation database between requests, but operational logs can include message text, reply excerpts, and tool arguments. Browser conversation data is cleared when you sign out through the app; you can also remove it through your browser’s site-data controls. Clearing browser data does not erase any backend or provider logs already generated.
Resume extraction temporarily reads submitted file contents to produce suggested fields. Profile information and documents you subsequently submit or save are retained as part of your profile. AI suggestions can be inaccurate, so review them before saving. Avoid including unnecessary identity numbers or other sensitive information in chatbot messages.
The Google Calendar integration does not automatically send Google account credentials, calendar metadata, or events to these AI features. If you manually paste personal information into a chatbot message or resume, that submitted content is processed as described in this section.
9. Retention and deletion
We retain account and profile records, saved documents, corporate associations, applications, transactions, and support records while needed to provide the relevant service, administer participation, resolve enquiries or disputes, maintain security, or meet applicable obligations. The current project does not provide a universal automatic deletion deadline for these categories. You can request deletion by contacting us; we assess the records and any reasons that require limited continued retention.
Google connection information remains until you disconnect, replace the connection, or it is removed following a request. Disconnecting removes the connection from the active application database. Imported Google events are not retained there. An expired or revoked Google token does not necessarily remove the remaining connection record.
Technical logs and any provider-managed backups may have separate retention lifecycles. We do not promise immediate deletion from all logs or backups when an active record is removed. Any retained Google-derived information remains subject to Limited Use restrictions. Deleting a login alone should not be assumed to delete every related application, transaction, document, or support record; contact us for a broader deletion request.
10. Security and international processing
We use authenticated sessions, role and ownership checks, private document access, and server-side controls to restrict access. Google OAuth credentials are encrypted using AES-256-GCM before being stored and handled on the server. The Google authorization flow uses state validation and PKCE, and production authentication cookies use secure transport settings. No method of transmission or storage can guarantee absolute security.
Our cloud, payment, and configured backend providers may process information outside your country. Processing locations depend on deployed infrastructure and provider operations; we do not represent that all information stays in Singapore. We seek to limit processing and access to what is necessary for the functions described here and to meet applicable data-protection requirements.
11. Your choices and rights
You can review and update supported profile fields, manage saved information, choose calendars, disconnect Google, and revoke Google access. You may contact us to request access to your information, corrections, deletion, or withdrawal of consent where applicable. Withdrawing permission or deleting required information may prevent us from providing the corresponding feature.
Email our privacy contact with the account email and a description of your request. We may ask for proportionate proof of account ownership before disclosing or changing records. Do not email your password, Google credentials, or full identity document unless we arrange a necessary secure verification method. We will explain any limitations or information that must be retained when handling your request.
12. Children and other people’s information
The project is intended for adult learners and corporate users, not children under 13. If you believe a child has submitted personal information, contact us so we can investigate and take appropriate action.
If you provide employee, emergency contact, or other third-party information, ensure that you are authorized to do so and inform that person about the relevant use. Submit only the information necessary for the feature.
13. Changes to this policy
We update this page when our practices change and revise the last-updated date. For material changes, we provide appropriate notice through the service or another suitable channel. Before accessing or using Google information for a new purpose beyond what you originally authorized, we will update the disclosures and obtain renewed consent as required by Google’s policies. Merely publishing a revised policy does not authorize new Google-data uses.
14. Contact us
For questions, privacy concerns, or requests about your information, contact Ang Yak Hng, privacy contact for the NUS ScaleUP student capstone project, at angyakhng8000@gmail.com. You can also submit an enquiry through our contact form.