1. About this policy
This policy explains how vocasona collects, uses, shares and protects your personal data when you use our website and app (the "Service").
vocasona is operated by Unfuss Sdn. Bhd. , Puchong, Malaysia ("we", "us"). We are the organisation responsible for your personal data. In some countries this is called the "data controller" or "data user".
Who this applies to. This policy applies to everyone who uses the Service, wherever you live. Singapore's Personal Data Protection Act 2012 (PDPA) is our baseline. Where the law in your country gives you more protection, we follow that law as well. Section 12 sets out the extra terms for each country.
Laws we follow include:
- Singapore: Personal Data Protection Act 2012 (PDPA)
- Malaysia: Personal Data Protection Act 2010, as amended (PDPA)
- Indonesia: Law No. 27 of 2022 on Personal Data Protection (PDP Law)
- Thailand: Personal Data Protection Act B.E. 2562 (PDPA)
- Philippines: Data Privacy Act of 2012 (DPA)
- Vietnam: Decree 13/2023 and the Personal Data Protection Law
- Australia: Privacy Act 1988 and the Australian Privacy Principles
- Hong Kong: Personal Data (Privacy) Ordinance (PDPO)
- [Add others as you enter new markets, e.g. Japan APPI, Korea PIPA, India DPDP Act]
Plain-language summary
- You give us your CV and job descriptions so we can tailor your CV. That is the core of the Service.
- We use AI providers to process your content. Some are outside your country.
- We do not sell your personal data.
- We do not use your CVs to train AI models unless you opt in.
- You can download or delete your data at any time.
2. Personal data we collect
Category | Examples | Where it comes from |
|---|---|---|
Account data | Name, email, password (stored hashed), country, language, contact details | You, at signup |
CV content | Work history, education, skills, contact details, referees, photo (if included) | Files and text you upload |
Job descriptions | Job ads, links, company names | You paste, upload or link them |
Your edits and preferences | Accepted or rejected suggestions, manual edits, writing-style profile | Your use of the Service |
Payment data | Plan, billing name, last 4 digits of card, invoices | Our payment provider ([e.g. Stripe]); we never see your full card number |
Usage and device data | IP address, browser, device type, pages used, error logs | Collected automatically |
Support messages | Emails and chat with our team | You |
Cookies | Login session, preferences, analytics (with consent where required) | Your browser; see our [Cookie Policy] |
Sensitive data in CVs. CVs sometimes include data the law treats as sensitive. Examples are national ID numbers (such as NRIC, MyKad or NIK), date of birth, nationality, religion, health details, photos and salary history. Please do not include national ID numbers or other sensitive details unless you need them in your CV. If you choose to include sensitive data, you agree that we may process it only to provide the Service to you.
Data about other people. If your CV names referees, make sure they are happy for their details to be shared.
3. Why we use your personal data
Purpose | Legal basis (where your law requires one) |
|---|---|
Create and manage your account | Contract; consent |
Analyse your CV against a job description and suggest edits | Contract; consent |
Learn your writing style so suggestions sound like you | Contract; consent (you can switch this off in Settings) |
Save your original and tailored CVs separately | Contract |
Take payments and send invoices | Contract; legal obligation |
Keep the Service secure and prevent fraud or abuse | Legitimate interests; legal obligation |
Fix bugs and measure how features perform (using de-identified data where possible) | Legitimate interests |
Answer support requests | Contract; legitimate interests |
Send product updates and offers | Separate opt-in consent only |
Improve or train our AI models using your content | Separate opt-in consent only |
Meet legal, tax and regulatory duties | Legal obligation |
We will not use your personal data for a new purpose without telling you first and, where required, asking for your consent.
4. How our AI works with your data
- You stay in control. The AI suggests edits. Nothing changes in your CV until you accept or edit it.
- No automated decisions about you. We do not make hiring, scoring or eligibility decisions. Employers do not see your data through us.
- We don't invent facts. If a suggestion needs information we don't have, we ask you for it.
- Third-party AI providers. We send your CV and job description text to our AI providers to generate suggestions. Our contracts require them to use your data only to serve our requests. They may not use it to train their models.
- Model training is off by default. We use your content to improve our own models only if you turn on "Help improve vocasona" in Settings. You can turn it off at any time.
5. Consent
When you create an account, we ask you to confirm that you have read this policy and agree to us processing your data for the Service. We keep a record of the date, time and policy version you accepted.
Marketing messages and AI model training each need a separate, optional consent. Saying no does not affect your use of the Service.
Withdrawing consent. You can withdraw consent at any time in Settings or by emailing [privacy@domain]. We will stop processing within [10] business days. If you withdraw consent for the core Service, we will no longer be able to provide it, and we will tell you what that means before acting. Withdrawal does not affect processing that already took place.
6. Who we share your data with
We do not sell or rent your personal data. We share it only with:
Recipient | Why | Location |
|---|---|---|
AI model providers (Anthropic) | Generate CV suggestions | [e.g. United States] |
Cloud hosting (Netlify) | Store and run the Service | [e.g. Singapore region] |
Payment processor ([e.g. Stripe]) | Take payments | [e.g. United States, Singapore] |
Email and support tools ([names]) | Send account emails; handle support | [location] |
Analytics ([names]) | Measure usage (de-identified where possible) | [location] |
Professional advisers | Legal, audit and accounting | Singapore |
Authorities | When the law requires it | As required |
A buyer or successor | If our business is sold or merged; they must honour this policy | As applicable |
All service providers act on our instructions under written contracts that require them to protect your data. We keep an up-to-date list of providers at [link].
7. Transfers outside your country
Some providers process data outside the country where you live, including outside Singapore. When we transfer personal data overseas, we make sure it receives protection at least comparable to the PDPA. We do this through:
- contracts with data protection clauses (such as the ASEAN Model Contractual Clauses or EU Standard Contractual Clauses), or
- providers certified under schemes such as the APEC CBPR or PRP systems, or
- your consent, where your local law requires it.
Section 12 sets out extra rules for some countries.
8. How long we keep your data
Data | Kept for |
|---|---|
CVs, job descriptions, tailored versions | Until you delete them, or [12] months after your account becomes inactive |
Account data | While your account is open, then deleted within [30] days of closure |
Data sent to AI providers | Not stored by the provider beyond [0–30] days, as their contract allows |
Payment and invoice records | [5–7] years, as tax law requires |
Security and access logs | [12] months |
Marketing preferences | Until you unsubscribe, plus a suppression record so we don't contact you again |
When we no longer need data, we delete it or make it anonymous. Backups are overwritten within [35] days.
9. How we protect your data
We use reasonable security measures, including:
- encryption in transit (TLS) and at rest
- role-based access, limited to staff who need it, with multi-factor authentication
- logical separation of each customer's data
- regular vulnerability testing and security reviews
- staff confidentiality agreements and data protection training
No system is completely secure. If a data breach is likely to cause you significant harm, we will tell you and the relevant regulators within the time the law requires (see Section 12).
10. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and learn how it has been used
- Correct data that is wrong or incomplete
- Delete your data (most of it you can delete yourself in Settings)
- Download your data in a common format (data portability)
- Withdraw consent or object to certain processing, such as marketing
- Restrict processing in some cases
- Complain to your data protection regulator (listed in Section 12)
How to ask. Use Settings > Privacy, or email [privacy@domain]. We may need to confirm your identity first. We aim to respond within 30 days, or sooner where your local law requires. We will not charge a fee unless the law allows it and the request is repetitive or excessive; we will tell you the fee first.
11. Age requirement
You must be 18 or older to use vocasona. If you are under 18 [or under the age of majority in your country], you may use the Service only with consent from a parent or guardian. We do not knowingly collect data from children under [13]. If we learn that we have, we will delete it.
12. Country-specific terms
These terms apply in addition to the rest of this policy if you live in the country listed. The breach timings below are from memory and need confirmation by local counsel before launch.
Country | Regulator | Breach notice to regulator | Extra terms for users there |
|---|---|---|---|
Singapore | Personal Data Protection Commission (PDPC) | Within 3 calendar days of assessing a breach as notifiable | We will not send marketing to Singapore numbers on the Do Not Call Registry without your clear consent. |
Malaysia | Personal Data Protection Commissioner (JPDP) | Within 72 hours; affected users without undue delay | This notice is available in Bahasa Melayu [link] and English. You may ask us to transfer your data to another organisation (data portability). |
Indonesia | Komdigi / PDP agency once established | Within 3 x 24 hours, to you and the regulator | Your consent is collected in Bahasa Indonesia [link]. You may object to automated decision-making (we do not use it). |
Thailand | Personal Data Protection Committee (PDPC Thailand) | Within 72 hours | A Thai version of this notice is available [link]. Sensitive data is processed only with your explicit consent. |
Philippines | National Privacy Commission (NPC) | Within 72 hours | You may file complaints with the NPC. [Register our DPO with the NPC if thresholds are met.] |
Vietnam | Ministry of Public Security (A05) | Within 72 hours | We file the required impact assessments for processing and overseas transfers. Your consent is recorded in a verifiable format. [Confirm requirements under the new PDP Law.] |
Australia | Office of the Australian Information Commissioner (OAIC) | As soon as practicable for an eligible breach | We take reasonable steps so overseas recipients handle your data in line with the Australian Privacy Principles. You may use a pseudonym where practical. |
Hong Kong | Privacy Commissioner for Personal Data (PCPD) | Voluntary (we will notify where harm is likely) | We will not use your data for direct marketing without your express consent. |
Users outside these countries. If you live in the EU, UK or another region with its own data protection law, contact us and we will apply the protections that law requires. [Add a GDPR section before marketing to EU or UK users.]
13. Changes to this policy
We may update this policy. If a change materially affects how we use your data, we will tell you by email or in the app at least [14] days before it takes effect and, where required, ask for your consent again. The version and date at the top show which version is current.
14. Contact us
Data Protection Officer [Name or title] [Company Name] Pte. Ltd. [Address], Singapore Email: [dpo@domain]
[Local representatives, if appointed: Malaysia [contact]; Indonesia [contact]]
If you are not satisfied with our response, you may contact the regulator in your country (Section 12).