1. Data We Collect
Account Information
When you create an account via Google OAuth, we collect your name, email address, and profile image URL.
- Lawful basis: Consent (you agree to our terms and privacy policy at first login)
- Retention: Lifetime of your account
Learning Progress
We store your module completion status, quiz results, concept check results, and earned achievements.
- Lawful basis: Contract (necessary to deliver the educational service)
- Retention: Lifetime of your account
Session and Technical Data
When you log in, our server records your IP address, user agent (browser type and version), and sets a session cookie to maintain your authenticated state. This data is stored in the sessions table.
- Lawful basis: Contract (necessary for authentication and security)
- Retention: Until session expiry or logout
Usage Analytics
We collect aggregate, anonymous usage data through Cloudflare Web Analytics. This includes page views, device types, and geographic regions. No tracking cookies are used and no personal data is included in analytics.
- Lawful basis: Legitimate interest (platform improvement)
- Retention: Indefinite (anonymous data)
Feedback
If you submit feedback through the Platform, we store your comment, sentiment rating, and the page URL where feedback was submitted.
- Lawful basis: Consent (voluntary submission)
- Retention: Lifetime of your account
2. How We Use Your Data
Your data is used solely to provide and improve the Platform: authenticating your account, displaying your progress, generating certificates, and improving platform performance. We do not sell your data or use it for advertising.
3. Third-Party Services
Cloudflare
Hosts the Platform (Pages, Workers, D1 database) and provides cookieless web analytics. Cloudflare processes requests through its global edge network. Data may be processed in regions outside your country of residence.
- Safeguard: Cloudflare maintains a Data Processing Addendum (DPA) compliant with EU Standard Contractual Clauses (SCCs)
Provides OAuth authentication. When you sign in, Google shares your name, email, and profile image with us. Google’s processing of your data is governed by their privacy policy.
- Safeguard: Google maintains GDPR-compliant data processing terms
4. Cross-Border Data Transfers
Your data may be processed outside your country of residence through our use of Cloudflare (global edge network) and Google (OAuth authentication). Both providers maintain appropriate safeguards including EU Standard Contractual Clauses (SCCs) and Data Processing Addendums (DPAs). These transfers are necessary to deliver the Platform service.
5. Data Retention
- Account data and learning progress: Retained for the lifetime of your account
- Session data (IP address, user agent): Retained until session expiry or logout
- Anonymous analytics data: Retained indefinitely
- Account deletion: When you delete your account, all personal data is permanently removed through cascading deletion across all tables
6. Your Rights
You have the right to:
- Access your personal data (use the Download My Data feature on your profile page)
- Correct your information (edit your profile)
- Delete your account and all associated data (use the Delete Account feature on your profile page)
- Withdraw your consent at any time
Under the GDPR, you also have the right to data portability, the right to restrict processing, and the right to object to processing. If you are an EU/EEA resident, you have the right to lodge a complaint with your local supervisory authority.
7. Automated Decision-Making
The Platform does not use automated decision-making or profiling that produces legal or similarly significant effects. Quiz scoring is algorithmic but does not affect your legal rights or status.
8. Language
This Privacy Policy is published in both English and Bahasa Malaysia. In the event of any inconsistency or discrepancy between the English version and the Bahasa Malaysia version, the English version shall prevail to the extent of the inconsistency.
9. Contact
For privacy-related questions, contact ClarityBlaze Sdn Bhd at: privacy@clarityblaze.com