Privacy Policy

1. Our approach

StudentsToCareer is built privacy-first: profiles are private by default, employer discovery is opt-in, we collect only what the service needs, and you can export or delete your data at any time.

2. What we collect

• Account data: name, email, password (stored only as a modern salted hash), institution, programme, country and city.
• Career Passport data you choose to add: education, skills, projects, experience, certifications, languages, awards, publications, portfolio links, résumé.
• Verified credential records supplied by ABIEdu or approved administrators (title, completion date, credential ID, verification link, associated skills).
• Consent records: which policies you accepted, when, and from which IP address.
• Security data: session records (IP address, browser identifier, timestamps) and audit events, kept to protect your account.
• Support messages you send through the contact form.

3. What we do NOT do

• We do not sell personal information.
• We do not show your profile to employers unless you opt in to employer discovery or share a public link.
• We do not read private messages except through a documented safety or legal process with logging (see Section 8).
• We do not use manipulative engagement algorithms or infer protected characteristics for targeting.

4. Why we process data (purposes and legal bases)

• Providing the service you signed up for (contract).
• Verification of students, employers and mentors (legitimate interest in platform integrity; consent for institutional email checks).
• Safety, security and fraud prevention (legitimate interest / legal obligation).
• Transactional email such as verification links and security notices (necessary for the service; CASL-compliant).
• Marketing email only with your separate, express, revocable consent (CASL).

5. Your rights

• Access & portability: export your data as machine-readable JSON from Settings → Data.
• Correction: edit your information directly in your Career Passport.
• Deletion: request account deletion in Settings. Public visibility ends immediately; data is purged after a 30-day grace period, except records we must keep (e.g. consent and audit tombstones) for legal defensibility.
• Withdrawal of consent: turn off employer discovery or marketing email at any time.

6. Retention

Account data is kept while your account is active. After deletion, personal data is purged within the grace period; security logs are retained up to 12 months; consent records are retained as required for legal compliance.

7. Sharing

We share data with service providers (hosting, email delivery, error monitoring) bound by data-processing agreements; with your institution only as aggregated, de-identified reporting; and with authorities only when legally required.

8. Administrative access

Administrators cannot casually browse private content. Access to private material occurs only through a documented safety or legal process, is limited to what is necessary, and is recorded in an audit log.

9. International transfers

Data may be processed in Canada and other jurisdictions where our providers operate, with contractual safeguards. We design for PIPEDA and GDPR-aligned protections regardless of location.

10. Contact

Privacy questions or complaints: use the contact form (topic: Privacy request). You may also contact the Office of the Privacy Commissioner of Canada.