HalaTuju

Privacy Policy

Last updated: June 2026

HalaTuju provides two things: a free course-matching tool for SPM/STPM students, and the BrightPath Bursary Programme, which connects verified low-income students with sponsors who support their public tertiary studies. This policy covers both.

Data we collect

  • Course tool: your IC number (NRIC, stored securely and shown only masked, e.g. ****-**-1234), SPM/STPM grades, optional profile details (name, gender, nationality, state, contact details, family background), optional quiz answers, and your sign-in identifier (phone number or Google account).
  • BrightPath Bursary Programme (only if you apply): household and family income details, and documents you upload to verify your application — your IC, results slip, university/college offer letter, a parent/guardian IC, and proof of household income or aid (e.g. an STR letter, EPF statement, payslip, or utility bill).

How we use and process your data

  • To generate course recommendations and to assess and administer assistance applications.
  • Automated processing: to help us read and check your documents, we use automated text-recognition and AI services (Google Cloud Vision and Google Gemini) to extract text from uploaded documents and to prepare an anonymised profile for sponsors. We also use an automated rule to check eligibility against the published criteria. These are decision-support tools — a person reviews your application before any decision, and you can ask us to review any automated outcome.
  • To send you relevant follow-up emails (e.g. assistance opportunities, important changes). You can unsubscribe at any time.

Who we share it with

  • Service providers that process data on our behalf: Supabase (secure database hosting, Singapore region) and Google (the text-recognition and AI services above). They process your data only to provide these services to us.
  • The administering trust foundation — for applicants accepted into the BrightPath Bursary Programme, to administer the support. (Currently being established.)
  • Sponsors — only an anonymised profile (e.g. field of study, region, academic band), and only after you give explicit consent (for applicants under 18, a parent or guardian must consent). Sponsors never see your name, IC, address, phone, email, photo, or your parents’ details.
  • We do not sell your data or share it for unrelated third-party marketing.

Keeping and deleting your data

We keep your data while your account is active and for as long as needed to administer the programme and meet legal obligations. You may request deletion of your account and data at any time. Certain limited data is purged automatically — for example, the contact details of an unconverted sponsor-referral invite are removed after 60 days.

Your rights

You may access, correct, or delete your data, and withdraw consent (including a sponsor-sharing consent) at any time. Use the contact form (there’s a “Data Deletion Request” option).

Security

Your data is stored on Supabase (Singapore region) with row-level security; sensitive data, including your IC, is encrypted at rest and in transit.

Minors

Many of our users are school-leavers. If you are under 18, a parent or guardian must consent before your profile is shared with any sponsor.

Questions about your data? Use our contact form.