Kuntum & Embun ("Kuntum", "we", "our") is an AI-powered recruitment platform built for the Malaysian tech market. This policy explains what personal data we collect, why we collect it, how we protect it, and what rights you have under the Personal Data Protection Act 2010 (Malaysia).
1. What we collect
- Account data — your email address and an encrypted password hash (managed by Supabase Auth).
- Candidate profile — your full name, professional headline, current role, years of experience, skills, salary expectations, work-arrangement preferences, location preferences, referral source, AI-generated profile summary derived from your resume. When you mark interest in a role, the professional fields of this profile (not your contact details) become visible to that employer — see Section 4A.
- Resume — the PDF you upload and the text we extract from it. Both are stored encrypted at rest.
- Communications — your WhatsApp phone number (if you opt in) and your message frequency preference (proactive / on demand / never). Message bodies sent on our behalf by Twilio.
- Employer profile (Embun) — your full name, company name, company website, and email when you sign up to hire on Embun.
- Waitlist data — if you join the Embun hiring waitlist, your email and optional company name and notes.
- Technical data — IP address (hashed before storage), browser user agent strings (transient), session cookies (see Cookies).
2. Why we collect it
We process personal data with your consent and in accordance with the PDPA. You provide this consent at signup and onboarding.
- Match candidates with relevant Malaysian tech jobs.
- Share your profile with employers so they can consider you — but only after you mark interest in their role. We share your professional profile (headline, role, experience, skills, preferences, AI summary). We do not share your contact details (email or phone) with employers — interview scheduling, reminders, and messaging are brokered through us, so you never hand your number or email to a company. Your contact details reach an employer only if you deliberately choose to share them (see Section 4A).
- Send you transactional WhatsApp messages: interview reminders, match alerts, hiring-manager pings — only at the frequency you choose.
- Send transactional emails: account creation, deletion notices, password reset, email-change confirmations.
- (If you opt in separately) marketing updates about new features and career resources.
3. How we protect it
We implement reasonable technical and organisational safeguards to protect your personal data, including:
- Encryption at rest. Sensitive personal data — such as resumes, WhatsApp numbers, and AI profile summaries — is encrypted at rest using strong, industry-standard encryption.
- Access controls. Database access policies are designed so that you access only your own data.
- Audit log. We keep records of privacy-sensitive actions to support compliance review. Audit logs are retained in accordance with our internal compliance and record-keeping policies and applicable laws.
- Server-side processing. Decryption of your data is performed on our servers, scoped to your authenticated session.
4. Sub-processors
We use the third-party services listed at /legal/sub-processors. Each entry names the service, the data we share with it, the region/jurisdiction, and a link to its own privacy policy.
4A. Who receives your data
There are two distinct kinds of recipient, and we treat them differently:
- Sub-processors (Section 4) process data on our behalf under contract — they cannot use it for their own purposes. They are listed at /legal/sub-processors.
- Employers are independent recipients— data controllers in their own right. When you actively mark interest in an employer's role, we share your professional profile with that specific employer so they can evaluate you for it. This happens only on your action — never automatically, never by default, and never for an employer whose role you have not engaged with.
What an employer can see, and when:
- Before you mark interest:nothing identifying — at most anonymous, aggregated signals (e.g. "a candidate with these skills is interested").
- After you mark interest: your professional profile — headline, current role, years of experience, skills, seniority, work-arrangement and location preferences, match score, and AI profile summary.
- Your contact details (email, phone):never shared with employers by default. All interview scheduling, reminders, and messaging are brokered through Kuntum & Embun — the employer communicates with you through us, never with your raw contact. Your email or phone reaches an employer only if you deliberately choose to share it.
- Your resume file: shared with an employer only if you explicitly choose to share it.
The purpose of this disclosure is to facilitate job-matching and applications. You stay in control: you can withdraw an employer's access to your shared profile at any time from /account/interests (see Section 5). Employers who receive your data are bound by our Terms to use it solely to evaluate you for the role you engaged with, and not to redistribute it.
5. Your rights
You have the following rights in respect of your personal data, which we support in accordance with the PDPA:
- Access. Download all your data as JSON or CSV via
/account/data. - Correction. Edit your profile via
/account/profile, change your email via/account/email, or write to privacy@kuntum.app. - Deletion. Request account deletion via
/account/data. We hold the request for 30 days during which you can cancel; after that, your account, profile, resume, matches, and communications history are permanently deleted. - Withdrawal of consent. Toggle marketing or WhatsApp notifications via
/account/notifications. Revoke an employer's access to your shared profile at any time via/account/interests— once revoked, that employer no longer sees your profile. - Documentation of processing. The export includes timestamps and processing context for your records.
- Complaint to the Commissioner. If you believe we have mishandled your data, you may complain directly to the Personal Data Protection Commissioner of Malaysia.
6. Cross-border transfer
We may transfer and process personal data outside Malaysia through our service providers, subject to appropriate safeguards and in accordance with applicable laws. Our current sub-processors and the regions in which they operate are listed at /legal/sub-processors.
7. Retention
- Active candidate accounts — kept while you use the service. After 24 months of inactivity (no login), we anonymise PII (drop name, headline, encrypted resume blobs) and at 36 months we hard-delete the row.
- Resume PDFs in storage — deleted within 30 days of your account deletion request being processed.
- WhatsApp message logs — retained 6 months for delivery audit + abuse detection.
- Match scores — retained 12 months after last activity on the candidate or the linked job posting.
- Interest & sharing records — when you mark interest or share your profile with an employer, that record is retained while the role is active and for up to 12 months after, or until you revoke it, whichever comes first.
- Embun hiring waitlist — retained until Embun launches OR explicit deletion request.
- Audit log — retained in accordance with our internal compliance and record-keeping policies and applicable laws.
8. Children
Kuntum & Embun is a service for users aged 18 and above. We do not knowingly collect data from minors. If you are under 18, do not register or submit personal data through our service. If you become aware that a minor has registered, contact us at privacy@kuntum.app and we will delete the account.
9. Breach response
If we become aware of a security incident affecting your personal data, we will take reasonable steps to contain and investigate it, and we will notify affected users and the relevant authorities where required by applicable laws.
10. Contact
For any data subject rights request, breach concern, or general privacy question, contact us at privacy@kuntum.app. We aim to respond within 21 days, in accordance with the PDPA.
11. Changes to this policy
We may update this privacy policy from time to time. Material changes will be notified to users and reflected in the "Last updated" date at the top of this page, and where required by law, your consent will be obtained before such changes take effect.