Kuntum & Embun ("Kuntum", "we", "our") is an AI-powered recruitment platform built for the Malaysian tech market. This policy explains what personal data we collect, why we collect it, how we protect it, and what rights you have under the Personal Data Protection Act 2010 (Malaysia).
1. What we collect
- Account data — your email address and an encrypted password hash (managed by Supabase Auth).
- Candidate profile — your full name, professional headline, current role, years of experience, skills, salary expectations, work-arrangement preferences, location preferences, referral source, AI-generated profile summary derived from your resume. When you mark interest in a role, the professional fields of this profile (not your contact details) become visible to that employer — see Section 4A.
- Resume — the PDF you upload and the text we extract from it. Both are stored encrypted at rest.
- Communications — your WhatsApp phone number (if you opt in) and your message frequency preference (proactive / on demand / never). Message bodies sent on our behalf by Twilio.
- Employer profile (Embun) — your full name, company name, company website, and email when you sign up to hire on Embun.
- Waitlist data — if you join the Embun hiring waitlist, your email and optional company name and notes.
- Technical data — IP address (hashed before storage), browser user agent strings (transient), session cookies (see Cookies).
2. Why we collect it
We process personal data with your consent and in accordance with the PDPA. You provide this consent at signup and onboarding.
- Match candidates with relevant Malaysian tech jobs.
- Share your profile with employers so they can consider you — but only after you mark interest in their role. We share your professional profile (headline, role, experience, skills, preferences, AI summary). We do not share your contact details (email or phone) with employers — interview scheduling, reminders, and messaging are brokered through us, so you never hand your number or email to a company. Your contact details reach an employer only if you deliberately choose to share them (see Section 4A).
- Send you transactional WhatsApp messages: interview reminders, match alerts, hiring-manager pings — only at the frequency you choose.
- Send transactional emails: account creation, deletion notices, password reset, email-change confirmations.
- (If you opt in separately) marketing updates about new features and career resources.
3. How we protect it
We implement reasonable technical and organisational safeguards to protect your personal data, including:
- Encryption at rest. Sensitive personal data — such as resumes, WhatsApp numbers, and AI profile summaries — is encrypted at rest using strong, industry-standard encryption.
- Access controls. Database access policies are designed so that you access only your own data.
- Audit log. We keep records of privacy-sensitive actions to support compliance review. Audit logs are retained in accordance with our internal compliance and record-keeping policies and applicable laws.
- Server-side processing. Decryption of your data is performed on our servers, scoped to your authenticated session.
4. Sub-processors
We use the third-party services listed at /legal/sub-processors. Each entry names the service, the data we share with it, the region/jurisdiction, and a link to its own privacy policy.
4A. Who receives your data
There are two distinct kinds of recipient, and we treat them differently:
- Sub-processors (Section 4) process data on our behalf under contract — they cannot use it for their own purposes. They are listed at /legal/sub-processors.
- Employers are independent recipients— data controllers in their own right. When you actively mark interest in an employer's role, we share your professional profile with that specific employer so they can evaluate you for it. This happens only on your action — never automatically, never by default, and never for an employer whose role you have not engaged with.
What an employer can see, and when:
- Before you mark interest:nothing identifying — at most anonymous, aggregated signals (e.g. "a candidate with these skills is interested").
- After you mark interest: your professional profile — headline, current role, years of experience, skills, seniority, work-arrangement and location preferences, match score, and AI profile summary.
- Your contact details (email, phone):never shared with employers by default. All interview scheduling, reminders, and messaging are brokered through Kuntum & Embun — the employer communicates with you through us, never with your raw contact. Your email or phone reaches an employer only if you deliberately choose to share it.
- Your resume file: shared with an employer only if you explicitly choose to share it.
The purpose of this disclosure is to facilitate job-matching and applications. You stay in control: you can withdraw an employer's access to your shared profile at any time from /account/interests (see Section 5). Employers who receive your data are bound by our Terms to use it solely to evaluate you for the role you engaged with, and not to redistribute it.
4B. Anonymous employer discovery
Verified employers can describe a role they are hiring for and see a shortlist of matching candidates in an anonymised form — employers searching for people might be able to see you, without any detailed information revealed. Matching runs when an employer searches, and can also run automatically when an employer posts or updates a role. A discovery profile shows only coarse information: a salary band, an experience band, a broad region, a field and role family, generalised skill groups, a seniority level, and a preferred work arrangement. It never shows your name, contact details, current employer, exact salary, or resume — and we apply a minimum-group-size safeguard, so a search that matches only a few people shows a coarse count instead of individual profiles. Your identity and contact are shared only through the existing mutual- interest flow described above: an employer can invite you to look at a role, and nothing about you is revealed unless you choose to engage.
You can opt out of employer discovery entirely, at any time, with one switch at /account/privacy — you will then never appear in any employer search. You can also hide yourself from specific companies (for example your current employer) on the same page.
4C. Connected services (KrackedDevs)
If you are a member of KrackedDevs (krackeddevs.com), you can choose to connect your KrackedDevs account to Kuntum from your settings. The connection is optional, never required to use Kuntum, and never asked for inside the onboarding chat.
- What we send to KrackedDevs. An opaque account identifier for your Kuntum account, so KrackedDevs can record which Kuntum account is connected. We do not send your profile, resume, matches or contact details.
- What we receive from KrackedDevs. Your KrackedDevs member id and username, and, if you approve the second item on the KrackedDevs consent screen, your builder stats: level, XP, developer score, verified status, tech stack tags, developer role, GitHub contribution count, projects shipped and bounties won. Nothing else. You see and approve exactly these items on the KrackedDevs consent screen before anything is shared. We also hold a connection credential issued by KrackedDevs, stored encrypted, and we re-read your builder stats from KrackedDevs nightly while connected.
- What we use it for.To show "Connected to KrackedDevs as <username>" in your own settings, and to show employers on your anonymised candidate card a "KrackedDevs member" mark and, if you shared them, these builder stats: level, developer score, projects shipped, bounties won, GitHub contribution count, tech stack tags and developer role. Employers never see your KrackedDevs username, member id, XP, verified status, profile link or any link to KrackedDevs through Kuntum. If you connected before builder stats existed, employers see only the member mark until you reconnect and approve them.
- Retention and disconnecting. The connection is kept until you disconnect it, from Kuntum settings or from your KrackedDevs profile (Connected apps). Disconnecting removes the credential, the employer mark and the stored builder stats; we reconcile with KrackedDevs nightly so a disconnection made on KrackedDevs is reflected here within a day. The connection record is deleted with your account.
- Who is responsible. KrackedDevs is a separate service run by KrackedDevs Sdn Bhd and processes your KrackedDevs account under its own privacy policy; it is not a sub-processor of Kuntum. Kuntum is responsible for the connection record it holds.
5. Your rights
You have the following rights in respect of your personal data, which we support in accordance with the PDPA:
- Access. Download all your data as JSON or CSV via
/account/data. - Correction. Edit your profile via
/account/profile, change your email via/account/email, or write to privacy@kuntum.app. - Deletion. Request account deletion via
/account/data. We hold the request for 30 days during which you can cancel; after that, your account, profile, resume, matches, and communications history are permanently deleted. - Withdrawal of consent. Toggle marketing or WhatsApp notifications via
/account/notifications. Revoke an employer's access to your shared profile at any time via/account/interests— once revoked, that employer no longer sees your profile. Disconnect KrackedDevs at any time via/settings(Section 4C). - Documentation of processing. The export includes timestamps and processing context for your records.
- Complaint to the Commissioner. If you believe we have mishandled your data, you may complain directly to the Personal Data Protection Commissioner of Malaysia.
6. Cross-border transfer
We may transfer and process personal data outside Malaysia through our service providers, subject to appropriate safeguards and in accordance with applicable laws. Our current sub-processors and the regions in which they operate are listed at /legal/sub-processors.
7. Retention
- Active candidate accounts — kept while you use the service. After 24 months of inactivity (no login), we anonymise PII (drop name, headline, encrypted resume blobs) and at 36 months we hard-delete the row.
- Resume PDFs in storage — deleted within 30 days of your account deletion request being processed.
- WhatsApp message logs — retained 6 months for delivery audit + abuse detection.
- Match scores — retained 12 months after last activity on the candidate or the linked job posting.
- Interest & sharing records — when you mark interest or share your profile with an employer, that record is retained while the role is active and for up to 12 months after, or until you revoke it, whichever comes first.
- KrackedDevs connection. Retained until you disconnect (on either side), then the credential is removed at once and the record is deleted with your account (Section 4C).
- Embun hiring waitlist — retained until Embun launches OR explicit deletion request.
- Audit log — retained in accordance with our internal compliance and record-keeping policies and applicable laws.
8. Children
Kuntum & Embun is a service for users aged 18 and above. We do not knowingly collect data from minors. If you are under 18, do not register or submit personal data through our service. If you become aware that a minor has registered, contact us at privacy@kuntum.app and we will delete the account.
9. Breach response
If we become aware of a security incident affecting your personal data, we will take reasonable steps to contain and investigate it, and we will notify affected users and the relevant authorities where required by applicable laws.
10. Contact
For any data subject rights request, breach concern, or general privacy question, contact us at privacy@kuntum.app. We aim to respond within 21 days, in accordance with the PDPA.
11. Changes to this policy
We may update this privacy policy from time to time. Material changes will be notified to users and reflected in the "Last updated" date at the top of this page, and where required by law, your consent will be obtained before such changes take effect.