Data privacy statement
This statement describes what personal data we process and why. It has not yet been reviewed by counsel, and the effective date, postal address and retention periods are still to be confirmed.
A focused summary of what data we process, our legal basis, retention periods, and your rights.
Related notices
- Privacy notice: the full privacy notice for the TRUVAN platform.
- Cookie policy: how we use cookies and first-party analytics.
Who we are
TRUVAN is the controller of the personal data described here. [Registered legal entity: to be confirmed by counsel]
You can reach us through the contact form on this website for any question or request about this statement.
Postal address: to be supplied before publication.
Effective date
Effective date: to be set when this statement is approved. Until then this page is published as a draft so you can see how the platform is designed to handle data.
What personal data we process
Website enquiries and bookings: name, email address, organisation, group, message, consent, page origin, and campaign parameters. We also store a one-way hash of your network address to limit automated abuse.
Diagnostic and pathway reports: answers to diagnostic questions, name, email address, marketing consent, and report link token.
Free resource downloads: name, email address, requested resource, and download link token.
Applications and interest requests: background, target role, availability, funding situation, and uploaded documents.
Learner accounts and progress: account details, enrolments, lesson position and progress, private notes, quiz attempts and answers, assignment submissions, and uploaded grading files.
Simulations and live voice practice: written work, timings, feedback, and session metadata. We do not retain audio or transcripts from live voice practice.
Career Assistants: conversation messages stored against your account until you delete them.
Career services and file exchange: enrolment, action plan, tasks, appointments, coaching updates, and exchanged documents.
Records issued by TRUVAN: record details, underlying evidence, standing, expiry, and lookup log.
Why we process it and our legal basis
Consent: marketing contact, analytics cookies, and optional uploads you choose to send.
Contract: delivering learning, simulations, career services, and any record you asked us to issue.
Legitimate interests: replying to enquiries, keeping the platform secure, preventing abuse of public forms, and improving the service. We balance those interests against your rights.
We do not sell personal data.
Who processes it for us
Hosting, database and file storage: Supabase.
Email delivery: Resend.
Analytics: Google.
Scheduling: Calendly, when online booking is connected.
AI model provider for Career Assistants and live voice practice: we will publish the provider and its terms, including whether any data is used to train models, before the feature is switched on for general use.
Processors act on our instructions under contract.
International transfers
Our hosting and processors operate in the United States. If you are outside the United States your data is transferred there, protected by the contractual terms we hold with each processor.
How long we keep it
The periods below are proposed and subject to legal review.
Enquiries and bookings: 24 months from last contact.
Diagnostic answers and report links: 12 months.
Free resource requests: 24 months.
Applications and interest requests: 24 months, or the life of the enrolment if you join.
Learner accounts, progress, submissions and issued records: for as long as your account is active, then for the period needed to defend the integrity of an issued record.
Career Assistant conversations: up to 12 months unless deleted sooner.
Live voice practice audio and transcripts: not retained.
Abuse control hashes: 30 days.
Your rights
You can ask for access to your data, correction, deletion, a portable copy, restriction of processing, or you can object to processing based on legitimate interests. You can withdraw consent at any time without affecting what we did before.
Send any request through the contact form. We respond within 30 days. If you are unhappy with our response you can complain to your local data protection authority.
Children
This service is for adults aged 18 and over. We do not knowingly collect data from children.
Changes to this statement
When we change this statement we will update the effective date, and we will tell account holders directly where the change is significant.