Privacy notice
This notice describes how the platform is built to handle data. It has not yet been reviewed by counsel, and the effective date, postal address and retention periods are still to be confirmed.
Plain terms. What we collect, why we hold it, who else processes it, and how to get it removed.
Related notices
- Cookie policy: how we use cookies and first-party analytics.
- Data privacy statement: a focused statement on what data we process and why.
Who we are
TRUVAN is the controller of the personal data described here. [Registered legal entity: to be confirmed by counsel]
You can reach us through the contact form on this website for any question or request about this notice.
Postal address: to be supplied before publication.
Effective date
Effective date: to be set when this notice is approved. Until then this page is published as a draft so you can see how the platform is designed to handle data.
What we collect: website enquiries and bookings
When you send an enquiry we collect your name, email address, organisation if you give one, which group you told us you belong to, your message, the consent you gave, the page you sent it from, and any campaign parameters in the link you arrived on.
We also store a one way hash derived from your network address, used only to limit automated abuse of the form. It is not used to identify you.
If you book a call, the scheduling provider collects the details you enter to make the booking.
What we collect: diagnostic and pathway report
Your answers to the diagnostic questions, your name and email address, whether you agreed to marketing contact, and the token in the link that opens your report.
Anyone holding that report link can open the report, so treat it as private.
What we collect: free resource downloads
Your name and email address, which resource you requested, and the link token issued for the download.
What we collect: applications and interest requests
Your background, target role, availability, funding situation, and any documents you choose to upload in support of an application or interest request.
What we collect: learner accounts and progress
Your account details, the courses and programs you are enrolled in, your position and progress in lessons, private notes you write, quiz attempts and answers, assignment submissions, and files you upload for grading.
Staff who deliver your learning can see submissions and progress. Private notes are yours.
What we collect: simulations and live voice practice
For written simulations and casebooks we store your work, timings and any feedback recorded against your attempt.
For live voice practice, the microphone is requested only after you start a session. We do not retain the audio and we do not retain a transcript of what you said. Only session metadata such as start time, duration and completion is kept. This matches our internal voice practice policy.
What we collect: Career Assistants conversations
Messages you exchange with a Career Assistant are stored against your account so you can return to them, and are retained until you delete them.
Proposed retention: up to 12 months unless you delete them sooner. This period is proposed and subject to legal review.
Assistants do not make hiring decisions and do not replace protocols, standard operating procedures, medical advice or legal advice.
What we collect: career services and file exchange
If you enrol in a career service we store the enrolment, the action plan and tasks, appointments, coaching updates, and documents exchanged between you and the career team, including who downloaded a document and when.
What we collect: records issued by TRUVAN
Where TRUVAN issues a record of demonstrated capability, we store the record, the evidence it rests on, its standing and its expiry, plus a log of lookups against it.
A record is only visible to others when you share it or when it is published with your agreement. You can ask for a record to be withdrawn.
What we collect: analytics
We measure how the website is used with our own software, running on our own infrastructure. There is no third-party analytics provider, no advertising identifier and no fingerprinting, and nothing measured here is shared with anyone else.
Each visit is counted under a random value held only for the life of the browser tab. We record the page address, the website that referred you if it was an external one, whether your screen is phone, tablet or desktop sized, and which buttons were used. We do not store your name, your email address, your IP address or the content of anything you type.
If your browser sends a Do Not Track signal we record nothing at all. If it asks for reduced data we count page views only.
Why we hold it and our legal basis
Consent: marketing contact, analytics cookies, and optional uploads you choose to send.
Contract: delivering learning, simulations, career services and any record you asked us to issue.
Legitimate interests: replying to enquiries, keeping the platform secure, preventing abuse of public forms, and improving the service. We balance those interests against your rights.
We do not sell personal data.
Who processes it for us
Hosting, database and file storage: Supabase.
Email delivery: Resend.
Analytics: Google.
Scheduling: Calendly, when online booking is connected.
AI model provider for Career Assistants and live voice practice: we will publish the provider and its terms, including whether any data is used to train models, before the feature is switched on for general use.
Processors act on our instructions under contract.
International transfers
Our hosting and processors operate in the United States. If you are outside the United States your data is transferred there, protected by the contractual terms we hold with each processor.
How long we keep it
The periods below are proposed and subject to legal review.
Enquiries and bookings: 24 months from last contact.
Diagnostic answers and report links: 12 months.
Free resource requests: 24 months.
Applications and interest requests: 24 months, or the life of the enrolment if you join.
Learner accounts, progress, submissions and issued records: for as long as your account is active, then for the period needed to defend the integrity of an issued record.
Career Assistant conversations: up to 12 months unless deleted sooner.
Live voice practice audio and transcripts: not retained.
Abuse control hashes: 30 days.
Your rights
You can ask for access to your data, correction, deletion, a portable copy, restriction of processing, or you can object to processing based on legitimate interests. You can withdraw consent at any time without affecting what we did before.
Send any request through the contact form. We respond within 30 days. If you are unhappy with our response you can complain to your local data protection authority.
Children
This service is for adults aged 18 and over. We do not knowingly collect data from children.
Cookies and analytics
We use cookies that are necessary to run the site and sign you in. We do not use analytics or advertising cookies: our own measurement uses a random value held in browser session storage, which your browser discards when the tab closes. You can clear or block cookies and site storage in your browser, though signing in will not work without the necessary cookies.
Changes to this notice
When we change this notice we will update the effective date, and we will tell account holders directly where the change is significant.