SEMASHUR Privacy Policy

Last updated 2026-09-23

This policy explains how SEMASHUR (Sekolah Menengah Sains Hulu Selangor) collects, uses, and protects your personal data when you use this site. We comply with Malaysia's Personal Data Protection Act 2010 (PDPA).

Data we collect

• Full name, email, username, role (student/parent/teacher) — when you register.
• Posts, comments, reactions you make on the site.
• IP address + sign-in timestamps (for security audit).
• Session cookies (for login) + language cookies (for BM/EN preference).

How we use it

• To run your account (login, profile, notifications).
• To publish the content you submit.
• Security audit + abuse prevention.
• To send verification + password reset emails when needed.

Third parties

• Supabase (data + image storage)
• Vercel (hosting)
• Resend (email delivery — optional)
• OpenAI / Groq / NVIDIA (chatbot — optional)

The SEMASHUR_BOT assistant

• Your question is sent to the third-party AI providers above to generate an answer.
• SEMASHUR does not store conversations. Only the question text is kept, with no identifiers, so the school can see what information the site is missing.
• Phone numbers, emails and IC numbers are redacted before storage. IP address, user agent and session id are not stored, so two questions cannot be tied to one person.
• Question records are deleted after 90 days.
• Please do not type personal details into the question box.

Your rights

• Access + export: request a copy of all your data at /api/me/export (sign-in required).
• Deletion: delete your account + all personal data at account settings.
• Correction: contact admin to update.

Contact

Any privacy inquiries: BEA5067@moe.edu.my