Privacy Policy

Our Commitment to Privacy

Self-Hosted Infrastructure: We run a self-hosted Supabase instance. Your data is stored entirely on our secured servers and never flows through external third-party database clouds like Supabase Cloud.
Minimal Data Collection: We limit collection strictly to your username, full name, and email address.
High Security & Isolation: Every account is secured and isolated using Row-Level Security (RLS). We never expose your personal account details to the public.
GDPR Compliant: We strictly follow General Data Protection Regulation (GDPR) guidelines to respect and enforce your privacy rights.

1. Data Controller

The Course Matcher Pro team acts as the Data Controller for the personal data processed within this platform. We manage and operate our infrastructure independently to maintain complete control over data integrity.

2. Information We Collect

To provide our course matching services while ensuring data minimization, we only collect and process the following fields:

Username: For authentication and user handle references.
Full Name: To personalize your account dashboard.
Email Address: For authentication, registration, security updates, and session management.

3. Purpose of Processing

Collected data is processed strictly to manage user accounts, record individual search histories, and execute course recommendation algorithms. We do not sell, rent, or share your account information or email addresses with external parties for marketing or any other commercial purposes.

4. Legal Basis (GDPR Compliance)

We process your data based on your explicit consent provided during authentication (via Email or GitHub integration). You have the right to withdraw your consent and request the permanent erasure of your account details at any time by deleting your profile.

5. Data Storage and Security

Because privacy is paramount, we self-host our database system using Supabase:

No Third-Party Clouds: Data is hosted directly within our self-hosted architecture inside the European Union (EU), bypassing Supabase Cloud entirely.
Data Isolation: We leverage PostgreSQL Row Level Security (RLS) to enforce strict rules, ensuring that users can only read or write their own authorized data.
Encryption & Maintenance: We implement TLS/SSL encryption protocols for all data in transit. Regular security updates are applied to keep the self-hosted environment protected against vulnerabilities.

6. Your Rights

Under the General Data Protection Regulation (GDPR), you possess the following core rights:

Access & Portability: The right to request a copy of the data we store.
Rectification: The right to update or correct your profile details.
Erasure: The right to request the complete deletion of your account and related search history ("Right to be Forgotten").
Objection & Restriction: The right to object to specific data processing actions.

7. Contact Information

For any inquiries regarding data privacy or to exercise your GDPR rights, please contact the team at:

hanna.saarela@oulu.fi