Privacy Policy

Last updated: July 8, 2026

This Privacy Policy explains how BoardingPass ("we", "us", "BoardingPass") collects, uses, discloses, and protects personal data when you access or use the BoardingPass platform (the "Platform").

This Policy is governed primarily by the Singapore Personal Data Protection Act 2012 (PDPA). If you are located outside Singapore, additional local laws may apply; contact us before relying on rights not listed here.

1. Scope and Applicability

This Privacy Policy applies to all users of the Platform, including visitors, registered users, and partner organisations ("Partners"). By creating an account or using the Platform, you acknowledge that you have read and understood this Policy.

2. Data Protection Officer

BoardingPass has appointed a Data Protection Officer (DPO) for PDPA enquiries and access requests:

Email: privacy@boardingpass.work

We aim to respond to PDPA requests within 30 days, as required under the PDPA.

3. Information We Collect

We may collect the following categories of personal data:

Information You Provide:

• Name, email address, and account credentials
• Profile information (education, work experience, skills, projects)
• Resume data (PDF files, parsed content, AI-generated suggestions)
• LinkedIn profile data (if you choose to connect)
• Contact information (phone, location, social media links)
• Challenge submissions and evaluation data
• Public project page content and cover images you choose to publish
• Subscription plan tier and AI usage event records (feature type and timestamp — not prompt content)
• Waitlist email addresses

Automatically Collected Information:

• IP address, device identifiers, browser type
• Usage analytics (pages visited, features used, time spent)
• Cookie data (authentication tokens, preferences, session information)

Information from Third Parties:

• OAuth providers (Google, LinkedIn) for authentication and profile data
• Official job feeds (MyCareersFuture, Careers@Gov, Greenhouse employer boards) for job search functionality

4. How We Use Personal Data

We use personal data to:

• Operate, maintain, and improve the Platform
• Provide career profile building, job search, and application tracking
• Parse resumes and provide AI-powered resume assistance (with your knowledge — see Section 5)
• Match users with relevant job opportunities
• Enable experience challenges, evaluations, and gallery features
• Send notifications about deadlines, status updates, and platform updates
• Communicate with partner organisations for challenge evaluations
• Prevent fraud, abuse, and maintain platform security
• Comply with legal and regulatory obligations

Legal bases under the PDPA: We collect, use, and disclose personal data based on consent, contractual necessity (providing the Platform), legal obligation, and legitimate business interests (improving services, security), as permitted under the PDPA.

5. Consent and Opt-In Features

Certain features require explicit consent or a clear affirmative action:

Feature	Consent mechanism
Account creation	Agree to Terms of Service and this Privacy Policy at signup
AI resume processing	Notice shown before upload; processing begins when you upload or request AI features
Public recruiter profile	Toggle with field disclosure; consent recorded when enabled
Challenge submission to partner	Submitting a challenge constitutes consent for partner access (see Section 6)
Native job application to employer org	Explicit consent before submit; only selected profile/resume snapshot fields are shared (see Section 6)
Public gallery featuring	Separate opt-in checkbox at submission; not implied by submit alone
LinkedIn import	Disclosure before confirm; you choose to connect and import

We record consent events (type, policy version, timestamp) for audit purposes. Withdrawing consent may limit feature availability.

6. Information Sharing

We do not sell your personal data.

Service Providers (data processors):

• Supabase (database and authentication)
• OpenAI / Google Gemini (AI-powered resume analysis)
• Resend (email notifications)
• Vercel (hosting)

These providers process personal data only as necessary to deliver the Platform and under contractual safeguards.

Partner Organisations:

• When you submit a challenge, your submission (project details, links, questionnaire answers, and associated profile identifiers needed for evaluation) is shared with the partner organisation that hosts the challenge. Submitting constitutes your consent to this sharing for evaluation and recruitment purposes, as described in our Terms of Service.
• When you apply to a job posted by an employer organisation on BoardingPass, you consent to share a point-in-time snapshot of the profile and resume fields you select at submit time. The employer organisation receives that snapshot for recruitment review; BoardingPass does not grant ongoing access to your live account data.
• Public gallery: Your work is featured publicly only if you separately opt in at submission and the submission is approved for gallery display. Gallery opt-in is not implied by challenge submission alone.

Legal Requirements:

• When required by law, court order, or government regulation
• To protect our rights, property, or safety
• To prevent fraud or abuse

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required by law:

• Account data: While your account is active
• Resume data: Until you delete it or close your account
• Application tracking: Until you delete it or close your account
• Consent audit logs: As required for PDPA compliance
• Analytics data: Aggregated data retained for up to 2 years
• Deleted accounts: Personal data deleted within 30 days of account closure, subject to legal holds

8. Overseas Transfer (PDPA Section 26)

Personal data may be transferred to and processed in jurisdictions outside Singapore, including the United States and the European Union, where our service providers host infrastructure.

Before transferring personal data overseas, we ensure that the recipient country or organisation provides a standard of protection comparable to the PDPA, or we implement appropriate contractual safeguards (including data processing agreements) as required under Section 26 of the PDPA.

You may contact privacy@boardingpass.work for more information about overseas transfers relevant to your data.

9. Data Security

We implement reasonable administrative, technical, and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure, including:

• Encryption of data in transit and at rest
• Role-based access controls for sensitive data
• OAuth-based authentication with secure token management
• Regular security reviews and testing

No method of transmission over the internet is 100% secure.

10. Data Breach Notification

In the event of a data breach that is likely to result in significant harm to affected individuals, or that is of significant scale, we will:

1. Assess the breach promptly and contain it
2. Notify the Personal Data Protection Commission (PDPC) as soon as practicable, and in any case within 3 calendar days of assessing that the breach is notifiable, in accordance with PDPC guidelines
3. Notify affected individuals if the breach is likely to result in significant harm to them
4. Document the breach, our response, and remedial actions

If you believe your personal data has been compromised, contact privacy@boardingpass.work immediately.

11. Your Rights Under the PDPA (Sections 21–22)

Singapore residents have the following rights, subject to exceptions under the PDPA:

Section 21 — Access: Request access to personal data we hold about you and information about how we have used or disclosed it in the past year.

Section 22 — Correction: Request correction of inaccurate or incomplete personal data.

You may also:

• Withdraw consent for processing that relies on consent (without affecting prior lawful processing)
• Request deletion of personal data where retention is no longer necessary and no legal exception applies

How to exercise your rights: Email privacy@boardingpass.work with your request. We may need to verify your identity. We will respond within 30 days unless an extension is permitted under the PDPA.

If you are not satisfied with our response, you may contact the PDPC:

• Website: https://www.pdpc.gov.sg
• Email: pdpc_enquiry@pdpc.gov.sg

Note for users outside Singapore

If you are located in the European Economic Area or United Kingdom, the EU General Data Protection Regulation (GDPR) or UK GDPR may provide additional rights (e.g. data portability, objection to processing). Contact privacy@boardingpass.work to discuss applicability. This Policy is not a substitute for jurisdiction-specific legal advice.

12. Children's Privacy

The Platform is not intended for individuals under 16 years of age. We do not knowingly collect personal data from minors. If we become aware of such collection, we will take steps to delete it.

13. Changes to This Privacy Policy

We may update this Policy from time to time. Updated versions will be posted on the Platform with a revised effective date. We will notify you of material changes by:

• Posting the new policy on our website
• Sending you an email notification where appropriate
• Displaying a prominent notice in the application

14. Contact Us

For questions, access requests, or complaints relating to this Privacy Policy:

Data Protection Officer Email: privacy@boardingpass.work