Privacy Policy

1. Information we collect

• · Enquiries: name, email, phone number, messenger ID, message
• · Applications: student and guardian names, date of birth, nationality, passport details, contact details, preferred course, dates and accommodation, and any health or dietary notes the applicant provides
• · Billing: information needed to issue invoices and confirm payments (we do not collect card numbers)
• · Email: sender address, subject, body and attachment names of messages sent to MEC
• · Technical: language preference cookie, portal login session cookies, and spam-protection checks (Cloudflare Turnstile)

2. How we use it

• · Answering enquiries and admissions counselling
• · Running the programme: enrolment, classes, accommodation, airport pickup and visa documents
• · Issuing invoices and receipts
• · Meeting legal obligations and handling disputes

We do not sell personal information or use it for advertising.

3. Service providers

• · Vercel — website and portal hosting
• · Supabase — database
• · Railway — scheduled email and background jobs
• · Resend — transactional email delivery
• · Google (Gmail) — MEC's business mailbox
• · Cloudflare Turnstile — spam protection
• · Anthropic (Claude) — assistance drafting replies (see section 5)

We use the following providers to operate our services. Each processes information only on MEC's instructions.

4. Google user data (Gmail API)

ConnectHub, MEC's internal system, connects through Google OAuth only to MEC's own business mailbox (mecacademy.adm@gmail.com). It does not access any other person's Google account.

Read (gmail.readonly): incoming enquiries are read to classify and summarise them and to prepare reply drafts. Compose (gmail.compose): reply drafts are placed in the same thread in Drafts. Send (gmail.send): only replies approved by a staff member are sent.

MEC's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. It is used only for the features above, is never sold or used for advertising or credit decisions, and is read only by staff handling replies.

5. Use of AI

We use AI (Anthropic Claude) to classify email and draft replies. Contact details such as email addresses and phone numbers are masked before text is sent to the AI, and every AI draft is reviewed and approved by staff before it is sent. Anthropic does not train its models on data received through its API.

6. Retention

• · Email bodies imported into ConnectHub: deleted automatically after 90 days (subject lines and handling history are kept as work records)
• · Enrolment and billing records: for the period required by law after the programme ends (7 years for Malaysian accounting and tax records)
• · Enquiries that did not lead to enrolment: deleted on request

7. Your rights

You may ask to access, correct or delete your information, or to stop its processing, using the contact details below. We follow the Malaysian Personal Data Protection Act 2010 and applicable laws of your country of residence, and respond within 14 days.

8. Contact

MEC Academy & Training Centre Sdn. Bhd. (Reg. No. 202201006286 (1451983-V)) mecacademy.adm@gmail.com · +60 14 741 1300