AFSAL Privacy Policy

1. Who we are

AFSAL, G.K. 合同会社 (“AFSAL”, “we”, “us”, “our”) operates a scholarship-matching platform that uses machine learning to recommend scholarships.

Legal entity: AFSAL, G.K. (Tokyo, Japan)

Principal place of business: Tokyo, Japan

Contact (privacy): afsal.community@gmail.com

Scope: This policy is designed for users in Japan and other non-EEA/UK regions. AFSAL does not offer services to individuals in the EEA or UK and does not monitor behavior in the EEA/UK.

2. What we collect

2.1 Data you provide

Identification and contact: name, username, email.

Academic and profile: education level, age/date of birth, GPA, years of work experience, and optionally gender or ethnicity information.

Application content: comments, free-text answers, and documents you upload (e.g., transcripts, CVs, statements).

Preferences: language, notification and privacy settings.

Records of consents (e.g., marketing, special-category data).

2.2 Data collected automatically

Usage and device information (e.g., IP address, browser/device type, pages viewed, timestamps, referral pages), service logs and diagnostics for security and performance.

2.3 Data from third parties

Scholarship program details from public sources.

We do not collect your data from third parties without your authorization.

2.4 Sensitive (special-category) data

We do not require sensitive data (e.g., health, disability, ethnicity) for general use. If you choose to provide such data to be matched with scholarships that explicitly require it, we will request your explicit consent and limit use strictly to that purpose, with access controls. You can withdraw that consent at any time.

We may invite you—entirely at your choice—to disclose your ethnicity and gender identity so we can match you with scholarships and programs that expressly support particular demographic groups. Because these attributes are sensitive, we collect and use them only with your explicit consent, and we limit access on a need-to-know basis. You can withdraw this consent at any time in your dashboard; doing so will stop future use and sharing of these attributes (see Sections 3, 5, and 9).

3. How we use your data (purposes)

• Provide the service: create and manage your account, match you to scholarships, display recommendations.
• Operate and improve the platform: operate our infrastructure; train and maintain our machine-learning models that power matching (AI/ML training is required to use the service; opting out means not using AFSAL).
• Customer support and service communications.
• Security, fraud prevention, and diagnostics.
• Marketing in Japan (with your opt-in consent; see Section 7.3).
• Recommend opportunities for underrepresented or specific demographic groups using your ethnicity and/or gender identity, if you have consented to provide these attributes.
• Produce de-identified, aggregate insights about scholarship access and outcomes. These aggregates do not identify you personally.

Under Japan’s APPI, we specify and announce these “purposes of use,” and we do not use your data beyond them unless we obtain your consent or as permitted by law.

Note: Your ethnicity and gender identity will not be used to train our machine-learning models unless you separately opt in to training on sensitive attributes. This separate opt-in is not required to use AFSAL.

4. Automated recommendations

AFSAL uses algorithms to profile your academic profile and preferences against scholarship criteria to generate recommendations. You may contact us to request human review of major outcomes or to provide feedback on recommendations.

5. Sharing and recipients

We do not sell personal data. We share data only with:

Service providers acting on our instructions under written agreements:

• Hosting and databases: Vercel and Supabase (Tokyo regions).
• Authentication and security: Supabase Auth, row-level security (RLS).
• Analytics: Simple Analytics (privacy-preserving, no personal data; no consent banner required for this analytics use).
• AI services: OpenAI (used to power and/or improve matching models).

• Scholarship providers only when you choose to apply and submit data to them.
• Regulators and authorities when required by law or to protect rights, safety, or property.

With your explicit consent, we may disclose your ethnicity and/or gender identity to universities and scholarship providers that are actively seeking applicants from certain demographic groups, for the purpose of scholarship/program outreach and evaluation. We will never disclose these attributes to such third parties without your consent, except when you directly submit an application to that provider (in which case the submission itself authorizes the disclosure needed to process your application). You can withdraw this sharing consent at any time in your dashboard; withdrawal stops future disclosures and outreach.

6. International data transfers

We primarily process data in Japan (Tokyo regions for hosting and database). Some providers (e.g., OpenAI) may process data in other countries (such as the United States). Where we transfer personal data to a party in a foreign country, we comply with APPI requirements, which include informing you about the foreign transfer and obtaining consent where required. We implement contractual and technical safeguards with our vendors.

7. Your choices and rights

7.1 Access, correction, deletion, suspension of use

Under APPI, you may request: disclosure (access), correction, addition or deletion, suspension of use, and suspension of third-party provision. Submit requests via the in-app data rights (DSAR) form or by emailing afsal.community@gmail.com. We may need to verify your identity.

7.2 Account deletion

You can delete your account at any time in your dashboard (Profile settings). We will delete or de-identify your personal data without undue delay, subject to limited retention of security logs, backups, and legal obligations (see Section 8).

7.3 Marketing communications (Japan)

We reserve the right to send marketing emails in Japan only with prior opt-in consent. You may withdraw consent at any time via the unsubscribe link.

7.4 Sensitive attributes controls

In Profile → Privacy, you can (a) add or remove your ethnicity/gender identity, (b) withdraw consent for us to use these attributes for matching, and (c) toggle whether we may share them with universities/scholarship providers for outreach. Withdrawal will not affect processing already performed, but will stop future use and sharing.

8. Retention

We retain personal data until you delete your account or request deletion. Limited operational records (e.g., security logs, backups) may persist for a short period before being overwritten. We periodically review stored information and delete or de-identify data that is no longer necessary for the purposes stated in Section 3. (If we are legally required to keep certain data for longer, we will do so and then delete it.)

We retain your ethnicity and gender identity only while your consent remains active and delete or de-identify them within 30 days after you withdraw consent or delete your account, subject to minimal backup retention and legal obligations.

9. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls and least-privilege access, Supabase Row-Level Security and Supabase Auth. Users are encouraged to use strong, unique passwords and change them regularly.

10. Cookies and analytics

We aim to minimize cookies. Our analytics provider, Simple Analytics, is privacy-preserving and does not collect personal data; under its implementation, a consent banner is not required for analytics. If we introduce additional cookies or SDKs (e.g., for authentication or security), we will disclose them here and, where required, request consent.

11. Children’s privacy

AFSAL is intended for users aged 16 and over. We do not knowingly collect personal data from individuals under 16. If you believe a minor under 16 has provided us with personal data, contact afsal.community@gmail.com and we will delete it. We do not collect ethnicity or gender identity from anyone under 16.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or an in-product notice. The “Last updated” date shows the latest revision.

13. Contact

Questions or requests about this policy: afsal.community@gmail.com