Privacy & Data Protection Policy
Plain-language summary
Browsing the site and applying to opportunities never requires any personal data from you. If you subscribe to our weekly newsletter, we collect your email — nothing else. If you choose to create a free student account (currently open to East and West Africa), we also collect your name, region, country, year of study, and optionally your university, sex, date of birth, and a profile photo, so we can save your bookmarked opportunities across visits. Creating an account is always optional.
We do not sell your data, we do not share it with recruiters or listed organisations, and you can ask us to delete your account or newsletter subscription at any time.
1. Who we are
This Privacy Policy is issued by Student Companion AI, the publisher of SCA Opportunities (this website). We are the data controller responsible for any personal data collected through this platform.
| Organisation | Student Companion AI |
|---|---|
| Data Controller | Andrew Steven Boima, Founder |
| Contact | info@studentcompanionai.rw |
| Website | studentcompanionai.rw |
| Based in | Kigali, Rwanda |
Note: Student Companion AI operates a separate AI chatbot product. If you also use the chatbot, a dedicated Privacy & Data Protection Policy (Version 1.0) applies to that service. This policy covers only SCA Opportunities.
2. Who this policy applies to
This policy applies to:
- Anyone who visits
career.studentcompanionai.rw - Students and others who subscribe to our weekly opportunities newsletter
- Students who create a free account to save opportunities (currently open to East and West Africa)
- Anyone who contacts us through the email or WhatsApp channels linked on the site
3. What data we collect
We practise strict data minimisation. We collect only what is necessary for the platform to function and, if you choose to subscribe, to send you the newsletter.
| Data | When & why |
|---|---|
| Email address | Only if you voluntarily subscribe to the weekly newsletter. Stored in our Subscribers sheet along with a timestamp and the page you subscribed from. |
| Account data | Only if you voluntarily create a free account: email, password (hashed, never visible to us), full name, region, country, year of study, and optionally university, sex, date of birth, and a profile photo. Accounts are currently open to students in East and West Africa; we plan to expand this scope. |
| Saved opportunities | If you're logged in and tap the ★ save button on a listing, we store which opportunity you saved against your account so it's there next time you visit. Guests can still bookmark opportunities without an account — those bookmarks just reset when the tab closes. |
| Technical metadata | Standard server logs from GitHub Pages (IP address, browser, visit time). Used only for security and availability monitoring. We do not link these to individuals. |
| Session cookies | Minimal technical cookies required for the site to function. No advertising cookies, no tracking pixels, no third-party analytics. |
Creating an account is always optional. Browsing opportunities, using the CV Checker, and applying to any listing never requires an account or any personal data.
What we do NOT collect, even with an account: phone numbers, student IDs, academic records, grades, financial data, precise location, or any data beyond what you enter on the signup and profile forms.
Only you can see your own profile and saved opportunities. Account data is protected by database-level Row Level Security — not just app logic — so no other student, and no listed organisation, can ever read it.
4. How we use your data
We use the email addresses of newsletter subscribers only to send the weekly opportunities newsletter. Full stop.
We will NEVER:
- Sell your email to third parties
- Share it with partner institutions, recruiters, or organizations listed on the platform
- Use it for advertising or targeted marketing
- Profile you based on your subscription
- Add you to any list other than the one you subscribed to
5. Legal basis for processing
Under the Rwanda Data Protection and Privacy Law (DPPL) and GDPR principles, we process your email on the basis of your explicit consent — which you gave when you ticked the consent box on the signup form. You can withdraw that consent at any time by emailing us or unsubscribing from any newsletter email.
For standard server logs and session cookies, we rely on legitimate interests (keeping the site secure and functioning) — a narrow basis that does not involve identifying individuals.
6. Your rights
Your data belongs to you. You have the following rights, which we will honour within 30 days of your request:
| Right to access | Ask us what email data we hold for you. |
|---|---|
| Right to deletion | Ask us to permanently remove your email from our list. |
| Right to correction | Update your email if the one we have is wrong. |
| Right to portability | Get your data in a machine-readable format. |
| Right to object | Stop any processing you're uncomfortable with. |
| Right to withdraw consent | Unsubscribe at any time. No questions, no friction. |
To exercise any of these rights, email info@studentcompanionai.rw with the subject line "Data rights request". We will respond within 30 days.
7. How long we keep your data
| Newsletter email | Until you unsubscribe, then deleted within 30 days. |
|---|---|
| Account & saved opportunities | Until you delete your account — email us and we'll remove your account and all associated data within 30 days. |
| Server logs | Held by GitHub per their standard retention policy (typically 90 days). |
8. How we protect your data
- Storage — subscriber emails are stored in a private Google Sheet accessible only to the Student Companion AI team.
- Transmission — all traffic between your browser and our services uses HTTPS encryption.
- Access — restricted to authorised team members only.
- Minimisation — we store the absolute minimum required. We have nothing to lose because we don't keep much.
- Breach notification — in the unlikely event of a data breach affecting your email, we will notify affected subscribers within 72 hours of discovery.
9. Third parties we rely on
SCA Opportunities is a small, free platform built on infrastructure from the following providers:
| Provider | What they do |
|---|---|
| GitHub Pages | Hosts the public website. GitHub's privacy statement applies to standard server logs. |
| Google (Sheets & Apps Script) | Stores the opportunities data and the newsletter subscriber list. Google's privacy policy applies. |
| Supabase | Stores account data (authentication, profile, saved opportunities) for students who create an account. Protected by Row Level Security so only you can read your own data. Supabase's privacy policy applies. |
We do not share your data with advertisers, recruiters, or any organisations listed as opportunities on the platform. When you click "Apply" on an opportunity, you leave our site and the privacy policy of that third-party site applies — not ours.
10. External links
Every opportunity listed on SCA Opportunities links out to a third-party website (the organisation offering the opportunity). We are not responsible for the content, accuracy, or privacy practices of those external sites. Always verify deadlines and requirements on the source site before applying.
11. Cross-border data transfers
Because we use Google and GitHub, your data may be processed in data centres outside Rwanda, including in the EU and United States. Both providers maintain GDPR-aligned safeguards and Standard Contractual Clauses that apply to such transfers.
12. Children & young people
SCA Opportunities is intended for university undergraduate students (generally aged 18+). We do not knowingly collect email addresses from children under 13. If you believe a child under 13 has submitted their email, please contact us immediately and we will delete it.
13. Your right to complain
If you're unhappy with how we've handled your data, we encourage you to email us first at info@studentcompanionai.rw so we can resolve it directly. You also have the right to lodge a formal complaint with:
- Rwanda National Cyber Security Authority (NCSA) — www.ncsa.rw
- EU residents — your national data protection authority
14. Changes to this policy
We may update this policy as the platform grows. Significant changes will be announced at the top of this page and emailed to active subscribers. The "Version" and "Effective" dates above will always reflect the current version. Continued use after changes take effect constitutes acceptance of the updated policy.
15. Contact us
| info@studentcompanionai.rw | |
| +250 791 920 747 | |
| Website | studentcompanionai.rw |
| Response time | Within 5 business days |
Opportunities that match your journey. Privacy that respects your ownership.