Privacy Notice

1. What we collect

Depending on how you use Folio, we may collect:

• Account dataYour email address, password (stored securely), name and the basic profile details you give us.
• Documents and profile contentCVs and supporting documents you upload (for example PDF, DOCX, TXT or PPTX files) and any text you add to your profile.
• Job Scanner preferences and payIf you use Job Scanner: the roles, level, type of work, locations and work arrangements you are looking for (we fill many of these in from your CV for you to check), and, if you choose to share them, your current role, current pay and expected pay.
• Work StyleYour answers to the Work Style questions and the results we work out from them, if you complete them.
• Activity in FolioMessages to your Folio chat and its conversation history, views of your share link, jobs you save, pass on or mark as applied in Job Scanner, and contact or interview requests you receive.
• Hiring and university dataIf you use Folio for hiring or for a university: job descriptions, shortlists, notes and evaluation results, and the candidate or student details your organisation provides.
• University detailsIf you join through your university: your faculty and programme, the courses, projects and interests you add, and your sharing choices.
• Device and technical dataIP address, browser and device information, security logs and limited website usage signals, used for security, reliability and improving the service.
• Advertising and attribution dataLimited ad click and browser identifiers, public-page visits, completed registration or CV-upload events, and one-way hashed versions of your email address and account identifier used to match those events with Meta or TikTok ads.
• Billing dataIf you subscribe: plan status and payment identifiers from our billing provider. We do not store full card details on our servers.
• Ambassador payout detailsIf you are a Folio ambassador: your name, contact details, bank name, account name and account number, the sign-ups and payments linked to your code or link, and the commission we calculate and pay you.

Your email address and password are required to create an account. Everything else is voluntary. Without a CV, features such as job matching, your Folio chat and sharing will not work. Sharing your pay and completing Work Style are optional. Without your pay, you will not see pay on Job Scanner roles.

2. How we use your data

• Provide the serviceCreate and secure your account, store your documents, and build your Folio profile and chat.
• Your CV and what you publishYour CV details are used to build your Folio profile. Anything you choose to publish may be visible or communicated through your public Folio link and chatbot, so be mindful of what you share. By adding a CV, you confirm the information is accurate and yours to share.
• Files you add before you sign upIf you add your CV and a job description on our website before creating an account, we hold them securely so they are ready for your new account. We only read them once you have confirmed your email, and we delete them after 48 hours if no account is created.
• AI featuresRead your documents to pick out skills and experience, answer questions about you through your Folio chat, and give feedback on your CV. These features use AI models (large language models).
• Job ScannerCompare your profile and your scan brief with job adverts from public and partner job sources, show you the roles that fit with a summary of why, and refresh your matches automatically, usually overnight. If you share your pay, we show the pay for each role and how it compares with what you hoped for. Job adverts come from third parties. We link to them and do not control their content.
• Work StyleShow you how you like to work and, if you turn on recruiter visibility, show your results to recruiters next to your profile.
• Folio UniversityIf you join your university’s group: manage your place, produce the group reports your university sees, and let the partner employers you choose find you.
• Ambassador programmeRecord sign-ups and payments made with an ambassador’s code or link, and calculate and pay their commission.
• Improving how Folio matchesWe use the CVs and job descriptions we process, the matches we show and what people do with them, such as saving or passing on a job, to test and improve our matching. This can include training our matching technology, and before we use information that way we remove your name, contact details and anything else that identifies you. If you delete your account, this information can no longer be connected to you. We also produce statistics that do not identify anyone, such as which skills employers ask for most. By using Folio, you agree to this use.
• Sharing and engagementRun your share links and QR codes, and show you who engaged with your Folio and your conversation history.
• CommunicationsSend account and service messages, and occasional news about Folio. Every news email has an unsubscribe link. We do not use your uploaded content for marketing without your consent.
• Safety, security and the lawDetect abuse, prevent fraud and scraping, keep the platform secure, record your consent and respond to your requests.

3. Consent

By creating an account and using Folio, you consent to us processing your personal data as this notice describes. Some processing, such as keeping your account secure, is needed to provide the service at all. You can withdraw your consent at any time by contacting us or by deleting your account.

4. Who can see your data

• People you share your link withAnyone with your share link or QR code can view and chat with your Folio, according to your settings. You can turn off or replace your link at any time.
• Recruiters and employers on FolioOnly if you turn on recruiter visibility. They can then see your profile and Work Style results and send you contact or interview requests, which you can accept or ignore. We do not show your pay to recruiters or employers.
• Your universityIf you join your university’s group on Folio, your university sees reports about groups of students, built from what you choose to share. Reports do not show your name or your grades. It also sees the details needed to manage your place, such as whether you accepted your invitation. It does not see your chats or your private activity.
• Your university’s partner employersOnly the partners you tick when you join or later in your settings can find your profile and ask your Folio about you. Your university sees how many students share with each partner, not who.
• The ambassador who referred youIf you sign up with an ambassador’s code or link, the ambassador sees a masked version of your email address, whether you joined as a candidate or a recruiter, your country or region, when you signed up and whether you have paid. They do not see your CV, profile or chats.
• Our service providersCompanies that host and store our data, run background processing, deliver email, process payments, monitor errors and provide AI models. They receive only what they need to do this work for us.
• Analytics and advertising partnersAs described in “Cookies, analytics and advertising” below.
• AuthoritiesRegulators, courts or law enforcement, when the law requires it.
• A new owner of FolioIf the Folio business is transferred, for example to a new company we set up, your data moves with it under the same protections as this notice.

We do not sell your personal data.

5. If a recruiter or university gave us your information

Recruiters can upload CVs to Folio to assess candidates for their roles, and universities can give us their students’ names and email addresses so we can invite them to Folio. In those cases the recruiter or university confirms that it obtained your information lawfully and may share it with us, and we use it only to provide that service to them. We do not add you to recruiter search or contact you for other purposes unless you create a Folio account and choose to.

To have this information removed, ask the recruiter or university, or contact us and we will help.

6. If you join through your university

Universities can invite their students to Folio. Your university gives us your name, email address, faculty and programme so we can send you its invitation. Joining your university’s group is your choice: you read your university’s sharing notice and agree to it before you join.

Once you join, your university sees reports about groups of students, built from what you choose to share, such as your courses, projects and career interests. Reports do not show your name or your grades. Your university does not see your chats, your CV feedback or your private activity. Partner employers can find you only if you tick them.

You can change what you share or leave your university’s group at any time. If your university paid for your place, leaving ends that, but your Folio account and everything in it stay yours.

University staff who use Folio have their own accounts. We use their names, email addresses and roles to give them access and to record what they do in the university space.

7. If you are a Folio ambassador

We use your name, contact details and bank account details to run the ambassador programme and pay your commission. We record the sign-ups and payments linked to your code or link so we can show you your referrals and your statements.

Your portal shows only masked details of the people you refer, never their CVs, profiles or chats. The programme terms, including how commission is earned and paid, are in Schedule C of our Terms of Service.

8. Cookies, analytics and advertising

Folio uses cookies and similar technologies for sign-in, security, payments, preferences, website analytics and advertising measurement. Analytics and advertising technologies may run automatically on selected public pages.

Website measurement may include Google Analytics 4, Microsoft Clarity, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag and related conversion tools. These tools are restricted to reviewed public pages and selected conversion events. Analytics tools help us understand overall behaviour, for example which pages are hard to use. They are not used to read your uploaded documents, chat text, job descriptions, payment data, email addresses or names.

Google Analytics receives sanitised public-page views and a sign-up completion event. We remove fragments and all query data except strictly filtered campaign labels and IDs used for attribution. We do not send CVs or document contents, job descriptions, chat content, payment data, email addresses, names, or raw account identifiers to Google Analytics. It does not collect events on dashboards, recruiter workspaces, private chats, billing pages, or pages that display CVs, documents, or job descriptions.

Google’s regional privacy controls keep analytics storage denied for visitors in the European Economic Area, United Kingdom, and Switzerland. Google advertising storage, advertising user data, and advertising personalisation remain denied for everyone unless Folio introduces a separately approved consent process.

Meta, TikTok, and LinkedIn may receive limited public-page and advertising measurement data. Meta and TikTok may also receive a completed registration or CV-upload event, the Folio page where it occurred, device and network information, advertising identifiers, and one-way hashed versions of your email address and account identifier to match conversions. A CV-upload event records only that an upload finished; it does not include the filename, file, or its contents. We do not send CV content, job descriptions, chat content, or recruitment data to these advertising providers.

9. Where your data is processed

Folio stores personal data in Singapore. Our service providers may also process it in other countries, including the United States. We transfer personal data outside Malaysia only as the PDPA allows, for example to providers that are bound by contract to protect it.

10. How long we keep your data

We keep your personal data until you delete your account. When you delete your account, we delete your documents, profile, chat history and matches. We keep only records the law requires us to keep, and billing and commission records with your identity removed. CVs that a recruiter uploaded stay in that recruiter’s workspace until the recruiter deletes them.

11. Security

We use reasonable administrative, technical and organisational safeguards to protect personal data. No method of transmission or storage is 100% secure, but we work to maintain strong security practices.

If a data breach is likely to cause you significant harm, we will notify the Personal Data Protection Commissioner and tell you, as the law requires.

12. Your rights

Under the PDPA, you can:

• ask for a copy of your personal data
• correct data that is inaccurate
• delete your account and your data
• withdraw your consent
• stop direct marketing emails at any time

You can update your profile and delete your account yourself in the app. For anything else, email us at the address below. When you ask for a copy of your data, we will send you the documents you uploaded and the account and profile details you gave us, or send them to another organisation if you ask. Information Folio creates to run the service, such as how we process, organise and score documents, is our confidential business information and is not included. We reply within the time the law requires.

13. Changes to this notice

We may update this notice. If the changes are significant, we will tell you by email or in the app, and we will always update the date at the top.

14. Contact

For privacy requests, questions or complaints, contact:

BIRDY STACK DIGITAL SERVICES (KT0609191-A)11-05, Corporate Tower 2, Pavilion Damansara Heights,3, Jalan Damanlela, Bukit Damansara,50490 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur.Email: [email protected]