1. Who we are
i-Syarah (isyarah.com) is a web application for lecturers to manage assessment, learning-outcome attainment (CLO/PO), CQI reports, course files, attendance and academic advising. It is operated by Rahida Wati Sharudin (“we”). Contact rahida1409@gmail.com for enquiries, complaints or requests about your personal data. i-Syarah is not an official system of any university.
2. Our role
| If you are… | Your data | Our role |
|---|---|---|
| A lecturer who registers | Account data and your course content | Data user — this notice applies in full |
| A student who registers your own account (e.g. course chat) | Account, group membership, your messages | Data user — this notice applies in full |
| A student whose details are entered by your lecturer | Class list, marks, attendance, advising records | Your lecturer (or their university) determines this data; we process it on the lecturer's behalf. Requests may be made to your lecturer, or to us and we will pass them on. |
| A student who chooses to link your account to your name on the lecturer's class list | Your published marks and your own attendance record are shown to you | The class-list record stays the lecturer's; we process it on the lecturer's behalf. You give specific consent to the link, the lecturer confirms it, and you can withdraw it at any time. |
3. Data we collect
- Lecturers: name, email, password (hashed — we cannot see it), language preference, your academic-portfolio records (publications, supervision records, etc.), an optional profile photo (stored privately; shown only in your portfolio), course content you create, and — if you choose — encrypted Google Calendar/Drive access tokens.
- Students with an account: email, real full name, password (hashed), course groups joined, messages sent, notification settings, confirmation of being 18 or older, and — if you link your account to the class list — the date of your consent and the link status (the matric number you type is used only to find your record; failed link attempts are logged with the matric number tried for 30 days for security and shown to the lecturer).
- Students without an account (QR attendance, supervision progress): the name you select from your lecturer's list, a hashed value of a cookie on your phone plus browser type, and — for supervision progress — the text you submit (work done, problems, plans, links).
- In-app notifications: a short title (for example the name of an assessment or announcement — never marks or message text), a link, and whether you have read it. Visible only to you.
- Push notifications (only if you turn them on): a device address and encryption keys issued by your browser's push service (Google, Apple or Mozilla), plus your browser type. The push message carries only the notification title and link. You can turn it off per device at any time.
- Technical: IP address and browser information in server logs; login session cookies.
We do not collect GPS location, phone numbers, health or biometric data. The only image we store is an optional lecturer profile photo, which we do not process for facial recognition.
4. Source
Directly from you; for students on a class list, from your lecturer (including the record your account is linked to).
5. Purposes
- Accounts and login.
- Course management, assessment and attainment reporting (including accreditation documents).
- Communication within course groups (chat and announcements).
- Letting students who link their account see their own published marks and attendance.
- Supervision of projects (consultations, weekly progress, submissions).
- Service emails (verification, password reset, notification digests if enabled).
- Security, abuse prevention and legal compliance.
We do not sell data, use it for advertising, or share it for marketing.
6. Obligatory or voluntary
Email and password are required to create an account; without them we cannot provide the service. For students, your real full name is also required so lecturers can identify group members; it is shown only to the lecturer and members of the same group. Your lecturer can also see the email of your account in the group member list. When you link your account to the class list, your name and account email are shown to the lecturer so the link can be confirmed. Other data is optional. Joining course chat and linking your account are voluntary for students — your lecturer keeps other channels for important information.
7. Recipients (our processors)
| Party | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and verification emails | Singapore |
| Vercel | Application hosting | Singapore (server functions); global network |
| Calendar/Drive — only if a lecturer connects it | Global |
Data may also be disclosed where required by law.
8. Transfer outside Malaysia
Data is stored in Singapore by the processors above.
9. Retention
- Accounts: while active; deleted within 30 days of account deletion.
- Chat messages: kept while the group exists. A lecturer can delete any message; a student can delete their own within 15 minutes (before it is answered). Messages are deleted when the group or course is deleted, or when the account is deleted (deleting a student account clears the content of their messages).
- Lecturer-recorded data: as determined by the lecturer; deleted when the lecturer deletes it, or within 30 days of the lecturer's account deletion.
- Server logs: kept by our processors for their default periods.
- Group membership and the account link to the class list: released when you leave the group (recommended after the semester ends).
- Failed account-link attempt records: deleted after 30 days (cleanup runs when the lecturer opens the Student List or a student tries to link an account).
- In-app notifications: deleted automatically after 60 days (cleanup runs when you open your notifications), when you delete them yourself, or when your account or the course is deleted.
- Push subscriptions: kept until you turn push off on that device, the device's push service reports it as expired (removed on the next send), or your account is deleted.
10. Security
HTTPS only; hashed passwords; encrypted third-party tokens (AES-256-GCM); per-user isolation enforced in the database (Row Level Security); students reach class-list data only through controlled functions after their consent and the lecturer's confirmation; profile photos are kept in private storage. If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected users within the periods required by the PDPA (currently 72 hours for the Commissioner) and without unreasonable delay for you.
11. Your rights
- Access — request a copy of your personal data.
- Correction — most data can be edited directly in the app.
- Withdraw consent / delete your account at any time.
- Portability — export your data in a machine-readable format.
- Limit processing — e.g. disconnect Google, or withdraw your class-list link on the group page.
Signed-in users can export or delete their account at Data & privacy. Other requests: rahida1409@gmail.com; we respond within 21 days. You may also complain to the Personal Data Protection Department.
12. Age
Student accounts are for users aged 18 and above only.
13. Changes
We will notify you of material changes before they take effect.