← Back to VC Academy

Privacy policy

Last updated: 2 October 2026. This is a plain-language summary of how the VC Academy website works. It is not legal advice.

Who we are

VC Academy is run by 宇斻管理顧問股份有限公司. In this page, "we" means this company. This page covers the VC Academy website (training-vc.mvl.biz).

Contact: contact@tessera.design

What we collect

Reserving a seat (checkout)

The name and email you type, the plan you choose (bank transfer or card, and instalments), the price, currency and price wave, your language, and timestamps. We store these as an order with an order number and a status (for example pending or paid). When you open checkout, a Cloudflare Turnstile check runs to block bots. To limit abuse we keep a hashed (HMAC) form of your network address, not the address itself, with a per-minute counter. Your browser keeps a random receipt code in session storage so you can check your payment status; our database keeps only a hash of it.

Card payments

You are sent to NewebPay's payment page. Card numbers are entered only there. We do not receive or store card numbers; NewebPay tells us whether the payment succeeded and gives a transaction reference. The payment page and your card statement may show the merchant name 集向有限公司 (NewebPay), which is the payment processing merchant name for this course.

Bank transfer and the payment registration form

The site shows our bank details; the transfer itself happens at your bank. Afterwards you fill in a payment registration form (Google Forms): name, email, phone, transfer details (such as date, amount and last digits of your account) and, if you need an invoice, invoice details such as company name and tax ID (統編). Responses are kept in Google's services and are visible to our team. If you email us instead, we keep that email.

Application form

Name, email, current role and company, LinkedIn, which description fits you, why you want to join, how you heard about us, and the time you submitted. It is sent to a Google Apps Script web app that writes it to a Google Sheet our team reviews.

Analytics (only if you accept)

Google Analytics 4 records a page view for each section you open (title and path, including any query string you arrived with, such as campaign tags) and events such as opening checkout, choosing a payment method, viewing transfer details, clicking the registration form, starting or submitting a form, and an error type. It also collects standard information such as approximate location from your network address, device, browser and referrer. We do not send your name, email, order number or receipt code to it.

Microsoft Clarity records how visitors use pages (clicks, scrolling, mouse movement, pages visited, device information) and can show session replays and heatmaps. Replays can show what was on screen; we use Clarity's masking features to limit capturing what you type into forms. We send it event names only.

Emails

After your payment is confirmed we send you a confirmation email from Contact@tessera.design (delivered through Resend). We also reply to messages manually from contact@tessera.design.

On your device

Your language choice and your cookie choice are kept in your browser's local storage; the receipt code is kept in session storage until you close the tab. The site itself sets no cookies. Cookies are set only by analytics after you accept, and by third-party services on their own pages (for example NewebPay).

Why we use it

  • To process your order, confirm payment, manage seats, refunds and invoices.
  • To review your application and reply to your messages.
  • To keep the service secure and prevent abuse (Turnstile and the hashed rate-limit counter).
  • To understand and improve the site (analytics, only with your consent).
  • To meet accounting, tax and other legal obligations.

We do not sell your personal data.

Who receives it

  • NewebPay (藍新金流): card payment processing.
  • Supabase: database hosting for orders (Tokyo region).
  • Vercel: website hosting and server functions.
  • Cloudflare: Turnstile bot check.
  • Google: Forms, Sheets and Apps Script for the registration and application forms; Analytics if you accept.
  • Microsoft: Clarity if you accept.
  • Resend: email delivery.
  • Authorities, where the law requires it.

Where it is processed

Order records are stored in Japan (Supabase, Tokyo). Google, Microsoft, Cloudflare, Vercel and Resend may process data in the United States and other countries. Where the law requires safeguards for such transfers, we rely on those providers' own transfer safeguards and terms.

How long we keep it

  • Orders, payment records, registration form responses and invoice details: kept as accounting records, generally 5 years as Taiwanese accounting rules require.
  • Applications: 12 months after the application is decided, then deleted.
  • Messages you send us: while needed to handle your request, up to 24 months.
  • Hashed network-address counters: cleared periodically.
  • Analytics: according to the retention settings in each tool; we aim to keep it no longer than 14 months.
  • Receipt code in your browser: until you close the tab.

After that we delete or anonymise the data.

Your rights

Under Taiwan's Personal Data Protection Act you may ask us to let you inspect your data, give you a copy, supplement or correct it, stop collecting, processing or using it, or delete it. Email contact@tessera.design from the address you used; we may need to verify your identity, and we reply within the time limits the Act sets. Some data, such as accounting records, we must keep, so deletion may be limited. If you do not provide the data needed for an order or application, we cannot complete it. You can withdraw analytics consent at any time (see Cookies).

If you are in the EU or UK

You may have additional rights under the GDPR: access, rectification, erasure, restriction, portability, objection, and the right to complain to your local supervisory authority. Our legal bases are: consent for analytics (withdraw any time); contract for orders and applications; legal obligation for accounting records; and legitimate interests for security, fraud prevention and rate limiting.

Cookies, analytics and your choice

Analytics is off by default. Google Analytics and Microsoft Clarity load only after you press Accept in the banner. If you press Reject, or make no choice, neither loads. You can change your choice at any time with "Cookie settings" in the page footer. The choice is stored in your browser's local storage (not a cookie) on this device and browser; clearing site data brings the banner back. If your browser blocks storage, the banner appears on every visit and analytics stays off unless you accept during that visit.

If you switch from Accept to Reject, we stop sending data, tell Clarity to stop where it supports this, and try to delete the analytics cookies (_ga, _gid, _clck, _clsk) set on this site. Limits: we cannot delete cookies that Google or Microsoft hold on their own domains; data already collected stays with the provider until its retention period ends (email us if you want deletion requested); and a tag already loaded in an open page is switched off but only removed when you reload.

Changes

We will update this page when our practices change. Last updated: 2 October 2026.

Contact

contact@tessera.design · Taipei, Taiwan