SMART-Q: Smart Quality Assurance

1 Introduction and Scope

This Privacy Policy governs the manner in which SMART-Q: Smart Quality Assurance (accessible at https://mutu.uinsaizu.ac.id, hereinafter referred to as the "Application" or "System") collects, uses, maintains, protects, and discloses information collected from registered users, university personnel, academic auditors, and visitors.

SMART-Q is an enterprise academic quality assurance management software developed, operated, and maintained by the Lembaga Penjaminan Mutu (Quality Assurance Agency / LPM) at Universitas Islam Negeri (UIN) Prof. K.H. Saifuddin Zuhri Purwokerto, Indonesia.

2 Information We Collect and Google OAuth 2.0 Scopes

We collect only the minimum data required to deliver secure authentication, role-based access control, and academic quality assurance workflows. The following table provides full transparency regarding each data category and specific Google OAuth 2.0 scope requested:

Data Category / API Scope	Data Points Collected	Purpose & Functional Justification
Google OAuth 2.0 Authentication openid .../auth/userinfo.email .../auth/userinfo.profile	Google User Unique ID (sub) Institutional Email Address (email) Full Name & Given Name (name) Profile Picture URL (picture)	Enables Single Sign-On (SSO) login for university faculty members, internal auditors, auditees, and institutional staff. The system links the verified Google Workspace email to authorize role permissions in the quality audit system.
Google Drive API Integration .../auth/drive.file or .../auth/drive	Authorized access to designated institutional Google Drive folders and files specifically created or opened by the SMART-Q application.	Allows authorized LPM quality administrators to backup, archive, and synchronize internal quality audit (AMI) evidence, accreditation matrices, and SPMI evaluation documents into designated institutional Google Drive storage.
Institutional Profile Data	NIP / NIDN (Employee ID), faculty assignment, department/study program, job title, institutional role (Auditor, Auditee, LPM Admin, University Leadership).	Assigning internal audit instruments, scheduling evaluation cycles, and generating official accreditation reports.
Audit & Quality Records	Self-evaluation answers, audit finding records (KTS/OB), corrective action plans (RTL), satisfaction surveys, and uploaded document attachments (PDF, DOCX, XLSX).	Executing Internal Quality Audits (Audit Mutu Internal) and satisfying Indonesian national accreditation standards (BAN-PT / LAM).
Technical & Security Logs	Client IP address, web browser user-agent, access timestamps, and authentication audit logs.	Ensuring application security, mitigating brute-force attacks, and maintaining regulatory audit trails.

3 How We Use and Process Google User Data

Google user data obtained through Google OAuth 2.0 and Google Drive APIs is used strictly and exclusively for:

• Identity Verification: Verifying user identity and institutional status using official university Google Workspace accounts (@uinsaizu.ac.id).
• Role Authorization: Mapping the authenticated user to appropriate institutional permissions (e.g. Auditor, Auditee, Study Program Head, Dean, LPM Administrator).
• Secure Cloud Document Archival: Backing up and retrieving academic quality documentation in designated institutional storage.

4 Strict Prohibitions and Data Protection Guarantees

5 Data Storage, Security and Encryption

We maintain comprehensive administrative, technical, and physical safeguards to ensure the security and confidentiality of user data:

• Encryption in Transit: All communications between user browsers, application servers, and Google APIs are secured with high-grade Transport Layer Security (TLS 1.2 / TLS 1.3 over HTTPS).
• Server-Side Credential Isolation: OAuth Client Secrets, tokens, and database credentials are kept in protected server environment variables and are never exposed to public repositories or client-side scripts.
• Role-Based Access Control (RBAC): Sensitive audit reports and accreditation files are accessible only to authenticated personnel who possess explicit institutional authorization.

6 Data Retention, Account Deletion and Revocation of Access

We retain user information only for the duration necessary to satisfy institutional accreditation and academic compliance obligations:

• How to Revoke Google Permissions: You can disconnect SMART-Q and revoke OAuth permissions at any time directly through your Google Account Permissions Settings.
• How to Request Data Deletion: Users may request the deletion of their user profile, uploaded files, or account data by sending an email from their registered institutional email address to:
  Email: [email protected] (cc: [email protected])
  Subject: [Data Deletion Request] - User Name / Email
  Processing Time: All valid deletion requests are executed within 14 calendar days.

7 Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect technological improvements, updated regulatory mandates, or changes in institutional policies. The revised document will always be published on this page with an updated "Effective Date".

8 Contact Information and Institutional Identity

If you have any questions, inquiries, or feedback regarding this Privacy Policy or our data management practices, please contact us at: