Privacy policy
Version
Uniacross helps families plan university applications abroad. We collect as little personal data as possible, never sell it, and show no advertising. This policy explains what we process, why, on which legal basis (EU General Data Protection Regulation, "GDPR"), and your rights.
1. Who is responsible
Data controller: [to be completed], [to be completed], [to be completed]. Contact for any privacy question or request: [to be completed].
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Visiting the site without an account: IP address, browser, pages requested (server logs) | Deliver the site, security, preventing abuse | Legitimate interest (Art. 6(1)(f)) | About 14 days (log rotation) |
| Tools (country finder, deadlines, chances, cost) without an account | Calculations run in your browser; nothing is sent to or stored by us | — | Not stored |
| Account: email address, password (stored only as a strong one-way hash), or a Google account identifier and name if you use Google sign-in; dates of creation and last login | Provide your account | Contract (Art. 6(1)(b)) | Until you delete the account; inactive accounts are deleted after 24 months without login |
| Study profile you choose to enter: student's first name, school system, grades, languages, fields, budget range, preferences, shortlist, timeline | Personalise your plan, deadlines and suggestions | Consent (Art. 6(1)(a)), asked separately and withdrawable at any time | Until you withdraw consent or delete the account (withdrawal deletes this data) |
| Email address for reminders and updates | Deadline reminders, important updates | Consent (Art. 6(1)(a)) | Until you withdraw consent |
| Record of your consents (what, when, policy version, hashed IP) | Demonstrating consent (Art. 7(1)) | Legal obligation / legitimate interest | As long as the account exists |
| Audience measurement (Google Analytics 4) if you accept analytics cookies | Understand which pages help, improve the site | Consent (Art. 6(1)(a)); not loaded at all without it | Google Analytics retention set to 14 months |
| Hashed IP address and email in a short-lived log of login attempts | Protect accounts against password guessing | Legitimate interest (Art. 6(1)(f)) | 24 hours |
Please do not enter sensitive data (health, religion, ethnic origin, etc.) in free-text fields: we don't need it.
3. Children and students
Accounts are for people aged 16 or over: parents, guardians and older students. A parent who enters information about their child should do so with the child's knowledge. We only ask for what is useful for planning (no date of birth, no photo, no ID).
4. Who receives data
- Hosting: Hetzner Online GmbH, servers in Germany (EU), acting as our processor.
- Google (Google Ireland Ltd / Google LLC): only if you choose "Continue with Google" (we receive your name, email and an identifier), and only if you accept analytics cookies (Google Analytics). Transfers to the US rely on the EU-US Data Privacy Framework and standard contractual clauses.
- Email delivery provider (to send confirmation, password reset and reminders): bound by a data processing agreement.
We never sell or rent personal data and never share it with universities, agents or advertisers.
5. Estimates, not decisions
Our tools give estimates based on public data (cut-offs, offer rates, costs). They involve no automated decision with legal or similarly significant effects on you. Admission decisions are made only by the universities.
6. Your rights
You can at any time: access your data and receive it in a portable format (download it from "My space"), correct it, delete it (delete your account from "My space"), restrict or object to processing, and withdraw any consent (without affecting processing before withdrawal). Write to [to be completed]. We answer within one month. You can also lodge a complaint with the data protection authority of your country of residence or of the controller's country.
7. Security
Encrypted connections (HTTPS), passwords hashed with Argon2id, protection against cross-site request forgery, rate limiting of login attempts, data stored in a dedicated database on servers in the EU, and least-privilege access.
8. Cookies
See our cookie policy. You can change your choice at any time via "Cookie settings" at the bottom of each page.
9. Changes
We will update this policy when our processing changes, change its version number, and, for important changes, inform account holders by email or when they log in.