Privacy Policy
This Privacy Policy explains how Uniply ("we", "us", "the Service") collects, uses, shares, and protects your personal data when you use uniply.tech and related services.
Read it before submitting anything to the Service. If you do not agree with it, do not use the Service.
1. Who is responsible for your data
The data controller is:
Arsenii Fedorenko
Moscow, Russian Federation
uniply.team@gmail.com
For any question about this policy or your data, contact us at uniply.team@gmail.com. We aim to respond within 30 days.
2. What data we collect
2.1 Data you give us directly
When you complete the matching survey, we collect:
- Academic data: intended major, GPA, SAT or ACT scores, TOEFL or IELTS scores
- Financial data: the amount your family can contribute per year toward university costs
- Preference data: preferred climate, city size, university size, athletic conference
- Free-text data: descriptions of your academic achievements, extracurricular activities, startup or personal projects, and work experience
2.2 Account data
When you register an account, we collect:
- A display name of your choosing. This does not have to be your real name, and we recommend that it is not.
- Your email address, used to identify your account and to contact you about the Service.
- Your password, which is stored only as a bcrypt hash. We never store, log, or have access to your password in readable form.
Account data is held in a separate table from your survey responses.
We do not ask for your real name, date of birth, home address, passport data, national ID, or government-issued identifiers. Please do not include such information in free-text fields.
2.3 Data collected automatically
Our hosting and infrastructure providers automatically process technical data necessary to deliver the Service, including IP address, browser type, device type, and request timestamps. This is standard server log data and is retained by those providers under their own policies.
Anonymous usage statistics. Since 7 October 2026 we also record anonymous events about how the Service is used, so that we can see what works and what does not. The events are:
- Where a visit came from: the
src/utm_*parameters of the link you opened, and the domain (not the full address) of the website that referred you - Which pages and survey steps you open, and whether you moved on from a step or left it empty — a yes/no fact, never what you entered
- Which test options you used in the survey (for example TOEFL or IELTS, SAT and/or ACT) — only which, never your scores
- Which university pages you open, and which universities you save or remove from your saved list
- Whether you use the interactive globe on the home page (spin, zoom, tap, reset)
- Whether a visit ended in registration (by password or with Google)
These statistics are anonymous. They are not linked to your account, name, email address, or IP address, and nothing is stored on your device for them — no cookies and no identifiers in local storage. Each visit gets a random code that exists only in your browser's memory while the page is open and disappears when you reload or close it, so we cannot tell whether two visits come from the same person. We never record the values you enter, the free text you write, or your scores.
Separately, we work out aggregate figures — such as average test scores, or how many users chose TOEFL rather than IELTS — from the survey answers stored in your account. We look only at totals and averages across users, and we do not publish them.
You can opt out at any time. We honour the Do Not Track and Global Privacy Control signals of your browser, and you can also switch statistics off here:
We do not use advertising or third-party tracking tools, and we do not build a profile of you across sessions or across other websites.
2.4 Data we do not collect
We do not collect special category data as defined by the GDPR — racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning sexual orientation. Do not submit such information through free-text fields.
3. Why we process your data, and on what legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Generating your university match list | Academic, financial, preference, and free-text data | Performance of a contract (Art. 6(1)(b)) |
| Scoring your profile strength via automated analysis | Free-text data | Performance of a contract (Art. 6(1)(b)) |
| Maintaining your account and authenticating you | Account data | Performance of a contract (Art. 6(1)(b)) |
| Operating, securing, and debugging the Service | Technical data | Legitimate interests (Art. 6(1)(f)) |
| Improving matching accuracy using aggregated statistics | De-identified aggregate data | Legitimate interests (Art. 6(1)(f)) |
| Understanding how the Service is used and improving it (usage statistics, source of visits, aggregate figures) | Anonymous usage events; aggregate figures from survey answers | Legitimate interests (Art. 6(1)(f)) — you can object, see section 8 |
We do not sell your personal data. We do not use your data for advertising. We do not share your data with universities, recruiters, or admissions agents.
4. Automated processing and AI
This section matters. Read it.
To assess the strength of your profile, the free-text you submit — your achievements, extracurricular activities, projects, and work experience — is transmitted to a third-party AI model for scoring. That score, combined with your test scores and stated preferences, determines which universities appear in your results and how each is classified.
Your display name, email address, and password are never sent to the model. Only the free-text you wrote is transmitted, with no identifier attached to it.
The request is routed through AITUNNEL (aitunnel.ru), a technical proxy service, to Anthropic, the provider of the Claude model family. According to AITUNNEL's published documentation, the content of requests is not stored in their database or logs; they retain only technical usage metrics — model used, token count, and cost. Their documentation on this is at https://aitunnel.ru/personal-data and their privacy policy at https://aitunnel.ru/privacy. Anthropic's own terms govern their handling of the request and are available at https://www.anthropic.com/legal/privacy.
This is automated processing. It produces a recommendation, not a decision with legal or similarly significant effect: we do not admit you anywhere, reject you anywhere, or transmit your profile to any institution. The output is informational and you are free to disregard it.
If you would prefer that your free-text not be processed this way, leave the free-text fields empty. The Service will still return matches based on your test scores and preferences alone.
5. Who we share data with
We share data only with infrastructure providers necessary to run the Service:
| Provider | Function | Location |
|---|---|---|
| Vercel | Frontend hosting | Washington, D.C., USA (us-east-1) |
| Render | Backend API hosting | Ohio, USA (US East) |
| Supabase | Database storage | Ireland (eu-west-1) |
| AITUNNEL | Technical proxy for model requests | Russian Federation |
| Anthropic | Automated profile scoring | United States |
Each acts as a processor on our instructions. We do not share your data with any other party except where required by law.
6. International transfers
Your account data and survey responses are stored in Ireland, within the European Economic Area.
The free-text you submit for automated scoring leaves the EEA: it is routed through a proxy operated in the Russian Federation and processed by Anthropic in the United States. This transfer is necessary to perform the service you requested (Art. 49(1)(b) GDPR) and is limited to text you chose to write, with no identifier attached. If you do not wish your data to be transferred this way, leave the free-text fields empty.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Account data and survey responses | Deleted after 18 months of account inactivity |
| Generated match results | Deleted with the account they belong to |
| Free-text sent for automated scoring | Not stored by us or by the proxy after the score is returned |
| Server logs | As retained by our infrastructure providers |
| Anonymous usage events | Deleted after 12 months |
| Aggregated, de-identified statistics | Indefinitely |
If you request deletion of your account, it and all associated data are removed within 7 days. Deletion is permanent and cannot be reversed after that point.
8. Your rights
If you are in the European Economic Area or the United Kingdom, you have the right to:
- Access — obtain a copy of the personal data we hold about you
- Rectification — correct inaccurate data
- Erasure — request deletion of your data
- Restriction — request that we limit processing
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent, withdraw it at any time
- Complain — lodge a complaint with your national data protection authority
Usage statistics are anonymous, so we cannot look up or delete your own events; to stop them, use the opt-out in section 2.3. To exercise any of the other rights, email uniply.team@gmail.com. We will not charge you or discriminate against you for making a request.
Users in other jurisdictions may have comparable rights under local law, and we will honour equivalent requests where we are able to.
9. Age requirement
You must be at least 16 years old to use the Service. You confirm this when you register. If you are under 16, do not create an account or submit any data.
If we learn that we have collected data from someone under 16, we will delete it. A parent or guardian who believes their child has registered may contact us at uniply.team@gmail.com.
10. Security
We protect your data using encrypted connections (HTTPS) for all traffic, access controls on our database, restricted credential handling, and storage of passwords as bcrypt hashes rather than readable text. Our database is not exposed directly to the public internet; all access passes through our backend.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to your rights, we will notify affected users and the relevant supervisory authority as required by law.
11. Cookies
We use only cookies and local storage that are needed to operate the Service — principally to keep you signed in — plus small preference flags: that you have dismissed a notice, your colour-theme choice (light, dark or automatic), and, if you choose it, your opt-out from usage statistics. These flags stay on your device and are not sent to us. Our usage statistics (section 2.3) do not use cookies or any identifier stored on your device. We do not use advertising, profiling, or third-party tracking cookies or tools.
12. Changes to this policy
We may update this policy. The "Last updated" date at the top reflects the most recent version. If we make a material change to how we use your data, we will give notice on the Service before the change takes effect.
7 October 2026: added anonymous usage statistics (sections 2.3, 3, 7, 8 and 11). Previously this policy stated that we used no analytics. We are announcing the change on the Service (news page and a notice) and to registered users by email.
9 October 2026: section 11 now also lists the colour-theme preference, which is stored only on your device.
13. Contact
Questions, requests, or complaints: uniply.team@gmail.com