UniConnectPrivacy policy
Beta version. This policy describes how UniConnect works today. It is being reviewed by legal advisers before the full launch; items marked to be completed will be filled in then.
1. Who we are
UniConnect is a network where verified universities, schools and companies connect, share events and opportunities, sign partnership agreements and refer students. The service is operated by legal entity name and registered address — to be completed (“UniConnect”, “we”). For data-protection law we are the controller of the personal data described here. Contact: privacy@uniconnect.example final address to be completed.
2. Whose data this covers
- Account holders — the people who run an organisation’s account: the owner who registered it and the colleagues they invite. Each person signs in with their own work email.
- Students who are referred — students are not UniConnect users. A school may share a student’s details with a university in a referral, only with the consent it has recorded (from a parent or guardian for anyone under 18).
- Visitors to our public pages.
3. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, job title, work email, phone number, password (stored only as a one-way hash), two-step sign-in settings | You, when you register or edit Settings |
| Organisation | Name, type, country and city, website, accreditation or registration details, page content, logo and photos, programmes, admissions information | You |
| Verification | Registration reference, accreditation / company registration number, reviewer notes | You and our verification team |
| Activity | Posts, events, opportunities, research projects, partnership agreements, follows | You and other organisations |
| Messages | Messages and files exchanged with other organisations, who sent each message and when, reports you make | You and the organisations you talk to |
| Referrals (students) | Student’s name, contact details (or a parent’s or guardian’s), school record, intended programme, predicted grades, references, consent record, the university’s decision | The referring school |
| Security | Active sign-in sessions (browser and device type, dates), password-reset requests | Automatically, when you sign in |
Images you upload are re-encoded, which removes hidden data such as GPS location and camera details.
4. Why we use it, and on what basis
| Purpose | Legal basis (e.g. under the GDPR) |
|---|---|
| Creating and running your account and your organisation’s page; delivering messages, referrals and agreements | Performing our contract with you |
| Checking that organisations are genuine; keeping the network safe; handling reports; preventing abuse (rate limits, blocking) | Our legitimate interest in a trustworthy network |
| Passing a student’s referral from a school to a university | The consent the school recorded (and the school’s own basis as a controller of its students’ data) |
| Sending service emails (password resets, verification results, security alerts, new-message alerts you can turn off) | Performing our contract; legitimate interest in account security |
| Occasional news about events and partnerships | Your consent (optional, withdraw any time) |
| Meeting legal obligations | Legal obligation |
We do not sell personal data, show advertising, or use it to train AI models.
5. Who can see what
- Signed-in members see organisation pages, including the contact person’s name and job title, and published posts, events, opportunities and research.
- Private to your organisation: your phone number, registration numbers, verification notes, draft content, the full terms of agreements (shared only with the other party), messages (only the two sides), files sent in messages, and the requests you receive.
- Referrals are visible only to the referring school and the university it was sent to.
- The public landing page shows only anonymous activity (for example “a university · an open day”) — never names.
- UniConnect staff see what they need to verify organisations and review reports. A report about a conversation shows staff the recent messages of that conversation only.
6. Service providers
| Provider | What for | Personal data |
|---|---|---|
| Render (hosting and database) | Runs the website and stores the database | All data described above |
| Email provider to be completed | Delivers service emails | Name, email address, the email’s content |
| Crossref, OpenAlex, arXiv, doi.org, ROR | Checking research publications and funders | None — only paper and funder identifiers are looked up |
| Google News (RSS) | The education news box | None — our server fetches headlines; your browser does not contact Google |
Fonts and icons are served from our own server, so your browser does not contact third parties when you use UniConnect.
7. Where data is stored
Data is stored on servers in Mumbai, India (Amazon Web Services). If you are in another country, this is an international transfer; where the law requires it we use appropriate safeguards, such as standard contractual clauses to be confirmed with legal advisers.
8. How long we keep it
| Data | Kept |
|---|---|
| Account and organisation page | While the account is open. When you delete it, it is removed straight away from the live database and from backups within 30 days, unless the law requires us to keep something longer. |
| Students’ referral details | 12 months after the university’s decision, or 24 months if no decision is recorded — then deleted automatically. |
| Messages and their files | While both accounts exist. Messages an account sent are deleted when that account is deleted. |
| Sign-in sessions | Up to 30 days, or until you sign out. |
| Password-reset links | One hour, and each works once. |
9. How we protect it
- Encrypted connections (HTTPS); the database is reachable only from our own servers.
- Passwords stored as bcrypt hashes; optional two-step sign-in with an authenticator app (its secret is stored encrypted, recovery codes are hashed).
- Every organisation is verified before it can start conversations; each organisation’s team is managed by its owner, colleagues join only by invitation on the organisation’s own email domain, and accounts are handed over through a checked process when people change jobs.
- Files sent in messages are private: only the two sides of the conversation can download them.
- Access to data is limited to what each role needs; staff actions such as account handovers are logged.
10. Your rights
Depending on where you live (for example under the GDPR, the UK GDPR, India’s Digital Personal Data Protection Act, Singapore’s PDPA or California’s CCPA), you can:
- access and export your data — Settings → Your data → Download your data;
- correct it — in Settings and on your organisation’s page;
- delete your account — Settings → Your data → Delete your account;
- object to or restrict some uses, and withdraw consent to optional emails;
- complain to your data-protection authority.
Students (or their parents or guardians) who want to see, correct or remove referral data can contact the school that referred them, or us at the address above.
11. Students and children
UniConnect has no accounts for students or anyone under 18. Schools may share a student’s details only in a referral, only with the consent they have recorded (from a parent or guardian for under-18s), and should share no more than the university needs. Students’ personal details must not be sent in messages — the messages screen reminds users of this.
12. Cookies and browser storage
We do not use advertising or analytics cookies, or any tracking. To keep you signed in, your browser stores your sign-in tokens (local storage), and it may remember small preferences such as your recent searches. Signing out removes the tokens.
13. Changes and contact
If we change this policy in a way that matters, we will tell account holders before the change takes effect. Questions or requests: privacy@uniconnect.example.