Privacy Policy

Who is responsible for your data

The controlling legal entity has not been named yet, which is why this document is marked as a draft above. Until it is, no controller is identified and this policy is incomplete.

This policy covers the UniSupport website and the UniSupport mobile app. Where they differ, it says so.

What we collect

Account and identity

• Email address, name, and phone number where you supply one.
• A password, stored only as a hash. We cannot read it and cannot recover it for you — a reset replaces it.
• If you sign in with Google or with Apple, the identifier that provider gives us and the tokens needed to keep your session working. Signing in with Apple lets you withhold your real address and use a relay one; we accept that and never see the address behind it.

Your learning record

• Courses you enrol in, your progress through chapters and lessons, quiz and exam attempts and their scores, and certificates issued to you.
• Universities, courses and categories you search for and view, which is what the recommendations and the "popular" lists are built from.
• Anything you submit to us directly — enquiries, support messages, applications.

Device and diagnostic data (mobile app)

• Device model, operating system version and a device identifier, read so that crash reports and push notifications can be tied to the right device.
• Crash reports and performance traces, via Firebase Crashlytics. A crash report includes a stack trace and device state at the moment of the crash.
• App usage events, via Firebase Analytics — which screens are opened and which actions are taken. This is aggregate product measurement, not advertising.
• A push notification token, via Firebase Cloud Messaging, if you allow notifications. It identifies the installation, not you, and revoking the permission stops it.

Photos and files you choose (mobile app)

• The app can ask for the camera, or for a file you pick, so you can set a profile picture or attach a document. It reads only what you select in that moment; it does not browse your library or scan your storage.
• Downloaded certificates are written to your device so you can keep them. They are yours and we do not read them back.

Billing

• Subscription, plan and enrolment records, and an identifier linking your account to the payment processor. We do not store card numbers — those go directly to the processor and never reach our servers.

Data that leaves your browser before you sign up

Three things on the public pages send data to a third party before you have an account or have agreed to anything. They are listed here because they are easy to overlook:

• Fonts. Typefaces are served from Google Fonts, so loading any page sends your IP address to Google. Self-hosting them removes this, and is the fix if that matters to you or your learners.
• reCAPTCHA. The sign-up, sign-in, password-reset and contact forms are protected by Google reCAPTCHA, which receives your IP address and interaction signals in order to judge whether you are a bot. Google's own terms and privacy policy apply to that processing.
• Vercel Web Analytics. Page views are counted by our host. It records the page, referrer, country and device type. It does not use cookies and does not build a profile that follows you to other sites.

Who else processes your data

We do not sell personal data, and there is no advertising network, no ad pixel and no cross-site tracking on either the site or the app. The analytics named above are product measurement — what is used and what crashes — not profiling.

How long we keep it

Account and learning records are kept for as long as the account exists, because they are the account: your progress, your certificates and your enrolments. Some records carry their own shorter life in the software — one-time codes, password-reset tokens and verification challenges all expire and stop being usable when they do.

Formal retention periods for diagnostic data have not been set yet. They should be, and this section should state them rather than stating that they are missing.

Your rights

Depending on where you live, you may have the right to see the data we hold about you, correct it, have it deleted, take it elsewhere in a portable form, or object to some of the ways it is used. If you are in the UK or EU, these rights come from the GDPR; California, Brazil, India and several other jurisdictions grant comparable ones.

To exercise any of them, email support@unisupport.co. You also have the right to complain to your local data protection authority.

Deleting your account. You can request deletion from the same address, and from inside the app. Deleting the account removes your profile, enrolments and progress. Certificates already issued to you stay on your own device, because they are already there.

If you reach UniSupport through a school, agency or employer, send the request to them first — they control that data and we act on their instructions.

Children

UniSupport is built for applicants to higher education, and accounts are intended for people aged 16 or over. We do not knowingly collect data from children below that age. If you believe a child has created an account, write to support@unisupport.co and we will remove it.

Changes

When this policy changes, the date at the top changes with it. If a change materially affects how we handle your data, we will tell account holders directly rather than relying on you to re-read the page.