Privacy Policy

This Privacy Policy explains how [UnisPath registered legal name] ("UnisPath", "we", "us", "our") collects, uses, stores, and shares information when you and your organization use our student counseling and application management platform (the "Service"), and when you visit our website.

1. Who we are and how to contact us

If you have a question about this policy or want to exercise a right, contact us at support@unispath.com or through our contact page.

2. Our role: controller or processor

Which of your rights apply, and who you exercise them against, depends on our role for the data in question.

If you are a student and want to access, correct, or delete your record, start with your school or counseling organization. If it does not respond, contact us and we will help — see Section 16. The one exception is model development (Section 8): because that is our own purpose and we are the controller for it, come to us directly to withdraw consent or ask what we hold.

3. Who uses UnisPath

• Students — added by their school or counseling organization or, where a school has asked us to turn on school sign-in for its email domain, joining that school themselves by signing in with their school Google or Microsoft account. Students cannot otherwise register themselves.
• Organization members — staff of a school or counseling organization, with access to the students assigned to them, or to all of the organization's students where its owner allows it, and their applications, documents, and messages. The founding member registers the organization; after our review and approval, they manage students and invite additional members. Staff accounts are only ever created by invitation, never through school sign-in.
• Parents and guardians — who, once they are offered, may buy a webinar subscription or university sessions for a student (Section 14).
• UnisPath superadministrators — UnisPath personnel who approve new organizations, turn on school sign-in for a school's email domains, set usage allowances, manage webinars, and provide support.

4. Information we collect

Account information. Email address, full name (optional), phone number (optional), WhatsApp number (optional), role, organization affiliation, a flag indicating whether you must change your password on next sign-in, and the date and time you confirmed you are 13 or older and accepted the Terms of Service and this Privacy Policy, with the version you accepted. You may sign in with a password (the hash is stored by Firebase Authentication / Google Identity Platform) or, where enabled, by connecting a Google or Microsoft account — in that case Firebase, Google, and (for Microsoft sign-in) Microsoft each confirm your identity, and we receive your verified email address, your name, and a link to your profile picture. UnisPath never has access to your Google or Microsoft password. If you join your school through school sign-in, we record that you joined that way and when. When you do so with Microsoft, we also check Microsoft's sign-in token to confirm that your account belongs to your school's Microsoft 365; we do not keep the token, and if the check fails we log your email address and the Microsoft account and organization identifiers so we can find the fault.

Student profile and application data. Through the profile setup flow, for undergraduate applicants: country of residence, preferred destination countries and cities, intended majors, grade level and graduating class (for example, Class of 2027), course system and score (for example IB or A-Levels), individual subject grades, standardized test scores (SAT/ACT), English proficiency scores (IELTS/TOEFL), extracurricular activities, awards and honours, a personal statement summary, tuition budget, and campus preferences. For postgraduate applicants, we additionally collect the name and class of your bachelor's degree, the institution that awarded it, its graduation year, and years of relevant work experience. We store the universities you shortlist and every application you create, with each application's status as it moves through the pipeline.

Uploaded documents. Documents required by target universities, as PDF files of up to 10 MB each, including academic transcripts, English-test score reports, personal statements, CVs, reference letters, and passport or identity pages. An organization may define additional custom document types for its own students.

Profile edits by your counselor. Counselors at your organization can view and edit your profile, including your grades. Once your grade level has been set, only your organization can change it. The Service supports Grades 8 to 12 and gap-year students.

Messages. Text messages exchanged between students and their counseling team within the platform. Messages cannot carry attachments.

Counselor notes and tasks. Notes and tasks that members of your organization record about you and your applications. A note stays on your record, with its author's email address, even after that staff member's account is removed.

Calendar links. If you make a private calendar link, we store a scrambled (hashed) form of it, when you made it, and when a calendar app last fetched it. What the link shows, and who can read it, is described in Section 11.

Daily brief. If you are a counselor, we store the daily brief written for you (Section 7) for 30 days, and whether it was emailed to you.

Status history. Each application's status transitions, logged with a timestamp and the user who made the change, for audit and notification purposes. The stages are Shortlisted, Documents Needed, Counsellor Review, Submitted to University, Under Review by University, and Offer Received. When a student confirms that their documents are final, we record that declaration with a timestamp, move the application to Counsellor Review, and notify the counselor; the counselor records the later stages. Students in an organization do not change stages themselves.

Contact form. If you submit our public contact form: your name, email, organization name, and message.

AI assistant conversations. Messages you send to the in-app AI assistant and to the public website chatbot are transmitted to our AI provider to generate a response (see Section 7). We do not store those conversations on our servers; we log only usage metadata (feature used, timing, and token counts). If an AI request fails or comes back empty, we keep its text for up to 30 days so we can find the fault, then delete it. Follow-up questions a counselor asks about a University Match result are different: the question and the answer are stored with the Match run (see Section 15).

Webinar data. Registration details, attendance, and — where a session is recorded — the recording and any Google Meet-generated summary. See Section 14.

Payments. Paid plans are not offered yet, so nothing is charged and no payment details are collected today. Once they are, and a school or counseling organization chooses a plan, we will keep a record of the plan, extra students, search packs, and message add-ons it buys, when they renew or end, and whether payment succeeded, with the references Stripe gives them. To set that up we give Stripe the organization's name, its contact email address, and its UnisPath identifier. Card details are entered on Stripe's payment page and processed by Stripe (Section 10); we never receive or store your full card number. Students and parents cannot buy anything in the Service.

Usage and device information. Server logs, IP address, browser user-agent, and request paths, used for security, debugging, and abuse prevention. We also record when you were last active (when you upload a document, send a message, or update your profile), which your school or counseling organization sees so it can follow up with students who have gone quiet and which counts towards its active-student usage, and when you last used the Service (updated as you use it, at most every few minutes). If you install the UnisPath mobile application and enable notifications, we store the device push token issued to that installation by Apple or Google, together with the platform and the role under which you registered it, so that we can deliver push notifications through the Expo Push Service (Section 10).

5. Sensitive and special category information

Documents uploaded to the Service — transcripts, personal statements, reference letters, and identity pages — can contain information that data protection law treats as sensitive or "special category": date of birth, nationality and national identification numbers, and sometimes information revealing health or disability (for example, an accommodation request or a medical explanation for absence), religious or philosophical belief (for example, a faith-school transcript), or racial or ethnic origin.

We do not ask for this information and we do not use it for profiling. Where it appears in a document, we process it only as part of storing and displaying that document and running the automated validation described in Section 7, on the basis of the explicit consent obtained by your school or counseling organization (or, where relevant, because you have manifestly made it public by including it in an application document). Schools and counseling organizations are responsible for obtaining that explicit consent before uploading.

Note that automated document validation reads the whole of every document it checks, including anything sensitive it happens to contain. It checks only transcripts, English-test results, personal statements, CVs, and reference letters; passports and other identity documents, and document types your organization defines itself, are never sent to AI. Every document is also reviewed by a person at your organization. We do not currently operate a filter that detects or removes special category information, which is why the request above matters. Should we ever begin developing our own models (Section 8), such a filter would be a precondition.

Please do not upload more than is needed. Redact information a university has not asked for. If you believe a document containing sensitive information was uploaded without a proper basis, contact support@unispath.com and we will work with your organization to remove it.

6. How we use information, and our legal bases

Where UnisPath acts as controller, we rely on the legal bases below. Where we act as processor, the school or counseling organization is responsible for establishing the legal basis and we process on its instructions.

Where we rely on legitimate interests, we have assessed that our interest in operating and securing the Service is not overridden by your rights and freedoms. You can ask for a summary of that assessment at support@unispath.com. Where we rely on consent, you may withdraw it at any time; this does not affect processing carried out before withdrawal.

7. AI processing

The Service uses the AI providers below, described more fully in Section 10:

• Google Vertex AI (Gemini), processed within UnisPath's own Google Cloud project, for document validation, coaching, the in-app assistants, the public website chatbot, the counselor daily brief, and — by default — writing the explanation shown with each University Match result.
• Perplexity AI, for the live web search step of the university Match feature (see Section 3 of the Terms of Service). For each university a Match run checks, we send the Perplexity API the university's name and country, the intake, your intended field of study, your country of residence (because it decides fee status), and which admissions and English tests to look up. When a counselor asks a follow-up question about a Match result, the question is sent together with a de-identified academic profile: your year of study and curriculum; your grades and test scores (for example IB, GPA, SAT, IELTS or TOEFL); for Master's applicants, your bachelor's degree, its classification, the university that awarded it, your graduation year and years of work experience; your intended field of study, preferred countries, cities and type of campus; your annual tuition budget; your country of residence; and your activities and awards. We never send your name, email address, phone number, current school, or home address. Before free text is sent, an automated filter removes your name, email address and phone numbers as they are recorded on your account; it cannot recognise anyone else's details, or yours written differently, so please keep free-text fields such as activities, awards and subject grades free of personal details. Perplexity processes these requests using OpenAI models, as its own subprocessor. Perplexity returns cited summaries drawn from publicly available web sources; those summaries, the queries sent, the citation links, and any follow-up questions and answers are stored on your Match run record, as described in Section 15.
• DeepSeek (DeepSeek's API, with servers in China), from October 30, 2026, which UnisPath may use instead of Google Vertex AI to write the explanation shown with each University Match result. That is the only thing DeepSeek is used for. It receives only the de-identified profile described above, the university facts found by the search, and your activities and awards with personal identifiers removed — never your documents, name, contact details, or school. We are currently evaluating DeepSeek against Gemini for this step: until October 30, 2026it is used only on UnisPath's own demonstration accounts, and we also test it on sample documents we create ourselves. No customer's data or documents are sent to it before that date, and no student's document is ever sent to it.

We may use additional or different AI providers or models as the Service evolves; we will give organizations at least 30 days' notice before doing so, as described in Section 10.

• Automated document validation — when a student uploads a transcript, English-test result, personal statement, CV, or reference letter, its content is sent to Google Vertex AI to check document type, legibility, completeness, and potential fraud indicators. Scanned pages and reference letters are sent as the file itself, so the model can see whether every name, number and date can be read, and whether a stamp or signature is there. We also measure each scanned page for resolution, blur, darkness and faintness ourselves, with no third party involved. For a reference letter, each item a university expects — letterhead, stamp or seal, signature, who wrote it and in what position, how to contact them, the date, and the student named — is checked and reported separately. The result is a status of valid, needs review, or invalid, with notes and the item-by-item checks, stored with the document and shown to the student and to the organization team. Passports and other identity documents, and document types your organization defines itself, are never sent to AI. Every document, checked by AI or not, is reviewed by a person at your organization.
• Document coaching — students may optionally request AI feedback on an uploaded transcript, English-test result, personal statement, CV, or reference letter, which returns quality ratings, strengths, suggested improvements, and a readiness assessment. It is not available for identity documents or for document types your organization defines.
• Student and counselor AI assistant — to answer your questions, context from your account is included in prompts sent to the AI provider along with your messages. For students that context includes your name, email address and phone number, together with your profile, applications and their notes, the names and review notes of your documents, your tasks, and your assigned counselor. For counselors it includes the names and email addresses of the students in their caseload, with application counts, intake status, tasks, recent uploads, and team workload figures, plus the documents awaiting review and upcoming deadlines across the students they can see, with those students' and counselors' names. When a counselor asks about a particular student, that student's full context is included: profile, phone number, application notes, tasks, and latest University Match results.
• Counselor daily brief — once a day, for each counselor, Google Vertex AI is sent the counselor's own name and role, and the names of the students assigned to that counselor with their intended majors, degree, grade level, how many days since each was last active, how many applications each has, whether their intake is complete, and which profile fields are empty (for postgraduate applicants, also their bachelor's degree and its class); those students' applications and deadlines; the counselor's open tasks, including any notes written on them and the student each concerns; the documents waiting for review; and the number of unread messages. It returns a short list of the day's priorities, which is shown on the counselor's dashboard, emailed to them if they have chosen that, and kept for 30 days. A counselor may turn an item into a task. Students who have been deleted are left out.
• Superadmin AI assistant — UnisPath superadministrators have an assistant that helps with platform management. Prompts include organization-level operational data only: the names, registered contact emails, statuses (pending, approved, rejected, suspended), and administrative notes of organizations on the platform, plus counts and timing metadata. Student personal data is not included in these prompts.
• Public website chatbot — answers general questions about UnisPath. Do not enter personal information about yourself or anyone else into it.

Google and Perplexity never train on your data. Google's Vertex AI terms prohibit training on anything you send through the Service. Perplexity's API terms prohibit using it to train, fine-tune, or improve any generative AI model, and Perplexity's data processing agreement states that personal data is not used for training; Perplexity processes our requests using OpenAI models as its own subprocessor. This is unconditional and is not affected by anything in Section 8. DeepSeek: unlike Google and Perplexity, DeepSeek's terms do not rule out using what it receives to train its models; DeepSeek says it may use a small, de-identified portion of inputs for training and offers an opt-out, and it keeps data in China for as long as it needs. We send it no customer data before October 30, 2026, and we will not use it for any customer until we have opted our account out of training. Whatever its terms say, DeepSeek only ever receives the de-identified information described above.

We log the type, timing, and token count of AI requests for monitoring, cost management, and abuse prevention. AI outputs are not guaranteed to be accurate or complete; verify university requirements, deadlines, and document acceptance directly with each university.

8. Developing our own models — opt-in only

We would like to develop our own AI and statistical models to make document review, university matching, and application guidance work better, and doing that well requires real examples. If we do, we will only use your information with your agreement.

Nothing would enter our training data unless all of these are true:

• Your organization has opted in through a signed data processing agreement. This is never a default and never happens because we updated this policy.
• You have separately said yes using a clearly labelled control in the Service, after being told what would be used and why. That control does not exist in the Service yet; it would have to be built before this could be turned on. Your answer would be recorded as a flag on your account, alongside the timestamp of when you set it. Where your local law requires a parent or guardian to agree as well, we would require that too.
• You were 16 or older when you agreed. Before you could turn the model-training consent on, you would be asked to separately attest that you are 16 or older, and that attestation would be recorded on your account. We would never use the data of anyone who had not made this attestation to develop models, on any basis, even with parental consent.
• Your organization is eligible. Institutions for which we act as a school official under FERPA, and organizations covered by student privacy laws that prohibit this use, are excluded entirely.
• The content passed our sensitivity filter. Documents flagged as containing special category information (Section 5) are excluded unless you gave explicit consent covering that information.

Saying no would cost you nothing. Consent here would be genuinely optional and entirely separate from your use of the Service. If you declined, or withdrew later, you would keep every feature, your documents would be reviewed exactly the same way, and neither UnisPath nor your school or counseling organization would treat your application differently. We would not ask again after you declined, other than through a setting you could change yourself at any time.

What we would do with it. Where you had opted in, we would use your uploaded documents, profile and application data, and counselor feedback on our automated review to train, fine-tune, and evaluate models that UnisPath owns and uses in the Service.

What we would never do. We would not sell the training data or make it available to any third party, we would not use it to build models for anyone other than UnisPath, and we would not deploy a model in a form that reproduces identifiable information from documents. We would test models for memorisation before releasing them.

Withdrawing. You would be able to withdraw at any time from your account settings or by emailing support@unispath.com. We would remove your records from the training data promptly and exclude them from every future training run. We want to be straightforward about one limit: a model that has already been trained cannot have an individual's contribution surgically removed, so withdrawal would apply going forward rather than retroactively to models already built.

Safeguards. The training data would be held in storage separate from the live Service, access restricted to named personnel and logged, and every record would carry a record of the organization opt-in and the individual consent that permitted it. Because this processing would involve people under 18, we would carry out and keep under review a data protection impact assessment addressing the best interests of the child, in line with the UK Age Appropriate Design Code and equivalent guidance, before starting.

9. Automated decision-making and human review

UnisPath does not make decisions producing legal or similarly significant effects about any student by automated means alone. The document validation status is a flag surfaced to your counseling organization for a person to review; it does not by itself reject a document, block an application, or affect any admission decision. Every consequential decision is taken by a human at your organization.

You may ask for human review of any automated flag, express your point of view, and contest the result — through your counseling organization, or by writing to support@unispath.com. We monitor validation outputs for accuracy and unintended bias.

University Match is profiling. For a given student, Match ranks universities with a fit score and a Reach/Target/Safety band. That is profiling, and we treat it as such. It produces recommendations for a counselor to review and never makes a decision by itself. UnisPath does not use AI to score or rank students against one another.

10. Subprocessors

We use the third-party providers below. Each is bound by a written contract limiting its use of the data to providing its service to us.

The Match feature also draws on two public, non-commercial data sources — the U.S. Department of Education College Scorecard and the U.K. Office for Students Discover Uni / Unistats service. This data is used as static reference material loaded from files bundled with the Service; UnisPath does not send you or your data to those sources, and citation links to them are surfaced in the Match interface for verification.

We will give organizations at least 30 days' notice before adding or replacing a subprocessor that processes Customer Data. To receive those notices, email support@unispath.com. An organization may object on reasonable data protection grounds, as described in the Terms.

11. How we share data

• Within your organization. A student's applications, documents, and messages are visible to members of the organization that onboarded them, within the limits the organization sets. Each student is assigned a primary counselor by an automatic least-loaded algorithm. Other members of the organization see the student's records only if the organization's owner has allowed them to see every student; otherwise they see only the students assigned to them.
• Between organizations: never. We do not share student data with any other school or counseling organization, no organization can see another's students, documents, or messages, and we do not maintain any combined data set drawn from more than one organization, other than operational and usage records (such as AI usage and University Match cost and quality reporting) that UnisPath uses to run, cost and improve the Service. Were the model development described in Section 8 ever to begin, the resulting training data would be the sole exception — it would contain only records that both the organization and the individual had opted in, would never be visible to any customer, and would never be disclosed to anyone outside UnisPath.
• Service providers. The subprocessors listed in Section 10, strictly for the purposes described.
• Calendar apps you choose. If you make a private calendar link and add it to Google Calendar, Outlook or Apple Calendar, that provider's servers fetch it about every six hours and keep their own copy under their own terms. A student's link shows their application deadlines (until the application is sent), decision dates, tasks their counselor shared with them, and webinars they registered for. A counselor's link shows the deadlines and decision dates of the students assigned to them, by first name and initial only, and the titles of the counselor's own open tasks exactly as written. Anyone who has the link can read it without signing in, so keep it private. Switching the link off, or making a new one, stops the old link working at once, but does not remove a copy a calendar app already holds.
• Legal and safety. Where required by law or valid legal process, or to protect the rights, property, or safety of UnisPath, our users, or others. Where we are legally permitted to do so, we will notify the affected organization before disclosing.
• Corporate transactions. In connection with a merger, acquisition, financing, or sale of assets, subject to the recipient being bound by protections at least as protective as this policy. We will notify affected organizations before their data is transferred.

We do not sell or share personal information, and we do not use it for advertising. We have not sold or shared personal information — including the personal information of anyone we know to be under 16 — in the preceding 12 months, as those terms are defined by the California Consumer Privacy Act and comparable laws. We do not run third-party advertising or social-tracking technologies in the Service, and there is therefore no opt-out for you to exercise. We honour Global Privacy Control and similar browser signals.

12. Children and minors

Many of our users are between 13 and 18 and applying to universities. The Service is intended for students aged 13 and over. On first sign-in, an invited student is asked to confirm they are 13 or older and to accept the Terms of Service and Privacy Policy; that confirmation is recorded on the account, with the date and time it was made. A student who joins through school sign-in makes the same confirmation before the account is created. Until the confirmation is recorded, the Service shows and accepts nothing else, and when we make a material change to the Terms or this policy we ask for it again at the next sign-in. We do not knowingly collect personal information from anyone under 13. The Service supports students in Grades 8 to 12 and gap-year students; students in Grades 8 to 10 see a simpler portal without the application tools.

Schools and counseling organizations are contractually responsible for obtaining and retaining evidence of every parental, guardian, or school consent required by local law — including the consent required under Article 8 of the EU and UK GDPR, which sets the digital consent age between 13 and 16 depending on the country — before submitting any data about a minor to the Service, or before turning on school sign-in for students who could then join themselves. A school that turns on school sign-in also undertakes to keep pupils under 13 from joining and to remove anyone who joins but is not its student (Terms of Service, Section 5). A separate age attestation of 16 or older is required as a precondition of the model-development consent described in Section 8.

If you believe a child's information has been provided to us without proper consent, contact support@unispath.com and we will delete it promptly.

13. Student records and education privacy laws

Our customers are schools and independent counseling organizations. Where UnisPath is engaged by an educational institution and processes education records on its behalf, we act solely as a school official with a legitimate educational interest, under the institution's direct control, in accordance with 34 CFR § 99.31(a)(1)(i)(B) of the US Family Educational Rights and Privacy Act (FERPA). In that role we will:

• use education records only for the purposes the institution authorises;
• not redisclose them to any third party without the institution's authorisation or as permitted by FERPA;
• not use them to create a student profile for any purpose other than delivering the Service; and
• return or destroy them at the institution's direction on termination.

Depending on your jurisdiction, our processing may also engage US state student privacy laws (such as California's SOPIPA), the EU and UK GDPR, the UK Data Protection Act 2018, the DIFC Data Protection Law No. 5 of 2020, UAE Federal Decree-Law No. 45 of 2021, or equivalent regimes. Consistent with those laws, we do not sell student data, do not use it for targeted advertising, and do not build advertising profiles.

14. Webinars and recordings

Webinars run on Google Meet. If a session is recorded, or Google Meet's AI note-taking is used, Google Meet tells everyone in the session when it starts. You may attend with your camera and microphone off, or leave, and your participation is entirely voluntary. Google Meet's built-in AI features may generate summaries or notes; these are processed by Google under its own terms.

Webinars are free. We do not sell webinar subscriptions or university sessions, and students and parents cannot buy anything in the Service.

Invitations. When we publish a webinar, we email an invitation to the students it is open to: every student on UnisPath, or the students of the organizations it is limited to. We send these for ourselves, as controller, not on your organization's instructions. Each invitation has a link to stop webinar invitations; it works without signing in, changes no other email, and we keep your choice for as long as your student record exists.

Presenters. We keep a presenter's name and email address with the webinar. Students see the presenter's name, never their email address.

Recordings and summaries may be shared with registered attendees. Twelve months after a session, its registrations and attendance, the link to its recording, and the presenter's email address are deleted from the Service, and the recording itself is deleted from our Google Workspace. You can ask us to remove your contribution sooner at support@unispath.com.

15. Data retention

During the 60-day recovery window, an organization admin or UnisPath can restore an account with its data intact. An organization or student may request immediate permanent deletion instead — see Section 16. We may retain information longer where we are legally required to, or where it is necessary to establish, exercise, or defend legal claims; in that case we isolate it and stop using it for any other purpose.

16. Your rights

Depending on where you live, you may have the right to: access a copy of your personal information; correct inaccurate information; delete it; obtain it in a portable format; restrict or object to certain processing, including processing based on legitimate interests; withdraw consent at any time; limit the use of sensitive personal information; not be discriminated against for exercising a right; and not be subject to a solely automated decision with legal or similarly significant effects (see Section 9).

Model development consent. We do not currently ask for this consent, because we do not develop our own models. If we ever do, you will be able to change your decision at any time from your account settings — a single toggle, as easy to turn off as on — withdrawal will take effect immediately for all future use, and nothing else about your account will change. See Section 8.

Students. You may delete your own account directly from the platform. This immediately disables sign-in, hides the account, and starts the 60-day period described in Section 15, after which the data is permanently erased. Because your record may also be your school's or counseling organization's business record, we will notify your organization of the deletion, and they may need to retain limited information where they have an independent legal obligation to do so. You may also ask your organization for assistance, including immediate permanent deletion.

Everyone else. Contact support@unispath.com or use our contact page. We will verify your identity through your registered email address before acting, and we respond within 30 days (extendable by a further 30 or 45 days for complex requests, where the law permits and with notice to you). Exercising a right is free unless a request is manifestly unfounded or excessive. You may use an authorised agent where the law allows; we will ask for proof of their authority.

Complaints. If you are unhappy with our response, you have the right to lodge a complaint with your data protection supervisory authority — in the EU, the authority in your country of residence or workplace; in the UK, the Information Commissioner's Office (ico.org.uk); in the DIFC, the DIFC Commissioner of Data Protection; and in the UAE, the UAE Data Office. We would appreciate the chance to address your concern first.

17. International transfers

UnisPath is established in the United Arab Emirates. The Service runs on Google Cloud Platform in the United States: your account data and uploaded documents are stored in a single US region, and Google keeps our database backups in the United States. There is no per-account or per-country choice of region. UnisPath personnel access the data from the United Arab Emirates. ByteeIT, the Google Cloud reseller that helps administer our cloud account, has administrative access from India (Section 10). The other providers in Section 10 process data where that section says.

Most AI processing is carried out by Google Vertex AI. Depending on the model, inference may run on Google's global endpoint, which means the content of a request may be processed in Google infrastructure outside the United States. For University Match, the de-identified profile and counselors' follow-up questions are sent to Perplexity AI in the United States, which processes them using OpenAI models. From October 30, 2026, the explanation shown with each Match result may instead be written by DeepSeek, whose servers are in China; DeepSeek receives only the de-identified information described in Section 7. Google and Perplexity may not use this data to train their models (Section 7).

For transfers of personal data out of the European Economic Area, the United Kingdom, Switzerland, or the DIFC, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss addendum, and the equivalent mechanisms under DIFC Data Protection Law, together with supplementary technical measures including encryption in transit and at rest and access controls. You can request a copy of the relevant transfer mechanism, with commercial terms redacted, from support@unispath.com.

18. Security

• Encryption in transit (TLS 1.2 or higher) for all client traffic.
• Encryption at rest for the database (Cloud SQL), document storage (Cloud Storage), and secrets (Secret Manager).
• The database is reachable only over a private IP from inside our Google Cloud VPC.
• Documents are served via time-limited V4 signed URLs; the storage bucket is not publicly accessible.
• Authentication is delegated to Firebase Authentication (Google Identity Platform). On first sign-in, invited users set their own password (or sign in with Google or Microsoft), confirm they are 13 or older, and accept the Terms and this policy; we record that on the server, and the server refuses every other request until it is recorded. A student joining through school sign-in does the same before the account is created, and only with a verified email on a domain the school has had us turn on (for Microsoft, from the school's own Microsoft 365).
• Google Cloud Armor, a web application firewall on our load balancer, inspects incoming requests, including IP addresses, and blocks abusive traffic.
• Role-based access control, per-member permissions set by each organization's owner, and organization-scoped queries, all enforced server-side on every authenticated request.
• Automated daily database backups with seven days of point-in-time recovery. A replaced or deleted document file stays recoverable for 7 days, so a mistake can be undone, and is then deleted.
• Administrative and infrastructure access is logged via Google Cloud Audit Logs.

Read more on our security page. No security programme is perfect, and no method of transmission or storage is completely secure.

19. If something goes wrong

If we confirm a personal data breach, we will notify the affected school or counseling organization, as controller, without undue delay and in any event within 72 hours of confirming it, with the information the organization needs to meet its own notification duties. Where we act as controller, we will notify the competent supervisory authority within 72 hours where required, and will notify affected individuals directly without undue delay where the breach is likely to result in a high risk to their rights and freedoms, or where any applicable law requires individual notice. We will follow up with a written post-incident summary.

To report a suspected vulnerability or incident, contact support@unispath.com. We acknowledge reports within 3 business days.

20. Cookies and similar technologies

We use only cookies that are strictly necessary to operate the Service. We do not run advertising, analytics, social-tracking, or session-recording technologies, and we therefore do not display a consent banner — strictly necessary cookies do not require consent.

Interface preferences, such as whether you closed a guide or how you arranged your dashboard, are kept in your browser's local storage rather than in cookies, as listed in our Cookie Policy.

Blocking the session cookie will prevent you from signing in. If we ever introduce analytics or any non-essential technology, we will update this section and ask for your consent first. Every cookie and storage item we use is listed in our Cookie Policy.

21. Communications

We send transactional and operational messages — invitations, application status updates, document review alerts, direct-message notifications, counselors' daily briefs where they have chosen to receive them by email, and service announcements — which are necessary to provide the Service and cannot be turned off while your account is active, though you can adjust notification preferences where the Service offers them. These are delivered by email through Resend and, where you have installed the UnisPath mobile application and granted notification permission, as push notifications through the Expo Push Service. Push notifications can be disabled at any time from your device settings, or by signing out of the mobile app (which removes your device token from our records). Webinar invitations are different: UnisPath sends them to tell students about its free webinars, and each one has a link to stop them (Section 14). Any purely promotional email will include an unsubscribe link and will be sent only where we have a lawful basis to do so.

22. Changes

We may update this policy. We will update the "last updated" date above and, for material changes, notify organizations and account holders through the Service or by email at least 30 days before they take effect, and ask you to accept the new version the next time you sign in. Until paid plans are offered (Terms of Service, Section 12.0), changes take effect on the date shown above, and we ask you to accept them at your next sign-in. We will never apply a materially different use of previously collected personal information without a lawful basis and, where required, your consent. Previous versions are available on request from support@unispath.com.

23. Contact

Questions about this policy, or requests to exercise your rights, can be sent to support@unispath.com, or through our contact page. Our postal address is [UnisPath registered legal name], [registered address, Dubai, United Arab Emirates]. Our Terms of Service are available here.