Terms of Service

These Terms of Service (the "Terms") are a binding agreement between [UnisPath registered legal name] ("UnisPath", "we", "us", "our"), a company registered under number [commercial licence / registration number] with its registered office at [registered address, Dubai, United Arab Emirates], and the person or entity accessing the UnisPath platform ("you"). They govern your access to and use of the UnisPath platform, websites, applications, and related services (together, the "Service").

1. Agreement to these Terms

1.1 Acceptance. You accept these Terms by clicking "I agree" (or a similar control) when registering an organization, accepting an invitation, first signing in, joining a school through school sign-in, or (once they are offered) buying a webinar subscription or university sessions, or by executing an order form that references them. The Service is not available to an account until its acceptance is recorded. If you do not agree, do not use the Service.

1.2 Authority. If you accept these Terms on behalf of a counseling organization, school, company, or other entity, you represent that you are authorised to bind that entity, and "you" means that entity. If you lack that authority, you must not accept these Terms.

1.3 Order of precedence. Where UnisPath and a customer have executed an order form, a master services agreement ("MSA"), or a data processing agreement, those documents form part of this agreement. In the event of conflict, precedence is: (a) the data processing agreement, for data protection matters; (b) an executed order form, but only where it expressly amends the document it conflicts with; (c) the MSA, where executed; (d) these Terms; (e) the Privacy Policy.

1.4 Students. Students are added by an Organization or, where a school has turned on school sign-in, join it themselves (Section 5.4). Where an organization has accepted these Terms, the student's use of the Service is also governed by them, and the organization remains responsible for the obligations in Section 6.

2. Definitions

• "Customer Data" means all content, documents, profile information, messages, and other data submitted to the Service by you, your students, or your organization members.
• "Organization" means a school, counseling organization, agency, or similar entity approved by UnisPath to use the Service.
• "Organization Member" means an individual invited to an Organization's account.
• "Student" means an individual invited to the Service by an Organization, or who joins an Organization through school sign-in (Section 5.4).
• "AI Features" means the features described in Section 9.

3. The Service

3.1 What the Service does. UnisPath is a software platform that helps schools and counseling organizations manage student university applications, and serves their counselors, their students, and students' parents and guardians. The Service includes:

• A student profile setup flow collecting academic preferences (country, field of study, qualifications, budget, and similar), for both undergraduate and postgraduate applicants. The Organization sets and changes a Student's grade level (a Student whose grade is not yet on file may set it once, during setup), and Students in Grades 8 to 10 see a simpler portal without the application tools.
• University search and comparison tools ("Match") that draw on: (i) a curated shortlist derived from QS World University Rankings; (ii) official public data from the U.S. Department of Education College Scorecard and the U.K. Office for Students Discover Uni / Unistats service; and (iii) live web search carried out for each run through Perplexity's API, which retrieves and summarises publicly available information from university websites and public sources to verify current programmes, admission requirements, deadlines, and fees. Section 9 sets out the AI disclaimers that apply to these outputs, and the Privacy Policy sets out how they are stored. An Organization can limit the universities its Students and staff see, in Match and elsewhere in the Service, to its own list. Match searches count towards the Organization's usage allowance (Section 3.5).
• A student portal for uploading required documents, tracking applications through the application pipeline, and monitoring deadlines. Students confirm when their documents are final; the Organization records submission to universities and the outcomes.
• An administrative dashboard for Organizations to manage students, documents, messages, tasks, and team workload, including bulk student import from CSV, Excel, or PDF files, and export.
• Automated AI validation of uploaded documents and optional AI-generated document coaching.
• An in-app AI assistant for students and counselors, a daily brief for counselors, written by AI, of the day's priorities among their assigned Students, and a public chatbot on our website.
• Private calendar links that put deadlines, tasks, and webinars into Google Calendar, Outlook, or Apple Calendar. Anyone who has a link can read it without signing in, so keep it private and make a new one if it leaks. The calendar provider fetches the link and keeps its own copy under its own terms.
• School sign-in, which lets a school's students join it by signing in with a school Google or Microsoft account on an email domain UnisPath has turned on for that school (Section 5.4).
• Transactional and operational email notifications, and — where a user has installed the UnisPath mobile application and enabled notifications — push notifications delivered through the Expo Push Service.
• Webinars hosted by UnisPath or invited presenters, delivered over Google Meet, and, once offered, optional paid webinar subscriptions and university sessions, as described in Section 11.

3.2 What the Service does not do. UnisPath does not submit applications to universities on your behalf. Submission is performed by the Organization or by the student directly through each university's own channels. UnisPath is not an agent, representative, or partner of any university and has no authority to bind any university.

3.3 Changes to the Service. We may modify, add, or discontinue features. We will not materially degrade the core functionality of a paid subscription during its then-current term without notice and, where the degradation is material, the option to terminate the affected subscription and receive a pro-rata refund of prepaid fees.

3.4 Beta and free features. Features designated as beta, preview, pilot, early access, or provided free of charge are offered "as is", may be changed or withdrawn at any time without notice, carry no service level commitment, and are excluded from any availability or support obligation.

3.5 Usage allowance. Each Organization has a usage allowance for AI features, shown in its settings: University Match searches for each year from the date the Organization joined, and AI assistant messages for each calendar month, both based on its number of Students (or, on a paid plan, on the plan: Section 12.2) and shared by everyone in the Organization. Each Match search includes a set number of follow-up questions and added universities. When part of the allowance is used up, those requests are paused until it renews or UnisPath raises it. Deleted searches still count. A single assistant message can be up to 2,000 characters.

4. Accounts and roles

The Service supports three account types: Students, Organization Members, and UnisPath superadministrators.

• Students are added by invitation from an approved Organization or, where a school has turned on school sign-in, join it themselves (Section 5.4), and cannot otherwise self-register.
• Organization Members have access to the Students assigned to them, or to all of their Organization's Students where the Owner allows it, and to those Students' applications, documents, and messages. Organization Members are only ever added by invitation, never through school sign-in. The founding member registers the Organization through our organization signup page. Each Organization is reviewed and must be approved by UnisPath before onboarding students. Additional members are invited by an existing member. Each member holds one of three roles: Owner, Admin, or Viewer. The Owner sets each member's permissions, and Viewers have read-only access.
• UnisPath superadministrators are designated UnisPath personnel who approve Organizations, turn on school sign-in for a school's email domains, set usage allowances, manage webinars, and provide support.

4.1 Account security. You must provide accurate information and keep it current. You may sign in with a password or, where enabled, by connecting a Google or Microsoft account. You are responsible for safeguarding your credentials and for all activity under your account. Invited users signing in with a password set their own password on first sign-in. Notify us immediately at security@unispath.com of any suspected unauthorised access.

4.2 No credential sharing. Accounts are personal to the named individual and may not be shared. Organizations must promptly revoke access for members who leave.

5. Eligibility, minors, and parental consent

5.1 You must be at least 13 years old to use the Service. On first sign-in, invited users are asked to confirm they meet this age and to accept these Terms and the Privacy Policy; that confirmation is recorded on the account. A Student joining through school sign-in makes the same confirmation before the account is created. Until it is recorded, the Service shows and accepts nothing else. We do not knowingly permit use by anyone under 13.

5.2 If you are under 16, or under the higher age of digital consent where you live, you may use the Service only if the Organization you belong to has obtained, and retains a record of, the consent of your parent or legal guardian, as required by the Organization's agreement with UnisPath (Sections 5.3 and 6). The age of digital consent under Article 8 of the EU or UK GDPR is between 13 and 16 depending on the country.

5.3 Organizations that onboard minors represent and warrant that they have obtained, and retain records of, all parental or guardian consents and school authorisations required by applicable law before submitting any data about that minor to the Service, or before turning on school sign-in for students who could then join themselves, and will provide evidence of those consents on our reasonable request.

5.4 School sign-in. A school may ask UnisPath to turn on school sign-in for one or more of its email domains. It must ask from an address on that domain, and we may ask for further proof that the domain is the school's. Anyone who then signs in with a verified Google account, or with a Microsoft account from the school's own Microsoft 365, on a domain turned on for that school can join it as a Student after confirming they are 13 or older and accepting these Terms. By asking for school sign-in, the school confirms that:

• (a) every account on the domain belongs to someone aged 13 or older, or the school will keep younger pupils from joining through school sign-in;
• (b) it already holds any parental or guardian consent needed under Section 5.2 for students who can join that way;
• (c) it will remove anyone who joins but is not one of its students, such as a member of staff, a former student, or a pupil under 13; and
• (d) it will tell us promptly when it stops owning or using the domain, so that we can turn school sign-in off for it.

6. Organization responsibilities

Where an Organization uses the Service, the Organization is responsible for, and represents and warrants that it will ensure:

• The accuracy and lawfulness of all student information it enters or imports, whether manually or by CSV, Excel, or PDF upload.
• Having a valid legal basis, and all notices and consents required by applicable data protection and student privacy law, for submitting Customer Data to the Service and for our processing of it as described in these Terms and the Privacy Policy.
• Obtaining parental or guardian consent for minors, as set out in Section 5.
• The conduct of the Organization Members it invites, and prompt removal of member access when a staff member leaves.
• Where it uses school sign-in, the commitments in Section 5.4.
• Making sure completed applications are submitted to universities, whether by its staff or by its Students, and verifying university requirements, deadlines, and document acceptance directly with each university.
• Responding to requests from its students to exercise data protection rights, with our reasonable assistance.

The Organization is the controller of its students' personal data and UnisPath acts as its processor, as described in Section 15 and the Privacy Policy.

7. Acceptable use

You agree not to, and not to permit any person to:

• Use the Service in violation of any applicable law, regulation, or third-party right.
• Upload content that is fraudulent, forged, altered, infringing, or that you do not have the right to share. Documents you upload must accurately and truthfully represent the student to whom they relate.
• Attempt to access data belonging to other Organizations, Students, or users, or to circumvent tenant isolation or access controls.
• Reverse-engineer, decompile, disassemble, scrape, crawl, probe, load-test, or otherwise interfere with the Service or the underlying infrastructure, except to the extent this restriction is prohibited by applicable law.
• Use the Service or its outputs to build, train, or benchmark a competing product or machine learning model, or to extract the underlying data sets.
• Impersonate any person, falsely claim affiliation with an educational institution, or misrepresent your role in the application process.
• Use the Service to harass, threaten, defame, or harm any Student or Organization Member.
• Use the Service to send unsolicited bulk or marketing communications.
• Submit to the AI Features any data you are not permitted to disclose, or any special category, health, biometric, or financial account data beyond what the Service requests.

We may investigate suspected violations and take any action we reasonably consider appropriate, including removing content, suspending access, and reporting to law enforcement.

8. Customer Data and uploads

8.1 Ownership. As between you and UnisPath, you retain all right, title, and interest in Customer Data. We claim no ownership of it.

8.2 Limited licence. You grant UnisPath a worldwide, non-exclusive, royalty-free, revocable licence to host, store, transmit, display, and process Customer Data solely to the extent necessary to provide, secure, and support the Service to you and to comply with law. This licence terminates when the relevant Customer Data is deleted in accordance with Section 18.

8.3 Model development. As of the last updated date, UnisPath has not deployed any artificial intelligence or statistical model trained on Customer Data, and does not use Customer Data to train models offered to any third party. UnisPath maintains an internal, superadministrator-triggered dataset export tool through which it can compile a training-and-evaluation corpus from Customer Data; that tool is switched off, and would in any case return nothing, because the in-product consent and attestation controls described in (b) and (c) below do not yet exist in the Service, and the Service accepts that consent and attestation in no other way. Any corpus it produced would be held in a storage bucket of its own, never the one that holds the production Service's documents (the tool refuses to run without one), never shared outside UnisPath, and used only for the purposes described in this Section. Organization Members would appear in it without their names, email addresses, phone numbers or photos. Customer Data may be used for model development only where all of the following conditions are satisfied, and UnisPath will notify affected Organizations before any such use begins:

• (a) Organization opt-in. The Organization has opted in through a signed data processing agreement or order form amendment that expressly authorises model development, recorded on the Organization record as a boolean flag together with the date the flag was set and the member who set it. Opt-in is never a default, is never effected by these Terms alone or by an update to them, and may be withdrawn by the Organization on 30 days' written notice.
• (b) Individual consent. The Student has given separate, specific, opt-in consent within the Service, recorded as a boolean flag on the Student record with the date it was set, and, where the law of the Student's jurisdiction requires it, their parent or legal guardian has also consented. Consent is not a condition of using the Service: a Student who declines, or who later withdraws consent, receives the full Service with no reduction in functionality and no consequence to their applications, records, document review, or standing with their Organization.
• (c) Age attestation. The Student has separately attested, in a distinct in-product control, that they were aged 16 or over at the time consent was given; that attestation and the timestamp are recorded on the Student record. Customer Data relating to a Student who has not made the 16+ attestation is never used for model development, on any basis.
• (d) Eligible customers only. The Organization is not an educational institution for which UnisPath acts as a school official under FERPA, and is not otherwise subject to a student privacy law that prohibits this use. Data from excluded Organizations never enters the training corpus.
• (e) Sensitive content. Documents identified as containing special category data are excluded from the training corpus unless the Student has given explicit consent covering that data.

8.4 Model development licence and safeguards. Where and only where every condition in Section 8.3 is satisfied, you grant UnisPath a non-exclusive, royalty-free licence to use the relevant Customer Data to train, fine-tune, evaluate, and develop UnisPath's own artificial intelligence and statistical models. That licence is subject to the following commitments, which survive for as long as UnisPath retains any model trained on Customer Data:

• The training corpus is held in storage separate from the production Service, with access restricted to named personnel and logged.
• Every record in the corpus carries provenance linking it to the Organization opt-in and the individual consent that admitted it.
• On withdrawal of consent by a Student or Organization, the affected records are removed from the corpus promptly and excluded from every subsequent training run. UnisPath does not represent that data can be removed from a model already trained.
• Models are tested for memorisation and reproduction of training data before release, and are not deployed in a form that reproduces identifiable Customer Data.
• UnisPath does not sell, license, or otherwise make the training corpus available to any third party, and does not use it to train models for any party other than UnisPath.
• Google and Perplexity remain contractually prohibited from using Customer Data to train their own general-purpose models; the position for DeepSeek is set out in Section 7 of the Privacy Policy.

8.5 Uploads. Documents are uploaded as PDF files of up to 10 MB each; other file types are not accepted. Documents are stored in Google Cloud Storage in a private bucket and served only via time-limited signed URLs.

8.6 Your own copies. While we maintain backups as described in the Privacy Policy, you remain responsible for retaining your own copies of Customer Data material to your operations.

9. AI features, disclaimers, and human oversight

The Service currently uses the following third-party AI providers:

• Google Vertex AI (Gemini), processed inside UnisPath's own Google Cloud project, for automated document validation, optional document coaching, the in-app AI assistants for students, counselors, and superadministrators, the public website chatbot, the daily brief for counselors, and, by default, writing the explanation shown with each Match result.
• Perplexity AI, for the live web search step of the university Match feature. For each university checked, UnisPath sends Perplexity's API the university's name and country, the intake, the student's intended field of study and country of residence, and the tests to look up; the API returns cited summaries drawn from publicly available web sources. Counselors' follow-up questions about a Match result are sent with personal identifiers removed, together with the student's de-identified academic profile. Perplexity processes these requests using OpenAI models, as its own subprocessor, and is contractually restricted from using this data to train its models, as described in the Privacy Policy.
• DeepSeek, from October 30, 2026 and only once UnisPath has opted its account out of DeepSeek's use of inputs for training (Privacy Policy, Section 7), which UnisPath may use instead of Google Vertex AI to write the explanation shown with each Match result, and for nothing else. DeepSeek receives only de-identified information — the de-identified profile, the university facts found, and activities and awards with personal identifiers removed — and never documents, names, contact details, or school. Its servers are in China. Until both of those are true it is used only on UnisPath's own demonstration accounts and on sample documents UnisPath creates, never on Customer Data.

We may use additional or different AI providers or models as the Service evolves, subject to Section 15.4. You acknowledge and agree that:

• AI output may be wrong. AI-generated content may be inaccurate, incomplete, biased, or out of date, and must be independently verified before it is relied on.
• Validation reads the whole document. Automated validation applies only to transcripts, English-test results, personal statements, CVs, and reference letters. For those documents it transmits the entire content to the AI provider, including any sensitive information it contains. Passports and other identity documents, and document types an Organization defines itself, are never sent to AI. Every document is reviewed by a person at the Organization. Upload only what the receiving university requires.
• Validation is not certification. Document validation statuses (valid, needs review, invalid), item-by-item checks (such as legibility, a stamp, or a signature), and coaching feedback are automated guidance only. They are not a professional, legal, or forensic certification of a document's authenticity, accuracy, or quality, and must not be represented as such to any university or third party.
• No decisions are made about you by AI alone. AI Features produce recommendations and flags for review by Organization Members. UnisPath does not use them to make decisions producing legal or similarly significant effects concerning any Student. Any consequence of a document flag results from a human decision by the Organization, and a Student may request human review of any flag through their Organization or by contacting us.
• You are told when you are using AI. AI Features are labelled in the Service. Responses from the AI assistant and website chatbot are automated informational guidance and create no commitment on behalf of UnisPath or any university.
• University data may be stale. University information shown in search results and comparisons is sourced from third-party data sets and may not reflect current requirements, deadlines, or fees.

10. No admissions, immigration, legal, or financial advice

10.1 UnisPath supplies software. It does not provide immigration or visa advice, legal advice, financial or investment advice, or regulated education agency services, and it is not registered or authorised to do so in any jurisdiction. Nothing in the Service is a substitute for advice from a qualified, appropriately regulated professional in your jurisdiction.

10.2 No guarantee of outcome. UnisPath makes no representation, warranty, or guarantee that any application will be submitted successfully, accepted, or result in an offer, admission, scholarship, visa, or any other outcome. Admission and visa decisions rest entirely with the relevant universities and authorities.

10.3 No agency or fiduciary relationship. These Terms create no partnership, joint venture, employment, agency, or fiduciary relationship between you and UnisPath.

11. Webinars and recordings

11.1 Webinars are hosted by UnisPath or invited presenters over Google Meet. They may be open to all Students on the platform or restricted to Students of specific Organizations. Webinars are free. Webinar subscriptions and university sessions are not sold, and Students and parents cannot buy anything in the Service. If we offer them, the price, renewal, cancellation, and refund terms will be shown before anyone buys.

11.2 Recording. Sessions may be recorded, and Google Meet's built-in AI features (such as automated meeting summaries and notes) may be used. Google Meet tells everyone in the session when recording or note-taking starts, and you can attend with your camera and microphone off, or leave. By remaining in a session after that notice, you consent to being recorded.

11.3 Recordings and AI-generated summaries may be made available to registered attendees. You may not record, re-transmit, or publish any session, or any recording or summary of it, without our prior written consent.

11.4 Invitations. When we publish a webinar, we email an invitation to the Students it is open to. Each invitation has a link to stop webinar invitations, which works without signing in and changes no other email the Service sends.

12. Fees and billing

12.0 Paid plans are not offered yet. Today the Service is free for approved Organizations: no plan can be chosen in the Service, nothing is charged, and no card is collected. An Organization uses the AI features within the usage allowance in Section 3.5, with no limit on its number of Students unless UnisPath has agreed a plan with it in writing. Sections 12.1 to 12.5 apply once paid plans are offered in the Service, and we will tell Organizations before that happens.

12.1 Free trial. An Organization's first plan starts with a free trial of 60 days, and no card is needed to start it. During the trial, University Match searches are limited to two months' share of the plan's yearly searches. When the trial ends, the Organization needs a monthly or yearly plan, paid by card, to carry on running new University Match searches, sending AI assistant messages, and adding Students, including Students joining through school sign-in (Section 5.4). Without one, those pause; everything else, including document checks, and all of the Organization's records stay available, and the records can still be exported (Section 18.3).

12.2 Fees. Fees for an Organization's plan are those shown in the Service when the plan is chosen or, where UnisPath and the Organization have executed an order form, those it sets out. A plan includes the number of Students and the AI allowances shown when it is chosen, which take the place of the student-based allowance in Section 3.5. Allowance years run from the date the Organization joined UnisPath: on a monthly plan, a twelfth of the year's University Match searches is added each month; on a yearly plan, all of them at the start of the allowance year. Students beyond the plan's number are charged as extra Students, and only after you confirm: the charge starts at once, for the part of the current period that is left, and then renews with the plan. Search packs and message add-ons can be bought on top; a message add-on renews each month until it is stopped. Only the Organization's Owner can choose, pay for, change, or cancel a plan, extra Students, packs, or add-ons. Fees are exclusive of value added tax and any other applicable taxes, duties, or withholdings, which you are responsible for.

12.3 Billing and payment. Plans, extra Students, search packs, and message add-ons are paid by card through Stripe. Card details go to Stripe, not to UnisPath. If a payment for a plan fails and is not put right within seven days, new University Match searches, AI assistant messages, and adding Students pause as described in Section 12.1 until it is paid. Where an executed order form sets out billing, payment terms, or suspension for non-payment, it governs.

12.4 Renewal and cancellation. A plan renews automatically at the end of each month or year until it is cancelled. Cancelling stops the next renewal, and access continues until the end of the period already paid for; when an Organization's plan ends, the features listed in Section 12.1 pause as described there. Deleting the Organization (Section 18.4) cancels its plan and any add-ons at once. Where an executed order form sets out renewal and cancellation, it governs. Questions about cancellation can be sent to support@unispath.com, and we will not make cancellation more difficult than signing up.

12.5 Refunds. Fees for a period that has started are not refunded. This covers a month or year of a plan, extra Students, and message add-ons. Search packs are not refunded, and unused searches from a pack end with the allowance year. We refund in full any amount charged by mistake, such as a double charge or a wrong price. Where an executed order form sets out refunds, it governs. Nothing in these Terms limits a refund given elsewhere in them or required by applicable law.

13. Intellectual property, feedback, and publicity

13.1 UnisPath and its licensors own all right, title, and interest in the Service, including all software, interfaces, documentation, curated data compilations, and trademarks. Subject to these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Service during the term for your internal purposes. All rights not expressly granted are reserved.

13.2 Feedback. If you send us suggestions or feedback, you grant us a perpetual, irrevocable, royalty-free licence to use it without restriction or obligation to you. Feedback is provided voluntarily and must not include Customer Data or confidential information.

13.3 Publicity. We may identify an Organization as a customer and use its name and logo in customer lists on the UnisPath website. Any other publicity requires the other party's prior written consent (email is sufficient).

14. Third-party services

The Service relies on third-party providers including Google Cloud Platform, Firebase Authentication (Google Identity Platform), Google and Microsoft (when you sign in with a Google or Microsoft account), Google Vertex AI, Google Meet (Google Workspace), Resend (transactional email), Perplexity AI (live web search for the university Match feature, using OpenAI models as Perplexity's own subprocessor), DeepSeek (from October 30, 2026, for writing Match explanations from de-identified information only), the Expo Push Service (mobile push notifications), Stripe (card payments), and ByteeIT (the authorised Google Cloud reseller that bills and helps administer UnisPath's Google Cloud account, with administrative access to it from India), each governed by its own terms. We contract with each on terms intended to protect Customer Data as described in the Privacy Policy, and we remain responsible for their performance of the processing we engage them to carry out. We are not otherwise responsible for their independent conduct, or for any third-party website, university portal, or service you access through or alongside the Service, including a calendar app you add a private calendar link to.

15. Privacy and data protection

15.1 Our collection and use of personal information is described in our Privacy Policy, which forms part of these Terms.

15.2 Roles. For personal data of Students and Organization Members submitted to the Service by an Organization, the Organization is the controller (or business) and UnisPath is the processor (or service provider), and processes that data only on the Organization's documented instructions, which these Terms and the Privacy Policy constitute. UnisPath is the controller for account administration, billing, security, and its own website visitors.

15.3 Data processing agreement. Where applicable data protection law requires it, our data processing agreement applies and is incorporated by reference. A copy is available on request from privacy@unispath.com. It includes the terms required by Article 28 of the EU and UK GDPR, the DIFC Data Protection Law No. 5 of 2020, UAE Federal Decree-Law No. 45 of 2021, and the service provider restrictions required by the California Consumer Privacy Act.

15.4 Subprocessor changes. We will give Organizations at least 30 days' notice before adding or replacing a subprocessor that processes Customer Data. An Organization may object on reasonable data protection grounds within that period; if we cannot offer a reasonable alternative, the Organization may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees.

15.5 No sale of personal information. UnisPath does not sell or share personal information as those terms are defined under the California Consumer Privacy Act or comparable laws, and does not use Customer Data for advertising or cross-context behavioural advertising.

16. Confidentiality

16.1 Each party will protect the other's non-public information disclosed in connection with these Terms using at least reasonable care and no less care than it uses for its own confidential information, will use it only as permitted by these Terms, and will limit access to personnel and advisers who need it and are bound by confidentiality obligations.

16.2 These obligations do not apply to information that is or becomes public through no fault of the recipient, was lawfully known to the recipient without restriction before disclosure, is lawfully received from a third party without restriction, or is independently developed without use of the disclosing party's information.

16.3 A party may disclose confidential information where required by law or valid legal process, provided it gives the other party prompt notice where legally permitted and discloses only what is required.

17. Service availability and support

We aim for high availability but do not guarantee uninterrupted or error-free service unless an executed order form contains a service level agreement. Scheduled maintenance, emergency maintenance, third-party outages (including at Google Cloud, Google Meet, and Resend), and force majeure events may affect availability. We will use reasonable efforts to schedule planned maintenance outside peak hours and to give advance notice.

18. Suspension, termination, and data return

18.1 Suspension. We may suspend an account or specific access immediately where we reasonably believe it is necessary to prevent harm to the Service, to other users, or to us — including suspected fraudulent applications, misuse of the AI Features, security risk, unlawful activity, or failure to obtain required consents. We will notify you and, where the cause is capable of remedy, restore access promptly once it is remedied.

18.2 Termination. Either party may terminate a paid subscription for material breach that is not cured within 30 days of written notice. Either party may terminate immediately if the other becomes insolvent or enters liquidation. You may close a free account at any time.

18.3 Data export. Organization admins with the export permission can download an export of their Organization's students, applications and their status history, documents, messages, tasks, and notes (as a ZIP file) themselves, at any time; University Match results and anything else not in that file are provided on written request. If we terminate your access, we will, on written request made within 30 days after termination, make Customer Data available for export in a structured, commonly used, machine-readable format, or delete it, at your election.

18.4 Deletion. The Organization's Owner may delete the Organization from its settings. If the Owner deletes the Organization, access ends immediately for all of its members and Students, so download an export first. Deleting the Organization also cancels its paid plan and any add-ons at once (Section 12.4). Deleted Customer Data — whether deleted by the Owner, on your instruction, or after the 30-day window in Section 18.3 — is deactivated and held for 60 days before permanent erasure, and can be recovered by contacting support within that window, in accordance with the Privacy Policy and subject to any retention we are legally required to maintain. Database backups are purged on their ordinary 7-day rotation, and deleted document files are unrecoverable 7 days after deletion.

19. Disclaimers

To the maximum extent permitted by applicable law, the Service, including all AI-generated content, university data, document validations, and coaching feedback, is provided "as is" and "as available" without warranty of any kind, whether express, implied, statutory, or otherwise, including any implied warranty of merchantability, satisfactory quality, fitness for a particular purpose, accuracy, quiet enjoyment, or non-infringement. UnisPath does not warrant that the Service will be uninterrupted, secure, or error-free, that defects will be corrected, or that any output will be correct, complete, or current.

Nothing in this Section limits any warranty or right that cannot be excluded under the law applicable to you, including mandatory consumer protection rights.

20. Limitation of liability

20.1 Excluded losses. To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenue, lost data, business interruption, or loss of business opportunity, however caused and on any theory of liability, even if advised of the possibility.

20.2 General cap. Subject to Sections 20.3 and 20.4, each party's total aggregate liability arising out of or related to these Terms will not exceed the greater of (a) the total fees paid or payable by you to UnisPath in the 12 months preceding the first event giving rise to the claim, or (b) one thousand US dollars (USD 1,000).

20.3 Enhanced cap for data incidents. For claims arising from UnisPath's breach of Section 15 (Privacy and data protection) or Section 16 (Confidentiality), UnisPath's total aggregate liability will not exceed the greater of (a) two times the fees paid or payable by you in the 12 months preceding the first event giving rise to the claim, or (b) five thousand US dollars (USD 5,000).

20.4 Exclusions from the caps. Nothing in these Terms limits or excludes liability for: fraud or fraudulent misrepresentation; wilful misconduct; death or personal injury caused by negligence; a party's indemnification obligations under Section 21; your payment obligations; or any liability that cannot lawfully be limited or excluded.

20.5 Application. The caps in this Section apply in aggregate across all claims and causes of action; multiple claims do not enlarge them. They apply notwithstanding any failure of the essential purpose of any limited remedy. Each party acknowledges that these allocations of risk are a fundamental basis of the bargain and are reflected in the pricing of the Service.

21. Indemnification

21.1 By you. You will defend UnisPath against any third-party claim arising out of (a) Customer Data you submit to the Service, including any allegation that it infringes a third party's rights or was submitted without required consent, (b) your breach of Sections 5, 6, or 7, or (c) your violation of applicable law, and will indemnify UnisPath against damages and costs finally awarded or agreed in settlement.

21.2 By UnisPath. UnisPath will defend you against any third-party claim that the Service, as provided by us and used in accordance with these Terms, infringes that third party's intellectual property rights, and will indemnify you against damages and costs finally awarded or agreed in settlement. This obligation does not apply to claims arising from Customer Data, from modifications not made by us, or from use of the Service in combination with anything not supplied by us where the claim would have been avoided without that combination. If the Service becomes, or we reasonably believe it may become, subject to such a claim, we may at our option procure the right to continue using it, modify it to be non-infringing, or terminate the affected subscription and refund prepaid, unused fees.

21.3 Procedure. The indemnified party must promptly notify the indemnifying party of the claim, give it sole control of the defence and settlement, and provide reasonable cooperation at the indemnifying party's expense. Failure to notify promptly relieves the indemnifying party only to the extent it is materially prejudiced. No settlement that admits liability or imposes a non-monetary obligation on the indemnified party may be made without its written consent, not to be unreasonably withheld. The indemnified party may participate with its own counsel at its own expense.

22. Export control and sanctions

You represent that you are not located in, ordinarily resident in, or organised under the laws of a country or territory subject to comprehensive trade sanctions, and that you are not a person or entity designated on any applicable restricted-party list. You will not use or make the Service available in breach of applicable export control or economic sanctions laws.

23. Dispute resolution, arbitration, and class action waiver

23.1 Informal resolution first. Before commencing arbitration, the party raising a dispute will send a written notice describing it to legal@unispath.com (or, for us, to your account contact). The parties will attempt in good faith to resolve it for 30 days before either may commence arbitration.

23.2 Binding arbitration. Any dispute, controversy, or claim arising out of or in connection with these Terms, including any question regarding their existence, validity, or termination, that is not resolved under Section 23.1 will be referred to and finally resolved by arbitration administered by the Dubai International Arbitration Centre (DIAC) under its Arbitration Rules in force at the time of the request, which are deemed incorporated by reference. The seat of arbitration is the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates. The tribunal will consist of one arbitrator and the language of the arbitration will be English.

23.3 Class action and jury waiver. To the maximum extent permitted by law, disputes will be arbitrated only on an individual basis. Neither party may bring a claim as a plaintiff or class member in a class, collective, consolidated, or representative proceeding, and the arbitrator may not consolidate claims or preside over any form of representative proceeding. Where a dispute proceeds in court under Sections 23.5 or 23.6, each party waives any right to a jury trial to the extent permitted by law. If this Section 23.3 is found unenforceable as to a particular claim, that claim will be severed and heard in court under Section 24, and the remainder of this Section 23 continues to apply.

23.4 Costs. Where you are an individual consumer and your claim is for less than USD 10,000, UnisPath will pay the arbitration filing and administrative fees, unless the arbitrator determines the claim was frivolous.

23.5 Exceptions. This Section does not prevent either party from (a) bringing an individual claim in a small-claims or equivalent court where it qualifies, or (b) seeking urgent injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property, confidential information, or data security.

23.6 Consumers in the EU, UK, and elsewhere. If you are a consumer resident in the European Union, the United Kingdom, or another jurisdiction whose law makes a pre-dispute arbitration agreement or forum selection unenforceable against you, Sections 23.2 and 23.3 do not apply to you, you keep the benefit of the mandatory consumer protection provisions of your country of residence, and you may bring proceedings in the courts of your place of residence.

23.7 30-day opt-out. You may opt out of Sections 23.2 and 23.3 by sending written notice to legal@unispath.com with your name, account email, and a clear statement that you opt out of arbitration, within 30 days of first accepting these Terms. Opting out does not affect any other part of these Terms and will not disadvantage your use of the Service.

23.8 Time limit. To the extent permitted by law, any claim must be brought within one year after it arises or be permanently barred.

24. Governing law and jurisdiction

These Terms and any non-contractual obligations arising out of or in connection with them are governed by the laws of the Dubai International Financial Centre (DIFC), United Arab Emirates, without regard to conflict-of-laws principles. Subject to Section 23, the DIFC Courts have exclusive jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply. Nothing in this Section deprives a consumer of the protection of mandatory provisions of the law of their country of residence.

25. Changes to these Terms

25.1 We may update these Terms. We will notify account holders of material changes through the Service or by email at least 30 days before they take effect, will update the "last updated" date above, and will ask you to accept the new version the next time you sign in. Until paid plans are offered (Section 12.0), changes take effect on the date shown above, and we ask you to accept them at your next sign-in.

25.2 Paid subscriptions. Material changes that are adverse to a paying customer take effect at the start of that customer's next renewal term, not during a term already paid for. If you do not accept them, you may decline to renew.

25.3 Free accounts. For accounts not under a paid subscription, continued use after the effective date constitutes acceptance. If you do not accept the changes, stop using the Service and close your account before that date.

25.4 Changes never apply retroactively to a dispute of which we had notice before the change took effect.

26. General

26.1 Entire agreement. These Terms, together with the Privacy Policy and any executed order form or data processing agreement, are the entire agreement between the parties on this subject and supersede all prior discussions and representations, except for fraud.

26.2 Severability. If any provision is held unenforceable, it will be modified to the minimum extent necessary to make it enforceable, or severed, and the rest remains in force.

26.3 Waiver. No failure or delay in exercising a right is a waiver of it, and no single or partial exercise prevents further exercise.

26.4 Assignment. Neither party may assign these Terms without the other's written consent, except that either may assign them in full to a successor in connection with a merger, acquisition, or sale of substantially all assets, on written notice. Any other attempted assignment is void.

26.5 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disasters, war, terrorism, civil unrest, epidemic, labour disputes, governmental action, internet or utility failures, and failures of third-party infrastructure providers. This does not excuse payment obligations for the Service already provided.

26.6 Notices. Notices to you may be given by email to your account address or through the Service, and are deemed received when sent. Notices to us must be sent to legal@unispath.com and, for formal legal notices, also to [registered address, Dubai, United Arab Emirates].

26.7 Survival. Sections 2, 8.1, 8.3, 8.4, 10, 13, 16, 18.3, 18.4, 19, 20, 21, 22, 23, 24, and 26 survive termination or expiry.

26.8 No third-party beneficiaries. These Terms do not confer rights on any person who is not a party to them, except that UnisPath's affiliates may enforce Sections 19, 20, and 21.

26.9 Language. These Terms are drafted in English. Any translation is provided for convenience only, and the English version governs in the event of conflict.

27. Contact

Questions about these Terms can be sent to legal@unispath.com, general support enquiries to support@unispath.com, or through our contact page. Our postal address is [UnisPath registered legal name], [registered address, Dubai, United Arab Emirates].