Privacy Policy
Version 1.0. Effective date: 28 October 2026.
This policy explains what personal data UniPortal collects, why, who receives it, how long we keep it, and your rights. It applies to https://uniportal.io and to anyone whose data we process, including people who are not users (section 3).
1. Who we are
UniPortal is run by a team of five individuals studying at Trinity College Dublin. We operate together as an unincorporated team. We decide together how and why UniPortal processes personal data. This makes us joint controllers under the General Data Protection Regulation (GDPR):
- Adam Bandyk
- George Adadi
- Kashmala Aamir
- Robin Schulz
- Vlad Postolachi
How we share responsibility. We have agreed amongst ourselves that the team acts as one controller. All privacy questions and requests go to one contact point, and we handle them together. You can still exercise your rights against any one of us.
Contact. Email team@uniportal.io, or write to UniPortal, c/o Trinity College Dublin, College Green, Dublin 2, D02 PN40, Ireland. We use this postal address only for correspondence. Trinity College Dublin is not a controller of UniPortal data, and no university receives your data from us.
We have not appointed a Data Protection Officer, because the law does not require one for our processing. Our supervisory authority is the Irish Data Protection Commission.
2. What we collect and why
We collect most data from you directly. Some data is created automatically when you use UniPortal. The table lists each activity and the lawful basis that we rely on under Article 6(1) GDPR.
| Activity | Personal data | Why we use it | Lawful basis |
|---|---|---|---|
| Creating and signing in to your account | Name, email address, encrypted password, sign-in session, "Remember me" choice, marketing email choice, password reset requests. | To create and secure your account, sign you in, and reset your password by email. To optionally send you emails about news of our Service. | Contract: needed to provide the Service you signed up for. Consent: marketing emails. |
| Your exchange profile | Home institution and department, subject area, study cycle, exchange start and end dates, languages and level. | To show partner institutions, checklists and deadlines that fit you, and to check whether you can write a review. | Contract. |
| Planning tools | Saved institutions and their order, checklist progress, chosen host institution, "notify me" requests, in-app notifications, notification settings. | To run your dashboard, checklist and notifications inbox. | Contract. |
| Deadline alert emails | Email address, name, task names and deadlines. | To remind you of deadlines and tell you when a deadline changes. These are on by default; switch them off in Settings → Notifications. | Contract. |
| Recommendations | Your exchange profile, and other users' reviews in combined form. | To suggest partner institutions (see section 9). | Contract. |
| Reviews | Review title, text and ratings, your name, home institution, subject area, exchange period, date posted. | To publish your review publicly. After you delete your account, to keep the review without your name. | Contract. After account deletion: legitimate interests (keeping honest reviews available to future students). |
| Shared shortlists | Your name, saved institutions, a random link code. | To show the public shortlist page that you asked us to create. | Contract. |
| Page feedback | Issue type, page section, your explanation and correction, page address, whether you were signed in, your email address, up to 3 screenshots. | To correct wrong information and email you when it is fixed. | Legitimate interests (keeping institution information accurate). |
| Suggesting an institution | Institution name, address, map pin and website. If you tick "I work here": your role, work email and phone number. Your account, if you are signed in. | To add missing institutions, and to contact you to confirm a claim. | Legitimate interests (completing and checking our institution list). |
| Browsing without an account | The names of up to two institution profiles that you opened in the last 24 hours, stored in your browser. | To apply the limit of two profiles for visitors without an account. | Legitimate interests (offering free access while asking regular users to sign up). |
| Product analytics (optional) | Events about the features that you use (for example "profile viewed", counts and settings, but not search text, names or emails), random identifiers, your account ID once you sign in, browser and device type, IP address. | To learn which features help students, and to improve them. | Consent. You can withdraw it at any time. |
| Browser diagnostics (optional) | A random session ID, browser type, app version, errors, sampled page-speed data with web addresses cleaned, IP address. | To find and fix errors in the app. | Consent. |
| Maps (optional) | IP address, browser data, the map area that you view (sent by your browser to Google). | To show maps of institutions. | Consent. |
| Security, error monitoring and logs | IP address, browser, pages requested and times (server logs); error reports from our servers, with user details, cookies and form contents removed; bot-check signals when you open the feedback form. | To keep UniPortal secure, prevent abuse and fix faults. | Legitimate interests (security and reliability of the Service). |
| Home-page globe image | IP address and browser data, sent by your browser when the home page loads. | To display the globe image, which we load from Wikimedia and unpkg (with jsDelivr as a back-up). | Legitimate interests (displaying the page). |
| Legal and safety | Any of the data above, where needed. | To handle content reports, answer lawful requests from authorities, keep records that we honoured your requests, and establish or defend legal claims. | Legal obligation; legitimate interests. |
Required data. You must give your name, email address and password to create an account. You must complete your exchange profile to use the personalised features. Everything else is optional.
Legitimate interests. Where we rely on legitimate interests, we have checked that our interest is not outweighed by your rights. We keep the data to what we need. You can object at any time (section 7).
Marketing. We send marketing emails if you give your consent at sign up. You may withdraw your consent by accessing Settings → Notifications.
What we do not do. We do not sell your data. We do not use it for advertising. We do not share it with your home or host university. We do not ask for special category data (such as health or religion). Please do not include it in reviews or feedback.
3. Information about people who are not users
Some personal data on UniPortal is about people who did not give it to us. This section is for them.
| Who | What data | Where it comes from | Why and lawful basis |
|---|---|---|---|
| University staff | Work email addresses (mostly office mailboxes, sometimes a named person's) that appear in institution descriptions. | The institution's own public web pages. | To help students contact the right office. Legitimate interests. |
| A person named in an institution suggestion | Role, work email, phone number. | The person who submitted the suggestion, who says that they work at the institution. | To check the suggestion. Legitimate interests. |
| People mentioned in reviews or feedback | Whatever the author wrote or showed in a screenshot. | The review or feedback author. | To publish reviews, and to fix reported issues. Reviews must not name other people. Legitimate interests. |
| People in institution photos | Their image, if they appear. | Institutions' photos and photo libraries. | To show what an institution looks like. Legitimate interests. |
If any of this data is about you, you have the same rights as users (section 7). In particular, you can object, and we will remove your details unless we have a compelling reason to keep them. Email team@uniportal.io with a link to the page.
4. Who receives your data
Service providers. These companies process data for us, only on our instructions, under data processing agreements:
| Provider | What it does for us | Data it receives | Where data is processed |
|---|---|---|---|
| Oracle | Hosts the UniPortal servers and server logs | All data sent to and from UniPortal | United Kingdom |
| Supabase, Inc. | Database and image storage | Account, profile, planning, review, suggestion and deletion-request data | European Union |
| Resend, Inc. | Sends our emails | Email address, name and email content (such as reset links and deadlines) | European Union |
| PostHog, Inc. | Product analytics, only with your consent | Analytics data (section 2) | European Union |
| Functional Software, Inc. | Error and performance monitoring | Diagnostics and error reports (section 2) | European Union |
| Atlassian | Stores page feedback for our team | Page feedback, including your email and screenshots | Global network, including the European Union |
| Cloudflare, Inc. | Checks that the feedback form is sent by a person | IP address, browser and device signals | Global network, including the United States |
Other organisations that receive data from your browser. When your browser loads their content, these organisations receive your IP address and browser data directly. They use it under their own privacy policies, as independent controllers:
- Google, for maps, only if you allow external media (Google Privacy Policy);
- Wikimedia Foundation, unpkg and jsDelivr, for the globe image on the home page (Wikimedia privacy policy).
Members of the public. Reviews, and the shortlists that you choose to share, are public (see section 2).
Others, only when needed. We may share data with professional advisers who must keep it confidential, with the Gardaí, courts or regulators when the law requires it or to protect someone's safety, or with a company that we set up to run UniPortal (we will tell you first).
5. International transfers
Some of our providers process data outside the European Economic Area (EEA), or are US companies that may access EU-stored data, for example to give technical support. We use these safeguards:
- United Kingdom: the European Commission has decided that the UK protects personal data adequately. This decision was renewed in December 2025 and runs until 27 December 2031.
- United States: we rely on the EU–US Data Privacy Framework for providers that are certified under it. For all other US transfers, we rely on the European Commission's Standard Contractual Clauses in the provider's data processing agreement.
To get a copy of the relevant safeguards, email team@uniportal.io.
6. How long we keep data
We keep data only for as long as we need it for the purposes in section 2.
| Data | How long we keep it |
|---|---|
| Account, exchange profile, saved institutions, checklist, notifications and settings | Until you delete your account. |
| Password reset links | Each link expires after 30 minutes. The secured record is deleted with your account. |
| Reviews | Until you delete your review, or we remove it for breaking our Terms. After you delete your account, we keep it without your name (section 8). |
| Shared shortlist link | Until we switch it off at your request, or you delete your account. |
| Page feedback, including screenshots | 12 months after we close the issue. |
| Institution suggestions, including claim contact details | 12 months after you submit them. |
| Record that we deleted an account (former account ID, analytics ID, status and dates, but no name or email) | 2 years after the deletion completes, as evidence that we honoured the request. |
| Product analytics (PostHog) | 12 months after collection, or until we delete it after you delete your account. |
| Diagnostics and error reports (Sentry) | 30 days. |
| Server application logs | 30 days. |
| Web server access logs | 30 days. |
| Records of emails that we sent (Resend) | 30 days. |
| Your cookie choice | 180 days in your browser, then we ask you again. |
The Cookie Policy lists how long each item stays in your browser.
7. Your rights
Under the GDPR, you have the right to:
- access your data and get a copy of it;
- correct inaccurate data;
- delete your data;
- restrict how we use your data, in some cases;
- object to processing that we base on legitimate interests;
- data portability: get the data that you gave us in a machine-readable format;
- withdraw consent at any time, without affecting processing that took place before.
| What you want to do | How |
|---|---|
| Change your name or exchange profile | Settings |
| Change your email address | Email team@uniportal.io |
| Stop deadline alert emails | Settings → Notifications |
| Change your cookie and analytics choices | Settings → Cookies & Privacy, or the cookie settings button |
| Delete your account | Settings → Delete account (see section 8) |
| Remove or correct a review | Your review → Three-dot icon button → Delete / Edit |
| Get a copy of your data, or use any other right | Email team@uniportal.io |
When you email us. Please write from the email address of your account, so that we can confirm that the request is yours. If we need more information to confirm who you are, we will ask. Requests are free. We reply within one month. If a request is complex, we may need up to two more months; we will tell you if so.
Emails about an account you did not create. We do not currently confirm email addresses at sign-up. If you receive UniPortal emails that you did not ask for, tell us and we will delete the account.
Complaints. If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Irish Data Protection Commission (dataprotection.ie, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland), or to the data protection authority in the EU country where you live or work.
8. Deleting your account
Go to Settings → Delete account and confirm. This is permanent.
Deleted at once: your account, email, name, password, exchange profile, languages, saved institutions, checklist progress, "notify me" requests, notifications, settings and password reset records. You are signed out on all devices.
Deleted soon after: we automatically ask PostHog to delete your analytics data. Our system sends the request within about 15 minutes. PostHog can take some time to complete the deletion.
What stays, and for how long:
- Your reviews stay public as "Anonymous", with your home institution, subject area and exchange period. People who know you may still recognise you. Ask us to remove them if you prefer.
- Institution suggestions that you sent stay, but no longer link to your account. Any claim contact details stay for the period in section 6.
- Page feedback stays in our feedback tool for the period in section 6.
- A deletion record without your name or email stays for 2 years, as evidence that we deleted your account.
- Logs, diagnostics, email records and backups keep traces until they expire (section 6).
- Your browser keeps items such as your cookie choice until they expire or you clear them (see our Cookie Policy).
9. Recommendations and automated processing
UniPortal recommends partner institutions by using your exchange profile. This is a form of profiling. It works like this:
- We only consider institutions that have an exchange agreement with your home institution or department.
- We give each institution points for how well it fits you. The fit criteria are as follows: your subject area, your study cycle, its teaching language, your language level, and your exchange dates. Subject area counts most, and exchange dates count least.
- We may label an institution "Alumni pick" if students from your home institution, in your subject area or department, reviewed it well.
- You can sort the list in other ways.
Recommendations are fixed rules that run on our server. They do not use artificial intelligence. They are suggestions only, without deciding anything about you. Your universities make all nomination and admission decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
AI and your data. We do not send your personal data to any AI service. Our team used an AI language model to help draft institution descriptions from institutions' public web pages, fact sheets. That process did not use user data.
10. Age, security and changes
Age. UniPortal is for people aged 16 or older. We do not knowingly collect data from anyone under 16. If we learn that an account belongs to someone under 16, we delete it. If you think that a child under 16 uses UniPortal, email team@uniportal.io.
Security. We protect your data with encrypted connections (HTTPS), passwords stored only as secure hashes, encrypted sign-in cookies, and logs that remove personal details. Only team members who need access to run UniPortal can access production data. No system is completely secure. If a breach puts your rights at high risk, we will tell you without undue delay, and we will report breaches to the Data Protection Commission as the law requires.
Changes to this policy. We update this policy when our processing changes. Each version shows its effective date at the top. If a change is significant, we tell account holders by email or in the app before it takes effect.
Questions. Email team@uniportal.io.