Privacy Policy

FindUniPath (the website at findunipath.com and the web app at app.findunipath.com) is run by the Aseel Team. We are responsible for the personal data described in this policy. You can reach us at any time at [email protected].

If you are an education consultant and add your clients to FindUniPath, you decide what information you store about them. For that information you are responsible for having a lawful basis and informing your clients, and we process it on your behalf.

We only collect what we need to run the service:

• Account details — your email address, name and plan. Your password is handled by our authentication provider and stored only as a secure hash; we never see it.
• Preferences — your home country, up to three preferred destination countries, applicant type and whether you want email alerts. We use them to show the right universities and entry requirements.
• Applicant records (consultant accounts) — names, passport country, status, target countries and universities and notes that you enter. Please don't store sensitive data such as passport numbers, health information or financial details in notes.
• Watchlist and deadline alerts — the universities you follow and how many days before a deadline you want to be reminded.
• Contact form messages — your name, email, topic and message, plus your browser type and a one-way hashed form of your IP address that we use only to block spam. We do not store your raw IP address.
• Technical logs — our hosting and database providers keep short-lived server logs (such as IP address, time and requested page) for security and reliability.

• We don't sell or rent your personal data.
• We don't use advertising trackers, and findunipath.com sets no analytics or marketing cookies.
• We don't send your personal data to AI models. Our AI tools read public university and government websites to keep admission information up to date.

The marketing site and blog at findunipath.com don't set cookies. The app at app.findunipath.com uses strictly necessary cookies to keep you signed in securely; they are required for the app to work and are not used for tracking.

To display fonts, pages load font files from Google Fonts and the jsDelivr CDN. Like any web request, these providers receive your IP address and browser information when the files are downloaded.

• To provide the service you signed up for — your account, preferences, applicants, watchlist and alerts (performance of a contract).
• To answer your messages and provide support (our legitimate interest in replying, or steps you asked for before entering a contract).
• To keep the service secure — preventing abuse, spam and fraud (legitimate interest).
• To send emails you asked for, such as deadline alerts, which you can switch off in Settings (consent / contract).
• To meet legal obligations where they apply.

The legal bases in brackets apply where data-protection laws such as the EU/UK GDPR apply to you.

We use a small number of trusted providers who process data on our behalf, under contracts that require them to protect it:

• Supabase — database and sign-in (accounts, preferences, applicants, alerts, contact messages).
• Vercel — hosting for findunipath.com and app.findunipath.com.
• Cloudflare — domain name and DNS.
• Resend — delivering contact form messages and service emails.
• Google Fonts and jsDelivr — font files.

Some of these providers process data outside your country, including in the United States. Where required, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

• Account data, preferences, applicants and alerts — while your account exists. When you delete your account in Settings, these are permanently deleted.
• Contact form messages — up to 24 months, then deleted, unless the conversation is still ongoing.
• Backups and server logs — kept only for the limited periods set by our providers, then overwritten.

All traffic is encrypted with HTTPS. Database access is restricted with row-level security so each account can only reach its own data, admin keys are kept server-side only, and access to production systems is limited to the people who need it. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a breach where the law requires it.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data — most of it you can edit yourself in Settings;
• delete your data — use Settings → Delete account, or ask us;
• object to or restrict certain processing, and withdraw consent at any time;
• receive your data in a portable format;
• complain to your local data-protection authority.

To exercise any of these rights, email [email protected] or use the contact form (topic “Privacy & my data”). We may need to confirm your identity and will reply within one month.

FindUniPath is meant for people aged 16 and over. Younger students should use it together with a parent, guardian or adviser. If you believe a child has given us personal data without permission, contact us and we will delete it.

If we change this policy we will update the date at the top of this page. For significant changes we will also tell signed-in users in the app or by email before they take effect.