Privacy policy

Last updated: 10 August 2026. UniChapter is operated from Germany and follows the EU General Data Protection Regulation (GDPR).

Controller

Loistava Holding UG (haftungsbeschränkt), Asternring 9, 15732 Schulzendorf, Germany. Contact: [email protected].

Analytics — no cookies, nothing stored on your device

We measure page views and visit counts with PostHog (EU-hosted) in a cookieless mode: no cookies, no localStorage, no persistent identifier — nothing is written to your device. Each page view uses an ephemeral in-memory identifier that disappears when you leave. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in understanding aggregate site usage. Because no information is stored on or read from your device, no consent banner is required for this measurement.

The “Get matched” and partner forms

When you submit a form, we store exactly what you enter (name, email, optional phone, and your study or business intent) in our database (Supabase, hosted in Frankfurt, EU). Legal basis: your explicit consent (Art. 6(1)(a)), which the form requires. We use it to respond to your request and — only if your request asks for it — to connect you with vetted application-support partners or, for partner inquiries, to set up lead delivery. We never sell student data beyond what the request explicitly covers, and search results are never influenced by it.

The AI advisor

The advisor form does not ask for your name or email. The profile you enter (country, study level, subject, budget band, intake, and your free-text description) is sent to an AI language-model API to generate the analysis: OpenAI (USA; certified under the EU-US Data Privacy Framework; API data is not used for model training) or, as fallback, DeepSeek (processed outside the EU). Please do not include names, contact details, or other personal identifiers in the free-text field — the analysis does not need them. Legal basis: performance of the requested service (Art. 6(1)(b)). Advisor inputs are not linked to any account.

Accounts

If you create an account (magic-link sign-in), we store your email address and your saved programs/application tracker in Supabase (EU-Frankfurt). Legal basis: performance of the service you signed up for (Art. 6(1)(b)). Delete your account any time by emailing us.

Processors

Supabase (database & auth, EU-Frankfurt), Vercel (hosting; EU-US Data Privacy Framework), Cloudflare (DNS and content delivery; processes IP addresses to serve the site), PostHog EU (analytics), OpenAI and DeepSeek (AI advisor, see above), Resend and ImprovMX (email delivery and forwarding). Each processes data under GDPR-compliant terms.

Retention

Form submissions: up to 24 months after last contact, then deleted. Advisor inputs are processed transiently and not stored with identifiers. Aggregate analytics contain no personal identifiers.

Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time — email [email protected] or use the form below, which sends a receipt confirmation immediately. You may lodge a complaint with a supervisory authority — for Brandenburg, the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht (lda.brandenburg.de); you may also contact the authority of your own EU member state.