Privacy policy

Last updated: 18 October 2026. UniChapter is operated from Germany and follows the EU General Data Protection Regulation (GDPR).

Controller

Loistava Holding UG (haftungsbeschränkt), Asternring 9, 15732 Schulzendorf, Germany. Contact: hello@unichapter.com.

Analytics — no cookies, nothing stored on your device

We measure page views and visit counts with PostHog (EU-hosted) in a cookieless mode: no cookies, no localStorage, no persistent identifier — nothing is written to your device. Each page view uses an ephemeral in-memory identifier that disappears when you leave. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in understanding aggregate site usage. Because no information is stored on or read from your device, no consent banner is required for this measurement.

The “Get matched” and partner forms

When you submit a form, we store exactly what you enter (name, email, optional phone, and your study or business intent) in our database (our own database server at Hetzner in Helsinki, Finland, EU). Legal basis: your explicit consent (Art. 6(1)(a)), which the form requires. We use it to respond to your request and — only if your request asks for it — to connect you with vetted application-support partners or, for partner inquiries, to set up lead delivery. We never sell student data beyond what the request explicitly covers, and search results are never influenced by it.

Your study plan and “Apply for me”

The study plan sends the profile you enter (passport country, level, field, budget, English score, grades and any notes) to an AI model to write your plan; it is not stored unless you then ask us to apply for you. If you do, we store that profile with your name, email and optional WhatsApp number, on the basis of your explicit consent (Art. 6(1)(a)). With that consent we create an application profile for you with our application partner (ApplyBoard Inc., Canada) and share your details and documents with the schools you choose to apply to. Transfers to Canada rely on the EU adequacy decision for Canada; schools outside the EU receive your data because you asked us to apply there (Art. 49(1)(b)). You can withdraw consent at any time by writing to hello@unichapter.com.

The AI advisor

The advisor form does not ask for your name or email. The profile you enter (country, study level, subject, budget band, intake, and your free-text description) is sent to an AI language-model API to generate the analysis: OpenAI (USA; certified under the EU-US Data Privacy Framework; API data is not used for model training) or, as fallback, DeepSeek (processed outside the EU). Please do not include names, contact details, or other personal identifiers in the free-text field — the analysis does not need them. Legal basis: performance of the requested service (Art. 6(1)(b)). Advisor inputs are not linked to any account.

Accounts

If you create an account (magic-link sign-in), we store your email address and your saved programs/application tracker in Supabase (EU-Frankfurt). Legal basis: performance of the service you signed up for (Art. 6(1)(b)). Delete your account any time by emailing us.

Processors

Supabase (database & auth, EU-Frankfurt), Vercel (hosting; EU-US Data Privacy Framework), Cloudflare (DNS and content delivery; processes IP addresses to serve the site), PostHog EU (analytics), OpenAI and DeepSeek (AI advisor, see above), Resend and ImprovMX (email delivery and forwarding). Each processes data under GDPR-compliant terms.

Emails we send to account holders

If you have an account, we occasionally email you about the German application calendar — most importantly when a deadline on a program you shortlisted is approaching. To make those emails specific rather than generic, we record which program and guide pages you open while signed in, and infer a subject area from them. Legal basis: our legitimate interest in providing a useful service to people who asked for one (Art. 6(1)(f)). Every email carries one-click unsubscribe and a preferences page where you can slow these down, choose your own subject area, pause them, or stop them entirely — without losing your account or your shortlist. Signed-out visits and crawlers are never recorded this way.

Retention

Form submissions: up to 24 months after last contact, then deleted. Browsing signals used to personalise emails: 90 days. The emails we send you, including their contents: 24 months. Both of those limits are enforced automatically on every daily run, not only stated here. Advisor inputs are processed transiently and not stored with identifiers. Aggregate analytics contain no personal identifiers.

Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time — email hello@unichapter.com or use the form below, which sends a receipt confirmation immediately. You may lodge a complaint with a supervisory authority — for Brandenburg, the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht (lda.brandenburg.de); you may also contact the authority of your own EU member state.