Privacy Policy

Apply U UK ("Apply U", "we", "our" or "us") is committed to protecting your privacy and personal information. Apply U UK is the data controller responsible for your personal information under this Privacy Policy. Our registered address is 128 City Road, London, United Kingdom, EC1V 2NX. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered university application assistance platform.

We are committed to complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions or concerns about this Privacy Policy or our data practices, you can contact us at service@apply-u.com.

Personal Information

We collect personal information that you voluntarily provide to us when you:

• Create an account (name, email address, password)
• Use our services and communicate with us
• Provide educational background and academic goals
• Upload documents such as CVs, personal statements, and application materials
• Set preferences for university programs and application assistance

Usage Information

We automatically collect certain information about your device and how you interact with our platform:

• Pages visited, features used, and time spent on our platform
• Device type, operating system, browser type and version
• General location information based on IP address
• Information collected through cookies and similar tracking technologies

Technical Information

We collect technical information to provide and improve our AI-powered services, including interaction data with our AI systems and document analysis results. We do not use your personal information or identifiable application materials to train our own models. We may use anonymised or aggregated data generated through your use of the Service to monitor performance, ensure quality and improve our AI tools.

Special Categories of Personal Data

In some cases, you may choose to provide information about your health, disability, ethnicity, financial circumstances or other details that qualify as "special category data" under data protection law (for example, when explaining mitigating circumstances in an application). We only process such information where you have given your explicit consent or where another lawful basis applies, and we apply additional safeguards to protect it. Where possible, please avoid including highly sensitive information unless it is necessary for the services you request.

We use the information we collect for the following purposes:

• Provide, operate, and maintain our university application assistance services
• Personalize your experience and provide tailored recommendations
• Communicate with you about our services, updates, and support
• Improve our platform, develop new features, and enhance our AI capabilities using aggregated or anonymised data where appropriate
• Protect against fraud, unauthorized access, and security threats
• Comply with legal obligations and enforce our terms of service
• Send you marketing communications about our services by email (with your consent where required or, where permitted, based on our legitimate interests), and allow you to opt out at any time

Legal Bases for Processing

We only process your personal information where we have a valid legal basis under data protection laws, including:

• Performance of a contract: where processing is necessary to provide, operate and maintain the Service you have requested.
• Legitimate interests: for example, to improve and secure our Service, prevent fraud and abuse, and communicate with you about similar services, provided that your interests and fundamental rights do not override these interests.
• Consent: for certain activities such as optional marketing communications and the use of non-essential cookies or similar technologies. You can withdraw your consent at any time.
• Legal obligations: to comply with applicable laws, regulations, court orders or requests from competent authorities.

Use of AI and Automated Processing

We use artificial intelligence ("AI") tools to analyse your documents and provide suggestions, recommendations and other assistance. We do not use your personal information or identifiable application materials to train our own models. We may use interaction data and anonymised or aggregated versions of your content to maintain and improve the quality, safety and performance of our AI-powered features. We do not use your identifiable personal information to make solely automated decisions that have legal or similarly significant effects on you.

You can opt out of marketing emails at any time by clicking the "unsubscribe" link in those emails or by contacting us. Even if you opt out of marketing, we may still send you service-related communications (such as security alerts or transactional messages).

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances and always under appropriate safeguards:

• With your explicit consent or at your direction
• With trusted third-party service providers who help us operate our platform, such as cloud hosting and storage providers, AI service or language model providers, analytics providers, payment processors, and email and communication tools. These providers act as our processors, may only process your personal information on our instructions and are bound by contractual and confidentiality obligations.
• When required by law, court order, or to protect our rights and safety
• In connection with a merger, acquisition, or sale of assets (with notice to you)
• With university partners or educational institutions (only with your explicit consent and for application purposes)

We implement robust security measures to protect your personal information:

• Data encryption in transit and at rest using industry-standard protocols
• Strict access controls and authentication for our systems and staff
• Regular security monitoring and vulnerability assessments
• Secure cloud infrastructure with enterprise-grade security features

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay and, where required, notify the relevant supervisory authority (such as the Information Commissioner's Office in the UK) in accordance with our legal obligations (normally within 72 hours of becoming aware of the breach).

Under applicable data protection laws (including the UK GDPR), you have the following rights regarding your personal information:

• Right to access: Request copies of your personal information
• Right to rectification: Request correction of inaccurate or incomplete information
• Right to erasure: Request deletion of your personal information
• Right to restrict processing: Request limitation of processing in certain circumstances
• Right to data portability: Request transfer of your data in a structured format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for processing where applicable

To exercise any of these rights, please contact us using the information provided in the 'Contact Us' section. We will respond to your request within the timeframes required by applicable law. You also have the right to lodge a complaint with your local data protection authority if you are unhappy with how we handle your personal information. In the UK, this is the Information Commissioner's Office (ICO).

At present we do not make decisions about you that are based solely on automated processing (including profiling) which produce legal or similarly significant effects for you. If we introduce such decision-making in the future, we will inform you separately and ensure that you can obtain human review, express your point of view and contest the decision.

We use cookies and similar tracking technologies to enhance your experience on our platform, to understand how our Service is used and, with your consent where required, to support analytics and marketing by us and our third-party partners:

Types of Cookies We Use:

• Essential cookies: Required for basic platform functionality
• Functional cookies: Remember your preferences and settings
• Analytics cookies: Help us understand how you use our platform
• Marketing cookies: Used for targeted advertising (with your consent)

You can control cookies through your browser settings and, where available, through our cookie banner or preference centre, which allows you to choose whether to accept analytics and marketing cookies. Disabling certain cookies may limit some functionality of our platform.

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. In general, we keep: (i) basic account information for as long as your account is active and for up to six (6) years after it is closed; (ii) security and usage logs for up to twenty-four (24) months; and (iii) application materials and documents you upload for as long as your account is active and typically for no longer than twelve (12) months after you delete them or close your account, unless we need to retain them for longer to comply with legal obligations or to resolve disputes. Our retention periods are based on:

• The purpose for which we collected the information
• Legal requirements and obligations
• Our legitimate business interests
• The scope of your consent (where applicable)

Your information may be transferred to and processed in countries other than your country of residence. Some of our service providers are located outside the United Kingdom and the European Economic Area (EEA), including in the United States, where they provide cloud hosting, AI processing, analytics and communication services on our behalf.

Where we transfer your personal information outside the UK/EEA, we ensure an adequate level of protection by using appropriate safeguards such as standard contractual clauses approved under UK and EU data protection laws, relying on adequacy regulations or decisions where available, or using other lawful transfer mechanisms.

Our services are intended for individuals who are at least 18 years old. If you are under 18, you may only use the Service with the consent and ongoing supervision of a parent or legal guardian, who will be responsible for your use of the Service. We do not knowingly collect personal information from children under 18 in circumstances where we are unable to verify that such consent has been provided.

If we discover that we have collected personal information from a child in a way that does not comply with these requirements, we will delete such information without undue delay and may take steps to disable the related account.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

We will notify you of any material changes by posting the updated Privacy Policy on our platform and updating the 'Last Updated' date. We encourage you to review this Privacy Policy periodically.