Privacy Policy

1. Introduction

UniPilot AI ("UniPilot," "we," "us," or "our") operates the website unipilotai.com and related services (collectively, the "Service"), an AI-powered platform that helps international students discover universities, manage application checklists, and prepare for visa and admission processes for destinations including Canada, the United States, Australia, Germany, and China.

This Privacy Policy explains what personal information we collect, how we use and share it, the choices you have, and the rights you can exercise. It applies to all users of the Service worldwide. By using the Service, you agree to this Privacy Policy.

If you have questions, contact us at privacy@unipilotai.com.

2. Information We Collect

We collect the following categories of information:

2.1 Information you provide directly

• Account information: When you sign up, we collect your name, email address, and (if you choose email/password sign-up) a hashed password. We never store passwords in plain text.
• Profile information: Optional details you provide about your academic background, target countries, target intake, language proficiency, and application goals.
• Communications: Messages you send through our contact form, WhatsApp, or email, including any documents or screenshots you attach.

2.2 Information from Google Sign-In

If you sign in with Google, we receive your name, email address, Google account ID, and profile picture from Google's OAuth service. We request only the basic email, profile, and openid scopes. We do not access your Gmail, Google Drive, Calendar, or any other Google service data.

2.3 Information collected automatically

• Device and log data: IP address, browser type and version, operating system, referring URL, pages visited, timestamps, and approximate location derived from IP address.
• Usage data: Actions you take in the Service, such as universities saved, checklists completed, and features used. This helps us improve product quality.
• Cookies and similar technologies: See Section 8 below.

3. How We Use Your Information

We use personal information for the following purposes:

• To create and manage your account and authenticate you securely.
• To provide the core Service: surfacing universities, generating personalized checklists, simulating interviews, and tracking application progress.
• To send transactional emails (magic-link sign-in, password resets, deadline reminders, and account notifications) via our email provider, Resend.
• To respond to your support requests and communications through the contact form, email, or WhatsApp.
• To analyze usage and improve the Service, including diagnosing technical issues and building new features.
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• To comply with legal obligations and enforce our Terms of Service.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information under the following legal bases:

• Performance of a contract: To provide the Service you signed up for.
• Consent: Where required, such as for optional marketing communications. You may withdraw consent at any time.
• Legitimate interests: To operate, secure, and improve the Service, provided these interests do not override your rights.
• Legal obligations: To comply with applicable laws and respond to lawful requests.

5. How We Share Your Information

We do not sell your personal information to anyone. We share information only as described below.

5.1 Service providers

We share data with third-party service providers that help us operate the Service. These providers are contractually bound to use your data only to provide services to us and to protect it appropriately:

• Supabase — authentication, database, and storage. Data is stored in Supabase's managed infrastructure. Supabase Privacy Policy.
• Netlify — website hosting and edge delivery. Netlify Privacy Policy.
• Google — OAuth sign-in (only if you choose to sign in with Google). Google Privacy Policy.
• Resend — transactional email delivery. Resend Privacy Policy.

5.2 Legal requirements

We may disclose your information if required by law, subpoena, court order, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, or to investigate fraud or security issues.

5.3 Business transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

6. International Data Transfers

UniPilot AI is operated from Pakistan. Our service providers (Supabase, Netlify, Google, Resend) may store and process your data in the United States, the European Union, and other regions. When we transfer personal information from the EEA, UK, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

7. Data Retention

We retain your account and profile information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Typical retention periods:

• Account information: until you delete your account, plus up to 30 days.
• Backup snapshots: up to 90 days after deletion, after which they are permanently purged.
• Server logs: up to 12 months.
• Support communications: up to 3 years.

8. Cookies and Similar Technologies

We use a limited number of cookies and similar technologies:

• Authentication cookies: To keep you signed in across sessions. These are strictly necessary and cannot be disabled without breaking the sign-in flow.
• Preference cookies: To remember your theme (light/dark) and locale choices.
• Analytics: We may use privacy-respecting analytics to understand aggregate usage patterns. We do not use third-party advertising cookies.

You can control cookies through your browser settings. Disabling authentication cookies will prevent you from staying signed in.

9. Your Rights and Choices

Subject to applicable law, you have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — update inaccurate or incomplete information.
• Deletion — request that we delete your account and associated personal data.
• Portability — receive your personal data in a structured, machine-readable format.
• Restriction and objection — restrict or object to certain types of processing.
• Withdraw consent — withdraw consent at any time where processing is based on consent.
• Complaint — lodge a complaint with your local data protection authority. EEA residents may also contact the supervisory authority of the EU member state in which they reside.

To exercise any of these rights, email privacy@unipilotai.com from the email address associated with your account. We will respond within 30 days (or sooner where required by law).

California residents: Under the California Consumer Privacy Act (CCPA), you have the right to know what personal information we collect, to delete it, and to opt out of the sale of personal information. We do not sell personal information.

10. Security

We protect your information using industry-standard measures: encryption in transit (TLS), encryption at rest where supported by our infrastructure providers, hashed passwords (bcrypt via Supabase Auth), least-privilege access controls, and routine security reviews. No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

11. Children's Privacy

The Service is intended for users who are at least 16 years old. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact privacy@unipilotai.com and we will delete it.

12. Third-Party Links

The Service may contain links to third-party websites (such as university websites, government visa portals, or partner resources). We are not responsible for the privacy practices of those sites. Review their privacy policies before providing any personal information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or by a prominent notice in the Service before the change takes effect.

14. Contact Us

For privacy questions, data requests, or any other concerns about this Privacy Policy, contact us at:

UniPilot AI
Email: privacy@unipilotai.com
General inquiries: hello@unipilotai.com