StudyWhere.ai — Privacy Policy

StudyWhere operates an AI-powered study-abroad discovery platform that provides automated information about universities, courses, scholarships, visas, and costs, and connects prospective students with relevant third-party businesses ("Matching Partners"). For the purposes of applicable data protection law, StudyWhere is the controller of personal data processed through the Service.

Data you provide directly:

• Identity and contact data: name, email address, phone number, WhatsApp number, country of residence, city, date of birth or age range.
• Academic profile data: current education level, institution, grades or GPA, standardized test scores (IELTS, TOEFL, GRE, GMAT, SAT, PTE, Duolingo), intended intake, target degree level, and field of study.
• Preference and planning data: destination countries, shortlisted universities, budget range, funding needs, scholarship interests, accommodation needs, and timeline.
• Financial context data: approximate budget, interest in education loans, sponsor or co-applicant details you choose to share, and income range where you provide it for loan matching.
• Conversation data: the full content of your chats with our AI agents, including free-text questions, documents or images you upload, and any personal details you volunteer within a conversation.
• Account data: login credentials, profile settings, and communication preferences.
• Communications: messages, survey responses, and feedback you submit through the Service.

Data collected automatically:

• Device and technical data: IP address, device type, operating system, browser type and version, language settings, and mobile identifiers.
• Usage data: pages visited, features used, session duration, referral source, search queries within the Service, clicks on partner listings, and interaction patterns with AI agents.
• Approximate location: inferred from IP address or provided by your device where you permit it.
• Cookies and similar technologies: as described in Section 10.

Data from third parties:

• Platform data: if you reach us via WhatsApp, Instagram, or another messaging platform, we receive your platform profile name, number or handle, and message content, subject to that platform's terms.
• Advertising and analytics data: campaign source, ad interaction data, and attribution data from advertising platforms (such as Meta and Google) when you arrive via an ad.
• Partner feedback data: Matching Partners may share with us the status of your inquiry (contacted, converted, closed) so we can measure referral quality.
• Enrichment and verification data: where lawful, we may supplement records with publicly available or licensed data to improve matching accuracy.

Sensitive data. We do not seek sensitive personal data (health, religious, biometric, or detailed financial data beyond what you volunteer). If you include such data in a conversation, you do so voluntarily and consent to its processing as part of your conversation data. Avoid sharing passport numbers, government ID numbers, or full financial account details in chat unless a specific verified flow requests them.

Children. The Service is intended for users 18 and older, or 13–17 with parental or guardian consent as set out in the Terms of Service. Where applicable law requires, we process a minor's data only with verifiable parental consent and do not use minors' data for behavioral advertising. If we learn we hold data of a child under 13, we will delete it.

We use personal data to:

• Operate the Service — run AI conversations, generate responses, maintain accounts, remember context across sessions, and provide requested information.
• Match you with partners — analyze your profile, preferences, and conversation content to identify relevant universities, consultants, lenders, test-prep providers, accommodation providers, insurers, and other Matching Partners, and to share your details with them as described in Section 4.
• Facilitate partner follow-up — enable Matching Partners to contact you and track the status of referrals.
• Communicate with you — send service messages, reminders (for example, application deadlines you've discussed), and, with the ability to opt out, promotional messages about the Service and partner offerings via email, SMS, and WhatsApp.
• Improve the Service and our AI — analyze usage, test features, debug, train and fine-tune our matching logic and AI agents, and build aggregated insights. Where feasible we use de-identified or aggregated data for these purposes.
• Advertising and measurement — measure campaign performance, build audiences (including hashed-identifier custom audiences and lookalikes on platforms such as Meta and Google), and attribute conversions.
• Safety, security, and compliance — detect fraud and abuse, enforce our Terms, secure our systems, establish or defend legal claims, and comply with law, regulation, and lawful requests from authorities in any jurisdiction where we operate.
• Corporate purposes — in connection with financing, restructuring, merger, acquisition, or sale of assets.

Legal bases. Where applicable law requires a legal basis for processing, we rely on: performance of a contract (operating the Service you've requested), your consent (sharing with Matching Partners, marketing messages, cookies where consent is required), our legitimate interests (service improvement, security, analytics, measurement, legal defense), and compliance with legal obligations. Where processing rests on consent, you may withdraw it at any time as described in Section 8; withdrawal does not affect prior lawful processing.

Matching Partners. This is central to how the Service works. When you express interest in a destination, institution, program, loan, or service — or ask to be contacted — we share relevant personal data with Matching Partners whose offerings match your needs. Shared data may include your name, contact details, academic profile, test scores, budget, destination preferences, intake timeline, and a summary of your relevant conversation content. Matching Partners are independent controllers of the data they receive: once shared, their use of your data is governed by their own privacy policies, and you should review those policies before engaging with them. We contractually require partners to use referred data for legitimate follow-up on your inquiry, but we do not control and are not responsible for their independent processing.

Service providers (processors). We share data with vendors who process it on our instructions: cloud hosting and storage providers, AI model providers whose models power our agents (conversation content is transmitted to these providers to generate responses), messaging infrastructure and WhatsApp Business Solution Providers, analytics providers, email/SMS delivery services, CRM and support tooling, and payment processors for any paid features. These providers are bound by contract to safeguard data and use it only to provide services to us.

Advertising platforms. We share hashed identifiers and event data with advertising platforms (including Meta and Google) for measurement, attribution, and audience building, subject to your cookie and consent choices where applicable.

Legal and safety. We disclose data where required by law, court order, or governmental authority in any relevant jurisdiction; to enforce our Terms; to protect the rights, property, or safety of StudyWhere, our users, or others; and to detect or prevent fraud.

Corporate transactions. If StudyWhere is involved in a merger, acquisition, financing, or sale of all or part of its business, personal data may be transferred as part of that transaction, subject to this Policy or a successor policy.

Aggregated and de-identified data. We may share aggregated or de-identified data (for example, demand trends by destination or course) that cannot reasonably identify you, without restriction.

We do not sell personal data for money. Sharing with Matching Partners in exchange for referral compensation may qualify as a "sale," "sharing," or equivalent concept under the privacy laws of certain jurisdictions; where such laws apply to you, you have the opt-out rights described in Section 8.

Our AI agents process your conversation content in real time to generate responses. You should know:

• Conversations are transmitted to third-party AI model providers to generate outputs. We select providers with contractual confidentiality and security commitments.
• Conversation content may be reviewed by authorized personnel for quality assurance, safety, abuse prevention, and improvement of prompts and matching logic.
• We may use conversation data — preferably de-identified — to evaluate and improve agent performance, build training and evaluation datasets, and refine partner-matching accuracy.
• AI outputs are automated and can be inaccurate. Matching results are algorithmic recommendations, not assessments of your merit, and produce no legal or similarly significant automated-decision effect. Where applicable law grants rights regarding automated decision-making, you may request human review of a matching outcome through the mechanisms in Section 8.
• Do not treat the chat as a confidential channel for data you are not comfortable being processed as described in this Policy.

We operate globally. Your data may be stored and processed in countries other than your own, wherever our infrastructure, personnel, service providers, and Matching Partners are located. Data protection standards vary between countries. Where applicable law imposes conditions on cross-border transfers, we implement appropriate safeguards, which may include recognized standard contractual clauses, adequacy mechanisms, certifications, or binding contractual data-protection commitments. By using the Service, you acknowledge that your data may be transferred to and processed in jurisdictions whose data-protection standards differ from those of your country.

We retain personal data for as long as needed for the purposes described in this Policy, then delete or de-identify it. Indicative periods:

• Account and profile data: for the life of the account plus up to 24 months after last activity or completion of a deletion request.
• Conversation data: up to 36 months from the conversation, to support session continuity, quality assurance, and matching improvement; earlier deletion on request where feasible.
• Referral and partner-status records: up to 5 years, for compensation reconciliation, audit, and dispute resolution.
• Marketing preferences and suppression lists: retained indefinitely in minimal form so opt-outs are honored.
• Legal, tax, and compliance records: as required by applicable law, typically 7–10 years.
• Security logs: typically 12–24 months.

We may retain data longer where necessary to establish, exercise, or defend legal claims, or where law requires. De-identified and aggregated data may be retained without limit.

Data protection laws around the world grant individuals rights over their personal data. Depending on where you live, these may include the right to:

• Access — obtain confirmation that we process your data, a copy of it, and information about how it is processed.
• Correction / rectification — have inaccurate or incomplete data corrected or completed.
• Deletion / erasure — have your data deleted, subject to legal retention requirements and permitted exceptions.
• Withdrawal of consent — withdraw any consent you have given, including consent to Matching Partner sharing and marketing, at any time and without affecting prior lawful processing.
• Objection — object to processing based on legitimate interests, and to any processing for direct marketing.
• Restriction / suspension — require that processing be limited while a dispute about accuracy or lawfulness is resolved.
• Portability — receive certain data in a structured, commonly used, machine-readable format, and have it transmitted to another provider where technically feasible.
• Opt out of sale, sharing, targeted advertising, and profiling — where your local law defines these concepts and grants an opt-out.
• Human review of automated decisions — request human involvement in, or contest, a decision made solely by automated means where your local law provides this right.
• Non-discrimination — exercise your rights without being denied the Service or receiving degraded treatment as a result, except where the data is necessary to provide a feature.
• Anonymity or pseudonymity — interact with the Service without identifying yourself, where the law of your jurisdiction provides for it and a feature does not require identification.
• Appoint a representative or nominee — have an authorized agent, legal representative, guardian, or (where local law provides) a nominated person exercise these rights on your behalf, including after death or incapacity where applicable.
• Lodge a complaint — complain to the data protection authority or regulator competent for your jurisdiction.

How to exercise rights: use the privacy and account controls available within the Service, including in-product settings for accessing, correcting, exporting, and deleting your data and for managing consent and marketing preferences. We may verify your identity before acting on a request. We respond within the timelines required by the law applicable to you. Rights requests are free except where applicable law permits a reasonable fee for manifestly excessive or repetitive requests. If we decline a request, we will explain why and inform you of any available review or appeal mechanism under applicable law.

Marketing opt-out: use the unsubscribe link in emails, reply STOP to SMS/WhatsApp promotional messages, or adjust your account settings. Service and transactional messages continue while you use the Service.

Partner contact opt-out: once your data has been shared with a Matching Partner, opt out of that partner's communications directly with them; on request through in-product controls, we will also instruct partners who received your data through a live referral to cease contact, though we cannot guarantee their compliance as independent controllers.

We use administrative, technical, and organizational measures appropriate to the risk: encryption in transit, access controls and role-based permissions, network security, vendor due diligence, logging, and staff confidentiality obligations. No system is perfectly secure. Transmission of data over the internet carries inherent risk, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential. If a breach affecting your personal data occurs, we will notify you and the competent authorities where and as required by the law applicable to the breach.

We use cookies, pixels, SDKs, and local storage to: keep you signed in and remember preferences (essential); measure traffic and usage (analytics); and measure and target advertising (marketing), including pixels from Meta and Google. Where law requires, we obtain consent via a cookie banner and honor your choices. You can also control cookies through browser settings, though blocking essential cookies may break parts of the Service. We honor recognized universal opt-out signals, such as Global Privacy Control, where applicable law requires; we do not otherwise respond to "Do Not Track" signals.

The Service links to Matching Partner sites, universities, government portals, and messaging platforms. Their privacy practices are their own. If you interact with us on WhatsApp or Instagram, Meta also processes your data under its own terms — messaging metadata in particular is subject to the platform's policies, not ours.

We may update this Policy as the Service, our partners, or the law changes. Updates will be posted here with a revised effective date; material changes will be flagged by in-product notice or other reasonable means. Continued use after the effective date constitutes acceptance of the revised Policy.