StudyWhere.ai — GDPR & UK GDPR Notice

StudyWhere is the controller of personal data processed through the Service. Matching Partners who receive your data through a referral act as independent controllers of the data they receive, responsible for their own compliance from the point of receipt.

We process the categories described in Section 2 of the Privacy Policy: identity and contact data, academic profile data, preference and planning data, financial context data, conversation data, account data, device and usage data, approximate location, platform data from messaging services, advertising attribution data, and partner feedback data.

We do not request special category data (Article 9). If you volunteer such data in a conversation — for example, a health condition relevant to your study plans — we process it on the basis of your explicit consent, given by the act of deliberately providing it in that context. You can have it deleted at any time.

Where we rely on legitimate interests, we have conducted a balancing assessment and concluded the processing is necessary and does not override your rights. You may object at any time under Article 21 — see Section 7.

Where processing rests on consent, refusing or withdrawing consent has one practical consequence worth stating plainly: without consent to partner sharing, we cannot refer you to Matching Partners, because that referral is the processing itself. The rest of the Service remains available.

Personal data is disclosed to: Matching Partners (as independent controllers, with your consent); processors including cloud hosting, AI model providers that generate agent responses from your conversation content, messaging and WhatsApp Business Solution Providers, analytics, delivery, CRM, and payment vendors, each bound by Article 28 data processing agreements; advertising platforms for measurement and audiences, subject to your consent choices; courts, regulators, and authorities where legally required; and successors in a corporate transaction.

StudyWhere's infrastructure, personnel, processors, and Matching Partners are located outside the EEA, UK, and Switzerland, including in jurisdictions without an adequacy decision. Transfers are protected by, as applicable: European Commission adequacy decisions; the EU Standard Contractual Clauses (2021) with transfer impact assessments and supplementary measures where needed; the UK International Data Transfer Addendum; and equivalent Swiss mechanisms. Note that Matching Partners relevant to your study plans are frequently established in your intended destination country — a US university, a Canadian lender — and the transfer of your data to them is necessary for the referral you request; where no other safeguard applies, such transfers rely on Article 49(1)(b) (performance of a contract or pre-contractual steps taken at your request) or your explicit consent under Article 49(1)(a).

Retention periods follow Section 7 of the Privacy Policy: account data for the life of the account plus up to 24 months; conversation data up to 36 months; referral records up to 5 years; suppression lists indefinitely in minimal form; statutory records as law requires. Data is deleted or irreversibly anonymized at the end of the applicable period unless a live legal claim requires longer retention.

European Users hold the full set of GDPR rights, exercisable free of charge through the privacy controls within the Service:

• Access (Art. 15): confirmation of processing, a copy of your data, and the supplementary information in this Notice.
• Rectification (Art. 16): correction of inaccurate data and completion of incomplete data.
• Erasure (Art. 17): deletion where the data is no longer necessary, consent is withdrawn, you validly object, or processing was unlawful. We honor erasure across our systems and instruct processors to do the same; Matching Partners who already received your data must be approached directly, as independent controllers, though we will pass on your request for live referrals.
• Restriction (Art. 18): processing frozen while accuracy or lawfulness is contested.
• Portability (Art. 20): your provided data in machine-readable format, transmitted to another controller where technically feasible — this covers your profile, preferences, and conversation history processed under contract or consent.
• Objection (Art. 21): to any legitimate-interests processing, on grounds relating to your situation; and an unconditional right to object to direct marketing, which we honor immediately.
• Withdrawal of consent (Art. 7(3)): at any time, with effect for the future.
• Automated decision-making (Art. 22): our partner matching is an algorithmic recommendation, not a decision producing legal or similarly significant effects — you remain free to ignore it, and admission, visa, and lending decisions are made by third parties through their own processes. If you believe a matching outcome affects you significantly, you may request human review and we will provide it.

We respond within one month, extendable by two further months for complex requests, in which case we tell you within the first month. Identity verification may be required. If we refuse a request we state the reason and your remedies.

You have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement — in the UK, the Information Commissioner's Office; in EEA states, your national data protection authority; in Switzerland, the FDPIC. We would welcome the chance to resolve the matter first through the Service's support and privacy controls, but nothing conditions your right to go straight to the regulator.

We apply data minimization to referral payloads (partners receive what is relevant to the inquiry, not your full history), pseudonymize data used for model evaluation where feasible, restrict internal access on a role basis, and encrypt data in transit. Processors undergo due diligence before onboarding and are contractually bound to Article 32 security measures.

Material changes to this Notice will be flagged by in-product notice before they take effect for European Users, with a fresh consent request where the change expands consent-based processing.