Privacy Policy

1. Who we are

IMEC.AI is an AI-powered course-matching platform that helps international students find and apply to UK universities. We act as the data controller for personal data processed through this platform.

For data protection enquiries, contact us at privacy@imec.ai.

2. What data we collect

We collect the following categories of personal data:

• Account data: name, email address, and mobile number provided during registration.
• Educational profile: nationality, current education level, study goals, intended start date, annual budget, and preferred UK cities.
• English proficiency: English test type (IELTS, TOEFL, PTE) and score bands you provide.
• Application data: courses you save, shortlists, and application submissions.
• Usage data: pages visited, features used, and interaction logs, collected to improve the service.
• Technical data: browser type, device, IP address, and session identifiers.

We do not collect special category data (e.g. health information, racial or ethnic origin) beyond what you voluntarily disclose in free-text fields.

3. Why we collect it and our legal basis

• To provide our service (contract performance — Article 6(1)(b) UK GDPR): course matching, shortlisting, application tracking, and AI advisory features.
• To improve the platform (legitimate interests — Article 6(1)(f)): usage analytics, debugging, and service optimisation.
• To send you relevant communications (legitimate interests or consent): application deadline reminders, new match alerts, and our monthly digest. You can opt out at any time in your profile settings.
• Analytics cookies (consent — Article 6(1)(a)): only activated after you explicitly accept cookies via our consent banner.
• Legal compliance (legal obligation — Article 6(1)(c)): where required by UK law.

4. How long we keep your data

• Account and profile data is retained for as long as your account is active.
• When you delete your account, all personal data is permanently erased within 30 days.
• Anonymised, aggregated usage statistics may be retained indefinitely as they cannot identify you.
• Server and security logs are retained for up to 90 days.

5. Who we share your data with

We do not sell your personal data. We share it only with:

• Supabase: our authentication and database infrastructure provider. Supabase processes your email and login credentials to manage secure sign-in, and hosts your data on servers within the European Economic Area. Supabase is SOC 2 Type II certified and processes data under standard contractual clauses.
• Analytics providers (only with your consent): if you accept analytics cookies, usage data is shared with our analytics platform to help us understand how the service is used.

We may disclose data if required by law or to protect the rights, property, or safety of IMEC.AI, our users, or others.

6. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data via your profile settings.
• Erasure — delete your account and all associated data at any time from your profile settings.
• Data portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests, including direct marketing.
• Restrict processing — ask us to pause processing while a complaint is resolved.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any right, email privacy@imec.ai. We will respond within 30 days. If you are unhappy with how we handle your data you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

We use two categories of cookies:

• Essential cookies (always active): the imec_session cookie stores your encrypted login session. Without it the platform cannot function.
• Analytics cookies (consent required): used to understand how visitors interact with the platform. These are only set after you accept cookies via our banner. You can change your preference at any time by clearing your cookies or contacting us.

8. Changes to this policy

We may update this policy from time to time. When we make material changes we will notify you via email or an in-app notice. The "Last updated" date at the top of this page always reflects the most recent version.