1.Data Controller
UniSwipe ("UniSwipe", "we", "us") is the data controller responsible for the personal data collected through the UniSwipe website and application (uniswipe.gr), including the AI Tutor.
For all data-related enquiries, contact: legal@uniswipe.gr
2.Data We Collect
We collect the following categories of personal data:
- Account data: name, email address, profile photo, university, study programme, role (student/tutor).
- Tutor-specific data: hourly rate, academic transcripts and verification documents, teaching availability, courses taught, bio/introduction.
- Booking data: session dates/times, hours booked, selected courses, booking status.
- Payment data: transaction amounts, subscription plans (tutor plans and AI Tutor Premium) and payout details. Payments are processed by Stripe; we never receive or store full card details.
- Communication data: messages exchanged through our in-platform messaging system.
- Review data: ratings and written reviews submitted for tutors.
- Usage data: pages visited, search queries, IP address, browser and device type, and which link brought you to UniSwipe (stored in cookies and server logs, and measured with Google Analytics if you accept analytics cookies).
- AI Tutor data: the courses you study, your study plan and exam date, lesson progress, your answers (typed, drawn or photographed), marks and feedback, mock exam attempts, and your messages to the AI tutor.
- Uploaded files: notes, past exams and other documents you upload, and the text we extract from them.
- Referral data: the affiliate link you signed up through, the people you referred and the commission they earned you, and the country of visitors who click a campaign link (worked out from the IP address on our own server).
3.How We Use Your Data
- To create and manage your account and profile.
- To match students with tutors and facilitate bookings.
- To process payments and subscriptions through Stripe.
- To send transactional emails (booking confirmations, payment receipts).
- To send service communications (policy changes, security alerts).
- To verify tutor academic credentials.
- To detect and prevent fraud, off-platform activity, and policy violations.
- To improve our Platform through aggregated analytics.
- To comply with legal obligations.
- To provide the AI Tutor: generate lessons and mock exams, mark your answers and photos of your work, answer your questions in the course chat, and translate course content into your language.
- To share notes you upload with the students of the same course, after automatic checks for exam papers, copies of other people's work and personal details.
- To credit referrals to affiliates and pay their commission.
We will only send you marketing communications if you have opted in. You may opt out at any time via the unsubscribe link in any email or through your account settings.
The AI Tutor marks answers automatically. These marks are only for your own studying: they have no legal or similarly significant effect on you and are not shared with your university.
4.Legal Basis (GDPR)
We process your personal data on the following legal bases under GDPR Article 6:
- Contractual necessity — to provide the services you signed up for, including the AI Tutor and sharing the notes you upload.
- Legitimate interests — fraud prevention, platform security, checking uploads before they are shared, crediting referrals and improving our services.
- Legal obligation — compliance with applicable laws and regulations.
- Consent — for optional marketing emails and for Google Analytics cookies, which we only set if you accept them.
5.Data Sharing
We share your data only with service providers that process it on our behalf, under data processing agreements:
- Stripe — payments, subscriptions and payouts.
- Our hosting provider — our own servers in the European Union (Germany), which run our database, sign-in system and file storage (self-hosted Supabase software).
- OpenAI, Anthropic and Voyage AI — the AI models behind the AI Tutor. When you use an AI feature, the relevant text, answers, photos or excerpts are sent to them to produce a response. Under their business terms they do not use this data to train their models.
- Resend — sending our emails.
- Google — sign-in, if you choose "Sign in with Google", and Google Analytics, if you accept analytics cookies.
We do not sell, rent or trade your personal data. All data processors are bound by data processing agreements that comply with the GDPR.
Some of these providers (Stripe, OpenAI, Anthropic, Voyage AI, Resend and Google) are based in, or process data in, the United States. These transfers are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
Some information is visible to other users by design: tutor profiles and reviews are public, messages go to the person you write to, and notes you upload to the AI Tutor are shared with students of the same course without your name (see our Terms).
We may disclose your data if required by law, court order, or to protect the rights and safety of UniSwipe or its users.
6.Retention
We retain your personal data for as long as necessary to provide our services and comply with legal obligations:
- Active account data: retained for the duration of your account, plus 2 years.
- Payment and transaction records: 7 years (tax and accounting obligations).
- Message history: 2 years after session completion.
- Verification documents: 3 years after verification, then securely deleted.
- Usage logs: up to 12 months.
- AI Tutor data: your progress, answers and chat history, for as long as you have an account.
- Uploaded files: until you delete them or your account. When you delete a file that was shared with a course, it stops being used; study material already created from it may remain, without your name.
Upon account deletion, we will erase or anonymise personal data within 30 days, except where retention is required by law.
AI providers keep the data we send them only for a limited period under their business terms (typically up to 30 days, for abuse monitoring), after which they delete it.
7.Your Rights
Under GDPR, you have the following rights:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate data.
- Right to erasure — request deletion of your data ("right to be forgotten").
- Right to restriction — request we limit how we process your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email legal@uniswipe.gr. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.
8.Security
We implement appropriate technical and organisational measures to protect your personal data, including TLS encryption in transit, encrypted storage, access controls, and regular security reviews. However, no internet transmission is 100% secure.
9.Cookies
We use cookies and similar technologies. For detailed information, please read our Cookie Notice.
10.Children's Privacy
UniSwipe is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it.
11.Policy Changes
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or a prominent in-app notice at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
