Privacy policy

RightUni is a free study-abroad organiser on the web, Android and iPhone. This policy explains what personal data we keep, why, who else is involved, how long we keep it and what you can do about it. Your documents are end-to-end encrypted: we can’t read them.

Who we are

RightUni is run by Toukir Ahmed Rony, a sole trader in the United Kingdom, trading as RightUni. We are the controller of your personal data (the “data fiduciary” under India’s law).

• Email: hello@setstech.co.uk — for anything about your data, including complaints (our grievance contact).
• Post: [TO CONFIRM: business address or P.O. Box — never a home address]
• ICO registration number: [TO CONFIRM: ICO registration number covering RightUni]

What we keep and where it comes from

We don’t use analytics, advertising or tracking tools, and we don’t build profiles of you. Browsing universities doesn’t need an account.

Your vault: what end-to-end encryption means here

• Your documents and their details are encrypted on your phone or in your browser before upload, with a key made from your vault passphrase (or your recovery key).
• Your passphrase, recovery key and vault key never leave your device. We store only encrypted files and encrypted keys, so neither we nor anyone who got hold of our server could read your documents.
• Only you can download and open them. We never share, send or look inside your documents.
• If you forget your passphrase and lose your recovery key, we can’t get your documents back. You can reset the vault, which deletes them.

Why we use it, and our lawful basis

You don’t have to give us any personal data to browse universities. To use your own applications and vault you need an account, which needs your name, email and a password. Students like you is optional. We make no decisions about you by automated means, and we don’t profile you.

Who else is involved

• Hostinger — our server (a virtual private server in the United Kingdom). It holds the database and the encrypted vault files.
• Hetzner — a storage box in Germany or Finland that receives one encrypted backup each night. It never serves files to anyone.
• Email: [TO CONFIRM: email service used to send account emails (password resets) and admin alerts]
• Wikimedia Commons — campus photos on university pages load from Wikimedia’s servers, so your browser connects to them and they see your IP address.
• Other students — only if you join Students like you, and only students who show themselves at the same university and whose own profile is visible.
• Sites you choose to open — job, accommodation, map, university and social links open outside RightUni under those sites’ own policies.

We don’t sell your data, share it with universities or agencies, or use it for advertising. We would only give it to the police or a court if the law required us to.

Transfers outside the UK

• Backups go to Germany or Finland, which UK law recognises as giving adequate protection (UK adequacy regulations for the EEA).
• Wikimedia may process data in the United States and other countries under their own safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the UK’s International Data Transfer Agreement.

How long we keep it

When you delete your account (in Settings, in the apps, or through the deletion page), we delete your account, applications, vault files, Students like you profile, sign-in records and the reports you made straight away.

Your rights

Under UK data protection law you can:

• see the data we hold about you, and get a copy (Settings → Export gives you everything, including your decrypted documents);
• correct it (most of it you can edit yourself);
• delete it (delete items, leave Students like you, or delete your account);
• restrict or object to how we use it;
• take it to another service (the export is in common formats: CSV and your original files);
• withdraw consent at any time — hide your Students like you profile or leave. This doesn’t affect what happened before.

Email hello@setstech.co.uk to ask for anything above. We’ll reply within one month. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint. We’d like the chance to put things right first.

Students in India

Under the Digital Personal Data Protection Act 2023 you can ask for a summary of your data and how it’s used, correct, complete or update it, have it erased, withdraw your consent, nominate someone to act for you if you die or can’t act, and raise a grievance with us at hello@setstech.co.uk. We aim to resolve grievances within 90 days. If you’re not satisfied, you can complain to the Data Protection Board of India.

Students in Bangladesh

Under Bangladesh’s personal data protection law you own your personal data. We use it only for the purposes above, with your consent where the law requires it, and you can ask to see, correct or delete it and withdraw consent at any time by emailing hello@setstech.co.uk.

Age

You need to be 16 or over to create an account, and 18 or over to join Students like you. Students under 18 can’t be seen by other students, and nothing about them is public.

Cookies

We use only the cookies needed to keep you signed in, and remember your light or dark theme on your device. See the cookie policy.

Security

All connections use HTTPS. Vault documents are end-to-end encrypted, sign-in tokens are stored scrambled, and every request is checked against your account. No system is perfectly secure; if a breach affected your data, we would tell you and the regulator as the law requires.

Changes

If we change this policy in a way that matters, we’ll tell you in the app or on the website before it takes effect.