Privacy and cookies

Who is responsible

The data controller is To be added before launch, reachable at To be added before launch.

What we handle and why

Information	Why	Legal basis	How long
Your route, if you don't have an account	To show your route	Stored only in your browser. We never receive it.	Until you choose Start over or clear your browser data
Your email address and sign-in details, if you create an account. Our sign-in system also records the time and IP address of each sign-in.	To create your account, send sign-in codes and keep your account secure	Providing the service you asked for (GDPR art. 6(1)(b))	Until you delete your account
Your route answers: your passport country, whether you have temporary protection (asked only for Ukrainian passports), how long you'll stay, whether you have a visa, and your dates. Also your ticked steps and documents, university (if you give it) and reminder setting.	To save your route across devices and work out your reminders	Providing the service you asked for (GDPR art. 6(1)(b))	Until you delete your account
A record of which reminders we've sent you	To avoid sending the same email twice	Providing the service you asked for (GDPR art. 6(1)(b))	Until you delete your account
Messages to the AI assistant	To generate an answer	Providing the service you asked for (GDPR art. 6(1)(b))	We don't save them. Our AI provider's retention is explained below.
IP address, kept in server memory	To limit how many questions can be sent, and prevent abuse	Legitimate interest in keeping the service available (GDPR art. 6(1)(f))	Up to about one hour
Technical logs, such as IP address, browser and time	To run and secure the website	Legitimate interest in security (GDPR art. 6(1)(f))	The limited period set by our hosting provider
Anything you send us by email	To reply to you	Legitimate interest in answering you (GDPR art. 6(1)(f))	As long as needed to deal with your message

Once a year, we also delete accounts that haven't been used for three years. We don't ask for your name, passport number, NIE, address or copies of your documents, and our route doesn't need them. You can't upload documents to StudentGo.

The emails we send

We only send sign-in codes and, unless you turn them off, deadline reminders and alerts when a rule changes for a step you still have to do. We don't send marketing emails. Every reminder has a link to turn them off, and you can also do this in your account.

Who receives information

Supabase provides our database and sign-in system. It stores your account data, which we keep in a data centre in the European Union.
Resend delivers our emails. It receives your email address and the content of each email.
Vercel hosts the website and processes technical logs. Its servers, which we run in the European Union, also handle your account data briefly when they send your reminders or delete your account.
Anthropic provides the AI model behind the assistant. If you use the assistant, it receives the messages in your conversation. Under its API terms, inputs and outputs are normally deleted within 30 days and aren't used to train models without permission. Content flagged for breaking its usage policy can be kept for longer.
Google, only if you choose to sign in with Google. It shares your name, email address and profile picture with our sign-in system. We only use your email address.

We don't sell your information or share it for advertising.

These providers may process information outside the European Economic Area. Where they do, we rely on the safeguards in their data processing terms, such as standard contractual clauses.

The student survey

Our survey is anonymous. It asks only fixed-choice questions: your passport country (optional), what you came to study, when you arrived, and how the paperwork went. It has no boxes to type in, so nothing you send can name you.

We store each response with the month it was sent, and nothing else: no name, email address, IP address or exact time, and no link to an account, even if you're signed in. Because we can't tell which response is yours, we can't show it to you, change it or delete it afterwards. Your browser remembers that you answered, so the form doesn't show again on that device. As with any page, our providers' technical logs briefly record your IP address, but it isn't stored with your answers.

We use the totals to decide what to improve, and we may share them with students, universities and public bodies. We only share totals for groups of five or more responses, so no one can be picked out.

Please don't share sensitive details

The assistant doesn't need passport numbers, NIE numbers, addresses, health details or photos of documents, so please leave them out.

Automated decisions

Your route and reminders come from fixed rules applied to your answers. Neither they nor the assistant make decisions about you that have legal effects. Only the authorities decide your case.

Your rights

You can access, correct, delete and receive a copy of your personal data, and you can object to or restrict how it's used. On your account page, you can change your answers, download your data and delete your account yourself. For anything else, contact us using the address above.

You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.

Cookies and local storage

StudentGo doesn't use advertising or analytics cookies, which is why you don't see a cookie banner. It uses your browser's local storage only to remember your route and, if you sign in, to keep you signed in. Signing out removes both from that device. Without an account, you can delete your route with Start over or by clearing your browser data. On a shared computer, do this when you finish.

Age limits

You must be 16 or older to create an account. The AI assistant is for people aged 18 or over.

Changes

We'll update this page if our practices change. The date at the top shows the latest version.