Uni Feedback
Dá Feedback!

Privacy Policy

  • Last Updated: August 27, 2026

1. Introduction

This Privacy Policy describes how Uni Feedback ("we," "us," "our," or the "Platform") collects, uses, and shares information when you use our university course review platform. This policy applies to all users, including students who submit reviews and administrators who manage the platform.

Controller Information:

  • Platform: Uni Feedback
  • Operator: Afonso (Individual Proprietorship)
  • Location: Portugal
  • Contact: [email protected]

2. Information We Collect

2.1 Information You Provide Directly

Student Users:

  • Email address (required for account verification and communication)
  • Course reviews and related content
  • University affiliation (derived from email domain)
  • Conversations with the AI assistant (the Chat), including the messages you write, the answers you receive, and any rating or comment you leave on an answer
  • Any additional information you choose to provide in communications with us

Administrator Users:

  • Email address for authentication and account management
  • Any additional information provided during account setup or communications

2.2 Information Collected Automatically

When you use our Platform, we may automatically collect:

  • Device information (browser type, operating system, device identifiers)
  • Usage information (pages visited, time spent, interactions)
  • Technical data (IP addresses, log files)
  • Analytics data to understand Platform usage patterns

For each Chat message we also record technical details of how the answer was produced: which of our internal lookups ran, which courses or degrees were consulted, the AI model used, processing time, and the size and cost of the request. We use this to operate the Chat, control its cost, and diagnose bad answers.

We use Cloudflare for hosting services, which may collect additional technical data according to their privacy policy.

2.3 Information from Third Parties

We may receive information from:

  • University email verification systems
  • Mailgun (our email service provider) for authentication flows
  • Legal authorities when required by law

3. How We Use Your Information

3.1 Primary Uses

For All Users:

  • Provide and maintain Platform services
  • Verify account eligibility and authenticity
  • Communicate important Platform updates and changes
  • Respond to your requests and provide customer support
  • Protect Platform security and prevent fraud
  • Comply with Portuguese law and EU regulations

For Student Users Specifically:

  • Verify university enrollment through email domain checking
  • Contact you for clarification or additional information about review submissions (only when necessary for approval)
  • Thank you for your contributions to the Platform
  • Process and moderate your content submissions

For Administrator Users Specifically:

  • Authentication and account management (signup, login, password reset)
  • Provide Platform updates and administrative communications
  • Manage Platform operations and security

3.2 Analytics and Business Intelligence

We use aggregated and anonymized data derived from reviews and Platform usage to:

  • Generate insights and reports about course trends and student preferences in Portuguese universities
  • Improve Platform functionality and user experience
  • Create data products and services for potential partnerships with universities
  • Conduct research and analysis for business development
  • Support educational improvement initiatives

Important: Individual student identities are never included in these analytics or shared with third parties.

3.3 Communication Purposes

We may contact you via email for:

  • Account verification and security purposes (admin only)
  • Responses to your inquiries or support requests
  • Platform updates and important announcements
  • Follow-up questions about your review submissions (student users only)
  • Appreciation messages for your contributions (student users only)

We do not send marketing emails or promotional communications.

3.4 The AI Assistant (Chat)

This section describes what happens to your conversations with the Chat, because it is the part of the Platform where the answer is least obvious.

Who can see your conversations

  • No other user can. Chats are never shown to other students and are never published.
  • They are linked to your account, in the same way your reviews are.
  • The Uni Feedback team can read them.

Why we read them

  • To find out what students want to know, and which of it we cannot answer yet, so we know what information to gather next
  • To find and fix bad answers, which is the main way we can tell when the Chat is wrong in a way that sounds convincing
  • To improve the Chat's instructions and the Platform generally
  • To produce aggregated statistics about the kinds of questions being asked

A note on the word "anonymous"

Reviews on Uni Feedback are anonymous in the sense that they are published without your name. They are still linked to your account internally. Chats work the other way round: they are never published at all, and they are also linked to your account. Neither is anonymous to us.

Sending your messages to an AI provider

To produce an answer, your message, the recent conversation, and the relevant course information from our database are sent to a third-party AI provider that processes them on our behalf under contract. See Section 4.3.

What we do not do with your conversations

  • We do not sell them
  • We do not share them with universities or any other third party, other than the AI provider described above and the limited scenarios in Section 4.3
  • We do not use them to send you marketing. If we ever want to contact you about a topic you raised in a Chat, we will ask for your consent separately first

Please do not enter personal or sensitive data. The Chat has no need for it, and anything you type is stored. This includes information about other people.

3.5 Requesting Access to the Chat

Signing in to Uni Feedback requires a university email address, so people who are not enrolled at a university we cover cannot create an account. If you are in that position, you can ask us to tell you when the Chat opens up to you.

What we collect when you do

  • Your email address, which is the only required field
  • Optionally: which universities you are interested in, whether you are an applicant, a high-school student or something else, and the question you wanted to ask

Why we collect it

  • To contact you once, when the Chat becomes available to people like you
  • To decide which universities to cover next, based on how many people are waiting for each one

How long we keep it

Until we have contacted you and you have had a reasonable opportunity to sign up, or until you ask us to delete it, whichever comes first. Write to [email protected] at any time and we will remove it.

What we do not do with it

  • We do not add you to a marketing list. This address is used for the notification described above and nothing else. If we later want to send you anything else, we will ask for your consent separately first
  • We do not share it with universities or any other third party

You do not need an account to make this request, and making one does not create an account.

4. How We Share Your Information

4.1 Public Information

  • Approved course reviews are published on the Platform without any personally identifiable information
  • Aggregated and anonymized data may be shared publicly or with university partners
  • Student emails are only visible to Platform administrators for verification purposes

4.2 We Do Not Sell Personal Information

We do not sell, rent, or trade your personal information to third parties for monetary gain.

4.3 Limited Sharing Scenarios

We may share your information only in these specific circumstances:

Service Providers:

  • Cloudflare: Hosting, content delivery, and file storage
  • Resend: Email delivery for authentication and Platform communications
  • OpenRouter: Routes Chat messages to AI model providers on our behalf. Your messages, the recent conversation, and the relevant course data are sent to OpenRouter and to the model provider it routes to, solely to generate the answer. These providers may process this data outside the European Union (see Section 8)
  • PostHog: Product analytics, hosted in the European Union
  • These providers are bound by contractual terms and may only use your information to provide services to us

Legal Requirements:

  • When required by Portuguese law, EU regulation, or legal process
  • To protect our rights, safety, or property
  • To investigate potential violations of our Terms of Service

Business Transfers:

  • In connection with a merger, acquisition, or sale of assets (with notice to users)

Data Exports:

  • We may export review data in various formats (CSV, PDF, aggregated summaries) for business purposes
  • Personal information including author emails are never included in exports
  • Exports are used for university partnerships, educational insights, and platform improvement

5. Data Security

We implement appropriate technical and organizational measures to protect your information:

  • Access controls and authentication measures
  • Secure hosting through Cloudflare infrastructure
  • Regular security assessments and updates
  • Limited administrator access to personal data

However, no system is completely secure, and we cannot guarantee absolute security of your information.

6. Data Retention

6.1 Account Data

  • Student user emails: Retained as long as necessary for Platform operations and legal compliance under Portuguese law
  • Administrator account data: Retained for the duration of the account plus 7 days after deletion request

6.2 Content Data

  • Approved reviews: Retained indefinitely as part of our Platform content to serve educational purposes
  • Rejected or pending reviews: Retained for moderation purposes and may be deleted after reasonable period
  • Author identities remain permanently confidential

Chat conversations:

  • Retained while your account exists, and after it, as described below
  • Deleting a chat removes it from your view and from any further use, but the record is kept. We say this plainly rather than implying erasure. If you want a conversation permanently removed, contact us and we will delete it
  • Ratings and comments you leave on answers are kept alongside the conversation. Removing a rating deletes it outright

Chat access requests: Kept until we have contacted you about the Chat becoming available, or until you ask us to delete the request. See Section 3.5

6.3 Analytics Data

  • Aggregated and anonymized usage data may be retained indefinitely for business intelligence purposes

7. Your Rights and Choices

Under Portuguese law and the General Data Protection Regulation (GDPR), you have the following rights:

7.1 Access and Correction

You may request access to or correction of your personal information by contacting us.

7.2 Data Portability

Upon request, we can provide you with a copy of your personal information in a commonly used format.

7.3 Account Deletion

Administrator Users: You may request account deletion by emailing [email protected]. We will process deletion requests within 7 days.

Student Users: Contact us for information about data deletion options. Note that published reviews may remain on the Platform as they become part of our educational content database, but your identity will never be disclosed.

What happens to your data when your account is deleted: we anonymise the account rather than erasing everything attached to it. Your email address, username, and referral code are removed, and your reviews and Chat conversations are transferred to an anonymised account so that the Platform's content and statistics remain intact.

We want to be accurate about the limits of this. The content of a conversation can still describe the person who wrote it, for example if you mentioned your degree and year. So we describe this as de-identification, not anonymisation, and that data remains within scope of your rights under Section 7. If you want your conversations deleted outright rather than de-identified, tell us and we will do that.

7.4 Objection and Restriction

You may object to certain processing activities or request restrictions under applicable circumstances.

7.5 Communication Preferences

You may opt out of non-essential communications, though some service-related messages are necessary for Platform operation.

7.6 Data Subject Complaints

You have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) if you believe your rights have been violated.

8. International Data Transfers

As we operate in Portugal, your data is primarily processed within the European Union. However, some of our service providers may process data internationally with appropriate safeguards in place as required by GDPR.

This applies in particular to the AI providers used by the Chat, which may be located outside the European Union, principally in the United States. Chat messages sent to them are transferred under the safeguards required by Chapter V of the GDPR. If you would rather your messages were not processed in this way, do not use the Chat: the rest of the Platform works without it.

9. Children's Privacy

Our Platform is intended for university students and administrators. We do not knowingly collect personal information from children under 18. If we become aware of such collection, we will delete the information promptly.

10. European Privacy Rights (GDPR)

As a platform operating in Portugal, we comply with the General Data Protection Regulation (GDPR):

10.1 Legal Basis for Processing

  • Contract: Providing the Platform services you sign up for, including answering your questions in the Chat
  • Legitimate interest: Improving the Platform, understanding what information students are missing, keeping the service secure, and controlling its running costs. This is the basis on which we read Chat conversations, and we consider it proportionate because the conversations are about courses rather than about you, we ask you not to enter personal data, and we tell you plainly in the product itself
  • Consent: Where explicitly provided for certain activities, including any future use of your Chat history to send you communications. Asking us to tell you when the Chat opens up (Section 3.5) is consent of this kind: you give us an address for one specific message, and you can withdraw it at any time
  • Legal compliance: Meeting Portuguese and EU legal requirements

You can object to processing based on legitimate interest at any time (Section 7.4). In practice, not using the Chat is the simplest way to keep your questions out of it entirely.

10.2 Your GDPR Rights

  • Right to access, rectify, erase, restrict, or object to processing
  • Right to data portability
  • Right to withdraw consent where applicable
  • Right to lodge a complaint with supervisory authorities

10.3 Data Protection Officer

For privacy-related questions or to exercise your rights, contact us at [email protected] with "Privacy Request" in the subject line.

11. Specific Portuguese Compliance

We comply with Portuguese data protection laws and educational regulations:

  • Data processing complies with Portuguese Law 58/2019 (GDPR implementation)
  • We respect academic freedom and student rights under Portuguese educational law
  • Our verification processes align with Portuguese university email systems

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will:

  • Post the updated policy on our Platform
  • Update the "Last Updated" date
  • Provide notice of material changes via email or Platform notification
  • Continue to honor the privacy practices described in the version that was in effect when your information was collected

13. Contact Information

For privacy-related questions, concerns, or requests:

Data Protection Contact:

  • Data Controller: Afonso Gonçalves (Individual Proprietorship)
  • Location: Portugal
  • Response Time: We aim to respond to privacy inquiries within 30 days as required by GDPR

14. Supervisory Authority

Portuguese Data Protection Authority (CNPD):