UniWayUniWay← Home

Privacy Policy

Last updated: 14 July 2026

UniWay ("UniWay", "we", "us") provides an AI companion for international students in Europe. This Privacy Policy explains how we process personal data when you use getuniway.live and related services (the "Service"), in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and, where applicable, the UK GDPR.

1. Data controller

The data controller for personal data processed through the Service is UniWay. For any privacy request (access, rectification, erasure, objection, portability, restriction) contact us at tasnimchrichi@gmail.com.

2. What data we collect

  • Account data: full name, email address, hashed password, preferred language, destination city/country, onboarding answers.
  • Authentication data: session tokens and login timestamps managed by our authentication provider (Supabase Auth, hosted in the EU).
  • Subscription & billing data: Stripe customer ID, subscription status, plan, current period end, cancellation state, invoice references. We do not store card numbers — payment details are handled directly by Stripe.
  • Content you provide: messages to the AI assistant, trusted emergency contacts, saved places, favorites, checklist items.
  • Location data: approximate device location (only when you actively use "Near Me", "Healthcare", "Cheapest Nearby" or similar features). Location is used in-session to run queries and is never sold or shared for advertising.
  • Technical data: IP address, browser type, device type, language, error diagnostics, and basic usage metrics required to operate and secure the Service.

3. Legal bases for processing (Art. 6 GDPR)

  • Contract (Art. 6(1)(b)): creating your account, delivering Premium features, processing payments.
  • Legitimate interests (Art. 6(1)(f)): securing the Service, preventing fraud and abuse, improving reliability.
  • Consent (Art. 6(1)(a)): optional cookies/analytics, marketing communications where applicable. You can withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)): tax, accounting and consumer-protection duties.

4. AI Assistant

The 24/7 AI relocation coach processes the messages you send in order to generate a response. Prompts are transmitted to our AI provider (Lovable AI Gateway, which routes requests to large language models operated by third parties such as Google and OpenAI). We do not use your chats to train third-party models. Do not share information you do not want processed by an AI system (for example, government ID numbers or medical details).

5. Google Maps Platform

Location-based features (Must-Visit Places, Near Me, Healthcare, Cheapest Nearby) use Google Maps Platform (Places API, Routes API, Maps JavaScript API). When you use these features, Google receives your approximate location, the search query, and technical request metadata. Google's use of this data is governed by the Google Privacy Policy and the Google Maps Platform Terms.

6. Payments (Stripe)

UniWay Premium subscriptions are processed by Stripe Payments Europe, Ltd. Stripe acts as an independent controller for payment and fraud-prevention purposes. See the Stripe Privacy Policy. Stripe is the source of truth for subscription state; we synchronize status via signed webhook events.

7. Cookies and analytics

We use strictly necessary cookies and local storage to keep you logged in, remember your language and theme, and secure the Service. These do not require consent. If we introduce non-essential analytics or marketing cookies, you will see a consent banner and can refuse or withdraw at any time. No advertising trackers are used at this time.

8. Sharing and sub-processors

We share personal data only with vetted sub-processors acting on our documented instructions:

  • Supabase (EU) — authentication, database, storage.
  • Stripe — subscription payments.
  • Lovable AI Gateway — AI assistant routing.
  • Google Maps Platform — location features.
  • Hosting/CDN providers used to serve the Service.

We never sell your personal data. Transfers outside the EEA rely on Standard Contractual Clauses and supplementary measures where required.

9. Retention

  • Account data: kept while your account is active and up to 12 months after deletion, unless a longer legal duty applies.
  • Chat history & saved places: kept until you delete them or close your account.
  • Billing records: 10 years, per EU accounting rules.
  • Diagnostics/logs: up to 90 days.

10. Your rights (Art. 15–22 GDPR)

You have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to withdraw consent. Contact tasnimchrichi@gmail.com. You may also lodge a complaint with your local supervisory authority.

11. Security

We apply row-level security on all user data, encrypt data in transit (TLS) and at rest, restrict access to secrets, and verify webhook signatures. No system is perfectly secure — please use a strong unique password.

12. Children

The Service is not directed at children under 16. If you believe a child provided us data, contact us and we will delete it.

13. Changes

We will notify you of material changes by email or in-app. The "Last updated" date above reflects the current version.