Privacy Policy

This policy explains how uniTAD (“we”, “us”) collects and uses your personal data when you use our website and services. We are the data controller. We comply with the UK GDPR and the Data Protection Act 2018.

Who can use uniTAD

The paid features of uniTAD are intended for users aged 18 or over. By creating an account you confirm you are at least 18.

What we collect

• Account data — email, name, your home country and current UK city, and a password (stored only as a secure hash) or a Google sign-in identifier.
• Content you add — profile details, listings and photos you upload, enquiries, job applications and cover notes, and budget entries you record in the money tools.
• Usage data — pages viewed, listings and events you interact with, and basic server log information. If you accept analytics cookies we also record anonymous usage statistics — see Analytics below for exactly what that does and does not include.
• Payment data — handled by Stripe. We never see or store your card details; we hold only Stripe identifiers and your subscription status.

Lawful basis

• Contract — to provide the account, listings, events and subscription you sign up for.
• Legitimate interests — to keep the service secure, prevent abuse, and improve it.
• Consent — for non-essential cookies/analytics (see our Cookie Policy).
• Legal obligation — to meet accounting, tax and fraud-prevention duties.

Who we share data with (processors)

• Stripe — payment processing.
• Supabase — our managed database and infrastructure provider (data hosted under a data-processing agreement).
• Google — only if you choose “Sign in with Google” (we receive your verified email, name and avatar).
• Adzuna, Reed & Careerjet — aggregated job listings; you are linked out to the source site to apply. We do not send your personal data to any of them.
• Resend — sends our transactional email (account verification, password resets, ticket confirmations, enquiry alerts) on our behalf.
• Listing recipients — when you enquire about a listing or apply to a job, we share your message and email address with that lister/employer so they can respond.
• Kitchens — when you start a meal plan, order a dish or ask a kitchen to set a plan up, we pass that kitchen your name, email, phone, delivery area and anything you tell us about allergies or which proteins you eat, because they cook and deliver the food. Allergy information is health data, so we only send what you write in that field and only to the kitchen fulfilling your order.
• Our visa team — a visa enquiry sends your name, email, phone, nationality, chosen visa type and travel timing to the uniTAD team member who handles appointment bookings. We help with booking and paperwork, not with whether an application will succeed, and we do not share these details outside uniTAD.
• Public-data lookups — area scores query postcodes.io, data.police.uk, findthatpostcode (IMD), OpenStreetMap and ONS rent statistics using only the postcode, never your identity. Currency tools query public exchange-rate APIs with amounts only.

Analytics

If you choose “Accept all” on our cookie banner, we record which parts of uniTAD get used so we can decide what to build next. If you choose “Essential only”, or never answer, we record nothing at all — there is no queue waiting for you to change your mind.

This is deliberately built so it cannot identify you:

• No account link — analytics records carry no user ID, even when you are signed in. We cannot tell which records are yours, and neither can our staff.
• No IP address or device fingerprint — we do not store your IP or your browser’s user-agent string. We record only a rough size band (phone, tablet or computer) taken from your window width.
• A per-visit random ID — one visit is joined together by a random value held in your browser for that visit only. It is not a cookie, it is erased when you close the tab, and it links to nothing else.
• Sections, not specific listings — we record that you viewed the jobs section, not which job. Web addresses are reduced to their general form before they leave your browser.
• Never what you type — search text is never recorded. Where a search returns no results we record the filters used, so we know what students want that we do not yet offer.

We record how long a page is open and in front of you, which pages you visit, and a fixed list of actions such as applying for a job or starting a subscription. We do not use any of this for advertising, and we do not build profiles of individual users. Records are deleted after 12 months.

You can change your mind at any time by clearing this site’s data in your browser, which will bring the cookie banner back.

Your rights

Under UK GDPR you can request to:

• access a copy of your data, or have it corrected;
• have your data erased (we offer in-app account deletion);
• export your data in a machine-readable format;
• restrict or object to certain processing, and withdraw consent at any time.

To exercise any of these, contact us (below). You can also complain to the ICO (ico.org.uk).

Retention

We keep your account data while your account is active. On deletion we soft-delete and then purge personal data after a short window, except where we must retain limited billing and audit records to meet legal obligations. Anonymous analytics records are deleted after 12 months.

Visa and meal enquiries are deleted two years after you send them. If you delete your account before that, we anonymise them straight away — the record that a request was made stays, everything identifying you goes. The exception is food you have already paid for: a meal order still to be delivered, or a plan that has not been cancelled, keeps the name and address the kitchen needs to deliver it, and is anonymised once it is finished.

Security

Data is encrypted in transit (TLS) and at rest via our managed database. Passwords are hashed. Access to systems is restricted and logged.

Contact

Privacy questions, or to exercise any of the rights above, email info@tadorg.com.