Privacy

What we collect, and what we do not

You can read every page on this site without an account, without giving us anything, and without being asked to. This page is about the few times that is not true.

Who we are

A.I.T. Multiverse Consulting Ltd, Cyprus, is the data controller (company details in the legal notice). Write to privacy@studiesmultiverse.com.

If you just read the site

Nothing identifying is collected. We use Cloudflare Web Analytics, which counts page views without cookies, without a device fingerprint, and without anything that follows you between sites. We cannot tell one reader from another and do not try to.

We count visits ourselves as well: one per browser session, as a number per day and country (the country comes from the network your request arrives on). No cookie, IP address or identifier is stored, and the count cannot be traced back to you. A marker that says only “already counted” stays in the open tab so one visit is not counted twice; it is gone when you close the tab.

We also use Google Analytics to understand which pages help people. In the EU, the UK and Switzerland it sets no cookie and stores nothing on your device unless you agree in the consent message; until then Google receives only anonymous, cookieless signals. IP addresses are not stored by Google Analytics. Lawful basis: your consent (EU, UK, Switzerland), otherwise our legitimate interest. Google keeps this data for 14 months.

Our servers keep ordinary request logs, including your IP address, for a short period to keep the site up and to stop abuse. Lawful basis: our legitimate interest in running a working, un-attacked service.

If you save schools to a shortlist

The shortlist lives in your own browser. It is never sent to us, so we could not read it if we wanted to. Clear your browser data and it is gone.

If you write to an institution

The question form on an institution’s page asks for your name, your email and your message, and optionally your nationality, where you live, the level and subject you want, when you want to start and your budget for a year. All of it is emailed to the institution you wrote to, which then answers you and becomes responsible for your message as its own controller. We keep a copy so that we can answer you if the institution never replies, and so the institution can find the message later. Where the institution does not manage its page with us, we email your question to its public admissions or general address, and it answers you directly.

• Lawful basis: performing the service you asked for.
• Who else sees it: the institution you wrote to. Nobody else. We do not sell enquiries, pass them to agents, or use them to market anything to you.
• How long: two years, then deleted.

If you manage a listing

We store the email address you sign in with, your password in hashed form only (we cannot read it), a hash of your sign-in code, and, if you turn on two-step sign in, a secret shared with your authenticator app. We record each sign-in attempt with its time, IP address, country and browser, which is what lets you see a sign-in from somewhere you have never been, and lets us stop someone guessing.

• Lawful basis: performing the contract, and our legitimate interest in keeping your account from being taken.
• How long: for as long as you hold the listing, and twelve months afterwards. Sign-in records are kept twelve months.
• What we never store: your password or sign-in code in readable form. Nothing we hold can be used to sign in as you.

Record of who manages each page. So that we can show who claimed and runs each page and what was agreed, we keep a short record of the key steps: the request to take over the page and the confirmation given with it, our approval, acceptance of these terms, when the password and two-step sign-in were set up, changes made to the page, and, for each email between us about the listing, its date, subject and a digital fingerprint. The record holds no email text, no IP addresses and no one-time links or codes; the emails themselves stay in our mailbox. Each entry is sealed so that any later change would show.

• Lawful basis: our legitimate interest in being able to show who manages each listing, and in establishing or defending legal claims.
• How long: while you manage the page, and six years after you stop, then deleted.

If you apply to be listed

The form at /join/apply/ asks for your organisation, your name, role, work email, an optional phone number and your message. A person at Studies Multiverse reads it and replies.

• Lawful basis: steps you asked us to take before a contract, and your consent to be contacted about the request, which you can withdraw at any time.
• Who else sees it: nobody outside Studies Multiverse.
• How long: two years after we last hear from you, then deleted.

If you write a review

The review form asks for your first name, your email, your country, whether you study or studied there, and your review and ratings. Your first name, country, relationship to the institution, the year you started and your review are published; your email is never shown. We use it once to confirm the review is yours, and to tell you when it is published or why it was not.

• Lawful basis: your consent, given when you tick the box; you can ask us to take your review down at any time.
• Who else sees it: everyone, for the published parts; nobody outside Studies Multiverse for your email.
• How long: a published review stays until you or we take it down. Unconfirmed reviews are deleted after 30 days, rejected ones after a year.

If you ask the study advisor

Your question is sent to an AI model run by Cloudflare (Workers AI) to write the answer, together with listings from this portal. We do not ask who you are and do not attach your question to you. To stop the advisor being abused, we count questions per connection for fifteen minutes. Please do not type personal details into it.

The advisor is an AI system, and it says so every time it opens: its answers are produced by a language model, not written by a person, as the EU Artificial Intelligence Act (Article 50) requires us to make clear. Its answers are limited to what this portal holds and can still be wrong; nothing it says is immigration, legal or financial advice. The rest of the site is written from official sources and reviewed by people; parts of the non-English pages are translated by machine and say so at the foot of the page.

Where your data goes

The site runs on Cloudflare, which processes data in the region closest to you. Email is sent through Microsoft 365. Cloudflare and Microsoft act as our processors under data processing agreements, and none of them is given your data to use for their own marketing.

Some of these companies may process data outside the European Economic Area. Where they do, the transfer is covered by the EU Standard Contractual Clauses or by the EU-US Data Privacy Framework.

We do not make decisions about you by automated means that have legal or similarly significant effects.

Your rights

Under the GDPR you may ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict its use, object to processing, withdraw a consent you gave, or ask for it in a portable form. Write to privacy@studiesmultiverse.com and we will answer within thirty days. There is no charge and we will not ask you why.

If we get it wrong you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy), or to the authority where you live. We would rather you told us first.

Children

This site is for people choosing where to study. Accounts are for institutions and organisations, not for students, and the forms here are not meant for anyone under sixteen. We do not knowingly collect a child’s data. If you think we hold a child’s data, write to us and it will be deleted.

Privacy · Cookies · Terms · Legal notice · Accessibility · How we make money · Corrections