Privacy Policy
Operated by Aytek Yenisen, sole trader (empresario individual / autónomo), trading under the business name "uni4real"
Effective date: 20 June 2026
Last updated: 20 June 2026
Plain-language summary (not part of the binding policy): We are uni4real, operated by Aytek Yenisen. We collect the information needed to run the platform: your account details, verification data, what you tell us, payment information (handled by Stripe), and Session activity. We may monitor Sessions for safety, but we don't record every call. We host data in the EU, we don't sell your data, and you have strong rights over it (access, correction, deletion, and more). If you're under 18, a parent or guardian must consent first. This summary is a quick guide; the full policy is below.
1. Who we are (data controller)
1.1. Aytek Yenisen, an individual operating as a sole trader (empresario individual / autónomo) under the business name "uni4real", with business address at Calle de Toledo 123, 1A, 28005 Madrid, Spain ("uni4real", "we", "us", "our"), is the data controller responsible for your personal data processed through the uni4real platform (the "Platform").
1.2. Contact. For any privacy question or to exercise your rights, contact us at support@uni4real.com, or by post at the address above.
1.3. This Policy explains how we collect, use, share, and protect personal data, and your rights under the EU General Data Protection Regulation (GDPR) and Spanish data-protection law (Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales, "LOPDGDD"). It should be read together with our Terms of Service.
2. The personal data we collect
We collect the following categories of data:
2.1. Information you give us
- Account data: name, email address, password, and your age or date of birth.
- Insider verification data: your institutional ("school") email address and information submitted for our internal profile review (e.g. evidence of enrolment).
- Parental consent data (for users under 18): the parent or legal guardian's full legal name, email address, and a record of the consent they provide (including date and content).
- Profile and onboarding data: profile details and your responses to the onboarding/matching quiz.
- Payment data: payment information you provide is processed by Stripe; we receive limited transaction data (such as confirmation of payment and the last digits of a card) but we do not store full card numbers.
- Communications: messages you send through the Platform and any correspondence with our support team.
2.2. Information from your Sessions
- Session activity: scheduling and participation data, in-Session messages, and, where a Session is recorded, the audio/video recording (see Section 6).
2.3. Information we collect automatically
- Technical and usage data: IP address, device and browser information, log data, pages and features used, and timestamps.
- Cookies and similar technologies: see Section 11.
- Analytics data: aggregated and individual usage data collected through our analytics tools.
2.4. Information from third parties
- Data from our payment processor (Stripe) relating to your transactions, and data arising from our verification processes.
We do not intentionally collect special categories of data (e.g. health, race, religion). Please do not share such data in Sessions or messages unless necessary.
3. How we use your data and our legal bases
Under the GDPR we must have a lawful basis for each use. We rely on the following:
| What we do | Why | Legal basis |
|---|---|---|
| Create and manage your account; provide the Platform; book and run Sessions; process Credits and payments via Stripe | To deliver the service you signed up for | Performance of a contract (Art. 6(1)(b)) |
| Verify Insiders (school email + internal review); detect and prevent fraud, abuse, and circumvention; monitor Sessions for safety and quality; secure the Platform | To keep Users safe, protect the service, and run our business responsibly | Legitimate interests (Art. 6(1)(f)) |
| Record Sessions (where we do so); send marketing or newsletters; use non-essential cookies and analytics; process the personal data of users under 18 | These uses require your permission | Consent (Art. 6(1)(a)) |
| Keep records, respond to legal requests, meet tax/accounting and child-safety obligations | To comply with the law | Legal obligation (Art. 6(1)(c)) |
| Protect someone's vital interests, e.g. a serious safety concern involving a minor | Safety | Vital interests / legal obligation (Art. 6(1)(d)/(c)) |
You can withdraw consent at any time (this does not affect processing already carried out). Where we rely on legitimate interests, you may object; see Section 9.
4. The onboarding/matching quiz (profiling, not automated decisions)
4.1. We use your quiz responses and profile to suggest Insiders we think may be a good match, including by comparing profiles using a matching technique.
4.2. These are suggestions only. You always choose which Insider to book. We do not make decisions that produce legal or similarly significant effects about you solely by automated means within the meaning of Article 22 GDPR. The final choice is yours.
5. Special protections for users under 18
5.1. The Platform is only available from age 16, and users under 18 may only use it with verifiable parental or guardian consent (as described in our Terms).
5.2. We collect and retain the parent/guardian's name, email, and consent record to demonstrate that consent was given.
5.3. A parent or legal guardian may, at any time, request access to their minor's data, withdraw consent, and request deletion/closure of the account, by contacting support@uni4real.com.
5.4. We apply additional safeguards to data and Sessions involving minors, including enhanced monitoring, and we will act on, and where appropriate report, any safety concern.
6. Monitoring and recording of Sessions
6.1. We reserve the right to monitor Sessions and Platform activity for safety, quality, fraud-prevention, and legal-compliance purposes. This does not mean every Session is recorded.
6.2. Where a Session is recorded, we will indicate this in line with applicable law, and the recording is treated as personal data under this Policy. Recordings are stored on our EU-based infrastructure (see Section 8) and retained only as described in Section 10.
6.3. The video calling functionality is operated by us on our own infrastructure; Session audio/video is not routed through a third-party video vendor for the purpose of providing the call.
7. Who we share your data with
We do not sell your personal data. We share it only as follows:
7.1. Other Users: the Insider or Applicant you connect with will see the information necessary to conduct your Session (e.g. your display name and Session activity).
7.2. Service providers (processors) acting on our instructions, including:
- Stripe: payment processing;
- DigitalOcean: server, hosting, and database infrastructure (EU region);
- analytics and product-measurement tools;
- email and customer-support tools.
7.3. Authorities and third parties where required by law, to comply with legal process, to enforce our Terms, to prevent fraud or harm, or to protect the safety of Users, particularly minors.
7.4. Business transfers: if we are involved in a merger, acquisition, asset sale, or a change in the legal form under which the business operates (including incorporation as a company), data may be transferred as part of that transaction, subject to this Policy.
All processors are bound by data-processing agreements requiring them to protect your data and use it only as instructed.
8. Where your data is stored and international transfers
8.1. We host personal data on infrastructure located in the European Union (including via DigitalOcean's EU region).
8.2. Because our Users are global and the schools our Users consider span the EU and the US, some data may be accessed from or transferred to countries outside the European Economic Area (EEA); for example, where a User connects from outside the EEA, or where a processor (such as Stripe) operates internationally.
8.3. Where data is transferred outside the EEA, we put appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses (SCCs) or transfers to countries with an adequacy decision. You may request a copy of the relevant safeguards by contacting us.
9. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), where applicable;
- Restrict processing in certain circumstances;
- Data portability: receive your data in a portable format;
- Object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent at any time where processing is based on consent;
- Not be subject to solely automated decisions with legal or similarly significant effects (see Section 4);
- Lodge a complaint with a supervisory authority. In Spain this is the Spanish Data Protection Authority (Agencia Española de Protección de Datos, "AEPD"), www.aepd.es. You may also complain to the authority in your country of residence.
To exercise any right, email support@uni4real.com. We will respond within the timeframes required by law (generally one month). We may need to verify your identity first.
10. How long we keep your data
10.1. We keep personal data only as long as necessary for the purposes described, then delete or anonymize it. As general guidance:
- Account data: for as long as your account is active, then up to 12 months after closure (longer where required by law).
- Parental consent records: for as long as the minor uses the Platform, plus a reasonable period afterward to evidence consent.
- Session recordings (where made): up to 90 days, unless needed for an active safety, dispute, or legal matter.
- Transaction and accounting records: for the period required by Spanish tax and accounting law (generally between 4 and 6 years).
- Support communications: up to 24 months.
10.2. We may keep certain data longer where necessary to comply with legal obligations, resolve disputes, prevent fraud, or protect safety.
11. Cookies and analytics
11.1. We use cookies and similar technologies for essential functions (such as keeping you logged in), and, with your consent, for analytics and performance measurement.
11.2. We use analytics tools to understand how the Platform is used and to improve it.
11.3. Where required, we present a cookie-consent banner so you can accept or reject non-essential cookies, and you can change your choices at any time. You can also control cookies through your browser settings.
12. Security
12.1. We implement reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, including encryption in transit, access controls, and restricting Session monitoring/recordings to authorized purposes.
12.2. No system is completely secure. You are responsible for keeping your login credentials confidential. If we become aware of a personal-data breach that is likely to result in a risk to your rights, we will notify you and the relevant authority as required by law.
13. Changes to this Policy
13.1. We may update this Policy from time to time. If we make material changes, we will provide reasonable notice (e.g. by email or an in-Platform notice). The "Last updated" date above shows the latest version. Your continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.
14. Contact
Questions, requests, or complaints about this Policy or your data:
Aytek Yenisen (uni4real)
Email: support@uni4real.com
Address: Calle de Toledo 123, 1A, 28005 Madrid, Spain
Made for students choosing where to spend the next four years.