College Abroad Guides

    Privacy & Data Protection

    How we handle your data — written in plain English. We follow the principles of the EU General Data Protection Regulation (GDPR), even if you're outside the EU.

    Last updated: April 24, 2026

    No selling, ever

    We don't sell or rent your personal data to anyone.

    Encrypted in transit & at rest

    All traffic uses HTTPS/TLS. Your account password is hashed (bcrypt) — even we can't read it.

    Your saves are yours

    Row‑level database rules ensure only you can see your shortlist and folders.

    Delete anytime

    One email, and your account and all associated data are erased — no questions asked.

    Who we are

    College Abroad Guides ("we", "us") is a free directory and decision tool that helps U.S. students and families compare full‑degree, English‑taught bachelor's programs abroad. This page explains what data we collect, why, how we keep it safe, and the rights you have over it.

    For any privacy question, write to privacy@collegeabroadguides.com.

    What data we collect

    We deliberately collect as little as possible. There are two different "buckets" of data depending on whether you create an account:

    1. Browsing without an account

    • Saves and folders stay in your browser's local storage. They never leave your device unless you sign in.
    • Anonymous analytics (page views, search filters used) help us improve the site. No identifiable information is attached.
    • IP address may be processed by our hosting and CDN providers for security and performance, then discarded.

    2. When you sign up for an account

    • Email address — to create your account, log you in, and (only if you opt in) send service updates.
    • Password — stored as a one‑way bcrypt hash. We never see, store, or log the plaintext.
    • Optional profile — display name, avatar (if you add one).
    • Your shortlist — programs and universities you save, and any folders you create to organize them.
    • Optional information requests — if you submit a "Request More Info" form, the name, email and country you provide are stored so we can pass the request along.

    We do not collect: payment information, government ID, academic transcripts, or contact lists.

    • Contract — to create your account and store your shortlist (Article 6(1)(b)).
    • Legitimate interest — anonymous analytics to improve the product (Article 6(1)(f)).
    • Consent — for any optional emails or "Request More Info" submissions (Article 6(1)(a)). You can withdraw consent at any time.

    How we protect your data

    • Encryption in transit: every page and API call uses HTTPS/TLS 1.2+.
    • Encryption at rest: our managed database (Supabase / PostgreSQL on AWS) encrypts stored data at the disk level (AES‑256).
    • Password hashing: passwords are stored as bcrypt hashes — irreversible, even if a database snapshot leaked.
    • Row‑Level Security (RLS): database policies ensure your saved programs, folders, and notes can only be read by your authenticated user — not by other users, and not by the public API.
    • Least privilege: only a small number of admins can access aggregate data, and only with audited tools.
    • Secrets management: API keys and service credentials live in encrypted secret stores, never in source code.
    • Breach notification: if a breach affecting your data ever occurred, we would notify you within 72 hours, in line with GDPR Article 33.

    Where your data is stored

    Account data is stored on managed PostgreSQL databases operated by our infrastructure provider (Supabase, hosted on AWS). Static assets are served via global CDN. When data is transferred across borders, it is protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

    How long we keep it

    • Account data — for as long as your account is active, then deleted on request (or after 24 months of total inactivity).
    • Information requests — kept for 12 months, then archived or deleted.
    • Anonymous analytics — aggregated and retained indefinitely; cannot be tied back to you.
    • Local browser storage — controlled entirely by you; clear it any time from your browser settings.

    Your rights under GDPR

    Whether or not you live in the EU, you can exercise all of these:

    • Right of access — get a copy of the data we hold about you.
    • Right to rectification — correct anything that's wrong.
    • Right to erasure ("right to be forgotten") — ask us to delete your account and associated data.
    • Right to data portability — receive your data in a machine‑readable format (JSON).
    • Right to object / restrict processing — opt out of any optional processing.
    • Right to lodge a complaint — with your local data protection authority.

    To exercise any of these, email privacy@collegeabroadguides.com from the address tied to your account. We respond within 30 days.

    Cookies & local storage

    We use the bare minimum:

    • Essential — keeps you signed in (a single secure session token).
    • Local storage — stores your shortlist and folders on your device when you're not signed in.
    • Analytics — anonymous, aggregated only.

    We do not use third‑party advertising or cross‑site tracking cookies.

    Third parties

    We rely on a small set of vetted vendors strictly to deliver the service:

    • Supabase — authentication and database (data processor).
    • Mapbox — interactive maps (no personal data shared beyond IP at request time).
    • Editorial automation tools — used internally to draft summaries from public data; never receive your account data.

    Children

    The service is not directed at children under 16. If you believe a child has signed up, contact us and we will delete the account.

    Changes to this policy

    If we make material changes, we'll update the "Last updated" date and, for account holders, send a notice by email.

    Contact

    Questions, requests, or concerns: privacy@collegeabroadguides.com.

    Want a copy of your data — or to delete your account?

    Email us from your account address and we'll handle it within 30 days, no questions asked.

    Request my dataDelete my accountContact us