Privacy Policy | Svvy

1. Introduction

Svvy is operated by SVVY AS (org. no. 934 745 647), a company registered in Norway, at Pilestredet Park 12, 0176 Oslo. SVVY AS is the data controller responsible for the personal data described in this policy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform that connects students with international universities.

Please read this privacy policy carefully. If you have questions or wish to exercise your rights, you can contact us using the details in Section 13.

2. Information We Collect

Personal Information

When you create an account and use our services, we may collect:

Name and contact information (email address)
Account credentials (managed securely through Clerk)
Profile information (educational background, interests)
Optional questionnaire answers (your study plans and intended degree level and field, destination and language preferences, grades, tuition budget and financial-aid needs, extracurricular interests, language certificates, nationality and visa needs). Every question is optional — you can skip any of them and still use the platform.
Documents you upload (transcripts, certificates, identification documents)
Application information submitted to universities
Communication preferences

Automatically Collected Information

When you access our platform, we automatically collect:

Device information (browser type, operating system)
Usage data (pages visited, features used, search queries)
IP address and approximate location
Cookies and similar tracking technologies

Interest and Demand Signals

As you use the platform, we record which universities and programmes you search for, are shown in your search results, view, bookmark or compare, and apply to (including when you click through to a university's own website, or apply to one of our partner universities instead). We use these signals to operate the platform and to give universities aggregated, statistical information about student demand, as described in Section 4.

If you are signed in, these signals are recorded under your account. You can object at any time by turning off demand analytics in your account settings; when you do, we stop recording this activity.
If you are signed out, they are recorded only if you accept analytics cookies. If you have not yet answered the cookie banner, or you choose "Essential Only", this browsing is not recorded. See our Cookie Policy.

For this demand measurement we do not use your IP address, cross-site identifiers, or device fingerprints, and your search text is never disclosed to universities.

3. How We Use Your Information

We use the information we collect to:

Provide and maintain our services
Process your university applications
Match you with relevant educational programs
Communicate with you about your account and applications
Improve our platform and develop new features
Ensure the security of our services
Comply with legal obligations

Legal Basis for Processing (GDPR Article 6)

We rely on the following legal bases, depending on the purpose:

Performance of a contract (Art. 6(1)(b)): creating and running your account.
Consent (Art. 6(1)(a)): storing the documents you upload, which we ask for before your first upload; sending each application and its documents to the university you apply to, which we ask for each time you submit; AI model training on anonymized data (Section 5); and sharing documents with our AdmitAll partner (Section 4). You can withdraw consent at any time.
Legitimate interests (Art. 6(1)(f)): securing the platform and preventing fraud, improving and developing our services, and pursuing university partnerships - including measuring aggregated student demand (Section 4). We balance these interests against your rights, and you may object (Section 8). For signed-out visitors, demand measurement additionally depends on your analytics-cookie consent.
Legal obligation (Art. 6(1)(c)): where we are required to retain or disclose data to comply with the law.

4. Information Sharing

We may share your information with:

Universities (your applications): When you apply to a program, and only after you consent to it when you submit, your application information and the documents you selected are sent to that university, which stores them in its admissions system
Universities (aggregated demand statistics): We share aggregated, statistical information about student demand with universities - including universities you did not apply to - for example how many students searched for or viewed their programmes and what those students had in common (such as country or field of study). This sharing is protected by a minimum group size: we never disclose any figure that would represent fewer than five students, we never share the raw records of your activity or your search text, and these statistics do not identify you
Service Providers: Third-party services that help us operate our platform (hosting, authentication, analytics, and programme search: the text you type into the search box is sent to our search provider so we can match it to programmes by meaning)
AI Development Partner: With your consent, a trusted development partner may process your anonymized data to help build and improve our AI models, under strict contractual obligations (see Section 5)
AdmitAll (application-support partner, Philippines): If you opt in, your grade transcripts and financial-proof documents are shared with AdmitAll, our partner that assists with application support. Access is consent-based, limited, and logged, and you can withdraw consent at any time in your settings. See Section 9 for the international-transfer safeguards
Legal Requirements: When required by law or to protect our rights

We do not sell your personal information to third parties.

5. AI Model Training & Anonymized Data

Svvy is developing AI-powered features to improve the platform experience. With your explicit consent, we may use your anonymized data to train and improve our AI models.

Legal Basis

This processing is based on your explicit consent under GDPR Article 6(1)(a). You may give or withdraw consent at any time via your account settings. This processing is also carried out in compliance with the EU Artificial Intelligence Act (EU AI Act).

What Data Is Used

If you consent, the following categories of data may be used after anonymization:

Profile information (educational background, nationality, field of study)
Education history (degree types, fields of study, institutions)
Application data (program preferences, application patterns)
Search and browsing patterns on the platform

Anonymization Process

Before any data is used for AI training, all personally identifiable information is removed. This includes your name, email address, phone number, street address, date of birth, and any other information that could directly or indirectly identify you. The anonymized data cannot be traced back to you.

Purpose & Limitations

Anonymized data is used solely to train and improve Svvy's own AI models
A trusted third-party development partner may process anonymized data on our behalf to help build and improve our AI models. This partner is bound by a data processing agreement (DPA) that restricts them to processing data solely for Svvy's purposes and prohibits any use of the data for their own training, products, or services
Anonymized data is not sold to or shared with any other third parties
We use AI to review your documents and give you feedback to help you improve your applications. In future, AI may also assist in validating documents, always with human oversight. Matching between students and universities is done by algorithms using the facts you self-report, not by AI
We do not operate an AI chatbot
No automated decisions with legal or similarly significant effects are made based solely on AI outputs; a human remains involved in decisions that affect your application

Your Rights Regarding AI Data Consent

Consent is entirely voluntary — you can use the full platform without consenting
You can withdraw consent at any time in your settings
Upon withdrawal, your data will no longer be included in future AI training datasets
Withdrawal does not affect the lawfulness of processing carried out before withdrawal, or the use of already-anonymized data that can no longer be linked to you

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information. Your documents are stored securely using encrypted storage, and access to your data is restricted to authorized personnel only. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you close your account, we will delete or anonymize your information within 90 days, unless we are required to retain it for legal purposes.

Demand-analytics events (the interest and demand signals described in Section 2) are kept for up to 550 days from when they occur and are then automatically deleted by a routine that runs every week, regardless of whether your account is still open. If you close your account, these events are detached from your account rather than kept against it: the link to your identity is removed and the events remain only as anonymous entries in aggregate statistics that can no longer be traced back to you.

8. Your Rights

Depending on your location, you may have the right to:

Access the personal information we hold about you
Correct inaccurate or incomplete information
Delete your personal information
Export your data in a portable format
Object to or restrict certain processing
Withdraw consent where processing is based on consent

To exercise these rights, please contact us at the email address provided below.

You can act on some of these directly in your account settings: withdraw AI-data consent, manage AdmitAll document sharing, and object to demand analytics at any time.

You also have the right to lodge a complaint with a data protection supervisory authority. In Norway this is the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no). You may also contact the supervisory authority in your country of residence.

9. International Data Transfers

Your personal data is primarily stored within the European Union (our database and document storage are hosted in Ireland). Some of our service providers and partners are located outside the EU/EEA, which means your data may be transferred to and processed in those countries:

United States: certain service providers (for example authentication, hosting, email delivery, and programme search, whose provider processes the text you type into the search box in the United States). Transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or otherwise on the European Commission's Standard Contractual Clauses (SCCs).
Philippines: AdmitAll, an independent application-support partner. AdmitAll is not owned by or part of SVVY, and works only with students from the Philippines. The Philippines is not covered by an EU adequacy decision. These transfers take place only if you have explicitly opted in, and only for the specific documents you choose to share. Access is limited to short-lived links, every access is logged, and you can withdraw your consent at any time in your settings, after which no further documents are shared. We are putting Standard Contractual Clauses in place for these transfers; you can ask us what safeguards currently apply before deciding whether to opt in.

You can request a copy of the safeguards we rely on by contacting us at the details in Section 13.

10. Cookies

We use cookies and similar technologies to operate our platform and improve your experience. For more information, please see our Cookie Policy.

11. Children's Privacy

Svvy is for students aged 18 and over. We do not knowingly collect personal information from anyone under 18.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Data controller: SVVY AS (org. no. 934 745 647), Pilestredet Park 12, 0176 Oslo, Norway
Email: legal@svvybtg.com