Privacy policy

Shortlist researches universities for students on the IB Diploma Programme and delivers the result as a dashboard. To do that we hold your grades and the list of places you are applying to, which is information you would not hand to a stranger. This page says exactly what we keep, why, who else touches it, and how to make us delete it.

The short version

• We collect the minimum needed to research your universities and show you the result.
• There is no third-party analytics on this site. No Google Analytics, no advertising pixels, no session recording, no behavioural tracking of any kind.
• We never sell your data or share it for marketing.
• Your card details never reach us — Stripe handles payment end to end.
• Ask us to delete your account and we delete it, within 30 days.

Who is responsible for your data

The data controller is Konnecturs LDA (NIPC 518700470), established in Portugal and trading as Shortlist, contactable at hello@uni-shortlist.com. Shortlist is run by one person, so that address reaches the only human with access.

What we collect

Your email address

Taken when you sign in. It is how you sign in, and how we tell you your dashboard is ready or a deadline has changed. There are no passwords on this site, so we never hold one.

Your name and application year

Given during onboarding. The name appears on your own dashboard and in the founder's research queue so a real person can be matched to their research.

Your subjects and grades

Subject names, level (HL or SL), and your predicted, goal and achieved grades, plus core points. This is the core of what the product does: entry requirements are compared against these to work out whether you clear a university's bar.

The universities and courses you want researched

Including any free-text notes you add about them. This goes into the research queue and is what gets worked on.

What you add to your own dashboard

Dates, categories, notes and which tasks you have ticked off.

Whether you have paid, and which plan

A flag and a date, set by hand after Stripe tells us a payment arrived. We do not receive or store your card number, expiry, or security code at any point.

What we do not collect

We do not ask for your date of birth, postal address, phone number, school, nationality, photograph, or identity documents. We do not run analytics, advertising, or tracking scripts. We do not build a profile of you for any purpose other than researching the universities you asked us to research. If you type something into a free-text box that we did not ask for, it is stored as you wrote it — so please do not put anything there you would not want us to hold.

Why we are allowed to hold it

Almost all of it is held to perform the contractyou entered when you bought the research: we cannot tell you whether you clear Imperial's bar without your grades. Keeping the service running and secure, and keeping records of what was sold, rests on our legitimate interests and on the ordinary legal requirement to keep sales records. We do not rely on consent for anything, because there is nothing optional to consent to — no marketing list, no analytics, no cookie banner.

Automated decisions

Whether your grades clear a university's published entry requirement is worked out by a calculation, and you see the result. It is a comparison shown to you, not a decision made about you: nobody is accepted, rejected, priced or ranked by it, and the judgment on your dashboard about how realistic a place is comes from a person. Where the published requirement cannot be checked against your subjects, the dashboard says so rather than guessing.

Who else processes it

These are the only companies with access, each doing one job. None of them are permitted to use your data for their own purposes.

Supabase

The database and the sign-in system. Your data is stored in their EU region (Stockholm). Everything in the list above lives here.

Vercel

Serves the site. Handles your requests in transit and keeps ordinary short-lived server logs, which include IP addresses.

Resend

Sends the emails — your sign-in link, the note that your dashboard is live, and deadline corrections. Receives your email address and the contents of those messages.

Stripe

Takes the payment on their own hosted checkout page. You give your card details to Stripe, not to us; we are told only that someone paid, with the name and email used at checkout.

Google

Only if you choose “Sign in with Google”. We ask Google for your email address and basic profile — nothing else, and never your Gmail, Drive, contacts or calendar. It is used to sign you in and to reach you about your dashboard, and it is not transferred to anyone else or used for advertising. If you sign in with an email link instead, Google receives nothing.

Cloudflare

Runs Turnstile, a background check on the sign-in form that confirms you are a person rather than a script, so a bot cannot drain our email quota and lock real students out. For almost everyone it runs silently and shows nothing on screen. It processes a few technical signals — things like IP address and browser signals — solely to tell human from bot, never to identify, profile or track you. See Cloudflare's Turnstile Privacy Addendum.

Cookies and local storage

The site sets a session cookie when you sign in, which is what keeps you signed in, and stores your light or dark theme choice in your browser's local storage. That is the complete list. Both are strictly necessary for the site to work as you asked it to, neither tracks you anywhere, and there is nothing here to opt out of — which is why you are not being shown a cookie banner.

Age

This product is for people applying to university, most of whom are 16 to 19. If you are under 18, a parent or guardian must be the one to buy it, and if you are under 16 we need their permission before you give us your grades. A parent or guardian can ask us at any time to show them what we hold about their child, or to delete it, using the address below.

How long we keep it

Your account and dashboard stay while you are using them — an application cycle runs well over a year, and the point of the maintenance promise is that your dashboard stays correct across it. If you ask us to delete your account we do so within 30 days. If an account goes untouched for two years after its application year ends, we delete it without being asked. Records of what was sold are kept for as long as tax law requires.

One thing outlives your account, deliberately: the research itself. Facts about a university — its deadlines, entry requirements and costs — are not personal data and are shared by every student who tracks that university. Deleting your account removes you, your grades, your selections and your notes; it does not remove Imperial's application deadline from the library.

Your rights

You can ask us to give you a copy of everything we hold about you, to correct anything wrong, to delete it, to restrict what we do with it, or to object to us holding it. You can also ask for it in a portable form. Email hello@uni-shortlist.com and we will answer within 30 days. There is no charge and you do not have to give a reason.

Most of it you can do yourself without asking: your subjects and grades are editable on the grades page for the whole cycle, and your own dates and notes are yours to change or remove at any time.

If you think we have handled your data badly, please tell us first — it is one person and it is probably a mistake we can fix. You also have the right to complain to the Comissão Nacional de Proteção de Dados (CNPD), Portugal's data protection authority, or to the equivalent authority in the EU country where you live.

How it is kept safe

Every student's rows are isolated in the database itself by row-level security, rather than by application code remembering to check — one student cannot read another's data even if the site has a bug. Administrative access is separated from ordinary access and is re-checked on every request rather than assumed from a previous screen. Everything travels over HTTPS. No system is perfect, and if something goes wrong that puts your data at risk we will tell you and the relevant authority promptly.

Changes

If this policy changes in a way that affects what we do with your data, we will email you rather than quietly changing the date at the top. The date at the top is when it last changed.

Contact

hello@uni-shortlist.com — for anything on this page, including deletion requests.

Terms of service →