Privacy policy

Shortlist researches universities for students on the IB Diploma Programme and delivers the result as a dashboard. To do that we hold your grades and the list of places you are applying to, which is information you would not hand to a stranger. This page says exactly what we keep, why, who else touches it, and how to make us delete it.

The short version

• We collect the minimum needed to research your universities and show you the result.
• Research and first-draft assessments are produced with AI assistance and reviewed by a person before publication. Your brief goes to that assistant without your name or email.
• There is no third-party analytics on this site. No Google Analytics, no advertising pixels, no session recording, no behavioural tracking of any kind.
• We never sell your data or share it for marketing.
• Join the waitlist and your email address is used for one thing: telling you when Shortlist opens.
• Your card details never reach us — Stripe handles payment end to end.
• Ask us to delete your account and we delete it, within 30 days.

Who is responsible for your data

The data controller is Konnecturs LDA (NIPC 518700470), established in Portugal and trading as Shortlist, contactable at hello@uni-shortlist.com. Shortlist is run by one person, so that address reaches the only human with access.

What we collect

Your email address

Taken when you sign in. It is how you sign in, and how we tell you your dashboard is ready or a deadline has changed. There are no passwords on this site, so we never hold one.

Your name and application year

Given during onboarding. The name appears on your own dashboard and in the founder's research queue so a real person can be matched to their research.

Your subjects and grades

Subject names, level (HL or SL), and your predicted, goal and achieved grades, plus core points. This is the core of what the product does: entry requirements are compared against these to work out whether you clear a university's bar.

Your qualification, and earlier grades where a bar asks for them

Which programme you are taking — the IB Diploma today — and, where a university's requirement depends on them, your GCSE or equivalent grades and the languages you have. Some entry requirements cannot be checked without these, so we record whether you have answered as well as what you answered: “I hold none” and “never asked” have to mean different things or the dashboard reports a shortfall you may not have.

Which passports you hold

Asked during onboarding and editable on the grades page, as ISO country codes. It exists for one purpose: universities charge different tuition to domestic, EU and international students, and without it we cannot tell you which of those prices is yours. Leaving it blank is a real option — the dashboard then says it cannot price your tuition, rather than assuming you are international.

The universities and courses you want researched

Including any free-text notes you add about them. This goes into the research queue and is what gets worked on. Where a university runs more than one admission round, such as Early Decision and Regular Decision, we also keep the round you tell us you are applying in, so your calendar shows that round's dates.

Offers and replies you record

If you tell us a university has made you an offer, turned you down, or that you withdrew, we keep what you entered, including any grades or conditions the offer asks for. It is used to keep your dashboard and research up to date. You can change or remove it at any time.

What you add to your own dashboard

Dates, categories, notes and which tasks you have ticked off.

Add-ons we write for you

What you asked for, and the document we write in answer to an add-on such as a visa checklist or a scholarship deep-dive, kept with the request so you can read it again from your requests page.

Whether you have paid, and which plan

A flag and a date, recorded automatically when Stripe confirms the payment, and for each add-on you buy, when that add-on was paid and the Stripe reference for it, or that it came with your plan. We do not receive or store your card number, expiry, or security code at any point. If your research is running late we record when we warned you, and if you cancel we record when your dashboard was closed.

A record of how each assessment was made

When an assessment of how realistic a university is for you is drafted, edited, published or discarded, we keep a copy of it at each step and note which of us reviewed it. It exists so we can show that a person checked every assessment before you saw it.

Which update emails we have sent you

When a date or fact on your dashboard changes and we email you about it, we record which email it was, what changed, and whether it was sent.

That you agreed to the terms, and who was buying

When you accepted the terms and which version was on screen, the same acceptance recorded by Stripe at checkout, whether the buyer said they were the student or a parent or guardian, and when we sent the purchase confirmation. We keep these because the law requires us to be able to show we told you what you were buying and what your cancellation rights were — not to profile you. You cannot edit them for the same reason.

What we do not collect

We do not ask for your date of birth, postal address, phone number, school, photograph, or identity documents. We do not run analytics, advertising, or tracking scripts. We do not build a profile of you for any purpose other than researching the universities you asked us to research. If you type something into a free-text box that we did not ask for, it is stored as you wrote it and is sent to the research assistant described below — so please do not put anything there you would not want us to hold.

Why we are allowed to hold it

Almost all of it is held to perform the contract you entered when you bought the research: we cannot tell you whether you clear Imperial's bar without your grades. Keeping the service running and secure, and keeping records of what was sold, rests on our legitimate interests and on the ordinary legal requirement to keep sales records. The one thing that rests on your consent is the waitlist, because joining it is the one optional thing here. Beyond it there is no marketing list, no analytics and no cookie banner.

The waitlist

Until Shortlist opens to new students, you can join a waitlist instead. If you do, we keep:

• Your email address.
• Where you came from, if the link you followed carried a tag such as ?ref=instagram, so we know which posts work. It is the tag we keep, and nothing about you.
• When you joined, and which of the emails below we have sent.

It is used to email you, and for nothing else: a confirmation when you join, and one email when Shortlist opens — or, if we let you in before then, one saying so. Your address is not added to any other list and is not shared with anyone. If you signed in to Shortlist before it opened, the account that created is kept as well — it holds only your email address — so you can carry on from it when we open.

We hold it because you asked us to. You can withdraw that at any time, with the link at the bottom of either email or by writing to us, and we delete your address. Otherwise we delete it within 30 days of sending the email that says Shortlist is open. Supabase stores it, Resend sends the emails and Cloudflare Turnstile checks that the form is being filled in by a person — the same companies, doing the same jobs, described below.

Automated decisions

Whether your grades clear a university's published entry requirement is worked out by a calculation, and you see the result. It is a comparison shown to you, not a decision made about you: nobody is accepted, rejected, priced or ranked by it. Where the published requirement cannot be checked against your subjects, the dashboard says so rather than guessing.

The other half of your dashboard — how realistic a place looks, and the note explaining why — is drafted with AI assistance and then read, edited and approved by a person before you ever see it. No estimate is published automatically. It remains an opinion rather than a measurement, it is labelled as one on the dashboard, and if you think it is wrong you can say so at the address at the bottom of this page and a person will answer.

Who else processes it

These are the only companies with access, each doing one job. None of them are permitted to use your data for their own purposes.

Supabase

The database and the sign-in system. Your data is stored in their EU region (Stockholm). Everything in the list above lives here.

Vercel

Serves the site. Handles your requests in transit and keeps ordinary short-lived server logs, which include IP addresses.

Resend

Sends the emails — your sign-in link, your receipt, the note that your dashboard is live or an add-on is ready, deadline and course corrections, a warning if your research is running late, confirmation of a cancellation, and the waitlist's two emails. Receives your email address and the contents of those messages.

Stripe

Takes the payment on their own hosted checkout page. You give your card details to Stripe, not to us; we are told only that someone paid, with the name and email used at checkout.

Anthropic

Runs Claude, the AI assistant used to produce first-draft research and first-draft assessments, which a person then checks and edits before anything is published to you. What it receives is a research brief: your subjects and grades, the universities and courses on your list, anything you typed into a free-text box (including what you asked for in an add-on), your passport codes where a tuition rate, scholarship or visa depends on them, any offer or rejection you have recorded with the points total an offer asks for, and the assessments already on your dashboard. It is not given your name, your email address, or the identifier your records are stored under — that identifier is replaced by a one-way code before the brief leaves us. This does not make the brief anonymous: it is still information about you, and we could still match it back. It is processed outside the EU, in the United States.

Google

Only if you choose “Sign in with Google”. We ask Google for your email address and basic profile — nothing else, and never your Gmail, Drive, contacts or calendar. It is used to sign you in and to reach you about your dashboard, and it is not transferred to anyone else or used for advertising. If you sign in with an email link instead, Google receives nothing.

Cloudflare

Runs Turnstile, a background check on the sign-in and waitlist forms that confirms you are a person rather than a script, so a bot cannot drain our email quota and lock real students out. For almost everyone it runs silently and shows nothing on screen. It processes a few technical signals — things like IP address and browser signals — solely to tell human from bot, never to identify, profile or track you. See Cloudflare's Turnstile Privacy Addendum.

Cookies and local storage

The site sets a session cookie when you sign in, which is what keeps you signed in, and stores your light or dark theme choice in your browser's local storage. That is the complete list. Both are strictly necessary for the site to work as you asked it to, neither tracks you anywhere, and there is nothing here to opt out of — which is why you are not being shown a cookie banner.

Age

This product is for people applying to university, most of whom are 16 to 19. If you are under 18, a parent or guardian must be the one to buy it, and if you are under 16 we need their permission before you give us your grades. A parent or guardian can ask us at any time to show them what we hold about their child, or to delete it, using the address below.

How long we keep it

Your account and dashboard stay while you are using them — an application cycle runs well over a year, and the point of the maintenance promise is that your dashboard stays correct across it. If you ask us to delete your account we do so within 30 days. If an account goes untouched for two years after its application year ends, we delete it without being asked. Records of what was sold are kept for as long as tax law requires. A waitlist address is kept until you leave the list or for 30 days after the email that says Shortlist is open, whichever comes first.

One thing outlives your account, deliberately: the research itself. Facts about a university — its deadlines, entry requirements and costs — are not personal data and are shared by every student who tracks that university. Deleting your account removes you, your grades, your selections, the offers you recorded, your requests and any add-ons we wrote for you, and your notes; it does not remove Imperial's application deadline from the library.

Your rights

You can ask us to give you a copy of everything we hold about you, to correct anything wrong, to delete it, to restrict what we do with it, or to object to us holding it. You can also ask for it in a portable form. Email hello@uni-shortlist.com and we will answer within 30 days. There is no charge and you do not have to give a reason.

Most of it you can do yourself without asking: your subjects and grades are editable on the grades page for the whole cycle, and your own dates and notes are yours to change or remove at any time.

If you think we have handled your data badly, please tell us first — it is one person and it is probably a mistake we can fix. You also have the right to complain to the Comissão Nacional de Proteção de Dados (CNPD), Portugal's data protection authority, or to the equivalent authority in the EU country where you live.

How it is kept safe

Every student's rows are isolated in the database itself by row-level security, rather than by application code remembering to check — one student cannot read another's data even if the site has a bug. Administrative access is separated from ordinary access and is re-checked on every request rather than assumed from a previous screen. Everything travels over HTTPS. No system is perfect, and if something goes wrong that puts your data at risk we will tell you and the relevant authority promptly.

Changes

If this policy changes in a way that affects what we do with your data, we will email you rather than quietly changing the date at the top. The date at the top is when it last changed.

Contact

hello@uni-shortlist.com — for anything on this page, including deletion requests.

Terms of service →