Privacy
What we do with your documents
Version 2 · 14 October 2026
In one paragraph.
To apply to a university for you we need real documents — your passport, your results, your
photograph. We keep them in an encrypted database in Europe, we send them only to the
university you are applying to, we never sell them, we never put them on WhatsApp, and you can
ask us to delete them.
What we collect, and why
| What | Why we need it |
| Name, email, phone or WhatsApp number, country | To create your account and to reach you |
| Date and place of birth, nationality, address, parents' names | Universities require these on the application form |
| Passport data page, number and expiry | Required by the university and by the consulate for your visa |
| Photograph | Required on the application and on your student file |
| Certificates, transcripts, English test results | To prove eligibility and to set your scholarship band |
| Budget, sponsor, emergency contact | To advise you honestly and to reach someone if you are in trouble |
| CV and cover note, if you apply for a job with us | To consider your application only |
We ask for nothing we do not need. If you think we have asked for something that
is not on this list, challenge us.
Who sees it
- You, at any time, in your portal.
- Your counsellor, and the Orbuni staff who manage your application.
- The universities you apply to, through our official partner channels. This is the whole
point of giving them to us.
- The consulate, when your visa file is submitted.
That is the complete list. We do not sell your data, and we do not share it for
advertising. A partner agency that referred you can see that you exist and how your
application is going — it cannot see a single one of your documents. That is enforced by
the database itself, not by a policy someone might forget.
Where it lives
In an encrypted PostgreSQL database and private file storage operated by Supabase, hosted in
the European Union (Frankfurt). Files are encrypted at rest. Access is by signed, expiring
links rather than public URLs, and every access is logged.
We do not send your documents over WhatsApp. WhatsApp is fine for talking to us. It is
not where a passport belongs, and we will always ask you to upload it to your portal instead.
How long we keep it
- While your application is live, and for as long as you have an account with us.
- If you stop using us: tell us and we will delete your file. If we hear nothing, we delete
student documents two years after your last application.
- Job applications and CVs: twelve months, then deleted.
- We may keep a minimal record of who applied where, for as long as we need it to answer a
question about a past application.
Your rights
Wherever you live, you can ask us to show you what we hold, correct it, delete it, or send it
to you in a portable form. Write to
privacy@myorbuni.com and we will answer within 30 days.
- Nigeria — the Nigeria Data Protection Act 2023 gives you these rights, and the
Nigeria Data Protection Commission (NDPC) supervises them.
- Türkiye — the Personal Data Protection Law (KVKK, Law No. 6698) applies to us as we
operate here.
- If you are in the EU or UK — the GDPR applies to your data, and our storage is
already inside the EU.
We will never charge you to exercise any of these, and we will never make you explain why.
Children
If you are under 18, a parent or guardian must be involved in your application, and we will
ask to speak to them.
The free assessment
When you take the 2-minute assessment we keep your answers, your score and the path it gave
you, with the name, WhatsApp number, email and country you type in. We use them to advise you and
to send the follow-up you asked for on WhatsApp and by email. Every message has a way to stop
it: reply STOP on WhatsApp, or use the unsubscribe link in the email. We also note which link
brought you here (for example our Instagram bio), so we know which posts help people. To see where people stop, the page also
counts anonymous steps (page opened, video played, question reached) under a random number that
your browser forgets when you close the tab. It is not linked to your name unless you send the
form.
Cookies and similar storage
Always on, because the site needs them. Your browser keeps your sign-in so you stay
signed in, and remembers small settings such as light or dark mode and whether you muted the
welcome sound. When you sign in or send a form, Cloudflare Turnstile checks you are not a robot.
When you pay, Whop or Paystack run the checkout and use what they need to take the payment
safely. None of this follows you to other websites.
Ad measurement. The Whop Pixel and the Meta Pixel
tell us which of our adverts brought people who later took the assessment, booked a call or
paid. They can set cookies and share that visit with Whop or Meta. If you visit from the
European Union, the EEA, the United Kingdom or Switzerland, they do not load at all until you
press Accept in the cookie banner. Everywhere else they are on from your first visit,
and you can switch them off at any time below. If your browser sends a Global Privacy
Control signal, we treat it as a no.
You can change your mind at any time: open cookie settings.
Saying no changes nothing else on the site.
Videos on this site play from YouTube's privacy-enhanced (no-cookie) player, and only when you
press play.
Services that handle data for us
- Supabase — our database and private file storage, in the European Union (Frankfurt).
- Netlify — hosts the website.
- Cloudflare — Turnstile, the robot check on sign-in and forms.
- Whop — card payments, our community and courses; the Whop Pixel only with your consent.
- Paystack — payments in naira.
- Twilio and WhatsApp (Meta) — WhatsApp messages between you and us.
- Resend — sends our emails.
- Google — calendar and video-call links when you book a call.
- Anthropic — the AI behind our chat assistant and WhatsApp replies. It receives the
messages it is answering and, when our team asks it about a file, the application details it
needs (for example which documents have arrived). It never receives the documents themselves.
Each works only on our instructions. None of them may sell your data or use it for their own
advertising, and your documents go only where the "Who sees it" list above says.
If something goes wrong
If your data is ever exposed, we will tell you — what happened, what was affected and what we
are doing — without waiting to be asked, and we will notify the regulator where the law
requires it.
Orbuni · Istanbul, Türkiye ·
privacy@myorbuni.com