Your privacy matters to us. This policy explains how we collect, use, and protect your data.
Last updated: May 26, 2026
At riftApply, your privacy is fundamental. We only collect what we need, we protect it rigorously, and we never sell it. This policy is written in plain language so you always know exactly what happens to your data.
riftApply ("we", "us", "our") operates the university admissions platform accessible at riftapply.vercel.app. We are committed to protecting the personal data and privacy of all users — students, agents, and university partners alike. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and your rights regarding your data.
We collect the following categories of personal data: • Identity data: full name, date of birth, nationality, gender. • Contact data: email address, phone number, residential address, city, country. • Account data: username, encrypted password, role (student / agent / university), account status, registration date. • Academic data: transcripts, diplomas, academic certificates, language test scores (IELTS, TOEFL, PTE, DELF, etc.), personal statements, letters of recommendation, and study preferences. • Identity documents: passport copies, national identity cards (CNI), visas — uploaded solely for application purposes. • Company data (agents): business registration documents, company name, address, and agent type. • University data: institution name, accreditation documents, program lists, logos, website, and location. • Usage data: IP address, browser type, pages visited, session duration, login timestamps — collected automatically for security and analytics. • Communication data: messages sent through the Platform between users, agents, and administrators.
We use your personal data strictly for the following purposes: • To create and manage your account on the Platform. • To process and submit your university applications. • To verify the identity and eligibility of agents and universities. • To communicate with you about the status of your applications, account updates, and support requests. • To send email notifications including verification codes, application decisions, and important platform updates. • To detect and prevent fraud, document forgery, and unauthorised access. • To comply with legal obligations and respond to lawful requests from authorities. • To improve the Platform through aggregated, anonymised analytics. We will never sell your personal data to any third party.
All documents uploaded to riftApply — including passports, transcripts, identity cards, and certificates — are stored securely using Cloudinary, an industry-standard cloud storage provider with end-to-end encryption. Documents are: • Stored with AES-256 encryption at rest. • Transmitted over HTTPS/TLS encrypted connections. • Accessible only to authorised personnel and the universities you have applied to. • Never shared with third parties without your explicit consent, except as required by law. • Retained for a maximum of 36 months after your last activity, unless you request earlier deletion.
We process your personal data on the following legal bases: • Contractual necessity: to provide the services described in our Terms of Service. • Legitimate interests: to prevent fraud, ensure platform security, and improve our services. • Legal obligation: to comply with applicable laws and regulations. • Consent: for optional communications and marketing messages — you may withdraw consent at any time.
We share your data only with: • Partner universities you apply to — only the application data and documents required for that specific application. • Verified agents acting on your behalf — only with your authorisation. • Infrastructure providers: MongoDB (database), Cloudinary (file storage), Resend (transactional email), Render (server hosting) — all bound by strict data processing agreements. • Law enforcement or regulatory bodies — only when legally required. We do not sell, rent, or trade your personal data with any third party for marketing purposes.
We retain your personal data for as long as your account is active, plus a period of 36 months thereafter to comply with legal obligations. Unverified accounts (where email verification was not completed) are automatically deleted after 5 minutes. You may request deletion of your account and associated data at any time by contacting privacy@riftapply.com. Documents specifically uploaded for university applications may be retained for the period required by the receiving institution.
Depending on your jurisdiction, you have the following rights regarding your personal data: • Right of access: obtain a copy of the data we hold about you. • Right to rectification: correct inaccurate or incomplete data. • Right to erasure ("right to be forgotten"): request deletion of your data. • Right to restriction: request that we limit how we process your data. • Right to data portability: receive your data in a structured, machine-readable format. • Right to object: object to processing based on legitimate interests. • Right to withdraw consent: for any processing based on your consent. To exercise any of these rights, contact us at: privacy@riftapply.com
riftApply uses strictly necessary cookies for authentication (JWT tokens stored in localStorage) and session management. We do not use third-party advertising cookies or tracking pixels. Usage analytics are collected in an aggregated, anonymised form. You may clear cookies at any time through your browser settings.
The Platform is not intended for children under the age of 16. We do not knowingly collect personal data from persons under 16 without verifiable parental consent. If we discover that a minor has registered without consent, we will delete their account and associated data promptly.
Your data may be processed and stored on servers located outside your country of residence. By using riftApply, you consent to such transfers. We ensure that all international data transfers comply with applicable data protection laws through appropriate safeguards, including standard contractual clauses.
We implement the following technical and organisational security measures: • All passwords are hashed using bcrypt with salt rounds. • All API communications are encrypted via HTTPS/TLS. • Database access is restricted to authorised services only. • Rate limiting and brute-force protection on all authentication endpoints. • Automatic deletion of unverified accounts after 5 minutes. • Regular security audits and vulnerability assessments.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify registered users via email or an in-Platform notice at least 14 days before any material changes take effect. The "Last updated" date at the top of this page always reflects the current version.
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact: Email: privacy@riftapply.com Support: support@riftapply.com We aim to respond to all legitimate requests within 30 days.