Privacy Policy

The short version

We collect what the platform needs to work and nothing for advertising. There are no third-party analytics or tracking scripts on this site. We do not sell your data. The transcript file you upload is read once and thrown away — only the course rows we extract from it are kept.

What we collect

• Account — your email address and name. If you sign in with Google we receive your email address, name and profile picture from Google; we never see your Google password.
• Profile — the photo, major and current semester you enter during onboarding, and anything else you later add to your profile.
• Studies — the courses you enrol in here, and the courses, grades and credits extracted from a transcript you choose to import.
• AI advisor conversations — the messages you send and the replies you get, so the conversation is still there when you come back.
• Security — your IP address is used as a short-lived counter to limit how many requests can be made per minute. It is not stored against your account and expires within minutes.

Your transcript is not kept

When you upload a transcript, the file is parsed in memory and discarded in the same request. It is never written to disk or to storage. What we save is the structured result: course code, title, grade, credits and term. An academic transcript is sensitive, and an extra copy of one is a liability rather than a feature.

Who else processes it

• Supabase — authentication and the database, hosted in the EU.
• Vercel — hosting; the application runs in the Frankfurt region.
• Anthropic — when you use the AI advisor, your message and the study context it needs (your courses, grades and the catalogue) are sent to Anthropic's Claude model to generate a reply.
• Google — only if you choose to sign in with Google.

These are processors acting on our instructions. We do not pass your data to anyone else, and there is no advertising network involved.

Why we are allowed to

Under the GDPR we rely on the contract between us to run your account and show you your studies, on your consent for anything optional you switch on, and on our legitimate interest in keeping the service secure and available.

Age

WBU is for people aged 16 and over. If we learn that an account belongs to someone younger, we will delete it.

How long we keep it

For as long as your account exists. Deleting your account removes the profile, enrolments, imported course records, advisor conversations and profile photo along with it. You can also delete an imported transcript on its own, without closing your account — your GPA and completed credits are reset with it.

Your rights

Two of these you can exercise yourself, immediately, from Profile → Your data: download everything we hold about you as a JSON file, and delete your account or just the imported transcript. Individual advisor conversations can be exported from the advisor page.

For anything else — correcting something, objecting to how we use it, or a question about any of the above — write to privacy@wbu.name and we will act within one month. If you think we have got it wrong, you can complain to your national data protection authority.

Cookies

Only the ones that keep you signed in. There are no advertising or analytics cookies, so there is no consent banner to click away.

Changes

If this policy changes we will update the date at the top and, for anything significant, tell you in the app.

Contact

privacy@wbu.name