Privacy Policy

For any privacy-related questions or to exercise your rights, contact us at [email protected].

We collect the following categories of personal data:

2.1 Data you provide directly

• Account data: name, email address, password (encrypted)
• Profile data: nationality, education background, target programs
• Application documents: diplomas, transcripts, motivation letters, CVs
• Communication: messages, support requests, feedback
• Payment data: billing address, payment method (processed by Stripe)

2.2 Data collected automatically

• Technical data: IP address, browser type, device information
• Usage data: pages visited, features used, time spent (collected via Google Analytics and YHAD Analytics — a cookieless analytics tool running on our own infrastructure)
• Cookies: see our Cookie Policy

2.3 Data from third parties

• Google Sign-In: name, email, profile picture (if you use Google login)

3.1 Email Communications

We send two types of emails:

• Transactional emails — account verification, payment confirmations, document status updates, deadline reminders, and support replies. These are tied to your use of the service and you continue to receive them as long as you have an active account.
• Onboarding and marketing emails — a short welcome series sent to new signups (five emails over two weeks) introducing our application checklist, guides, deadlines, and services. We send these on the basis of legitimate interest in the customer relationship you established by signing up. The series stops automatically if you purchase a service package.

You can opt out of marketing emails at any time using the one-click Unsubscribe link in the footer of every marketing email — no login required. We store your preference and honor it on all future marketing emails. Opting out of marketing does not stop transactional emails — those continue because they are necessary for the service you signed up for.

If you change your mind, you can re-enable marketing emails by contacting us at [email protected].

We do not sell your personal data. We share data only with:

With your cookie consent, we use OpenAI’s Measurement Pixel and Conversions API to measure whether ads in ChatGPT lead to visits, enquiries, and purchases on StudyPath. OpenAI receives public-page view events, successful service and Zoekjaar enquiry events, and motivation-letter checkout and completed-payment events. We mark these events as opted out of future user-level personalization.

Measurement data includes event identifiers and times, the website address, browser information, an advertising attribution identifier stored in the first-party __oppref cookie when available, and purchase amounts and currency. Browser requests also expose your IP address to OpenAI. Our server sends page origins and paths with query strings and fragments removed. The Pixel manages its own transport information.

After a successful enquiry or checkout start, we also share a SHA-256 hash of your email address for conversion matching. We normalize and hash the address before sending it to OpenAI; hashing does not make this data anonymous. We do not include uploaded documents, enquiry messages, phone numbers, or education and visa details in our conversion payloads.

For motivation-letter purchases, your measurement consent at checkout, attribution identifier, page address, and browser information may be stored with the Stripe checkout session. This lets our server report a confirmed payment even if you do not return to our website. A payment already initiated with consent can therefore be reported after you leave the page.

You can decline measurement using “No thanks” or change your choice using the button below. Declining does not affect enquiries, payments, or access to our services. Withdrawal stops new browser measurement and tracking on subsequent submissions; it does not recall events already sent or cancel reporting for a checkout already initiated with consent. Contact [email protected] for questions or deletion requests concerning those records.

OpenAI may process this data outside the EEA. Its processing, international transfers, retention, and your rights are described in the OpenAI Privacy Policy. The general analytics retention period below is not a promise about OpenAI’s retention. Stripe checkout metadata follows the retention applicable to the associated Stripe records.

Some of our service providers are located outside the European Economic Area (EEA), primarily in the United States. We ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework certification (where applicable)
• Standard Contractual Clauses (SCCs) approved by the EU
• Binding Corporate Rules

You can request a copy of applicable safeguards by contacting us.

After the retention period, data is securely deleted or anonymized.

Under GDPR, you have the following rights:

To exercise your rights, email us at [email protected]. We respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority: Autoriteit Persoonsgegevens

We implement appropriate security measures including:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data
• Access controls and authentication
• Regular security assessments
• Employee training on data protection

While we take reasonable precautions, no system is 100% secure. Please use strong passwords and keep your login credentials safe.

Our services are not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For significant changes, we will notify you via email or website notification.