GDPR-aligned
Your data. Your control.
What we collect, how we use it, who can see it. GDPR-aligned, in plain language.
Who sees which data
What each party can see and do, and what it cannot
Student data
Companies see what you make public. Your school sees the profile of each student linked to it.
Access & Controls
- See who viewed or acted on your data (access log)
- Download your data as one JSON file, which says what it leaves out and why
- Delete your account at any time
- Make your profile public or private
- Choose what companies see: hide a project; show or hide your email, phone and grade average
- Decide whether your school may publish your CV and your placements on its website
Data Sharing
Shared with: Academic Partner
Data: Your profile, including email and grade average; public projects; how many applications you have sent; your internships and their hours
Purpose: Enrolment, internships and placement
When: When you name the school on your profile, or the school adds you
Shared with: Companies, and anyone with the link
Data: In company search lists: first name + surname initial (e.g. "Fabio C."), school, course, skills. On your profile page, which anyone can open and search engines can index unless you turn that off in Settings → Privacy: your full name and public projects. Your grade average only if you show it.
Purpose: Searchable profile
When: When you make your profile public
Shared with: Companies (after you apply or introduce yourself)
Data: Full name, photo, LinkedIn and GitHub; email and phone only if you show them
Purpose: Contact for opportunities
When: Once you apply, choose "Reply and introduce yourself", opt in to shortlist reveal, or are hired
How your data moves
01
1. The profile
- You fill in your profile; your school can also create it from its roster (name, email, course, year)
- Your school confirms your enrolment and your internships; a project is evaluated only by a teacher you ask
- Data encrypted at rest and in transit
02
2. Companies browse profiles
- Only public profiles appear, listed as first name + surname initial (e.g. "Fabio C.")
- Opening a profile shows the full name, school, course, skills and public projects
- Email, phone and grade average stay hidden unless you choose to show them
03
3. Contact
- A company writes once and waits for your answer; if your school reviews first messages, it reaches you once approved
- You're notified in the app as soon as it reaches you, and by email if your email and message notifications are on
- When a company first writes, you can reply, decline or block it; you unblock it in Settings → Privacy
When you sign up, your account keeps your optional answer to “How did you hear about us?” and the campaign parameters of the link you signed up from (such as utm_source or ref), read from the link's address and never from a cookie or your browser's local storage. No company or school sees them: we use them only to see which channels bring sign-ups.
Your rights under the GDPR
Under the General Data Protection Regulation (GDPR), you have these fundamental rights
01
Right of access
Ask for a copy of the personal data we hold about you. Students download it as one JSON file in their settings, which says what it leaves out and why; for anything else, or for another kind of account, file a request.
02
Right to erasure
Students delete their account in their settings; related records are anonymized or removed as the deletion runs. Other accounts file a request.
03
Right to rectification
Correct inaccurate personal information. Students edit their profile at any time; other accounts can file a request.
04
Right to restrict processing
Limit how we process your data while maintaining your account.
05
Right to data portability
Take your data to another service in a structured format: students download the same JSON file; other accounts file a request.
How we protect your data
How your information is protected: encryption, access control and EU database hosting
01
AES-256 Encryption
At rest, by our database provider; the app also encrypts students' phone numbers and addresses, sign-in secrets and connected-account tokens
02
TLS 1.2+
Every connection to the site and to the database is encrypted; browsers are told to use HTTPS only
03
Primary database in the EU
Neon Postgres in Frankfurt. Some sub-processors are outside the EEA — the processing page lists which, and on what transfer basis.
04
Two-factor sign-in
Students can turn on an authenticator-app code in Settings → Security
Questions about your data?
For any privacy question, or to exercise your GDPR rights, write to info@in-transparency.com.
Students' export and deletion are immediate from their settings. Requests filed here or by email carry the GDPR 30-day deadline.
For DPA-grade detail (sub-processors, retention periods, cross-border transfers, legal bases), see our Data Processing Details page.