Privacy Policy

UniBae ("we", "us") is the data controller for the personal data processed through this dating platform, which is available exclusively to verified university students aged 18 and over. This policy explains what personal data we collect, why, the lawful basis for each purpose, how it is used, who it is shared with, how long it is kept, and how you can exercise your rights. Using UniBae after being given this notice amounts to acceptance of it.

1. Data we collect

• Account email — used to create and secure your login.
• First name — shown on your public profile.
• Date of birth — used only to confirm you are 18+ and to display your age. It is never shown to other users.
• University email — used for student verification via a one-time code. It is never shown publicly.
• Student ID document — optional second verification method. Stored in private storage and accessible only to authorised moderators via a short-lived signed link. It is used solely to verify your student status and is never shown to other users.
• University, course, year, city/area — shown on your profile to help matching. City is approximate; precise location is never collected or shown.
• Bio, interests, hobbies, photos — content you choose to add to your public profile.
• Messages — private messages exchanged with your mutual matches. Visible only to the two participants and, where required for safety, moderators.
• Likes and matches — used to operate matching.
• Reports and blocks — used for community safety.
• Usage data — limited technical data (such as device type) processed by the platform to operate the service.

2. Purposes and lawful bases

• Providing the dating and verification service (account, profile, matching, messaging) — contract (UK GDPR Art 6(1)(b)).
• Verifying you are a real, 18+ university student — contract and, where you upload a student ID, consent (Art 6(1)(a)). You can withdraw this consent at any time by deleting the document/account.
• Investigating reports and enforcing our Community Guidelines — legitimate interests (Art 6(1)(f)) in protecting the safety of the community.
• Preventing fraud and re-registration by banned users — legitimate interests (Art 6(1)(f)).
• Service and safety notifications — contract and legitimate interests.
• Disclosing data where required by law — legal obligation (Art 6(1)(c)), including reports of potential child exploitation.

3. Special-category data

We do not knowingly collect special-category personal data (such as health, racial origin, sexual orientation, religious or political beliefs). Gender, where you provide it, is used only for profile display and matching preferences. A student ID document may incidentally reveal your age or a photograph; it is used solely for verification and access is restricted as described above.

4. Compatibility Score and profiling

UniBae uses a transparent, weighted Compatibility Score to help order suggested matches. It is guidance to surface potentially relevant profiles, not an objective or definitive measure of compatibility.

• What influences the score: shared interests, dating intention, your age preference, distance between campuses, shared hobbies/lifestyle, and campus proximity.
• Where the information comes from: the profile details and preferences you enter (interests, hobbies, looking-for, preferred age range, preferred distance, university and city).
• Sensitive preferences: the score does not use special-category data. It uses self-declared interests and dating intention, which are ordinary preference data.
• AI involvement: the score is a fixed mathematical weighted calculation. No artificial intelligence or automated inference is used to produce it.
• Significant decisions: the score only affects the order in which profiles are shown. It does not make automated decisions with legal or similarly significant effects about you, and it never determines whether you are verified or banned.
• Correcting inaccurate information: because the score is based on your profile data, you can correct it at any time by editing your profile, interests, preferences and photos. The administrators can also adjust the category weights from the Admin settings.

5. AI involvement

Apart from the weighted Compatibility Score described above, UniBae does not use artificial intelligence to make decisions about you. Verification, matching, messaging and moderation are not automated by AI. Where AI-assisted tools are introduced in future, we will update this policy and ensure any necessary consent is obtained.

6. What is shared and with whom

We do not sell your data. Your public profile fields (first name, age, university, course, year, approximate city, bio, interests, hobbies and photos) are visible to other verified students. Your private messages are visible only to you and your match. Date of birth, university email and student ID documents are never shown to other users. We may disclose data where required by law or to protect safety, including reports of potential child exploitation.

Processors and recipients: UniBae uses the following third parties to operate the service:

• Base44 — the platform that hosts the application, provides authentication, and stores the database and uploaded files. Base44 acts as a processor.
• Resend — delivers transactional verification-code emails on our behalf.
• Google — provides Google sign-in for users who choose it.

We do not share your personal data with advertising networks. No other recipients are configured at present.

7. International transfers

The providers listed above may process personal data outside the United Kingdom. Where this happens, we rely on appropriate safeguards as required by UK data protection law (for example, standard contractual clauses or other transfer mechanisms recognised under UK GDPR). You may contact us for further information about the safeguards relied on for a specific transfer.

8. Storage and security

• Transmission and storage: data is transmitted over HTTPS/TLS and stored on the Base44 platform. Passwords are not held by UniBae — authentication is handled by the platform.
• Role-based access: access to personal data is restricted by role. Moderation tools and student ID documents are available only to admin/moderator accounts.
• Student ID documents: stored in private storage and viewable only via a short-lived signed link issued to authorised staff.
• Audit logs: moderation actions (approvals, rejections, suspensions, bans, report resolutions) are recorded in a ModerationAction audit log.
• Backups: platform backups are managed by the hosting provider; see retention below.
• We apply reasonable technical measures, but no system can be guaranteed perfectly secure. We have not implemented mandatory multi-factor authentication for admin accounts beyond what the platform provides; this is under review.

9. Retention

Retention periods for each category of data are configurable by our administrators and are recorded with a documented reason. The current configuration is maintained in the Admin Privacy area. In summary:

• Verification codes expire automatically (default 15 minutes).
• Active profiles are kept while your account is active.
• Student verification results are retained for a set period after expiry.
• Student ID documents are securely deleted (the stored reference is cleared) after the configured retention period following review, unless a retention hold applies for an active appeal, fraud/safety investigation, or legal obligation.
• Likes, matches and messages are retained for a set period; matches you close are removed after that period.
• Safety reports and banned-account records are retained for safeguarding, fraud prevention and legal obligations.
• Backups are retained by the hosting provider for a limited period.

Where the retention period for a category must be based on a documented reason, our administrators record that reason before relying on the period. We do not apply arbitrary retention periods automatically.

10. Account deletion

You can delete your account at any time from Settings → Account management → Delete account. Deletion immediately removes your profile from discovery and deletes your profile, photos, preferences, likes, messages, notifications, verification records, subscriptions and blocks from active systems. Your matches are closed.

We retain certain information where we have a legal or legitimate basis to do so — for fraud prevention, safety, moderation and legal obligations. This includes safety reports and the moderation audit log. Because platform backups may take a short time to overwrite, we do not represent that every copy of your data is erased instantly; residual copies in backups are removed in line with the backup retention period above.

11. Your rights

You have the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data. You can do this directly by editing your profile, or by contacting us.
• Erasure — delete your account as described above.
• Restriction — ask us to restrict processing in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Data portability — receive your data in a structured, machine-readable format.
• Withdrawal of consent — withdraw consent for verification-document processing at any time by deleting your account or contacting us.
• Complaint to the ICO — if you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

To exercise any of these rights, use the in-app deletion and profile-editing tools, or contact us through the app's report/contact channel (use the "Other" category with your request). We will respond without undue delay and within one month. We do not charge a fee unless requests are manifestly unfounded or excessive.

12. Cookies and marketing

UniBae uses only essential cookies and local storage needed to operate the service and keep you signed in. We do not use non-essential analytics, advertising or marketing cookies, and we do not send marketing emails. If we introduce non-essential cookies or marketing in future, we will ask for your consent before enabling them and you will be able to opt out at any time. You will never be automatically opted into marketing emails.

13. What happens if you do not provide required data

Providing your account email, date of birth, university and university email is necessary to verify your student status and use the service. If you do not provide this data, or do not complete verification, you cannot access discovery, matching or messaging. Optional fields (bio, interests, hobbies, photos, student ID document) are genuinely optional — not providing them simply means a less complete profile.

14. Children

UniBae is strictly 18+. We do not knowingly collect data from anyone under 18. If you believe a minor has accessed the service, please report it immediately — see our Child Safety Standards.

15. Changes to this policy

We may update this policy to reflect changes in our processing or the law. The "last updated" date above indicates when it was last revised.