Privacy Policy

University Apartments ("we," "us," or "our") operates the universityapartments.com website. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, mobile applications, and related services (collectively, the "Platform").

By using the Platform, you consent to the data practices described in this Privacy Policy. If you do not agree with the practices described herein, please do not use the Platform.

This Privacy Policy should be read in conjunction with our Terms of Use, which govern your use of the Platform.

2.1 Information You Provide Directly

• ●Account registration: name, email address, phone number, password, date of birth
• ●Profile information: university, occupation, company, bio, avatar/photo, address, social media links, user type (student, professional, agent, landlord)
• ●Contact preferences: preferred contact method, email/phone visibility settings, marketing email opt-in
• ●Property inquiries: name, email, phone number, message to landlord/agent
• ●Roommate matching: personal details, location preferences, lifestyle preferences, amenity preferences, contact information, uploaded photos
• ●Contact form: name, email, phone number, subject, message
• ●Reviews and ratings of agents and properties
• ●Blog comments
• ●Newsletter subscription email address
• ●Saved searches and favorites

2.2 Information Collected Automatically

• ●Device information: browser type and version, operating system, device type
• ●Usage data: pages visited, search queries, properties viewed, time on page, click patterns, favorites/shares
• ●IP address and approximate geolocation
• ●Referral URLs and exit pages
• ●User agent string
• ●Cookie identifiers and local storage data

2.3 Information from Third-Party Sources

• ●Google OAuth2: name, email address, profile picture
• ●Facebook OAuth2: name, email address, profile picture
• ●Mapbox: geolocation and address data for map features (user-initiated)
• ●Cloudflare Turnstile: bot detection signals (challenge tokens only, no personally identifiable information)

2.4 Sensitive Data

• ●We do not intentionally collect sensitive categories of personal data such as race, religion, or health information.
• ●.edu email addresses may indicate educational affiliation but are treated as standard contact information.
• ●University affiliation is voluntarily provided by users and is not considered sensitive data.

For users in the European Union, European Economic Area, and United Kingdom, we process personal data on the following legal bases:

• ●Contract performance: account creation, property search functionality, inquiry processing, roommate matching services
• ●Legitimate interests: platform improvement, analytics, fraud prevention, security measures, customer support
• ●Consent: marketing emails, analytics cookies, newsletter subscription
• ●Legal obligation: tax records, law enforcement requests, regulatory compliance

We use the information we collect for the following purposes:

• ●Provide and maintain the student housing search platform
• ●Process property inquiries and connect tenants with landlords/agents
• ●Facilitate roommate matching services
• ●Create and manage user accounts
• ●Enable social authentication (Google, Facebook)
• ●Personalize search results and recommendations
• ●Send transactional emails (inquiry confirmations, account verification, password resets)
• ●Send marketing communications (with consent; opt-out available)
• ●Deliver newsletter content
• ●Platform analytics and performance monitoring
• ●Fraud prevention and platform security (rate limiting, CAPTCHA, IP logging)
• ●Content moderation (reviews, comments, roommate posts)
• ●Comply with legal obligations
• ●Respond to contact form inquiries and support requests
• ●Anonymize personal data after retention periods expire
• ●Improve and develop new platform features

5.1 Types of Cookies We Use

Essential Cookies (cannot be disabled):

• ●access_token: JWT authentication cookie, 15-minute duration
• ●refresh_token: httpOnly session refresh cookie, 7-day duration
• ●Cloudflare Turnstile tokens: bot protection, session-based

Analytics Cookies (can be disabled via cookie consent):

• ●PostHog analytics cookies: track pageviews, events, and user behavior; various durations
• ●PostHog distinct_id: user identification across sessions

Preference Cookies:

• ●ua_cookie_consent: stores your cookie consent decision (localStorage, persistent)

5.2 How to Manage Cookies

• ●A cookie consent banner is displayed on your first visit, allowing you to accept or decline non-essential cookies
• ●Cookie preferences can be changed at any time in your account settings
• ●You can also manage cookies through your browser-level cookie controls
• ●Disabling essential cookies may impair platform functionality

5.3 Do Not Track Signals

We honor Do Not Track (DNT) browser signals. When a DNT signal is detected, analytics tracking is automatically suppressed.

6.1 We Do Not Sell Your Personal Information

6.2 Service Providers

We share information with the following service providers who assist in operating our Platform:

6.3 Sharing with Other Users

• ●Property inquiry information is shared with the relevant landlord or agent
• ●Roommate profiles are visible to other users per your visibility settings
• ●Reviews are publicly visible on the Platform
• ●Blog comments are publicly visible after moderation approval

6.4 Legal and Safety Disclosures

We may disclose your information in the following circumstances:

• ●In response to law enforcement requests, court orders, or subpoenas
• ●To protect the rights, property, or safety of University Apartments, our users, or the public
• ●To prevent fraud or illegal activity

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Platform of any change in ownership or use of your personal information.

We retain your personal data for the following periods:

Anonymization process: when retention periods expire, personal identifiers are replaced with anonymized values and associated files are deleted from cloud storage. Anonymized data cannot be linked back to individual users.

Some data may be retained longer where required by legal obligations, including tax records, regulatory compliance, or ongoing legal proceedings.

We implement the following technical and organizational measures to protect your personal information:

• ●Industry-standard password hashing (Argon2)
• ●HTTPS/TLS encryption in transit with HSTS enabled
• ●Secure, HttpOnly, SameSite cookies for authentication
• ●Rate limiting on authentication, API endpoints, and file uploads
• ●CAPTCHA protection on public forms (Cloudflare Turnstile)
• ●CSRF protection on all state-changing requests
• ●Content Security Policy headers
• ●PII masking in server logs
• ●OAuth redirect URI validation
• ●Google Cloud Platform infrastructure security

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

9.1 Rights for All Users

Regardless of your location, you have the following rights:

• ●Access your personal data
• ●Correct inaccurate data
• ●Delete your account and associated data
• ●Export your data in a portable format
• ●Opt out of marketing communications
• ●Modify cookie preferences

9.2 Additional Rights for EU/EEA/UK Users (GDPR)

• ●Right of access (Article 15)
• ●Right to rectification (Article 16)
• ●Right to erasure (Article 17)
• ●Right to restrict processing (Article 18)
• ●Right to data portability (Article 20)
• ●Right to object to processing (Article 21)
• ●Right not to be subject to automated decision-making (Article 22)
• ●Right to withdraw consent at any time
• ●Right to lodge a complaint with a supervisory authority

9.3 Additional Rights for California Residents (CCPA/CPRA)

• ●Right to know what personal information is collected
• ●Right to know what information is sold or disclosed (we do not sell your information)
• ●Right to opt out of sale of personal information
• ●Right to deletion
• ●Right to non-discrimination for exercising privacy rights

9.4 Other US State Residents

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights under their respective state legislation. We will honor verified requests consistent with applicable law.

9.5 How to Exercise Your Rights

• ●Email us at privacy@universityapartments.com
• ●We may verify your identity before processing your request
• ●We will respond within 30 days (GDPR) or 45 days (CCPA), with a possible extension if necessary
• ●There is no fee for standard requests

University Apartments is based in the United States. Your data is primarily stored and processed in the US on Google Cloud Platform infrastructure.

Third-party services we use may process data in other jurisdictions. For EU/EEA/UK users, international data transfers are conducted under Standard Contractual Clauses (SCCs) approved by the European Commission.

Users in other countries consent to the transfer of their data to the United States by using the Platform.

The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under the age of 18.

If a parent or guardian becomes aware that their child has provided us with personal information without their consent, please contact us at privacy@universityapartments.com and we will take steps to delete such information promptly.

• ●Google login: we receive your name, email address, and profile picture
• ●Facebook login: we receive your name, email address, and profile picture
• ●We do not access your social media posts, friend lists, or any other data beyond the information listed above
• ●You can revoke Platform access at any time through your Google or Facebook account settings
• ●Social authentication tokens are stored securely and are not shared with third parties

The Platform contains links to external property listings, university websites, and other third-party services. We are not responsible for the privacy practices of these linked sites.

We encourage you to review the privacy policies of any third-party websites before providing them with your personal information.

Currently, University Apartments does not use artificial intelligence or automated systems for decision-making that significantly affects users.

Analytics tools (PostHog) perform automated aggregation of usage data but do not produce individual decisions or profiling that affects your access to the Platform or its features.

If AI-powered features are introduced in the future, this section will be updated with details about how those features work and how you can opt out.

• ●We may send marketing emails about new listings, platform features, and blog content
• ●Newsletter subscription is optional
• ●You can opt out at any time via the unsubscribe link included in every marketing email, through your profile settings, or by contacting us directly
• ●Your marketing consent preferences are tracked and respected across all communications

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law.

Material changes will be communicated via email and a prominent notice on the Platform. The "Last updated" date at the top of this page will be revised accordingly.

Continued use of the Platform after notification of changes constitutes your acceptance of the updated Privacy Policy. Previous versions of this policy are available upon request.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, you can reach us through the following channels:

• ●Privacy inquiries: privacy@universityapartments.com
• ●General support: support@universityapartments.com
• ●Mailing address: Available upon request via support@universityapartments.com
• ●Data Protection Contact: privacy@universityapartments.com

You can also reach us through our contact page.