GiCommon Privacy Policy

This Privacy Policy explains how GiCommon collects, uses, shares and protects personal information about people who use our platform — applicants, students, parents and guardians, institutional staff, administrators and visitors of our websites (collectively, “you” and “your”).

It applies to the GiCommon platform in all its forms: account registration and sign-in, candidate profiles, admissions applications and document uploads, student dashboards, fee and payment screens, institutional administration tools, statistics, messaging, chat and AI-assisted features, and any website or page that links to this policy.

It does not cover information that institutions process on their own systems outside GiCommon, nor the practices of third parties we do not control. Where an institution is the entity that decides why and how your application data is used, that institution is the controller of that data and its own privacy notice also applies to it.

By using GiCommon you acknowledge that you have read this policy. Specific consent prompts shown at the point of collection — for example when uploading a document or enabling an optional feature — supplement this policy for that interaction.

For account data, platform usage data, billing relationships with institutions and support communications, GiCommon acts as the data controller and determines the purposes and means of that processing.

For application content, academic records, evaluation notes and decisions, the institution you applied to (or are enrolled with) is typically the controller, and GiCommon processes that information on the institution’s instructions as a service provider. In that situation, questions about your application data should go to the institution; we will forward requests to them where appropriate.

Our contact details for privacy matters are set out in the Contact Us section at the end of this policy.

Account and identity information. Your first name (and any preferred first name you choose to share), last name, date of birth, email address, phone number, country, address details, postal code, password (stored only as a salted hash), and the account type you selected during registration.

Application and academic information. The programmes you apply to, your academic history, institutions attended, attendance dates, graduation dates, grades and GPA, reasons for transfer, documents you upload (transcripts, identification, letters and similar material), and the answers you give in application forms.

Payment and billing information. Amounts due and paid, payment status, transaction references, invoices and the billing details you or your institution provide. Full payment card numbers are captured only by our payment processors — we receive confirmation and limited metadata, not the card itself.

Communications. Messages you send through in-app chat, emails and support requests, feedback, survey responses and any content you include when you contact us or an institution through the platform.

Usage and device information. Pages and features you use, actions you take, timestamps, referring URLs, browser and device type, operating system, approximate location derived from your IP address, and diagnostic data such as error logs and performance metrics.

AI interaction data. Prompts, files and text you submit to AI features, the responses generated, and signals about whether the output was accepted, edited or dismissed — used to operate and improve those features as described in the How We Use AI section.

Information from third parties. Information your institution provides about your enrolment or status, verification results from identity or document checks where enabled, and details delivered by sign-in or payment providers when you choose to use them.

Institution and administrator information. When an institution registers on GiCommon — for example through the school sign-up form — we collect the information needed to create and verify its workspace: the institution’s name, school code, abbreviation, type, country, city, address, website, official phone number and official email address, together with information about the account’s administrator and other staff — their first and last name, job title, work email, phone number, role and permission level, and any verification documents they submit.

How we use it. We use this information to create and operate the institution’s workspace, confirm the institution’s identity and authority, deliver the administration, admissions, statistics and payment features the institution configures, provide support, collect any institutional fees, prevent fraud and misuse, and comply with legal and accreditation obligations.

Legal bases. Where data-protection law requires a legal basis, this processing rests on performance of our contract with the institution, our legitimate interests in verifying institutions and keeping the platform secure, and compliance with legal obligations — with consent used where the law requires it.

Controller role. For institution account and platform relationship data, GiCommon acts as the controller. Where an institution is the entity that decides why and how its applicants’ or students’ information is used, the institution is the controller of that data and GiCommon processes it on the institution’s instructions as a service provider, as described in Who Controls Your Data.

Sharing. Institution and administrator information is shared with authorised users within that institution whose role requires access, with service providers acting on our instructions (such as hosting, email, verification, payment and support providers), and with authorities where the law requires it. An institution’s official contact details and profile may be displayed to applicants and visitors of the platform.

Retention and closure. We keep institution account data for the life of the institution’s account and for the period required by accounting, tax and education-sector rules, after which we delete or irreversibly anonymise it. To close an institution account, an authorised administrator should contact us using the details in the Contact Us section; closure is subject to records we must retain by law.

• Directly from you — when you create an account, complete or edit a form, upload a document, make a payment, subscribe to notifications or contact support.
• Automatically — when you use the platform, through logs, cookies and similar technologies described in the Cookies section.
• From institutions — when a school, university or its staff submit, verify or update information connected to your application or enrolment.
• From service providers — payment processors, email delivery services, verification vendors and AI providers acting on our instructions.
• From public sources — where you or an institution point us to publicly available information (for example an institution’s published requirements), used only in connection with the feature you are using.

Where information about another person reaches us because you submitted it — a referee, a guardian, a family member — you must have informed that person and obtained any consent required before sharing their details with us and with the institution concerned.

We use personal information to:

• create and manage accounts, authenticate sign-in, and keep your profile accurate;
• process applications, display them to the institutions you choose, and give you status updates and notifications about your applications;
• operate student dashboards, fee statements, payment records and the institutional administration screens our customers configure;
• provide messaging, chat and AI-assisted features, and generate the summaries, hints and analytics you or your institution request;
• process transactions, send invoices and receipts, and maintain financial records;
• detect, investigate and prevent fraud, misuse, security incidents and violations of our Terms of Use;
• respond to support requests and communicate with you about the service, including security and operational notices;
• measure performance, debug errors, understand how features are used, and improve the reliability and usability of the platform;
• comply with legal obligations, respond to lawful requests, and establish, exercise or defend legal claims;
• with your consent, send optional updates, newsletters or invites to new features — which you can withdraw at any time.

We do not sell your personal information, and we do not use application content to build advertising profiles.

Where data-protection law requires a legal basis, we rely on the following:

• Performance of a contract — to provide the account, process your application and deliver the features you signed up for;
• Legitimate interests — to secure the platform, prevent abuse, improve the service, communicate with institutional customers and maintain business records, balanced against your rights and expectations;
• Consent — for optional features such as marketing messages or non-essential cookies, which you may withdraw at any time without affecting prior processing;
• Legal obligation — where we must retain records, respond to authorities or comply with applicable law.

Where we rely on legitimate interests, you may ask us for further information about the balancing test we performed. Where we rely on consent, you can withdraw it through the relevant setting or by contacting us.

AI features in GiCommon process the content you submit to them in order to return a response — for example, drafting a summary, checking a document, answering a question about the platform, or highlighting information for admissions staff.

• Inputs are processed only to deliver the feature you invoked and to keep it safe and reliable.
• We may send content to third-party AI providers acting as our processors under contractual confidentiality and data-protection terms; we do not authorise them to use your content to train their general-purpose models without our written permission.
• We may retain prompts and outputs for a limited period to operate the feature, debug errors and prevent misuse — see the Retention section.
• AI outputs are informational and may be wrong; they are not a substitute for professional advice and do not decide admissions outcomes on their own.

Do not submit to an AI feature any information you are not permitted to share — for example, another person’s sensitive data or material covered by a duty of confidentiality.

We share personal information only with the following recipients:

• Institutions you apply to or study with — your application content, profile and relevant activity, so they can evaluate and manage your application.
• Service providers — hosting, storage, email and messaging, payment processing, analytics, security monitoring and AI providers, each limited to what they need and bound by data-protection obligations.
• Authorised users within your institution — staff and administrators whose role requires access, according to the permissions the institution configures.
• Legal and safety — regulators, courts, law enforcement or other parties where disclosure is required by law, necessary to protect rights, safety and security, or needed to investigate fraud or misuse.
• Business transfers — a successor organisation in connection with a merger, acquisition, reorganisation or sale of assets, subject to this policy or a notice of material change.
• With your direction — whenever you choose to share, export or integrate data, or ask us to disclose it.

We do not sell personal information and we do not share it with third parties for their own direct advertising.

GiCommon and our service providers may process information in countries other than the one where you live. Those countries may have different data-protection rules than yours.

Where we transfer personal information internationally, we use the safeguards recognised by applicable law — such as standard contractual clauses approved by the relevant authority, adequacy decisions, or your explicit consent where required — and we require the receiving party to protect your information to a comparable standard.

You may contact us for more information about the safeguards that apply to a particular transfer, using the details in the Contact Us section.

We keep personal information only for as long as needed for the purposes described in this policy, including to provide the service, meet legal and accounting requirements, resolve disputes and enforce our agreements.

• Account data — for the life of your account and for a reasonable period afterward so the account can be restored if you change your mind.
• Application records — for the duration required by the institution’s retention policy and by education-sector law, which may extend beyond your account.
• Payment records — as required by tax, accounting and payment-scheme rules.
• Support and AI logs — for a limited operational period, then deleted or anonymised.
• Security logs — for a short period needed to detect and investigate incidents.

When information is no longer required, we delete it or irreversibly anonymise it so it can no longer be linked to you. Backups are aged out on a rolling schedule; residual copies may persist for a short further period before automatic deletion.

GiCommon uses cookies and similar technologies (such as local storage) that are strictly necessary to keep you signed in, remember your preferences, protect forms against cross-site request forgery and keep the platform secure and functional.

These essential technologies do not require consent. Where we ever introduce non-essential cookies — for example analytics or personalisation — we will ask for your consent first and provide a way to refuse them.

You can control cookies through your browser settings. Blocking essential cookies may prevent sign-in or other core functions from working correctly. We do not currently use cookies to build cross-site advertising profiles, and we do not respond to browser “Do Not Track” signals at this time.

We apply technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure and loss, including:

• encryption of data in transit using TLS, and protection of sensitive data at rest;
• password storage as salted hashes — we never store or display your plain-text password;
• role-based access controls inside institutions, so staff see only what their role requires;
• logging and monitoring of suspicious activity, and rate-limiting of authentication attempts;
• separation of test and production data, use of mock data in demonstration environments, and regular dependency and platform updates;
• contractual confidentiality and security obligations on our service providers.

No system is perfectly secure. If we become aware of a breach that affects your personal information, we will investigate and notify you and the relevant authorities as required by applicable law.

Depending on where you live, you may have some or all of the following rights over your personal information:

• Access — request confirmation of whether we process your data and a copy of it.
• Rectification — correct inaccurate data or complete what is incomplete.
• Erasure — request deletion where we no longer have a lawful reason to keep it.
• Restriction — ask us to limit processing while a dispute is resolved.
• Portability — receive data you gave us in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests, including profiling.
• Withdraw consent — where processing is consent-based, withdraw it at any time.
• Complain — lodge a complaint with your local data-protection authority.

To exercise a right, contact us using the details in the Contact Us section. We may ask you to verify your identity before acting on a request, and we will respond within the period required by applicable law. Some rights have exceptions — for example, we may be unable to erase records we must keep for legal or educational-compliance reasons, and rights about institutional application data are handled by the institution concerned.

GiCommon is used by applicants who are often still in secondary school, which means many users are minors under the law where they live.

Users below the age of legal majority may only use GiCommon with the involvement and consent of a parent, guardian or legal representative, as set out in our Terms of Use. We collect only the information reasonably needed to operate their account and application, and we do not knowingly process younger children’s data in a way that is prohibited by law.

If you believe a minor has provided personal information without the required consent, contact us and we will investigate and take appropriate steps, including deletion where the law requires it.

The platform may contain links to websites, payment pages or services operated by others — institutions, partners or advertisers. Their privacy practices are governed by their own notices, which we do not control and which this policy does not cover.

We encourage you to read the privacy notice of any third-party site you visit. Your interactions with those sites are at your own discretion.

We may update this Privacy Policy to reflect changes in our practices, features or legal obligations. The “Last updated” date at the top of this page shows when it was most recently revised.

For material changes, we will give additional notice — such as an email to the address on your account or a prominent notice in the platform — before the changes take effect, where reasonably practicable. We encourage you to review this page periodically.

For questions about this policy or to exercise your privacy rights, contact us at:

• Email: contact@gicommon.app
• General support: contact@gicommon.app
• Institutional data: your institution’s own privacy or admissions contact for matters concerning your application record.

Please include the email address of your account and a description of your request so we can respond accurately. If you are unhappy with our response, you may also have the right to complain to your local data-protection authority.