Privacy Policy
Last updated: 13 February 2026
1. Who We Are
Apply Intelligence is a trading name of Apply Intelligence Ltd, a company registered in England and Wales. We operate an education technology platform that enables education agents to manage student applications to schools.
For the purposes of data protection law, Apply Intelligence Ltd is the data controller for personal data processed through our platform (app.applyintel.ai), our website (applyintel.ai), and our admissions portal (admissions.applyintel.ai).
Contact: Data Protection Lead, Apply Intelligence Ltd — [email protected]
2. What This Policy Covers
This privacy policy explains how we collect, use, share, and protect personal data when you:
- Visit our website (applyintel.ai)
- Register for and use our agent dashboard (app.applyintel.ai)
- Are a student whose data is managed by an education agent using our platform
- Are a parent or guardian contacted through our platform
- Are a school admissions professional using our admissions portal
- Contact us for support or enquiries
3. Personal Data We Collect
3.1 Data you provide directly
| Category | Data Elements | Who |
|---|---|---|
| Account information | Name, email, phone, password | Agents, school staff |
| Organisation details | Agency name, address, registration number, VAT number | Agencies |
| Student profile | Name, DOB, gender, nationality, country of residence, passport number, school, academic summary | Students (via agents) |
| Family contact | Parent/guardian name, email, phone, relationship | Parents/guardians |
| Documents | Passports, transcripts, medical records, consent forms | Students (via agents) |
| Signatures | Handwritten signature images for contracts | Contract signatories |
| Communications | Messages, support tickets, notes | All users |
3.2 Data collected automatically
- Technical data: IP address, browser type, device type, operating system
- Usage data: Pages visited, features used, login times, actions performed
- Session data: Authentication tokens, session identifiers
3.3 Special category data
We may process the following special categories of personal data (Article 9, UK GDPR):
- Racial or ethnic origin — inferred from nationality and country of residence
- Health data — if medical records are uploaded
- Biometric data — handwritten signature images for contracts
We process special category data only with explicit consent or where necessary for safeguarding.
4. How We Use Your Data
| Purpose | Lawful Basis |
|---|---|
| Providing and managing your account | Contract |
| Processing student applications | Contract |
| Sharing student data with schools | Consent |
| Sending status updates to families | Consent |
| Billing and subscription management | Contract |
| Security monitoring and audit logging | Legitimate interest |
| Responding to support requests | Contract |
| Complying with legal obligations | Legal obligation |
| Safeguarding children | Vital interests / Public task |
5. How We Share Your Data
5.1 Schools
When an agent shares a student application, student data (name, DOB, nationality, academic details, selected documents) is disclosed to the school. This occurs only after appropriate consent. The school becomes an independent data controller for that data.
5.2 Service providers
| Provider | Service | Location |
|---|---|---|
| Google Cloud Platform | Document storage | EU (Belgium) |
| Hetzner | Server hosting | EU (Germany) |
| Resend | Transactional email | United States |
| Stripe | Payments | United States |
All processors are bound by Data Processing Agreements.
5.3 Legal and regulatory
We may disclose data to law enforcement, regulators, or authorities where required by law or for safeguarding purposes.
6. International Data Transfers
Your data is primarily stored in the EEA and UK. Where we transfer data outside these regions:
- EU-UK: Adequacy decision renewed December 2025, valid until December 2031.
- US processors: Protected by UK IDTA and/or EU SCCs, with verified EU-US Data Privacy Framework participation.
7. Children's Data
We comply with the UK Age Appropriate Design Code (Children's Code):
- Children cannot create accounts directly — agents enter student data on behalf of families.
- High-privacy defaults applied to all student data.
- No profiling, targeting, or marketing to students.
- Data shared with schools only with appropriate consent.
- Parental consent required for students below the applicable age of digital consent (13 in the UK, up to 16 in some EU states).
8. Data Retention
| Category | Retention Period |
|---|---|
| Active user accounts | Duration + 2 years after closure |
| Student records | 3 years after last enrolment activity |
| Uploaded documents | 3 years or when record deleted |
| Consent records | 6 years |
| Audit logs | 3 years (IPs anonymised after 1 year) |
| Financial records | 6 years (HMRC) |
| Contracts and signatures | 6 years after expiry |
9. Your Rights
Under UK GDPR and EU GDPR, you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion of your data
- Restrict processing — limit how we use your data
- Data portability — receive your data in a portable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent
Contact [email protected] to exercise your rights. We respond within one month.
10. Cookies
We use only strictly necessary cookies:
- Session cookie — keeps you logged in
- CSRF token — protects against cross-site request forgery
No analytics, advertising, or tracking cookies are used.
11. Data Security
- Encryption in transit (TLS/HTTPS)
- Secure authentication with short-lived tokens
- Role-based access controls
- Comprehensive audit logging
- EU-based data centres (Germany and Belgium)
12. Data Breaches
We notify the ICO within 72 hours of any breach posing a risk to your rights. High-risk breaches are communicated directly to affected individuals without undue delay.
13. Complaints
You may complain to:
Information Commissioner's Office (ICO)
ico.org.uk — Tel: 0303 123 1113
EU-based users may also contact their local data protection authority.
14. Changes to This Policy
Material changes will be communicated via email or in-app notice. Check the "Last updated" date above.
15. Contact
[email protected]
Apply Intelligence Ltd, United Kingdom