Privacy Policy
Last updated: 28 October 2026
In short:
We collect what we need to help you find professors and send your emails from your own mailbox. We don't sell your data and we don't show ads.
Your email password (or Google permission) is locked in Google Secret Manager. Nobody at UniProfs can read it.
We never read your inbox. Professors' email addresses are kept separately and are never shown to you.
Analytics runs only if you accept it. You can ask us to see, correct or delete your data at any time.
This policy explains how UniProfs (the website uniprofs.in and its web app, "UniProfs", "we", "us") handles personal data. UniProfs is an independent online service run from India. For your personal data we act as the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). By using UniProfs you agree to this policy and to the Terms of Use.
1. What we collect
| Information | Why we use it |
|---|---|
| Account details: name, email address, university, password (held by Firebase Authentication, never by us in readable form), email verification status, sign-in times, the referral code you used, and when you accepted these policies. If you sign in with Google, Google shares only your name, email address and profile photo with Firebase Authentication; we keep your name and email address. Signing in with Google gives us no access to your Gmail or other Google data | To create and secure your account and keep a record of your consent |
| Your profile ("About you"): degree, year, field, research interests, skills, projects, achievements, links, signature, tone and notes for the AI | To write, personalise and sign your emails, and to match you with professors |
| Documents you upload (for example your CV), up to 5 PDFs | To attach them to your emails; to make a short summary of your CV for AI writing; to read its text for CV matching |
| Sending email settings: your email address, mail server, and either your password / app password or, if you use "Connect with Google", a Google permission token. The same for a backup sending email if you add one | To send emails from your own account (see sections 2 and 3) |
| Your outreach: lists, drafts, emails you write, schedule or send, sending windows, which professors you have contacted, and delivery results (sent or failed, with the error) | To send your emails at the right times, show your history, stop the same professor being emailed twice, and help when something fails |
| Your searches: filters you use and how many searches you make | To show results and apply your plan's limits. We don't sell or share your searches |
| CV match data: a list of numbers describing your CV's topics and the name of the document used (section 4) | To rank professors by how well they fit your CV |
| AI usage: how many AI requests you made each day, the number of words (tokens) processed and their cost | To apply your plan's AI limit and keep our costs under control |
| Plan and payments: plan, dates, amounts, Razorpay order and payment IDs, discount, referral or ambassador codes used, and payment status | To give you the right features, send receipts, pay referral and ambassador earnings, and keep the records tax law requires |
| Referral and ambassador details: the friends who joined with your code (first name and plan only), coins or commission earned, and the UPI ID or payment details you send us to receive them. For ambassador applications: name, email, phone, college, city, course, links and your answers | To run the referral and ambassador programmes and pay you |
| Support and reports: support tickets, your messages, and reports you send about a professor's details | To answer you by email and keep professor information accurate |
| Notifications: messages we show you in the app and when you last read them | To tell you about your account and changes to UniProfs |
| Technical data: IP address, browser and device type, request logs and error logs | Security, rate limiting, preventing abuse and fixing problems |
| Analytics, only if you accept (section 9) | To understand which pages help and where people get stuck |
We don't knowingly collect sensitive data such as health, religion, caste, finances or government ID numbers. Please don't put them in your profile, documents or emails.
2. Your email password
- When you connect your sending email, the password is first checked with your mail server, then stored in Google Secret Manager, not in our database.
- The website can save or replace it but cannot read it back. Only a separate sending service reads it, at the moment an email is sent.
- No one at UniProfs can view it. For Gmail, use an app password, which you can revoke at any time in your Google account.
- We only connect to your mail server to send. We never read, download or delete the messages in your mailbox.
- A backup sending email is stored the same way and is used only when your main mail server can't be reached, so an email is never sent twice.
3. Connecting Gmail with Google
If you choose "Connect with Google" (where available), Google asks you to let UniProfs send email on your behalf. This is the only permission we request (the gmail.send scope).
- What we can do: send the emails you write, schedule or approve in UniProfs, from your Gmail address.
- What we can't do: read, search, list, change or delete your emails, contacts, calendar or anything else in your Google account.
- What we store: your Gmail address and the permission token Google gives us. The token is kept in Google Secret Manager like a password, is unlocked only by the sending service when an email goes out, and is never shown to anyone.
- Sharing: we don't share data from your Google account with anyone, don't use it for advertising, don't sell it, and don't use it to train AI models. People at UniProfs can't read it.
- Stopping it: press "Disconnect" in Profile, or remove UniProfs at myaccount.google.com/permissions. When you disconnect in UniProfs, we delete the token and withdraw the permission at Google.
UniProfs's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. AI writing and CV matching
If your plan includes AI writing, we use Amazon Bedrock (Amazon Web Services) to:
- read your CV once, when you upload it, to make a short summary;
- build a compact profile of your skills and experience from your profile and that summary;
- write each email from that profile and the professor's public information. Your documents are not sent again for this.
Matching professors to your CV. If you choose "Search with my CV" in Find Profs, our server reads the text of the CV you pick (the first 8 pages), plus the research interests and skills on your profile, and turns it into a list of numbers that describes its topics. We use Amazon Bedrock (an embedding model, not a writing model) for this and compare those numbers with each professor's research. We keep only the numbers and the name of the document used, not a copy of the text.
Under AWS's terms, this data isn't used to train their AI models, and we don't use it to train any model either. AI can make mistakes; you check and approve every email before it is sent.
5. Professors' information
Professor profiles (name, position, university, department, research areas, publications and public links) come from public professional sources such as university pages and publication records. We use them to help students find relevant researchers, on the basis of our and our users' legitimate interest in academic outreach and because this information is published by the professors or their institutions.
- Professors' email addresses are stored in a separate database, are never shown to users, and are used only to deliver emails users choose to send.
- Each user can email a professor only once, and sending is paced and limited per day.
- A professor can ask us to correct or remove their information, or to stop all emails to them, at support@uniprofs.in. We act on this within 7 days and keep only what's needed to make sure they aren't emailed again.
6. Who we share data with
We don't sell your data and we don't share it for advertising. We share it only with the services that run UniProfs, only as needed, and under their own security and privacy commitments:
| Service | What for | Where |
|---|---|---|
| Google Cloud and Firebase | Hosting, sign-in, database, file storage, Secret Manager, logs | United States |
| Google (Gmail API) | Sending your emails, only if you connect with Google | Google's data centres |
| Your email provider (for example Gmail, Outlook or your university) | Sending the emails you choose to send | Your provider's servers |
| Amazon Web Services (Amazon Bedrock) | AI writing and CV matching | United States |
| Razorpay | Payments. It handles your card, UPI or bank details under its own privacy policy; we don't receive or store them | India |
| Google Analytics and Microsoft Clarity | Analytics, only if you accept (section 9) | United States and other countries |
The people you email see what you send them: your name, sending email address, the email, your signature and any documents you attach. If you choose to send a copy (CC) to yourself, it goes to the address you pick.
We may also disclose data if the law requires it (for example a valid order from a court or government authority), to protect the safety and rights of users, professors or UniProfs, or to a successor if UniProfs is ever transferred, who must follow this policy.
7. Where and how long we keep data
Data is stored on Google Cloud servers in the United States. By using UniProfs you agree to this transfer; we transfer data only to countries the Government of India has not restricted under the DPDP Act.
| Data | How long |
|---|---|
| Account, profile, documents, sending settings, drafts and lists | While your account is open; deleted within 30 days of your deletion request |
| Records of emails already sent (which professor, when, the result) | Up to 12 months after your account is deleted, to prevent repeat emails and abuse |
| Payment and invoice records | As long as Indian tax and accounting law requires (generally 8 years) |
| Support tickets and professor reports | Up to 2 years after they are closed |
| Sending requests between our services | Deleted automatically after 7 days |
| Server request and error logs | About 30 days |
| Admin access logs (who opened what in the admin area) | Up to 400 days |
| Analytics | Google Analytics up to 14 months; Clarity recordings about 30 days |
8. Security
- Encryption in transit (HTTPS) and at rest on Google Cloud.
- Passwords and Google tokens in Secret Manager; professors' addresses in a separate database. Each part of UniProfs has its own restricted access: the website can't read your password or professors' addresses, and only the sending service can, at the moment of sending.
- Your browser can't write to our database directly; every change goes through our checked server.
- The admin area is limited to the owner's accounts, needs a recent sign-in, and every admin action is logged.
- Rate limits and checks against misuse.
No system is perfectly secure. Use a strong password and keep it private. If a personal data breach affects you, we'll tell you and the Data Protection Board of India as the DPDP Act requires.
9. Cookies, local storage and analytics
We use your browser's storage to keep you signed in and remember settings such as dark mode. These are needed for UniProfs to work. We don't use advertising cookies.
Analytics, only if you accept. On your first visit we ask whether you accept analytics cookies. If you accept, we use:
- Google Analytics (Google): how visitors find UniProfs (for example a search engine or a shared link), which pages and app sections they open, how long they spend there, the page where they leave, and steps such as signing up, connecting a sending email, sending an email and buying a plan;
- Microsoft Clarity (Microsoft): clicks, scrolling and anonymous recordings of how pages are used, to find what is confusing. Text you type into forms is masked.
When you're signed in, these services get only your random account ID, never your name, email address, the emails you write, your documents or your password. Google Analytics doesn't store IP addresses. We use this only to improve UniProfs, not for advertising. If you decline, none of this is loaded. You can change your choice at any time:
10. Emails we send you
We email you about your account: verification, password reset, receipts, plan and payment notices, referral and ambassador earnings, answers to your support requests and important changes to UniProfs or these policies. These are part of the service. We don't send marketing emails unless you agree to them, and you can always say no.
11. Your rights
Under the DPDP Act and other laws that apply to you, you can:
- Access: get a summary of the personal data we hold about you and how we use it;
- Correct and update: most of it directly in the app (Profile), or by asking us;
- Erase: ask us to delete your account and data (some records are kept as set out in section 7);
- Withdraw consent: at any time, for example by disconnecting your email, declining analytics, or deleting your account. This doesn't affect what was done before, and some features won't work without the data they need;
- Nominate someone to use these rights for you if you die or can't act yourself;
- Complain: to our Grievance Officer (section 12), and if you aren't satisfied, to the Data Protection Board of India.
Write to support@uniprofs.in from your account's email address. We may ask you to confirm who you are. We aim to reply within 30 days. If you live outside India, you also have the rights your local law gives you (for example under the GDPR in Europe).
12. Grievance Officer
For any question, complaint or request about your personal data or these policies, contact our Grievance Officer at support@uniprofs.in with the subject "Grievance". We acknowledge complaints within 24 hours and resolve them within 15 days, as required by the Information Technology Rules, 2021 and the DPDP Act.
13. Children
UniProfs is meant for students aged 18 or over. If you are under 18, you may use it only with the consent of a parent or legal guardian, who agrees to these policies for you; we may ask for proof of that consent. We don't track children or show them advertising. If we learn that a child under 18 is using UniProfs without that consent, we will delete their account. Parents can contact us at support@uniprofs.in.
14. Changes to this policy
We'll post updates here with a new date and, for significant changes, tell you in the app or by email before they apply. Where the law requires, we'll ask for your consent again.
15. Contact
Privacy questions and requests: support@uniprofs.in. Signed-in users can also raise a ticket from the Support page; we reply by email.