Privacy Policy

Effective and last updated: 11 September 2026 Version: 2026-09-11

The UC Bureau ("we", "our", "us") provides Fit Factor, an interactive prioritization exercise that helps students reflect on what matters to them in choosing a university. This Privacy Policy explains what information we collect when you use Fit Factor and related account, family, school, and support features (the "Service"), how we use it, and the choices and rights you have.

The Service is operated by Amiata Company Limited, a company incorporated in Hong Kong with registration/file number 78275059. The Service may be presented under the names Amiata, Amiata Co., and The UC Bureau; no registered-trademark status is claimed for those names. Amiata Company Limited is the controller of the personal information described here. Its registered and principal business address is Watson Rd, Sea View Estate 2-8, Rm 102, North Point, Hong Kong. Apex Integration (Grid Logic LLC), based in California, USA, helps build and maintain the technical platform on Amiata Company Limited's behalf.

1. Information we collect

1.1 Information you provide

When you create an account, you provide your name, email address, password, account type, and relevant profile details. Student accounts must provide a date of birth so the Service can enforce its minimum-age rule. We receive your password only to hash or verify it and store only a salted hash; we do not retain your plaintext password.

When you complete a sort, you implicitly provide the priority you assign to each of the 64 selection-criteria cards (High, Medium, Low, or Non-Factor).

When you agree to our Terms of Service or acknowledge receiving and reviewing this Privacy Policy, we record the document type, the server-defined document version, the document and interface languages, and the time. The Privacy Policy record is an acknowledgment of notice—including the international-transfer notice—not consent to optional uses or sharing. These registration records do not include your IP address. Separately, when you grant an optional consent, we record the consent type, decision, version, and date.

When a parent or guardian invites a student, we record the invited email address, stated relationship, required authority attestation version and time, request status, and relevant timestamps. The invitation credential is stored on our server only as a one-way hash. If the student accepts, we record the family relationship, the student's consent version and decision time, and whether access is active or revoked.

1.2 Information we collect automatically

While you are using the tool, we collect:

Session metadata: when you started a sort, when you completed it, total duration, and the type of device you used (desktop, tablet, or mobile).
Interaction events: when you flip a card, drag a card from one priority zone to another, undo a placement, or otherwise interact with the sorting interface. These events help us understand how the tool is used and improve it.
Technical and security information: your browser's user-agent string, device category, and security events. For authentication, fraud prevention, and abuse investigation, login and failed-authentication records may include the email address submitted and the precise IP address supplied by our hosting edge. We do not use this information for advertising.

1.3 Cookies and essential browser storage

When you log in, we set an auth_token cookie containing a signed token that proves you are logged in. It is HTTP-only (not readable by browser scripts), is sent only to our servers, and expires 7 days after it is issued.

When you select a language, we set a locale cookie for up to one year so the Service remembers that choice. This cookie is readable by our application in your browser and is not used for tracking or advertising.

When you open a parent invitation, the raw invitation credential is held temporarily in same-origin browser sessionStorage for that tab so the request can continue through sign-in and email verification. It is removed after acceptance or when the server identifies it as invalid, is not placed in a cookie or persistent localStorage, and is otherwise governed by the browser tab's session lifetime.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies that identify you across other sites.

2. How we use your information

We use the information we collect to:

Operate the tool: authenticate you, save your sort progress, let you resume an in-progress sort, and show you your completed results.
Manage optional family access: deliver a parent's invitation, record the student's explicit choice, let either party revoke an accepted connection, and show a parent the student's Fit Factor Sort results only while the connection remains active.
Understand and improve the tool: aggregated or de-identified analysis of how students prioritize selection criteria, including authorized cohort comparisons.
Maintain account security: detect abuse, recover access via password reset, comply with applicable laws.

We do not use your information to advertise to you, build behavioral profiles for marketing, sell personal information or Sort Data, or commercially share it.

3. Legal basis (for users in the EU/UK/EEA)

Where applicable, our legal bases for processing are:

Performance of a contract (your account agreement and the Terms of Service) for operating the tool.
Consent for data-collection beyond what is strictly necessary to operate the tool (you explicitly grant this in the consent prompt before your first sort).
Legitimate interests in improving the tool and securing it against abuse, balanced against your privacy.

You may withdraw consent at any time from your account settings, and you may exercise the rights described in Section 6.

4. How we share your information

We do not sell your personal information.

We share information only as described below:

4.1 Service providers

We use Microsoft Azure for hosting, database, storage, email delivery, and operational monitoring. The deployed core application, database, and storage resources are in Azure's East Asia (Hong Kong) region. Azure Communication Services email is configured to Microsoft's Asia Pacific data location. Microsoft states that Communication Services data may transit or be processed in other geographies to provide the service. Apex Integration (Grid Logic LLC) may access the platform only as needed to build, maintain, secure, and support it on our behalf.

4.2 Optional family and school access

A parent receives a student's Fit Factor Sort results only after the student verifies the invited email address and explicitly accepts the named parent's request. Acceptance allows that parent to view the student's Fit Factor Sort results without further qualification while the link remains active; it does not grant broader account or profile access. The student may decline or ignore the request without losing ordinary Service access. Either linked user may revoke the connection in Settings, which stops future parent access. Disabling the invitation feature blocks new invitation activity but does not revoke a connection the student already accepted.

Authorized school or counseling users may receive individual or cohort information only through the roles, memberships, student connections, and consent controls provided by the Service and any applicable institutional agreement.

4.3 Aggregated and de-identified insights

We may derive aggregated or de-identified statistics from Sort Data to operate and improve the Service and to provide authorized cohort comparisons. We do not sell or commercially share personal information, Sort Data, or these derived insights.

4.4 Legal disclosure

We may disclose your information if required by law, court order, or to protect our rights or the rights of others.

4.5 Business transfers

If Amiata Company Limited is involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to applicable law and notice requirements.

5. Data retention

Account information is retained while your account is active.
Sort results and interaction events are retained while your account is active so you can review them.
Pending parent-to-student requests expire after 7 days. A daily retention process is scheduled to replace the invitation email address and credential with non-identifying tombstones 30 days after acceptance, revocation, or expiry while retaining minimal status and timing evidence. If that process is delayed, tombstoning occurs on its next successful run.
Accepted family-link records are retained while the related accounts remain active so either party can see and revoke the connection. Account deletion immediately revokes the link and removes or tombstones its direct invitation identifiers.
Guardian registration requests expire after seven days. Expired requests are deleted by daily cleanup unless specific evidence must be preserved under a bounded legal hold.
Jurisdiction consent and recruiter access evidence has a purpose-specific deletion date under the applicable country policy, capped at ten calendar years for these audit classes. A shorter period may apply. Legal holds preserve only identified evidence until their review or release date and never restore sharing access.
Consent, Terms-acceptance, Privacy-notice acknowledgment, and eligibility records may be retained as minimal, versioned evidence of the decision or attestation.
Authentication and security events are used for fraud and abuse investigation. Database cleanup is configured around a 90-day security window, but older records may remain until the next administrative cleanup. We retain them only as long as reasonably needed for security, legal, or incident-response purposes.
When you delete your account, direct account identifiers and credentials are erased or replaced with anonymous placeholders. Family access is revoked. Sort results and interaction events may remain associated with the anonymized account for aggregate analysis, and limited security, legal, or consent evidence may remain where necessary.
Email and infrastructure records are retained according to our configuration and the applicable Microsoft service terms. Email content is processed to deliver the message; delivery and abuse-prevention metadata may be retained by Microsoft.
Aggregated or de-identified statistics may be retained for ongoing analysis where they no longer identify an individual.

6. Your rights and choices

You have the right to:

Access the information we hold about you. You can download an export of your account data, including profile, sort results, interaction events, consents, role assignments, and family invitation or link history associated with your account, from Settings or by contacting us. Invitation credentials and unrelated parties' internal account identifiers are excluded.
Delete your account and have your personal information anonymized. You can do this from your account settings or by contacting us.
Withdraw consent for data collection. You will be re-prompted at the start of your next sort; if you decline, we will not record results from that sort.
Decline or revoke family sharing without losing ordinary account or sorting access. Either linked user can revoke an accepted connection in Settings.
Correct inaccurate information by contacting us.
Object to or restrict certain processing, where applicable under your local privacy laws.
Lodge a complaint with your local data-protection authority. For Hong Kong residents, that is the Office of the Privacy Commissioner for Personal Data (PCPD). For EU/UK/EEA residents, your national data-protection authority.

Where required by your local laws (such as GDPR, CCPA/CPRA, or Hong Kong's PDPO), we will respond to verified requests within the time periods those laws specify.

7. Children's privacy

Student accounts are generally available from age 14. An approved country-specific eligibility flow may permit participation from age 13 where the applicable country, age and purpose-specific requirements are met. We do not permit student participation below 13. When that eligibility flow is available, we ask for date of birth, self-reported country of usual residence and, when needed, state or province. Self-reported residence is not a verification of age or identity.

Where the country-specific eligibility flow is available and guardian authorization is required, a pending registration contains limited contact, birth-date and residence information while authorization is reviewed. It does not permit sorting or university disclosure. Staff review the guardian's identity, adulthood and legal authority using evidence obtained outside the app; the app records the review result and an evidence reference, not copies of identity documents. Email verification and family links alone are not proof of legal authority.

The guardian separately decides whether to authorize the specific purpose. Students also make their own account and university-sharing choices. Country restrictions, expired or disputed authority, withdrawal and policy changes can suspend affected processing and require fresh consent. Countries requiring additional judicial or regulatory authorization may be unavailable.

8. Security

We protect your information using industry-standard practices:

All connections to the tool are encrypted with HTTPS (TLS 1.2 or higher).
Passwords are hashed with bcrypt before storage; we cannot recover or share your plaintext password.
Authentication tokens are stored in HTTP-only cookies that browser scripts cannot read.
Database access is restricted by network firewall rules and authentication.
We monitor the platform for unusual activity and apply security updates promptly.

No system is perfectly secure. If we ever detect a breach affecting your information, we will notify you and the relevant authorities as required by law.

9. International transfers

Your information is transferred electronically when you create or use an account, submit Sort Data, request or respond to an invitation, or receive a Service email. Core account, profile, Sort, family-link, consent, and technical data is hosted for Amiata Company Limited in Hong Kong using Microsoft Azure. Email content and delivery metadata is processed through Microsoft Azure Communication Services configured to the Asia Pacific data location; Microsoft advises that this data may transit or be processed in other geographies.

The recipients and purposes are Amiata Company Limited, as controller, to provide the Service; Microsoft Corporation and its service operators, to host, store, secure, monitor, and deliver Service email on our behalf; and Apex Integration (Grid Logic LLC), whose authorized personnel may provide technical support from the United States. Data is retained according to Section 5 and applicable provider schedules. Transfers use encrypted network connections, account access controls, and applicable provider contractual protections.

For a user in South Korea, these transfers are necessary to provide the requested online Service and are disclosed here. You may refuse by not creating or using an account, but the core Service cannot be provided without the core transfer. A parent connection is optional: refusing or revoking it does not prevent the student from using ordinary account and sorting features. Contact us to exercise your rights or ask for current recipient and location details.

10. Changes to this Policy

We may update this Policy from time to time. The version number and date are recorded at the top. If a change materially affects your rights, we will notify you by email or through a prominent notice in the tool before it takes effect, and where required by law we will obtain your consent again.

11. Contact us

For questions, requests, or complaints about this Policy or your information:

Email: privacy@ucbureau.org
Postal: Amiata Company Limited, Watson Rd, Sea View Estate 2-8, Rm 102, North Point, Hong Kong
Controller: Amiata Company Limited (Hong Kong registration/file number 78275059)