Privacy Policy

Where Is My Uni (“WIMU”, “we”, “us”) helps prospective students discover universities and degree programmes in Germany. You can use it on our website, in our web app and, through our app, inside AI assistants such as Claude, ChatGPT and Codex. It is operated by Where Is My (Pvt) Ltd, a private limited company in Sri Lanka. Where Is My (Pvt) Ltd is the controller responsible for your personal data.

The company runs the service on whereismyuni.com, app.whereismyuni.com, mcp.whereismyuni.com, and its email on whereismy.group.

• Legal form: Private limited company, Sri Lanka
• Email: support@whereismy.group

For any privacy question or request, email support@whereismy.group with the subject “Privacy”.

We collect only what we need to run the service and the features you choose to use:

• Account and identity: when you sign in with Google, our sign-in provider passes us your name, email address, profile picture and a provider account identifier.
• Onboarding answers: where you’re from, your education, the subjects you studied, the level you want, your English and German results, your interests, and your timezone, so we can personalise your map and recommendations.
• Application materials you create: your applicant profile, the CVs you build, your motivation letters, and any academic transcript or document you upload (which may include your prior institution, grades and credits). You provide these only when you use those features.
• Application tracking: the programmes you track, their status, deadlines and document checklists.
• Credits: your credit balance and a history of credits you received and used in the web app.
• Technical and usage data: your IP address, device and browser information, and how you use the website and app, to keep the service secure and working, and, with your consent, to count visits.
• Records of requests from AI assistants, and usage counts, when you use WIMU in an AI assistant. See “Using WIMU in Claude, ChatGPT or Codex” below.

Where Sri Lanka’s Personal Data Protection Act, India’s Digital Personal Data Protection Act or another law applies instead, we rely on the equivalent grounds it provides.

You can connect WIMU to an AI assistant, such as Claude (by Anthropic) or ChatGPT and Codex (by OpenAI), at https://mcp.whereismyuni.com/mcp. The assistant can then use WIMU tools to search courses, rank courses for you, manage your applications, and read and save your profile, CVs and motivation letters. Here is what that means for your data:

• We never receive or store your conversation. The assistant sends WIMU only what one tool needs: the tool’s name and its inputs, such as a search term, a course or an onboarding answer.
• WIMU saves only details you give or confirm for your WIMU account, such as onboarding answers, profile details, a CV or a letter you approved. The tools ask the assistant to show you what will be saved first.
• Searching courses, reading course or university details and showing universities on a map work without signing in. Tools that read or change your WIMU data ask you to sign in with your WIMU account and approve what the assistant may do.
• What a tool returns goes to the assistant and becomes part of your conversation there. Anthropic (for Claude) and OpenAI (for ChatGPT and Codex) decide how your conversation is handled. They are separate controllers of it under their own privacy policies, not our service providers.
• No WIMU tool in an AI assistant uses or spends WIMU credits. When the assistant writes or improves a letter or a CV for you, it does that with its own AI, and WIMU only stores what it saves.
• WIMU never submits an application for you. Application statuses are what you tell WIMU.

This is what each WIMU tool in an AI assistant reads, what it keeps in your WIMU account, what it returns to the assistant, and which of our providers it sends data to. Every tool also leaves a request record, described in the next section.

Tools that use one of our AI providers also record the AI model, the amount of text it processed and its cost to us, so we can check our costs. These records stay with your account until you delete it.

For every request an AI assistant sends to WIMU, including requests we refuse, we keep one record:

• We don’t keep your conversation, the tool’s inputs or what it returned.
• We don’t keep your IP address in this record. The browser or app name the request comes with is read to tell which assistant sent it, then dropped.
• If a request fails, our server’s error log records the error and the tool’s name, never the tool’s inputs.
• We use these records only to run the service, fix problems and prevent abuse. We don’t use them for advertising or profiling, and we don’t share them.
• Only WIMU administrators can see them, as totals per tool, per assistant and per day, and the most active accounts by account id.
• A daily job deletes each record 90 days after the request. When you delete your account, your records are deleted at once.

To keep the service available and stop abuse, we count how many requests reach WIMU from AI assistants:

• From each network (IP) address, when you use WIMU without signing in. When a request comes from Anthropic’s or OpenAI’s published servers, we count it against all signed-out users of that service together, not against your own address.
• From each signed-in WIMU account, for each kind of tool (looking things up, making changes, ranking courses).
• From each connecting app, such as Claude or ChatGPT, to spot unusual load.
• We never store IP addresses in readable form. Before an address is counted, it is hashed: turned into a keyed one-way code (HMAC-SHA256) that can’t be turned back into the address. IPv6 addresses are also grouped by their network prefix. A hashed address is still personal data, and we treat it as such.
• Each count is kept only for its time window (a minute or a day) and is then deleted automatically, normally within about a day and always within about two days. When you delete your account, the counts linked to your account are deleted with it.
• We use these counts only to apply usage limits, and to spot and investigate abuse. We don’t use them for advertising or profiling, and we don’t share them.

You decide which assistants can use your WIMU account:

• Disconnect: remove WIMU in the assistant’s own settings (Connectors in Claude, Apps in ChatGPT, “claude mcp remove wimu” in Claude Code, “codex mcp remove wimu” in Codex). The assistant stops calling WIMU. Your WIMU account and everything saved in it stay as they are.
• Block from WIMU’s side: the Connected apps page (Profile → Connected apps) lists the assistants that used your account in the last 90 days. Removing one makes WIMU refuse every request it sends with your account, straight away and even if it signs in again, until you allow it again. Our sign-in provider, Clerk, doesn’t let us cancel the assistant’s sign-in there, so also disconnect it in the assistant.
• Delete: deleting your WIMU account (Profile → Account) deletes your saved data and your request records at once, and WIMU then refuses requests from every assistant you connected. Disconnecting alone deletes nothing.
• WIMU marks every tool that changes your data, so the assistant can ask you before it runs one. How and when it asks is up to the assistant.

We do not sell your personal data. We share it only with service providers that process it for us, under contract, to run the service:

When you use WIMU in an AI assistant, the assistant’s provider (Anthropic or OpenAI) receives what WIMU tools return, because you chose to use WIMU there. It isn’t our service provider, and its own privacy policy applies.

We may also disclose data when the law requires it, or to protect our users, the service or others from fraud or abuse.

Our service providers are in several countries, so your personal data is processed outside your country of residence:

• Where Is My (Pvt) Ltd is a company in Sri Lanka, so your data is controlled from there.
• Your data is stored mainly in the European Union, with OVHcloud.
• Some providers are in the United States (Clerk, OpenAI, Google, Resend and Cloudflare), Cohere is in Canada, and Zoho may process email in the country of its data centre.
• Where the GDPR applies to a transfer, we rely on the provider’s certification under the EU–US Data Privacy Framework, or on the European Commission’s standard contractual clauses in its data-processing terms, or, for Canada, on the Commission’s adequacy decision.
• Where another law applies, such as Sri Lanka’s Personal Data Protection Act, we transfer data as that law allows, under contractual safeguards with each provider.

When you delete your account, or ask us to, we permanently remove the data that identifies you, except the items listed under “Deleting your account and your data” below.

You can delete your account and your personal data at any time in the web app, under Profile → Account. Here is exactly what happens:

• What we permanently delete: your account and sign-in identity (removed through our sign-in provider), your profile and onboarding answers, the CVs you built, transcripts and files you uploaded, application materials and motivation letters, free text you wrote, your credit history, and the records and usage counts from your use of WIMU in AI assistants. This is a deletion, not a deactivation.
• What we keep to prevent abuse: a hashed fingerprint of your email address (not the address itself), so the same email can’t repeatedly open new accounts to claim starting credits. It can’t be used to recover your email address or rebuild your profile, and we use it for nothing else.
• What we may keep: the minimal records the law requires us to keep.
• Backups: deleted data stays in our encrypted backups until they expire, as set out above, and is never restored into the live service.
• AI assistants: once your account is deleted, WIMU refuses requests from any assistant you connected. What an assistant already received stays in your conversation there, under its provider’s policy.
• How long it takes: we complete deletion within 30 days of verifying your request.

We use strictly necessary cookies to keep you signed in (set by our sign-in provider), and store preferences such as your theme and your cookie choice in your browser. Your active filters are kept in the page address.

Our website and web app use Google Analytics to count visits. It sets analytics cookies only if you accept them in the cookie banner. Before you choose, and if you decline, it sends measurements without cookies or advertising identifiers. We do not use advertising or cross-site tracking cookies.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you, and receive a copy.
• Have inaccurate data corrected and incomplete data completed.
• Have your data erased, and restrict or object to certain processing, including processing based on our legitimate interests.
• Receive your data in a portable format.
• Withdraw any consent you have given, without affecting processing before you withdrew it.
• Nominate another person to exercise your rights on your behalf where the law allows it.

To exercise a right, email support@whereismy.group with the subject “Privacy”. We may ask you to confirm it’s you. We reply within one month, or tell you within that month why we need longer.

If you have a concern about how we handle your data, contact us first at support@whereismy.group. We will acknowledge it and aim to resolve it within 90 days at the latest.

You can also complain to a data-protection authority: in Sri Lanka, the Data Protection Authority of Sri Lanka; in the European Union, the authority where you live, work or where you think the problem happened; elsewhere, the authority in your country.

We apply one privacy standard to every user, wherever you are. Depending on where you live, your local law may give you additional rights, for example under Sri Lanka’s Personal Data Protection Act, the EU and UK GDPR, India’s Digital Personal Data Protection Act or Bangladesh’s data-protection law, and you can exercise them through the contact above.

Where Is My Uni is for prospective university students aged 18 or over, and is not directed at children. You must be 18 or over to create a WIMU account, including by signing in from an AI assistant. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, contact us and we will delete it.

We protect your data with encryption in transit, access controls, hashing of IP addresses and email fingerprints, and encrypted backups. No service is perfectly secure, so we can’t guarantee absolute security.

To report a security problem, email support@whereismy.group with the subject “Security”.

We may update this policy as the service changes. The date at the top shows the last change. When we make material changes we will, where appropriate, tell you in the app.

Where Is My (Pvt) Ltd, Sri Lanka. Email support@whereismy.group with the subject “Privacy”.