Privacy Policy

Last updated: March 20, 2026

1. Who We Are

UStart (“we”, “our”, or “us”) operates the UStart platform, a paid-access resource portal helping international students navigate life in the United States — including banking, credit, tax filing, and government services. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our website and services.

2. Information We Collect

We collect the following categories of information:

  • Account information — your email address, first and last name, university name, phone number, and country of origin, provided when you create an account or update your profile.
  • Purchase information — membership tier, purchase date, and subscription status. Payment card data is processed exclusively by Stripe and never stored on our servers.
  • Usage data — pages visited, content accessed, and session timestamps, collected automatically to personalise your experience and improve the platform.
  • Communications — messages you send via our contact form, including name, email address, and message content.
  • Parent account data — if you purchase a Parent Pack, we create a separate linked account for the parent email address you provide.

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the UStart platform.
  • Verify your membership tier and grant access to the appropriate content library.
  • Process payments and manage billing through Stripe.
  • Send transactional emails (sign-in links, purchase confirmations) via Resend.
  • Respond to your support and contact requests.
  • Analyse platform usage with PostHog to improve features and content.
  • Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We do not use your data for targeted advertising.

4. Legal Basis for Processing

For users in the European Economic Area, United Kingdom, or other jurisdictions with similar requirements, our legal bases for processing personal data are: (a) contract performance — processing necessary to deliver the services you purchased; (b) legitimate interests — usage analytics and platform security; and (c) legal obligation — where required by applicable law.

5. Data Sharing

We share your information only with service providers that help us operate the platform:

  • Supabase — authentication and database hosting (United States).
  • Stripe — payment processing. Stripe's privacy policy governs how they handle payment data.
  • Resend — transactional email delivery.
  • PostHog — product analytics (pseudonymised usage events only).
  • Vercel — hosting and edge infrastructure.

Each provider is bound by data processing agreements and is prohibited from using your data for their own commercial purposes.

6. Data Retention

We retain your account information for as long as your account is active. If you request account deletion, we will deactivate your account and delete or anonymise your personal data within 30 days, except where retention is required by law (for example, financial records that must be kept for tax purposes).

7. Your Rights

Depending on your location, you may have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Request deletion of your personal data (“right to be forgotten”).
  • Object to or restrict certain processing activities.
  • Receive your data in a portable, machine-readable format.

To exercise any of these rights, contact us using the form on our website or at the email address below.

8. Cookies and Tracking

We use cookies and similar technologies for session management (essential) and analytics (PostHog). Analytics cookies collect pseudonymised usage data. You can disable non-essential cookies in your browser settings; this will not affect your access to paid content.

9. Security

We implement industry-standard safeguards including encrypted connections (TLS), hashed session tokens, and role-based access controls. No method of transmission over the internet is 100% secure. We will notify you promptly in the event of a breach that affects your personal data.

10. Children's Privacy

UStart is intended for users aged 18 and over. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top. Continued use of the platform after changes constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please reach out via the on our website. We will respond within 5 business days.