Privacy policy
Effective 30 October 2026
This policy explains what personal data Every Program handles, why, how long we keep it and what you can do about it. It covers everyprogram.com, our social media accounts and our emails.
- You can use the site without an account and without giving us any personal data.
- We do not use cookies for analytics or advertising.
- Without an account, your profile and saved programmes stay in your browser. If you create an account, they are also kept in it. Accounts are optional.
- We do not sell personal data.
Who is responsible
The data controller is Sole proprietor Daniil Tserkovnyi, vul. Hvardiitsiv-Shyronintsiv 63a, apt. 21, 61000 Kharkiv, Ukraine. Email: privacy@everyprogram.com. See also the Legal notice.
Facts about programmes
Our programme database holds facts about study programmes and institutions. It does not contain personal data. To check each fact against its source, we also keep dated copies of official institution pages. These copies are not public, and they can happen to contain names or work contacts that the institution itself published. We do not extract those details and we do not publish them. If your name appears in one, you can ask us to remove it.
What we process, why and for how long
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account (only if you create one): your email address, your name if you give one or sign in with Google, and the sign-in session | To let you sign in and keep your list and profile across devices | Contract (providing the account you asked for) | Until you delete the account |
| Account profile and saved items: citizenship, start year, English test and score, grade average, budget, interests, saved programmes and institutions with your notes and statuses | To show prices and deadlines that apply to you and to keep your shortlist | Contract; your consent for anything you choose to add | Until you delete the account, or the item |
| Marketing consent (only if you tick it): your email, the choice and the time you made it | To send emails about programmes, deadlines, events near you and offers from us and our partners, chosen using your profile and location, and to prove your consent. We send these emails ourselves and do not give your address to partners | Consent | Until you withdraw it. We then keep a record of the withdrawal for 12 months. |
| Site visits: IP address, browser type and the page requested, in our hosting provider's logs | To deliver the site and keep it secure | Legitimate interest | As set by Vercel's log settings. We do not use these logs to build profiles. |
| Page statistics and error reports, where switched on (see below) | To see which pages are useful and to fix faults | Legitimate interest | Statistics are aggregated. Error reports: up to 90 days. |
| Emails to our hello@, privacy@ or legal@ addresses: your address, name and message | To answer you and keep a record of what was said | Legitimate interest and your request | 24 months after the last message |
| Error reports: your email address and message | To check the fact against its source and correct it | Legitimate interest and your request | 12 months |
| Social media: your username or ID on the platform, your comment or message, and its time | To reply to you and to count which content is useful | Legitimate interest | 90 days, then deleted. Aggregated statistics contain no personal data. |
| Institution staff: name, job title and work contact details in replies to our questions | To get facts from the institution | Legitimate interest | Signatures are removed before a reply becomes a source. The original email: up to 12 months. |
| Copies of official pages, which may contain names or work contacts published by the institution | To check each fact against its source | Legitimate interest | As long as the service runs. Not extracted, not published, removed on request. |
“Legitimate interest” means Article 6(1)(f) GDPR. Ours is to run a free information service, keep it secure, answer people and get accurate facts from institutions. Database backups are kept for 30 days, so deleted data can stay in a backup for that long. You do not have to give us personal data to use the site. If you email us, we need your address to reply.
Accounts
An account is optional. Nothing on the site needs one, and facts are never hidden behind it.
- What we store. Your email address and, if you give it or sign in with Google, your name. Your profile (citizenship, start year, English test and score, grade average, budget and interests, each only if you fill it in) and the programmes and institutions you save, with your status and notes. We do not ask for a date of birth, an address, a phone number or documents.
- Why. To sign you in, to show prices and deadlines that apply to you, and to keep your shortlist on your devices. We use your profile to choose marketing emails only if you tick the marketing box. We do not sell it, and we do not pass it to institutions or agencies without your separate consent.
- Who processes it. Supabase, in the EU, stores the account and its data on our behalf and handles sign-in. Resend sends the sign-in emails. If you choose “Continue with Google”, Google signs you in under its own policy.
- Connected assistants. If you connect an AI assistant such as Claude or ChatGPT to your account, we show you who is asking first. The assistant’s provider then gets your email address and a token for our data, and we count your requests against your account. It gets nothing else from your account. You can disconnect it on the API and MCP page; its provider handles what you tell it under its own policy.
- How long. Until you delete the account. Deleted data can stay in a database backup for up to 30 days.
- Deleting it. Open “My search”, go to Settings and choose “Delete my account”. It removes your account, profile and saved lists at once. There you can also download your data as a file. If that does not work, email privacy@everyprogram.com.
- Marketing. We email you updates only if you tick a separate box that is never ticked for you, on the sign-in page or in Settings. Each one says how to stop, and you can untick the box at any time. The sign-in emails are service emails and are not marketing.
- Guest mode. If you never sign in, none of this applies: your list and profile stay in your browser.
Cookies, browser storage and other sites
- We do not use cookies for analytics or advertising.
- Without an account, the citizenship you choose, your profile and the programmes you save are kept in your own browser (local storage). They are not sent to us. Clearing your browser data removes them. If you sign in, a copy is kept in your account (see Accounts below). Your sign-in session is kept in the same browser storage, not in a cookie, and is used only to keep you signed in.
- Pages load their fonts and code from our own hosting. They do not load Google Fonts, maps, social media widgets or advertising tags.
- Where page statistics are switched on, they come from Vercel Web Analytics, which counts page views in aggregate, without cookies and without identifying you.
- Where error reporting is switched on, it goes to Sentry, with data stored in the EU, without session recording and without IP addresses or other personal data.
- Source links and “Archived copies” links open other sites, such as the Internet Archive. Their own policies apply there.
- We send no newsletter unless you tick the separate, unticked-by-default box for updates, in an account. If we add anything else that collects data or loads content from another provider, we will update this policy first and ask for your consent where it is needed.
If you work at an institution
We sometimes email institutions to ask for facts such as fees or deadlines. We write to role addresses published by the institution, such as an admissions address, and each email says where we found the address. These emails are prepared and sent by our automated system with the help of AI, and the Every Program team is responsible for them.
If you reply, we receive your name, job title, work contact details and message. We use the facts in the reply and cite the institution, not you. Before a reply is stored as a source, we remove the signature and any personal email addresses and phone numbers. The original email stays in our mailbox for up to 12 months. Our legal basis is legitimate interest. To object, reply “stop” or write to privacy@everyprogram.com. Institutions can read more on the page For institutions.
Social media
We have accounts on Instagram, Facebook, Threads, Pinterest and Bluesky, and will add YouTube and TikTok once those accounts are open. When you comment on our posts or send us a direct message, we receive your public username or ID, the text and its time through the official platform tools. We use this only to reply, for example to send you the link to a programme you asked about, and to measure which content is useful. We do not use it for advertising and we do not combine it with other sources.
For statistics about our Facebook Page and Instagram account, we and Meta Platforms Ireland Ltd are joint controllers. The Page Insights Controller Addendum sets out who does what, and Meta's privacy policy describes how Meta uses data. Otherwise, each platform is an independent company that handles your data under its own policy.
Our use of YouTube API Services is subject to the YouTube Terms of Service and the Google Privacy Policy. You can revoke our access in Google security settings.
AI and automation
We use software and AI tools to run the service. In particular, AI tools help us read and sort emails and messages, draft replies and prepare emails to institutions, and some replies on social media may be sent automatically. We do not make decisions about people by automated means that have legal or similarly significant effects on them (Article 22 GDPR).
Who receives personal data
| Provider | What for | Where |
|---|---|---|
| Vercel | Website hosting, domain and logs; page statistics where switched on | USA, global network |
| Google Workspace | USA and EU | |
| Supabase | Database and sign-in for accounts | EU (Ireland) |
| "Continue with Google" sign-in, only if you choose it. Google tells us your email and name. | USA and EU | |
| Hetzner | Servers | EU (Germany) |
| Cloudflare | Storage of page copies and backups | EU storage, US company |
| Resend | Service emails | EU (Ireland), US company |
| Sentry | Error reports, where switched on | EU storage, US company |
| Anthropic | AI assistant that helps us read and sort emails and messages and draft replies | USA |
Providers that process data on our behalf, including Supabase for accounts, work under data-processing terms. Anthropic handles the text it receives under its own terms, as an independent company. Where we use Vercel AI Gateway for voice-overs in our videos, it receives our own scripts, not your personal data. The platforms named under “Social media” also receive what you post there. We share personal data with others only when the law requires it.
Transfers outside the EU
Every Program is operated by a sole proprietor registered in Ukraine, so personal data is accessed from Ukraine. The EU has not adopted an adequacy decision for Ukraine, which means Ukrainian law may protect your data less than the GDPR does. We apply this policy to your data wherever it is handled.
Some providers are based in the USA. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses in the provider's data-processing terms.
Your rights
You can ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format. Where we rely on your consent, you can withdraw it at any time. We answer without undue delay and within one month at the latest. Write to privacy@everyprogram.com.
Your right to object. You can object at any time to processing based on our legitimate interest. We then stop, unless we have compelling grounds that override your interests or we need the data for legal claims. To object, write to privacy@everyprogram.com. For emails from us, you can also reply “stop”.
How to ask for deletion
- Email privacy@everyprogram.com with the subject “Data deletion request”.
- Tell us your username on the platform (for example, your Instagram handle) or the email address you used.
- We delete your data and confirm by reply, within one month at the latest.
You can also remove our app's access in your platform settings. On Facebook and Instagram: Settings, then Apps and Websites. Messages you sent stay in your own inbox on the platform, and deleting them there is up to you.
Complaints
You can complain to the data-protection authority where you live or work. The European Data Protection Board lists EU and EEA authorities. In the UK it is the Information Commissioner's Office, and in Ukraine the Ukrainian Parliament Commissioner for Human Rights.
Children
The service is meant for people aged 16 and over. We do not knowingly process data about younger children. If you think we have, write to us and we will delete it.
Changes
We post any change here with a new effective date.