uConnect Privacy Policy

What We Collect: We collect information such as personal identifiers (name, email), university and education information, career search activities, affinity group memberships, employment outcomes data, and technical information like IP addresses and cookies.

How We Use It: To provide career exploration services, improve our platform, and share insights with your university.

Who We Share With: Your university owns and has access to all data you enter or create in the Platform, as we operate as their career services system. We do not sell your data or share it with third parties for marketing purposes.

Your Rights: You can access, correct, or request deletion of your data through your university or by contacting us directly. See the 'Your Rights and Choices' section below.

How We Protect Your Data: We implement technical and organizational security measures such as encryption, access controls, security monitoring, and employee training. See 'Data Security Measures' below for details.

uConnect Does Not Sell Student Data

We have never sold student data and we never will. Our business model is based on providing valuable services to universities, not monetizing student information.

Introduction and Purpose

This Privacy Policy explains how uConnect Inc. ('the Company,' 'we,' 'us,' or 'our') collects, uses, protects, and shares personal information of students who use the uConnect virtual career center platform ('Platform').

Important: The uConnect Platform is provided as a service to your university and operates as part of your university's career services system. When you use the Platform, you are using your university's system, and your university has access to the data you enter.

We are committed to protecting student privacy and complying with all applicable laws, including state privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ('CCPA/CPRA'), New Jersey's Student Data Privacy Law, and other state student data privacy regulations, as well as federal laws including the Family Educational Rights and Privacy Act ('FERPA').

uConnect's Role as Your University's Service Provider

uConnect provides the Platform technology as a service to your university and acts as a 'service provider' or 'processor' under state privacy laws and FERPA. Our relationship with your university is governed by a Data Processing Agreement that ensures:

uConnect processes student data only as directed by your university
Your university controls what data is collected and how it is used
We implement appropriate technical and organizational security measures
We do not use student data for any purpose other than providing and improving services to your university
All data you enter into the Platform is accessible by your university as part of their career services system

Under applicable privacy laws, both uConnect and your university share responsibility for protecting your data and complying with privacy regulations. You have rights under this arrangement, which are described in the 'Your Rights and Choices' section below.

What Information We Collect

We collect only the information necessary to provide Platform services and support your career exploration. The categories of information we may collect include:

I. Personal Identification Information

We collect personal identifiers such as:

Full name
University affiliation
University-issued email address
Education information including academic program, major, class year, and other information provided by your university

II. Affinity Group Membership (Optional)

Students may voluntarily join affinity groups to connect with identity-specific career opportunities and resources. Affinity groups may include communities such as Women in STEM, LGBTQ+ Professionals, Black Professionals Association, Veterans Career Network, First-Generation Scholars, Students with Disabilities, and others.

Important Privacy Notice: Affinity group membership is completely optional and does not affect access to core Platform features. However, joining certain affinity groups may reveal sensitive personal information about your identity (such as sexual orientation, gender identity, disability status, or veteran status) to your university career center. Your university has access to all Platform data, including which affinity groups you have joined. Only join affinity groups if you are comfortable with your university seeing this information.

III. Platform Usage and Career Search Data

We collect information about your Platform usage, such as:

Login times and session duration
Career fields and resources accessed
Search queries and browsing patterns
Saved careers, bookmarks, and preferences
Interaction with career content (views, clicks, time spent)

IV. Technical and Device Information

We automatically collect certain technical information when you access the Platform, including:

IP address
Browser type and version
Device type and operating system
Referring website or application
General geographic location (typically city and state level)

V. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

Maintain your login session
Remember your preferences
Analyze Platform usage and performance
Improve user experience

You can control cookies through your browser settings. Note that disabling cookies may limit some Platform functionality.

VI. Employment Outcomes Data (Optional)

Students may voluntarily provide post-graduation or pre-graduation employment information, or your university may provide this information on your behalf. Employment outcomes data may include:

Job title and employer name
Salary and compensation information
Employment start date and work location
Job offer details and acceptance information
Other career outcome information

This information helps universities assess career services effectiveness and support students in their career development. Employment outcomes data may be shared with your university in both individual and aggregate form to improve career programming and demonstrate institutional outcomes.

How We Use Your Information

We use collected information for purposes including:

Provide Platform Services: Enable account creation, authentication, and access to career exploration resources
Personalize Experience: Customize career recommendations and content based on your interests, search history, and affinity group memberships
University Reporting: Share individual and aggregate usage data, employment outcomes, and other information with your university to improve career services and demonstrate program effectiveness
Platform Improvement: Analyze aggregate usage patterns to enhance features and user experience
Technical Operations: Maintain security, prevent fraud, and troubleshoot technical issues
Legal Compliance: Fulfill legal obligations and respond to lawful requests

Automated Processing and AI-Powered Features

uConnect's AI Search feature uses artificial intelligence to provide personalized career recommendations, search results, and insights. To improve the relevance of results over time, AI Search uses a long-term memory mechanism: when you submit a search query, your previous search activity is summarized by the AI model and stored as a memory associated with your account. Each time you use AI Search, that stored memory summary is included alongside your new query in the context sent to the AI model. This allows AI Search to provide more relevant, personalized results based on your search history over time.

What this means for you:

AI Search uses a running summary of your previous search activity — not your raw search history — to personalize recommendations. This summary is generated and stored by uConnect and is transmitted to Anthropic's API as part of each subsequent query.
This memory summary may reflect patterns in your career interests, including searches related to industries, roles, or topics you have explored over time.
AI Search recommendations are informational only. They do not make binding decisions about your career prospects or qualifications.
Students in Colorado, Connecticut, and other states with laws governing automated decision-making have the right to opt out of profiling that produces legal or similarly significant effects. AI Search recommendations are informational and do not produce such effects.
You may request deletion of your AI Search memory summary by contacting privacy@gouconnect.com. Deletion of your memory summary will result in AI Search no longer having access to your previous search history for personalization purposes.
You may contact us at privacy@gouconnect.com if you have questions about how automated processing applies to your data.

When you use AI Search, your current query and your stored memory summary are transmitted to Anthropic's API and to Langfuse for quality monitoring (see Subprocessors section). uConnect transmits your first and last name and an internal user identifier alongside this data. Your university-issued email address is not transmitted.

Who Has Access to Your Information

Because uConnect operates as your university's career services platform, data sharing works differently than with third-party consumer applications. Here's who can access your information:

I. Your University

Your university has access to all information you enter into the Platform. This includes:

Your profile information (name, email, major, class year, and other education information)
Affinity group memberships (which may reveal sensitive information about your identity)
Career searches, resources viewed, and platform activity
Saved careers, bookmarks, and preferences
Employment outcomes data you provide or that is provided on your behalf

Your university uses this information to:

Support your career development and provide personalized assistance
Improve career services programs and resources
Generate aggregate reports on student career interests and outcomes
Identify students who may benefit from additional career support
Demonstrate program effectiveness to institutional leadership and accreditors

This sharing complies with FERPA regulations, as your university is the educational institution maintaining your education records, and uConnect acts as a school official with legitimate educational interest.

II. No Third-Party Sharing or Sale

We do not:

Sell your personal information to any third party
Share your data with advertisers or marketing companies
Provide your information to employers without your consent
Use your data for marketing purposes outside the Platform

III. Service Providers and Subprocessors

uConnect engages certain third-party service providers ('subprocessors') to help us provide the Platform technology. These subprocessors process student data on our behalf under contractual obligations that include data protection requirements comparable to this Privacy Policy. Service providers with access to student personal information operate under contractual terms that require:

Use of data only to provide services to uConnect
Implementation of appropriate technical and organizational security measures
Prohibition on use of student data for their own business purposes
Immediate notification of any data breaches

For subprocessors subject to GDPR requirements, we maintain Data Processing Agreements or utilize service terms that include equivalent data protection provisions (such as Google Cloud's standard Data Processing Terms).

Current subprocessors include (updated April 17^th, 2026):

Pagely, Inc.: Managed WordPress hosting provider (hosts entire platform infrastructure with full access to student data). Pagely's hosting infrastructure runs on Amazon Web Services (AWS), which is also listed separately as a subprocessor.
MongoDB, Inc. (MongoDB Atlas): Cloud database platform used to store and manage platform application data, including student profiles, career activity, search history, affinity group memberships, and employment outcomes data. MongoDB Atlas processes student data on infrastructure hosted within the United States and is bound by MongoDB's Data Processing Agreement.
Amazon Web Services, Inc. (AWS): Cloud infrastructure provider used for data storage, transmission, and compute services underlying the uConnect platform. Student data is stored and transmitted through AWS infrastructure as part of core platform operations. AWS is bound by its Data Processing Addendum and AWS GDPR commitments. Data is stored in US-based AWS regions.
Google LLC (BigQuery): Data warehouse and analytics platform (stores raw student data, usage logs, and personally identifiable information for performance monitoring)
Google LLC (Google Analytics): Web analytics and user behavior tracking . uConnect configures Google Analytics with IP anonymization enabled and advertising features disabled to minimize data sharing. uConnect has reviewed its Google Analytics implementation and determined that, as configured, it does not constitute a "sale" or "sharing" of personal information under CCPA/CPRA. Students may opt out of Google Analytics tracking by using the Google Analytics Opt-Out Browser Add-On available at tools.google.com/dlpage/gaoptout.

Email provider (SendGrid)

Anthropic, PBC (Claude API): AI language model provider. When students use the AI Search feature, query data is transmitted to Anthropic's API for processing. Anthropic processes this data as a subprocessor under contractual data protection terms that prohibit use of student data for model training or any purpose other than providing the requested service. uConnect does not transmit personally identifiable information beyond what is necessary to fulfill the search query.
Langfuse (Finto Technologies, Inc.): AI observability and monitoring platform used to measure and monitor the quality, performance, and reliability of the AI Search feature. Langfuse receives AI Search query data, model inputs and outputs, system performance metrics, and certain personally identifiable information including student first and last name and internal uConnect user IDs. Email addresses are not transmitted to Langfuse. This data is used solely for platform monitoring, quality assurance, and system reliability purposes under a data processing agreement with uConnect that prohibits use of student data for any other purpose.

We maintain a current list of all subprocessors with detailed information about their services and data access levels and will notify university partners at least 30 days before adding new subprocessors that will have access to student data.

IV. De-Identified Data

We may use de-identified and aggregated data for cross-university research, reporting, and platform improvement. Data is de-identified using methods consistent with recognized standards, including statistical techniques that render re-identification not reasonably practicable (consistent with NIST SP 800-188 guidance and, where applicable, HIPAA Safe Harbor methodology). This data cannot reasonably be used to identify individual students and is not subject to FERPA restrictions.

V. Legal Requirements

We may disclose your information when required by law, such as in response to a valid subpoena or court order. When legally permitted, we will notify affected students and universities before such disclosure.

Third-Party Links and External Websites

The Platform may contain links to external career resources, employer websites, and other third-party sites. When you click on these links:

We Track Your Journey: We record that you clicked on a link to leave our Platform (to understand which resources are most valuable to students)
Our Policy Ends: Once you leave our Platform, you are subject to the privacy policy and terms of the third-party website
We Are Not Responsible: We have no control over and assume no responsibility for third-party data practices

We encourage you to review the privacy policies of any third-party sites you visit.

Data Security Measures

We implement comprehensive security measures to protect your information, including:

Encryption: Data is encrypted in transit (using TLS/SSL) and at rest
Access Controls: Strict role-based access limitations and authentication requirements
Security Audits: Regular security assessments and vulnerability testing
Employee Training: Mandatory privacy and security training for all staff
Monitoring: Continuous monitoring for unauthorized access or security breaches
Incident Response: In the event of a data breach affecting student personal information, uConnect will notify affected university partners within 72 hours of discovering the breach (or as required by applicable law, whichever is sooner). When legally permitted, uConnect will also notify affected students. Notification will include the nature of the breach, categories of data affected, and steps uConnect is taking to address it.

Despite these measures, no system is completely secure. We cannot guarantee absolute security but continuously work to enhance our protections.

Our Privacy Commitments and Certifications

uConnect is committed to protecting student privacy through adherence to industry best practices and recognized compliance frameworks:

Core Privacy Commitments

We commit to the following privacy principles:

No Data Sale: We do not sell student personal information to third parties and never will
Limited Use: We use student data only to support the educational purposes of your university
No Behavioral Advertising: We do not use or disclose student information for behavioral targeting of advertisements
Transparency: We maintain clear, accessible privacy policies and notify users of material changes
Data Minimization: We collect only data necessary for platform functionality and educational purposes
Data Retention Limits: We enforce limits defined by your university.
Security Standards: We implement comprehensive technical and organizational security measures
User Rights: We support student and parental rights to access, correct, and request deletion of student information

Security and Privacy Certifications

TX-RAMP Certification: uConnect is certified under the Texas Risk and Authorization Management Program (TX-RAMP), demonstrating compliance with rigorous state security standards for cloud services.
HECVAT Completion: We have completed the Higher Education Community Vendor Assessment Toolkit (HECVAT), available to university partners upon request.

State Law Compliance

We comply with student data privacy laws in all states where we operate, including comprehensive privacy laws such as CCPA/CPRA (California), New Jersey's Student Data Privacy Law, and other state student privacy regulations. These state laws often provide more restrictive protections than federal law and codify many of our core privacy principles.

Data Retention and Destruction

We retain your data only as long as necessary for the purposes described in this policy:

Active Account Data: Retained as required by your university's data retention policy
Usage Logs: Retained for security and troubleshooting purposes

Employment Outcomes Data: Retained as directed by your university

De-identified Data: May be retained indefinitely for research and analysis, as it cannot be linked to any individual.
Legal Holds: Data subject to legal proceedings may be retained longer as required by law

Upon university requests, we securely delete it using methods that prevent reconstruction, including permanent deletion from all systems.

Your Rights and Choices

Under state privacy laws and FERPA, you have the following rights regarding your personal information:

How to Exercise Your Rights

We recommend a two-step approach for data requests:

Primary Path - Contact Your University (Recommended):

We recommend contacting your university career center for data access, correction, or deletion requests. As the controller of your education records, your university can best assist you with these requests and will coordinate with uConnect to execute approved actions. Your university maintains ultimate responsibility for your education records and can provide the most comprehensive assistance.

Alternative Path - Contact uConnect Directly:

You may also contact uConnect directly at privacy@gouconnect.com. For requests we receive directly from students, we will coordinate with your university before taking action to ensure proper handling of your education records. We will respond to verified requests within the timeframes required by law and may need to verify your identity before processing your request.

Your Specific Rights

Right to Access:

You may request access to the personal information we have collected about you. We will provide a copy within 45 days of your verified request.

Right to Correction:

If you believe your information is inaccurate or incomplete, you may request corrections. We will update records within 30 days unless we have a legitimate reason to maintain the existing information.

Right to Deletion:

You may request deletion of your personal information. We will honor deletion requests except where we must retain data to comply with legal obligations or complete transactions you requested. Note that deletion will result in loss of Platform access. Because this is your university's system, deletion requests will be coordinated with your university.

Right to Manage Affinity Group Membership:

You may join or leave affinity groups at any time through your account settings. Remember that your university can see your affinity group memberships, so leaving a group does not erase the university's knowledge that you were previously a member.

Right to Data Portability (State-Specific):

If you reside in California, Colorado, Connecticut, Virginia, or other states with comprehensive privacy laws, you may request a copy of your personal information in a portable format.

State-Specific Privacy Rights

California Residents (CCPA/CPRA)

In addition to the rights above, California residents have the right to:

Know what personal information we collect, use, disclose, and sell
Opt out of the 'sale' or 'sharing' of personal information (Note: We do not sell or share personal information)
Limit use of sensitive personal information (such as affinity group memberships that reveal protected characteristics)
Not be discriminated against for exercising privacy rights

New Jersey Residents (Student Data Privacy Law)

New Jersey law provides additional protections for student data privacy. We comply with requirements regarding data minimization, security standards, and limitations on data use that apply to vendors serving New Jersey educational institutions.

Colorado, Connecticut, and Virginia Residents

Residents of these states have similar rights to access, correct, delete, and obtain copies of their data, as well as the right to opt out of targeted advertising and profiling. Note that we do not engage in targeted advertising or profiling.

Other States

As of the effective date of this policy, uConnect also complies with comprehensive privacy and student data protection laws in Texas (TX-HB 4), Florida, Montana, Oregon, Nevada, and all other states where such laws are in effect. The rights described in this section apply to residents of all states with applicable privacy laws, regardless of whether your state is specifically listed. If your state has enacted a student data privacy law or comprehensive consumer privacy law, you may have rights to access, correct, delete, and port your data, as well as the right to opt out of targeted advertising and profiling. uConnect does not engage in targeted advertising or profiling for commercial purposes.

Contact our Privacy Officer at security@gouconnect.com to learn more about rights specific to your state.

Age Requirements and Minors

The Platform is primarily intended for college and university students who are 18 years or older. uConnect recognizes that some universities serve dual-enrollment students or other users under the age of 18.

If you are under 18, your university is responsible for obtaining any required parental or guardian consent before providing you with access to the Platform.
uConnect does not knowingly collect personal information directly from children under 13. If we learn we have collected information from a child under 13 without appropriate consent, we will promptly delete it and notify the relevant university.
Universities that enroll minors should contact uConnect at security@gouconnect.com to discuss appropriate data handling configurations for their institution.

Business Transfers

If the Company is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. If the Company is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. In accordance with our Software Services Agreement, we will notify your university of any such transfer. Your university, as the controller of your education records, will communicate with you regarding any changes to how your data is handled as a result of the transaction.

Legal Compliance

The Company complies with all applicable state and federal privacy laws, including state student data privacy laws such as CCPA/CPRA (California), New Jersey's Student Data Privacy Law, and other state regulations, as well as federal laws including FERPA and the Privacy Act of 1974. We regularly review and update our practices to ensure ongoing compliance.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will:

Post the updated policy on the Platform with a new effective date
Notify the university via email at least 30 days before the changes take effect
Obtain their consent if required by law

Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

Contact Information

For questions, concerns, or to exercise your rights under this Privacy Policy:

Privacy Officer

uConnect Inc.
303 Wyman Street, Suite 300
Waltham, MA 02541
Email: security@gouconnect.com

Response Time: We respond to all inquiries within 10 business days.

Additional Privacy Resources

For more detailed information about privacy at uConnect, please visit:

Student Privacy FAQ: gouconnect.com/privacy/student-faq
University Partner Privacy FAQ: gouconnect.com/privacy/university-faq
Career Center Professional FAQ: gouconnect.com/privacy/career-center-faq