Trust

Privacy Policy

Unitic (https://unitic.ai) is operated by AlaLinks ("we", "us"). The plain-English version: we collect what we need to match you with programs, professors, and funding; we never sell your data; and we never use your data to train AI models. If you sign in with Google or connect your Gmail, the section "Google user data" below says exactly what we receive from Google, what we do with it, and how to take it back.

Effective · October 26, 2026 · Last updated · October 27, 2026

§1Data controller

Unitic is a product of AlaLinks. AlaLinks is the trading name of 1001383479 Ontario Inc., the entity responsible for your personal data. Our contact email addresses use the alalinks.com domain; they belong to the same organisation that runs Unitic.

1001383479 Ontario Inc. · Toronto, Ontario, Canada · Incorporated October 12, 2025. Email: omidveisi@alalinks.com.

We handle personal data in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and — for users in the UK and EU — the UK Data Protection Act 2018 and the General Data Protection Regulation (GDPR).

§2Google user data

This section covers everything Unitic receives from Google: when you sign in with Google, and when you choose to connect your Gmail so Unitic can send emails for you. These are two separate steps that use two separate Google sign-in clients. Connecting Gmail is optional and is never part of signing in.

Unitic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

§3What Google data we access

Google sign-in: your name, email address and profile picture. We use them only to create your Unitic account and to identify you when you sign in. Sign-in gives Unitic no access to your Gmail, contacts, calendar or files, and we keep no Google token from it.
Gmail connection (optional): only Google's permission to send email on your behalf (the scope https://www.googleapis.com/auth/gmail.send). With it, Unitic can send a message from your Gmail address — nothing more. We do NOT read, list, search, modify or delete any of your emails, and we have no access to your contacts or your Gmail settings.
To know which address it is sending from, the Gmail connection also receives the email address of the Google account you connect. We show it to you in Settings and put it in the From line of the emails you send.
When Gmail accepts an email, Google returns the message's ID and conversation (thread) ID. We keep them with that email in your sent history, so Unitic can show you that it was sent and when.

§4Why we need it

We ask for permission to send from your Gmail only so that the emails you write and send inside Unitic — for example, an email to a professor from the Applications page — go out from your own address, appear in your Gmail Sent folder, and bring replies straight to your inbox.

We ask for it only when you choose to connect Gmail, after you have signed in, with an explanation shown before Google's screen. If you never connect Gmail, Unitic never has this permission.

§5How we use Google user data

We use Google user data only to provide the features you use in Unitic, as described above. In particular:

We send an email from your Gmail only when you click Send on it. There are no automatic, scheduled or bulk sends from your Gmail.
No advertising: we never use Google user data to show, target or measure ads.
No selling: we never sell Google user data.
No sharing with third parties: we do not share or transfer Google user data to anyone else, except where Google's policy allows it — when it is needed to provide a feature you use (your name and email address are part of your Unitic account, and the service providers listed under "Data sharing and sub-processors" process the account on our behalf), to comply with the law, or as part of a merger or acquisition, with notice to you. Gmail tokens are never given to anyone: they are only ever sent back to Google.
No human reading: no one at Unitic reads your Google data, and Unitic has no permission to read your Gmail at all. Your name and email address appear in our account-administration tools so we can run your account and answer you when you contact us. Beyond that, a person would see Google data only with your explicit permission, when needed for security (for example, investigating abuse), or to comply with the law.
No AI or machine-learning training: we never use Google user data to develop, improve or train AI or machine-learning models — ours or anyone else's.

§6How Google tokens are stored and protected

Google sign-in: Google sends us a signed confirmation of who you are. We check it and keep no Google token.
Gmail connection: Google gives us a refresh token, which keeps the connection, and short-lived access tokens, each valid for about one hour. The refresh token is stored in our database encrypted at rest (AES-128 with an HMAC-SHA256 integrity check, using a key that is used for nothing else). Access tokens are kept only in our server's temporary cache, encrypted the same way, and expire within the hour.
Everything travelling between your browser, Unitic and Google is encrypted in transit (HTTPS/TLS).
Who can access them: only Unitic's own servers, which use them for one thing — sending the emails you send. Tokens are never shown in the app, in any administration screen, or in our logs. Access to the production servers and the encryption key is limited to the few Unitic staff who administer our servers.
How long we keep them: only while your Gmail is connected. See "Retention and deletion" below.

§7Retention and deletion

When you disconnect Gmail, we ask Google to revoke Unitic's access and delete the stored tokens immediately — even if Google reports that the access had already been removed.
If Google tells us the access is no longer valid (for example, because you removed Unitic in your Google Account), we delete the tokens at once and show a "Reconnect Gmail" prompt in case you want to keep sending.
When you delete your Unitic account (Settings › Security › Delete account), we revoke and delete every Google token at once.
A database backup can still contain an encrypted copy of a token after it has been deleted. Because we revoke the token with Google first, that copy can no longer be used.
To have all of your data deleted — your account, your profile and everything Google sent us — email omidveisi@alalinks.com from the address on your account. We confirm the request and complete the deletion within 30 days.

§8How to revoke access

You can take back Unitic's access to your Gmail at any time, in either of two ways:

In Unitic: Settings › Email Control › Your Own Email › Disconnect.
In your Google Account: Google Account › Security › Third-party access ("Your connections to third-party apps & services", at myaccount.google.com/connections). Remove Unitic there and Google stops Unitic's access at once; we delete our copy of the tokens the next time Unitic is told the access is gone.
Disconnecting Gmail does not delete your Unitic account and does not affect signing in with Google.

§9Information we collect

We collect and process the following categories of information:

Personal information — name, email address, login credentials, and profile details you provide when creating or updating your account.
Uploaded documents — files you upload (CVs, résumés, transcripts, statements of purpose, reference letters). These may include educational history and other details you choose to share, and are used only for AI-assisted features, recommendations, and document review.
AI chat data — messages exchanged with Unitic agents. Logged securely to improve accuracy; never shared or used to train external models.
Usage information — IP address, device type, browser, country, pages visited, and interaction patterns, collected via cookies and similar technologies.
Sign-in network — each time you sign in, and while you use Unitic, the IP address you connect from, the country it belongs to (looked up on our own servers; the address is not sent to anyone else), and your device and browser type. We use it to limit how many accounts can sign in from one network and to detect misuse, and we keep it for up to 12 months.
Google data — if you sign in with Google or connect your Gmail, the data described under "Google user data" above, and nothing else.

§10Legal bases for processing

We process your data only where one or more of the following apply: Contract (to provide the service), Legitimate Interest (to operate, improve, and secure the platform), or Consent (for analytics or marketing where required). You can withdraw consent or unsubscribe from marketing at any time.

§11Sign-in and email

How you sign in, and how the emails you send through Unitic leave:

OAuth 2.0 with Google — you sign in directly with Google; we never see your password. Sign-in requests only the basic scopes 'openid', 'email' and 'profile'.
Microsoft sign-in is not offered at the moment.
If you connect Gmail, the emails you send go out from your Gmail address, as described under "Google user data".
If you have not connected Gmail, an email Unitic sends for you goes out through Unitic's own mail server, with Reply-To set to your address so replies reach you directly. It is not sent from your mailbox.
Encrypted in transit over TLS.
PIPEDA-compliant (Ontario-incorporated, Canadian privacy law).
No third-party sharing — your data is never resold, syndicated, or shared with advertisers.

§12How we use your information

We use your information to:

Create and manage your account.
Provide AI-powered tools and personalized academic recommendations.
Process payments for paid subscriptions and guided plans.
Communicate service updates and account notifications.
Improve performance and user experience, and detect or prevent misuse.
Enforce our Terms of Service.

§13Model training

We do not use your application materials, drafts, transcripts, chat data or Google user data to train, fine-tune, or evaluate any machine-learning model — ours or any third party's. We also do not use your personal data for automated decision-making that produces legal or similarly significant effects. This is a hard product principle, not a setting.

§14Data sharing and sub-processors

We do not sell your personal information. We share data only where necessary to operate the service, with sub-processors bound by GDPR Article 28 / PIPEDA-equivalent obligations:

Hetzner Online — the servers that run Unitic, including its database and file storage (Helsinki, Finland).
OpenAI, Anthropic and Google (Gemini) — the AI models behind the AI features you use. They receive the text a feature needs (for example, your CV and your request), never your Google tokens or any access to your Gmail.
Google (Google Sign-In and Gmail) — signing you in, and sending the emails you send from a connected Gmail.
Google Workspace — Unitic's own outgoing email (sign-in codes, notices).
Stripe & PayPal — payment processing (we never store card details).

§15Data transfers

Your data may be processed outside your country of residence. Where it is, we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards, conduct transfer impact assessments, and apply supplementary measures such as encryption and access controls to keep your data protected outside Canada, the UK, and the EU.

§16Security

We use encryption, access controls, and secure infrastructure to protect your data. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

§17Cookies and tracking

We use cookies for essential functionality and, with your consent, analytics. Non-essential cookies are only set after you opt in via our cookie banner, and you can change or withdraw your preferences at any time.

§18Profiling and personalization

We may analyze details you provide — field of study, preferred destination, or uploaded documents — to recommend professors, programs, and scholarships. Uploading documents is optional; the platform still works without them, though recommendations will be less personalized. This profiling has no legal or similarly significant effects, and you can opt out in your account settings.

§19Your rights

Depending on your location you may access, correct, delete, or export your data, object to or restrict certain processing, and withdraw consent at any time. We may request proof of identity first, and will respond within 30 days. Contact omidveisi@alalinks.com.

You may also complain to your local data protection authority — in Canada, the Office of the Privacy Commissioner (priv.gc.ca); in the UK, the ICO (ico.org.uk). We extend similar rights to users globally where reasonably possible.

§20Data retention

We keep personal data only as long as needed to provide the service or meet legal obligations. Sign-in network records (IP address, country, device) are deleted 12 months after the network was last used.

Deleting your account in Settings closes it at once: you are signed out, the account can no longer be used, and every Google token is revoked and deleted. The rest of your data is kept until you ask us to erase it; email omidveisi@alalinks.com and we permanently delete it within 30 days.

§21Children's privacy

The service is not intended for individuals under 18. If we learn we have collected data from a minor, we will delete it promptly.

§22Changes to this policy

We may update this policy periodically. If changes are significant, we will notify you by email or platform notice. Continued use after the effective date indicates acceptance.

§23Contact us

Questions about this Privacy Policy, or a request to delete your data? Email omidveisi@alalinks.com · 1001383479 Ontario Inc., Toronto, Ontario, Canada.