Privacy Policy

Last updated: June 10, 2026

At StudyinEurope.eu, we take your privacy seriously. This policy explains how we collect, use, share, and protect your personal information when you use our website and services — including Leonardo, our AI European Study Advisor. We have written this in clear language for students, families, and institutions across Europe and worldwide.

1. Who We Are

StudyinEurope.eu is an independent platform helping students explore and compare higher education opportunities across Europe. Our mission is to make studying in Europe more accessible and transparent.

StudyinEurope.eu is operated by CREA Ideas Studio, SL, a company registered in Spain (VAT: ESB22654230).

Registered business address:
Calle Isla Cristina, 10, 21600 — Valverde del Camino, Spain.

Data Controller: CREA Ideas Studio, SL. Contact: support@studyineurope.eu.

2. Scope

This Privacy Policy applies to all visitors and registered users of StudyinEurope.eu — including students, educational explorers, and registered higher education institutions (HEIs) — as well as users of our AI advisor ("Leonardo"), our membership and payment features, and our student–institution lead forms. It explains what we do with your personal data and your rights under the General Data Protection Regulation (EU) 2016/679 ("GDPR").

3. What Data We Collect

3.1 From Students and Visitors

We collect the following categories of data:

Identity and contact data: first name, last name, email address, country (and, if you choose to provide it, other contact details).
Account and preferences: login credentials (hashed), chosen fields of study, saved favorites, membership status, and AI credits usage.
Lead and communications data: messages you send to institutions, program(s) of interest, and your email verification status ("validated" / "verified").
Technical and usage data: device/browser information, IP address (for security and approximate country detection), pages viewed, clicks (e.g., favorites, brochure downloads), and session events.
Payment data: handled by Stripe (card details are never stored on our servers). We receive limited payment metadata (e.g., transaction IDs, amount, status) for invoicing and support.
Cookies and similar technologies data: used for sign-in, preferences, security (e.g., reCAPTCHA), analytics, limited advertising, and user experience.

Special categories: We do not request or intentionally collect sensitive data (e.g., health, ethnicity, political opinions).

Chat privacy: We do not store the content of your conversations with Leonardo. Personalization is session-based only; no chat history is kept on our side.

3.2 From Institutions (HEIs)

When a higher education institution registers on StudyinEurope.eu, we collect the following data about the institution and its authorized representatives:

Institution identity data: institution name, official website, country, city, VAT number, and accreditation status.
Representative contact data: first name, last name, email address, job title, and IP address at the time of registration.
Account data: login credentials (hashed), subscription plan, billing history, and dashboard activity.
Payment and billing data: processed via Stripe. We receive limited metadata (transaction IDs, plan, amount, invoice status) for account management and tax compliance.
Content data: logos, photographs, videos, program descriptions, and other materials uploaded to the platform.
Consent records: timestamps and version references for acceptance of our Privacy Policy and Terms of Use.

4. How We Collect Data

Directly from you: when you create an account, purchase a subscription or membership, contact us, submit a lead to an institution, upload program content, or use the AI advisor.
Automatically: via cookies and similar technologies when you browse the site (see Cookies section).
From third parties: payment confirmations from Stripe; email validation results from our email verification provider; analytics signals from our analytics providers.

5. Why We Use Your Data (Purposes and Legal Bases)

5.1 For Students and Visitors

Provide our services (create/manage your account, favorites, membership, AI credits; show program information; enable brochure downloads and lead forms) — Legal basis: performance of a contract (Art. 6(1)(b)).
Process payments and invoices — Legal basis: performance of a contract and legal obligation (tax law) (Art. 6(1)(b), 6(1)(c)).
Send service communications (account notices, membership status, receipts, verification emails) — Legal basis: performance of a contract (Art. 6(1)(b)).
Share your details with educational institutions only after your express consent via our lead form — Legal basis: consent (Art. 6(1)(a)).
Protect the service (security, fraud prevention, abuse detection including reCAPTCHA, rate limiting) — Legal basis: legitimate interests (Art. 6(1)(f)).
Improve and analyze our site (aggregate, de-identified usage analytics; feature performance) — Legal basis: legitimate interests and/or consent where required for cookies (Art. 6(1)(f), 6(1)(a)).
Show limited advertising (where applicable) and measure its effectiveness — Legal basis: consent (Art. 6(1)(a)).
Comply with the law (tax, accounting, regulatory requests) — Legal basis: legal obligation (Art. 6(1)(c)).

5.2 For Institutions (HEIs)

Create and manage institution accounts (dashboard access, program listings, team members, subscription management) — Legal basis: performance of a contract (Art. 6(1)(b)).
Process subscription payments and issue invoices — Legal basis: performance of a contract and legal obligation (Art. 6(1)(b), 6(1)(c)).
Transmit student lead data to institutions where the student has given their explicit consent via our "Request Information" form — Legal basis: performance of a contract with the institution and the student's consent (Art. 6(1)(a), 6(1)(b)).
Send operational communications (account notices, lead notifications, billing alerts, platform updates) — Legal basis: performance of a contract (Art. 6(1)(b)).
Display institution content (logo, images, videos, program descriptions) on the platform — Legal basis: performance of a contract and legitimate interests (Art. 6(1)(b), 6(1)(f)).
Comply with the law (tax records, regulatory obligations) — Legal basis: legal obligation (Art. 6(1)(c)).

You may withdraw consent at any time via your account settings or by emailing support@studyineurope.eu. Withdrawing consent does not affect prior lawful processing.

6. Sharing Your Data

6.1 With Educational Institutions (HEIs) — Student Data

Only when you submit our "Request Information" form and give explicit consent do we share your data with an institution. We share the information visible on the form (e.g., your name, email address, country, the selected program, and your message) together with your email verification status (validated/verified) so the institution can respond to your inquiry.

Important: Once your data is transmitted to an institution, that institution acts as an independent data controller for the purpose of responding to your inquiry. StudyinEurope.eu is not responsible for how the institution processes your data after receipt. Each institution is bound by our Terms of Use to use your data only for responding to your inquiry and in compliance with applicable data protection law. You may contact the institution directly to exercise your data rights regarding their processing.

6.2 With Service Providers (Processors)

We share data with trusted service providers who help us operate the platform. These providers act solely on our instructions and under Data Processing Agreements (DPAs) that protect your data. They include providers for: hosting and infrastructure, security and DDoS protection, analytics, email delivery and validation, form protection (Google reCAPTCHA), AI processing (OpenAI, which powers Leonardo and our search engine), and payment processing (Stripe).

6.3 With Public Authorities

Where required by law, or to protect our rights or those of other users (e.g., to prevent fraud or abuse), we may disclose data to relevant authorities.

6.4 Business Changes

If we undergo a reorganization, merger, or acquisition, your data may transfer as part of that transaction under appropriate safeguards.

We never sell your personal data.

7. International Transfers

Some providers may process data outside the EU/EEA (for example, in the United States). This includes our AI provider OpenAI, which may process your queries to generate responses. When such transfers occur, we rely on lawful mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) and have signed DPAs with these providers. Additional safeguards (such as encryption in transit) are applied where appropriate.

8. Leonardo (AI Advisor) and Your Privacy

When you use Leonardo, our AI European Study Advisor, or our AI-powered search, your message is processed in real time to generate a response. We do not store your chat content and we do not build profiles across sessions. We minimize personal data in AI requests and do not add identity data unless strictly necessary to provide the service you requested.

Your message is transmitted securely to our AI provider, OpenAI, solely to generate the requested response. OpenAI acts as a data processor under our Data Processing Agreement and cannot use your data for any other purpose.

Important: Leonardo's suggestions are informational only and do not produce legal or similarly significant effects about you.

9. Cookies, Analytics, and Advertising

We use cookies and similar technologies to:

Keep you logged in and remember your preferences and favorites.
Secure forms and prevent abuse (e.g., Google reCAPTCHA).
Measure and improve site performance (aggregated analytics).
Show limited advertising and measure reach (where applicable).

Where required, we will request your consent via our cookie banner. You can update your choices at any time (see our Cookie Settings link, if available, or contact us). Third-party services (such as Google reCAPTCHA or ad networks) may set their own cookies and receive device/browser data as described in their policies. Learn more in Google's Privacy Policy and Terms.

10. Data Retention

Student account data: kept while your account is active. Upon a deletion request, we remove personal data within 30 days (unless we are required to retain some data by law).
Leads to institutions: copies of leads in our system are kept for up to 18 months to support your inquiries and prevent abuse, or until you request deletion. Note: we cannot control the receiving institution's retention policy — please contact them directly as well.
Institution account data: kept for the duration of the active account relationship. Upon account termination, personally identifiable contact data is deleted or anonymized within 60 days, subject to the billing retention requirement below.
Membership and invoicing data: payment and invoice records (via Stripe) are kept for up to 6 years for tax and accounting compliance.
Consent records: GDPR and Terms of Use consent records (timestamp, version, IP) are retained for the duration of the account relationship and for up to 6 years thereafter as evidence of lawful processing.
Security logs (including IP): kept for up to 12 months unless needed longer for ongoing investigations.
Cookies/analytics: according to their purpose and your consent settings.
AI chats: we do not store your chat content on our side.

When the applicable retention period ends, we securely delete or anonymize the data.

11. Data Security

We use technical and organizational measures to protect your data, including HTTPS encryption, access controls, and regular security reviews. We limit access to personal data to staff and providers who need it for legitimate purposes and who are bound by confidentiality obligations.

12. Your GDPR Rights

Under the GDPR, you have the right to:

Access your personal data.
Rectify inaccurate or incomplete data.
Erase your data ("right to be forgotten").
Restrict or object to processing (including profiling for analytics/UX improvements).
Data portability (obtain your data in a structured, commonly used format).
Withdraw consent at any time for processing based on consent.

Students can manage much of this in My Account (e.g., update details, reset password, request account deletion). Institution representatives may submit requests via support@studyineurope.eu. We will respond within one month (extendable by two months for complex requests, as permitted by the GDPR).

Note for students regarding leads: If you would like to request erasure of your data from a specific institution's records, you will need to contact that institution directly, as they act as an independent data controller for your lead data once it has been transmitted.

13. Children

Our services are intended for students who are at or above the age of digital consent in their country (typically 13–16 in the EU; 14 in Spain). If you are below that age, you must obtain parental or guardian consent before using the site. We do not knowingly collect personal data from children who cannot lawfully consent; if we learn this has occurred, we will delete the data promptly.

14. Third-Party Services We Rely On

To provide and secure our services, we use trusted providers, which may change over time. Typical categories include:

AI processing (OpenAI, to analyze user input and generate responses).
Payment processing (Stripe) and invoicing.
Email delivery and validation (transactional email and email verification).
Hosting, security, and performance (including DDoS protection, CDN, and reCAPTCHA).
Analytics (aggregate, de-identified insights).
Advertising (limited; consent-based).

Each provider processes data under its own privacy policy and our Data Processing Agreements (DPAs). For international transfers (including OpenAI in the U.S.), we use safeguards such as the EU Standard Contractual Clauses (SCCs).

15. Anonymized and Aggregated Insights

We may produce and publish anonymized, aggregate statistics about study interests and platform usage (for example, popular fields of study or countries students explore, or aggregate inquiry volumes by region). These insights cannot reasonably be used to identify any individual or institution.

16. How to Complain

If you believe your data protection rights have been infringed, you can contact us at support@studyineurope.eu and/or lodge a complaint with your local supervisory authority. In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD) at www.aepd.es.

17. Legal Jurisdiction

This Privacy Policy is governed by the laws of the European Union and Spain. Any legal matters or disputes arising from the use of this website or our services will fall under the jurisdiction of Spain, where StudyinEurope.eu is legally established.

18. Changes to This Policy

We may update this policy to reflect legal, technical, or business changes. We will post the updated version with a new "Last updated" date, and when appropriate we will notify you by email or via the site. Please review it periodically.