Who controls your data
StudyBridge operates the platform at studybridgee.io and all agency-branded subdomains powered by StudyBridge technology.
For students using studybridgee.io directly, StudyBridge acts as the data controller — meaning StudyBridge determines what data is collected, why, and how long it is kept.
For students using an agency-branded subdomain (e.g. agencyname.studybridgee.io), the agency acts as the data controller for data collected within their portal. StudyBridge acts as a data processor on behalf of the agency — processing your data only to deliver the platform service, and not for any other purpose. The agency's own privacy policy, published on their subdomain, governs that relationship.
This policy covers data collected and processed by StudyBridge directly — including data generated through studybridgee.io, the marketplace, and platform-level infrastructure shared across all subdomains.
StudyBridge is currently operated by an individual, El Bechir Ebnou, based in Turkey. The business is in the process of formal registration as a legal entity. Upon incorporation, this section will be updated accordingly.
Who this policy applies to
This policy applies to:
Students who create an account on studybridgee.io or browse the StudyBridge marketplace
Agency representatives who apply for or hold a StudyBridge subscription
Visitors who browse studybridgee.io without a registered account
What data we collect and why
We only collect data that is genuinely necessary to operate the platform and deliver the service.
| Data category | Why we collect it | Legal basis |
|---|---|---|
| First name, last name, email address | To create and identify your account | Contract performance |
| Phone number | Collected when you submit an application — used by the agency to contact you | Contract performance |
| Country of residence | Collected at application stage to match you with relevant programs and requirements | Contract performance |
| Uploaded documents (transcripts, passport, ID, financial statements, or other program requirements) | Required by the agency and ultimately the university to assess your application | Contract performance |
| Application records and correspondence | To manage your applications, track status, and maintain a communication history | Contract performance |
| Login credentials (hashed — never stored in plain text) | To authenticate you securely and protect your account | Legitimate interest (platform security) |
| Session data | To keep you logged in during your visit | Legitimate interest (platform functionality) |
We do not collect sensitive personal data such as health information, religious beliefs, political opinions, or biometric data. If a specific university program requires such information, you will be asked to provide it directly to the university — not through this platform.
Phone numbers submitted through the platform are not verified. You are responsible for providing accurate contact information.
| Data category | Why we collect it | Legal basis |
|---|---|---|
| Business name, registration details, and jurisdiction | To verify the agency is legally authorized to operate as an educational placement or consulting service | Contract performance |
| Proof of authorization to operate as an educational agency or student consultancy | Required as part of manual onboarding to protect students on the platform | Legitimate interest (platform integrity) |
| Agency owner or representative name and email | To manage the subscription and communicate about the account | Contract performance |
| Subscription and billing records | To administer the agency's subscription | Contract performance |
| Platform usage and audit logs | To maintain a tamper-evident record of all actions taken within the platform | Legitimate interest (security and compliance) |
Who can see your data
Your personal data is visible to:
The agency you are working with — authorized team members of any agency whose subdomain you have created an account on, or through whom you have submitted an application. Access within the agency is role-based. Not all team members can see all data — access is determined by the permissions set by the agency owner.
StudyBridge staff — only in the following limited circumstances: where technically necessary to investigate a verified security incident affecting your data; where required by applicable law or a valid legal order; or where you have contacted StudyBridge directly with a data-related request.
Your data is never sold, shared with advertisers, or disclosed to third parties for marketing purposes.
Agency account and onboarding data is accessible only to the StudyBridge team for the purposes of onboarding verification, subscription management, and platform support. It is not shared with other agencies or third parties.
StudyBridge uses the following third-party services to operate the platform. Each is bound by data protection obligations consistent with this policy:
| Service | Purpose | Data location |
|---|---|---|
| Cloudflare R2 | Encrypted storage for all uploaded documents | EU region |
| Amazon Web Services | Platform server infrastructure | EU — North (eu-north-1) |
| Google Firebase | User authentication | Google global infrastructure |
| Google SMTP | Transactional email notifications | Google global infrastructure |
| Google Firebase Analytics | Aggregate, anonymized usage analytics on studybridgee.io | Google global infrastructure |
Google Firebase Analytics is used on the main studybridgee.io domain only to understand general platform usage patterns (page visits, feature usage). It does not identify you personally and does not track you across other websites. Agency subdomain analytics are generated entirely from StudyBridge's own servers — no third-party analytics tools are used on agency subdomains.
How long we keep your data
Your data is retained for as long as your account is active and you have an ongoing relationship with one or more agencies on the platform.
If you request deletion of your data at agency level, it is removed from that agency's active records and purged from backup systems within 90 days.
If you request full platform-wide erasure, all personal data across all agencies is permanently deleted within 30 days of your confirmed request.
A minimal anonymized audit record — containing no personal data, only a timestamp and deletion event — is retained for compliance purposes after deletion.
Agency account data is retained for the duration of the subscription.
Upon cancellation, agency account data is retained for 30 days to allow for any necessary export, then permanently deleted.
Audit logs associated with student applications managed through the agency's portal are subject to the student data retention rules above.
How we protect your data
Your data — especially uploaded identity documents and academic records — is protected by multiple layers of security:
All documents are stored in an encrypted private storage system (Cloudflare R2). The storage bucket is not accessible from the public internet under any circumstances.
Documents are only accessible via time-limited pre-signed URLs generated by the StudyBridge backend. These links expire after 30 minutes. After expiry, re-authentication is required to generate a new link.
All data is encrypted in transit using TLS. Your connection to the platform is always secured.
Access within agency portals is role-based. Team members can only view data their role permits. Only the agency owner may delete student records.
All access and modification events within the platform are recorded in a tamper-evident audit trail.
Login credentials are hashed using industry-standard cryptographic methods. StudyBridge staff cannot read your password.
No system is entirely immune to security risks. If we become aware of any incident affecting your personal data, we will notify you promptly by email with details of what happened and the steps being taken.
Where your data is stored
StudyBridge stores platform infrastructure on Amazon Web Services servers located in the EU North region (eu-north-1). All uploaded documents are stored on Cloudflare R2 with primary storage in the EU region.
Authentication is handled by Google Firebase. Transactional emails are sent via Google SMTP. Both involve data passing through Google's global infrastructure under Google's data processing terms and Standard Contractual Clauses for international data transfers.
All data storage and processing is governed by the EU General Data Protection Regulation (GDPR). If you are a resident of Turkey, your data is additionally processed in accordance with Turkey's Personal Data Protection Law (KVKK), Law No. 6698.
Agency subdomain analytics and student visibility
Agencies subscribed to StudyBridge receive aggregated insights about visits to their branded subdomain — including the number of visitors and when visits occurred. This data is generated entirely from StudyBridge's own servers. No third-party analytics tools are used on agency subdomains. Visit data does not include personally identifiable information unless a visitor creates an account.
When you create an account on an agency's branded subdomain, the agency can see that you have registered. This allows the agency to manage their student relationships and organize their work effectively.
Upon registration on an agency subdomain, the agency gains the right to request documents from you independently of any specific application — for example, to assess your general eligibility or prepare your profile. You are under no obligation to provide documents that are not required for a program you have actively chosen to apply to. If you have concerns about a document request, you may contact StudyBridge at support@studybridgee.io.
Cookies and tracking
StudyBridge uses a minimal set of cookies strictly necessary to operate the platform:
| Cookie type | Purpose | Expiry |
|---|---|---|
| Session authentication cookie | Keeps you logged in during your visit | Deleted when you close your browser |
| Cloudflare security cookie | Protects the platform against automated attacks and abuse | Short-term, set by Cloudflare |
We do not use advertising cookies, retargeting pixels, or any cookies that track you across other websites. We do not serve advertisements on this platform.
Google Firebase Analytics is used on studybridgee.io to collect anonymized, aggregate usage data. This does not set cookies that identify you personally and does not follow you across other websites.
The cookies described above are strictly necessary for the platform to function securely and do not require separate consent under applicable law. You may disable cookies in your browser settings, but doing so will prevent you from logging in to the platform.
Your rights
You have the following rights over your personal data. These rights apply regardless of which country you are applying from.
Right to know
You can ask us at any time what personal data StudyBridge holds about you and receive a copy of it. We will respond within 30 days. Contact: privacy@studybridgee.io
Right to correct
If any of your information is inaccurate, you can update it directly from your student dashboard, or contact the relevant agency or StudyBridge to request a correction.
Right to delete — single agency
To delete data held by a specific agency, contact that agency directly through their subdomain or the contact details on their privacy policy.
Right to delete — full platform erasure
To permanently remove all your personal data across every agency you have interacted with on StudyBridge:
Visit studybridgee.io/delete-my-data
Confirm your identity using your registered credentials
Review the list of agencies that hold your data
Confirm your erasure request
All personal data associated with your account will be permanently and irreversibly deleted within 30 days. You will receive email confirmation once deletion is complete. This action cannot be undone.
Right to restrict processing
You can ask us to pause processing of your data while a concern or dispute is being resolved, without deleting it. Contact: privacy@studybridgee.io
Right to data portability
You can request a copy of your personal data in a portable, machine-readable format (JSON or CSV). Contact: privacy@studybridgee.io
Right to object
You may object to processing of your personal data where we rely on legitimate interests as the legal basis. Contact: privacy@studybridgee.io
Right to lodge a complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In the EU, contact your national data protection authority. In Turkey, contact the Personal Data Protection Authority (KVKK Board).
We take all data rights requests seriously. If you submit a request and do not receive a response within 30 days, please follow up at privacy@studybridgee.io.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in the platform, applicable law, or our practices. When we make material changes, registered users will be notified by email at least 14 days before the changes take effect.
The current version of this Privacy Policy is always available at studybridgee.io/privacy. The effective date at the top of the document shows when it was last updated.
Contact us
For any questions, requests, or concerns about this policy: