Privacy Policy

Plain Language Summary

This summary provides a brief overview of our privacy practices. Please read the complete policy below for full
details.

What We Collect: We collect information such as personal identifiers (name, email), university and
education information, career search activities, affinity group memberships, employment outcomes data, and technical
information like IP addresses and cookies.

How We Use It: To provide career exploration services, improve our platform, and share insights
with your university.

Who We Share With: Your university owns and has access to all data you enter or create in the
Platform, as we operate as their career services system. We do not sell your data or share it with third parties for
marketing purposes.

Your Rights: You can access, correct, or request deletion of your data through your university or
by
contacting us directly. See the Your Rights and Choices section below.

How We Protect Your Data: We implement technical and organizational security measures such as
encryption, access controls, security monitoring, and employee training. See Data
Security Measures below for
details.

Introduction and Purpose

This Privacy Policy explains how uConnect Inc. (“the Company,” “we,” “us,” or “our”) collects, uses, protects, and
shares personal information of students who use the uConnect virtual career center platform (“Platform”).

Important: The uConnect Platform is provided as a service to your university and operates as part
of your university’s career services system. When you use the Platform, you are using your university’s system, and
your university has access to the data you enter.

We are committed to protecting student privacy and complying with all applicable laws, including state privacy laws
such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), New
Jersey’s Student Data Privacy Law, and other state student data privacy regulations, as well as federal laws
including the Family Educational Rights and Privacy Act (“FERPA”).

uConnect’s Role as Your University’s Service Provider

uConnect provides the Platform technology as a service to your university and acts as a “service provider” or
“processor” under state privacy laws and FERPA. Our relationship with your university is governed by a Data
Processing Agreement that ensures:

• uConnect processes student data only as directed by your university
• Your university controls what data is collected and how it is used
• We implement appropriate technical and organizational security measures
• We do not use student data for any purpose other than providing and improving services to your university
• All data you enter into the Platform is accessible by your university as part of their career services system

Under applicable privacy laws, both uConnect and your university share responsibility for protecting your data and
complying with privacy regulations. You have rights under this arrangement, which are described in the Your Rights and Choices section below.

What Information We Collect

We collect only the information necessary to provide Platform services and support your career exploration. The
categories of information we may collect include:

I. Personal Identification Information

We collect personal identifiers such as:

• Full name
• University affiliation
• University-issued email address
• Education information including academic program, major, class year, and other information provided by your
  university

II. Affinity Group Membership (Optional)

Students may voluntarily join affinity groups to connect with identity-specific career opportunities and resources.
Affinity groups may include communities such as Women in STEM, LGBTQ+ Professionals, Black Professionals
Association, Veterans Career Network, First-Generation Scholars, Students with Disabilities, and others.

III. Platform Usage and Career Search Data

We collect information about your Platform usage, such as:

• Login times and session duration
• Career fields and resources accessed
• Search queries and browsing patterns
• Saved careers, bookmarks, and preferences
• Interaction with career content (views, clicks, time spent)

IV. Technical and Device Information

We automatically collect certain technical information when you access the Platform, including:

• IP address
• Browser type and version
• Device type and operating system
• Referring website or application
• General geographic location (typically city and state level)

V. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

• Maintain your login session
• Remember your preferences
• Analyze Platform usage and performance
• Improve user experience

You can control cookies through your browser settings. Note that disabling cookies may limit some Platform
functionality.

VI. Employment Outcomes Data (Optional)

Students may voluntarily provide post-graduation or pre-graduation employment information, or your university may
provide this information on your behalf. Employment outcomes data may include:

• Job title and employer name
• Salary and compensation information
• Employment start date and work location
• Job offer details and acceptance information
• Other career outcome information

This information helps universities assess career services effectiveness and support students in their career
development. Employment outcomes data may be shared with your university in both individual and aggregate form to
improve career programming and demonstrate institutional outcomes.

How We Use Your Information

We use collected information for purposes including:

• Provide Platform Services: Enable account creation, authentication, and access to career
  exploration resources
• Personalize Experience: Customize career recommendations and content based on your interests,
  search history, and affinity group memberships
• University Reporting: Share individual and aggregate usage data, employment outcomes, and other
  information with your university to improve career services and demonstrate program effectiveness
• Platform Improvement: Analyze aggregate usage patterns to enhance features and user experience
• Technical Operations: Maintain security, prevent fraud, and troubleshoot technical issues
• Legal Compliance: Fulfill legal obligations and respond to lawful requests

Automated Processing and AI-Powered Features

uConnect’s AI Search feature uses artificial intelligence to provide personalized career recommendations, search
results, and insights. To improve the relevance of results over time, AI Search uses a long-term memory mechanism:
when you submit a search query, your previous search activity is summarized by the AI model and stored as a memory
associated with your account. Each time you use AI Search, that stored memory summary is included alongside your new
query in the context sent to the AI model. This allows AI Search to provide more relevant, personalized results
based on your search history over time.

What this means for you:

• AI Search uses a running summary of your previous search activity — not your raw search history — to personalize
  recommendations. This summary is generated and stored by uConnect and is transmitted to Anthropic’s API as part
  of each subsequent query.
• This memory summary may reflect patterns in your career interests, including searches related to industries,
  roles, or topics you have explored over time.
• AI Search recommendations are informational only. They do not make binding decisions about your career prospects
  or qualifications.
• Students in Colorado, Connecticut, and other states with laws governing automated decision-making have the right
  to opt out of profiling that produces legal or similarly significant effects. AI Search recommendations are
  informational and do not produce such effects.
• You may request deletion of your AI Search memory summary by contacting privacy@gouconnect.com. Deletion of your memory summary will result
  in AI Search no longer having access to your previous search history for personalization purposes.
• You may contact us at privacy@gouconnect.com if you have questions
  about how automated processing applies to your data.

When you use AI Search, your current query and your stored memory summary are transmitted to Anthropic’s API and to
Langfuse for quality monitoring (see Subprocessors section). uConnect transmits your first and last name and an
internal user identifier alongside this data. Your university-issued email address is not transmitted.

Who Has Access to Your Information

Because uConnect operates as your university’s career services platform, data sharing works differently than with
third-party consumer applications. Here’s who can access your information:

I. Your University

Your university has access to all information you enter into the Platform. This includes:

• Your profile information (name, email, major, class year, and other education information)
• Affinity group memberships (which may reveal sensitive information about your identity)
• Career searches, resources viewed, and platform activity
• Saved careers, bookmarks, and preferences
• Employment outcomes data you provide or that is provided on your behalf

Your university uses this information to:

• Support your career development and provide personalized assistance
• Improve career services programs and resources
• Generate aggregate reports on student career interests and outcomes
• Identify students who may benefit from additional career support
• Demonstrate program effectiveness to institutional leadership and accreditors

This sharing complies with FERPA regulations, as your university is the educational institution maintaining your
education records, and uConnect acts as a school official with legitimate educational interest.

II. No Third-Party Sharing or Sale

We do not:

• Sell your personal information to any third party
• Share your data with advertisers or marketing companies
• Provide your information to employers without your consent
• Use your data for marketing purposes outside the Platform

III. Service Providers and Subprocessors

uConnect engages certain third-party service providers (“subprocessors”) to help us provide the Platform technology.
These subprocessors process student data on our behalf under contractual obligations that include data protection
requirements comparable to this Privacy Policy. Service providers with access to student personal information
operate under contractual terms that require:

• Use of data only to provide services to uConnect
• Implementation of appropriate technical and organizational security measures
• Prohibition on use of student data for their own business purposes
• Immediate notification of any data breaches

For subprocessors subject to GDPR requirements, we maintain Data Processing Agreements or utilize service terms that
include equivalent data protection provisions (such as Google Cloud’s standard Data Processing Terms).

Current subprocessors include (updated April 14th, 2026):

• Pagely, Inc.: Managed WordPress hosting provider (hosts entire platform infrastructure with
  full access to student data). Pagely’s hosting infrastructure runs on Amazon Web Services (AWS), which is also
  listed separately as a subprocessor.
• MongoDB, Inc. (MongoDB Atlas): Cloud database platform used to store and manage platform
  application data, including student profiles, career activity, search history, affinity group memberships, and
  employment outcomes data. MongoDB Atlas processes student data on infrastructure hosted within the United States
  and is bound by MongoDB’s Data Processing Agreement.
• Amazon Web Services, Inc. (AWS): Cloud infrastructure provider used for data storage,
  transmission, and compute services underlying the uConnect platform. Student data is stored and transmitted
  through AWS infrastructure as part of core platform operations. AWS is bound by its Data Processing Addendum and
  AWS GDPR commitments. Data is stored in US-based AWS regions.
• Google LLC (BigQuery): Data warehouse and analytics platform (stores raw student data, usage
  logs, and personally identifiable information for performance monitoring)
• Google LLC (Google Analytics): Web analytics and user behavior tracking. uConnect configures
  Google Analytics with IP anonymization enabled and advertising features disabled to minimize data sharing.
  uConnect has reviewed its Google Analytics implementation and determined that, as configured, it does not
  constitute a “sale” or “sharing” of personal information under CCPA/CPRA. Students may opt out of Google
  Analytics tracking by using the Google Analytics Opt-Out Browser Add-On available at tools.google.com/dlpage/gaoptout.
• Email provider (SendGrid)
• Anthropic, PBC (Claude API): AI language model provider. When students use the AI Search
  feature, query data is transmitted to Anthropic’s API for processing. Anthropic processes this data as a
  subprocessor under contractual data protection terms that prohibit use of student data for model training or any
  purpose other than providing the requested service. uConnect does not transmit personally identifiable
  information beyond what is necessary to fulfill the search query.
• Langfuse (Finto Technologies, Inc.): AI observability and monitoring platform used to measure
  and monitor the quality, performance, and reliability of the AI Search feature. Langfuse receives AI Search
  query data, model inputs and outputs, system performance metrics, and certain personally identifiable
  information including student first and last name and internal uConnect user IDs. Email addresses are not
  transmitted to Langfuse. This data is used solely for platform monitoring, quality assurance, and system
  reliability purposes under a data processing agreement with uConnect that prohibits use of student data for any
  other purpose.

We maintain a current list of all subprocessors with detailed information about their services and data access
levels
and will notify university partners at least 30 days before adding new subprocessors that will have access to
student data.

IV. De-Identified Data

We may use de-identified and aggregated data for cross-university research, reporting, and platform improvement.
Data is de-identified using methods consistent with recognized standards, including statistical techniques that
render re-identification not reasonably practicable (consistent with NIST SP 800-188 guidance and, where applicable,
HIPAA Safe Harbor methodology). This data cannot reasonably be used to identify individual students and is not
subject to FERPA restrictions.

V. Legal Requirements

We may disclose your information when required by law, such as in response to a valid subpoena or court order. When
legally permitted, we will notify affected students and universities before such disclosure.

Third-Party Links and External Websites

The Platform may contain links to external career resources, employer websites, and other third-party sites. When
you
click on these links:

• We Track Your Journey: We record that you clicked on a link to leave our Platform (to
  understand which resources are most valuable to students)
• Our Policy Ends: Once you leave our Platform, you are subject to the privacy policy and terms
  of the third-party website
• We Are Not Responsible: We have no control over and assume no responsibility for third-party
  data practices

We encourage you to review the privacy policies of any third-party sites you visit.

Data Security Measures

We implement comprehensive security measures to protect your information, including:

• Encryption: Data is encrypted in transit (using TLS/SSL) and at rest
• Access Controls: Strict role-based access limitations and authentication requirements
• Security Audits: Regular security assessments and vulnerability testing
• Employee Training: Mandatory privacy and security training for all staff
• Monitoring: Continuous monitoring for unauthorized access or security breaches
• Incident Response: In the event of a data breach affecting student personal information,
  uConnect will notify affected university partners within 72 hours of discovering the breach (or as required by
  applicable law, whichever is sooner). When legally permitted, uConnect will also notify affected students.
  Notification will include the nature of the breach, categories of data affected, and steps uConnect is taking to
  address it.

Despite these measures, no system is completely secure. We cannot guarantee absolute security but continuously work
to enhance our protections.

Our Privacy Commitments and Certifications

uConnect is committed to protecting student privacy through adherence to industry best practices and recognized
compliance frameworks:

Core Privacy Commitments

We commit to the following privacy principles:

• No Data Sale: We do not sell student personal information to third parties and never will
• Limited Use: We use student data only to support the educational purposes of your university
• No Behavioral Advertising: We do not use or disclose student information for behavioral
  targeting of advertisements
• Transparency: We maintain clear, accessible privacy policies and notify users of material
  changes
• Data Minimization: We collect only data necessary for platform functionality and educational
  purposes
• Data Retention Limits: We enforce limits defined by your university.
• Security Standards: We implement comprehensive technical and organizational security measures
• User Rights: We support student and parental rights to access, correct, and request deletion of
  student information

Security and Privacy Certifications

• TX-RAMP Certification: uConnect is certified under the Texas Risk and Authorization Management
  Program (TX-RAMP), demonstrating compliance with rigorous state security standards for cloud services.
• HECVAT Completion: We have completed the Higher Education Community Vendor Assessment Toolkit
  (HECVAT), available to university partners upon request.

State Law Compliance

We comply with student data privacy laws in all states where we operate, including comprehensive privacy laws such
as
CCPA/CPRA (California), New Jersey’s Student Data Privacy Law, and other state student privacy regulations. These
state laws often provide more restrictive protections than federal law and codify many of our core privacy
principles.

Data Retention and Destruction

We retain your data only as long as necessary for the purposes described in this policy:

• Active Account Data: Retained as required by your university’s data retention policy
• Usage Logs: Retained for security and troubleshooting purposes
• De-identified Data: May be retained indefinitely for research and analysis, as it cannot be
  linked to any individual
• Legal Holds: Data subject to legal proceedings may be retained longer as required by law

Upon university requests, we securely delete it using methods that prevent reconstruction, including permanent
deletion from all systems.

Your Rights and Choices

Under state privacy laws and FERPA, you have the following rights regarding your personal information:

How to Exercise Your Rights

We recommend a two-step approach for data requests:

Primary Path – Contact Your University (Recommended):

We recommend contacting your university career center for data access, correction, or deletion requests. As the
controller of your education records, your university can best assist you with these requests and will coordinate
with uConnect to execute approved actions. Your university maintains ultimate responsibility for your education
records and can provide the most comprehensive assistance.

Alternative Path – Contact uConnect Directly:

You may also contact uConnect directly at privacy@gouconnect.com. For requests we receive directly
from students, we will coordinate with your university before taking action to ensure proper handling of your
education records. We will respond to verified requests within the timeframes required by law and may need to verify
your identity before processing your request.

Your Specific Rights

I. Right to Access:

You may request access to the personal information we have collected about you. We will provide a copy within 45
days
of your verified request.

II. Right to Correction:

If you believe your information is inaccurate or incomplete, you may request corrections. We will update records
within 30 days unless we have a legitimate reason to maintain the existing information.

III. Right to Deletion:

You may request deletion of your personal information. We will honor deletion requests except where we must retain
data to comply with legal obligations or complete transactions you requested. Note that deletion will result in loss
of Platform access. Because this is your university’s system, deletion requests will be coordinated with your
university.

IV. Right to Manage Affinity Group Membership:

You may join or leave affinity groups at any time through your account settings. Remember that your university can
see your affinity group memberships, so leaving a group does not erase the university’s knowledge that you were
previously a member.

V. Right to Data Portability (State-Specific):

If you reside in California, Colorado, Connecticut, Virginia, or other states with comprehensive privacy laws, you
may request a copy of your personal information in a portable format.

State-Specific Privacy Rights

California Residents (CCPA/CPRA)

In addition to the rights above, California residents have the right to:

• Know what personal information we collect, use, disclose, and sell
• Opt out of the “sale” or “sharing” of personal information (Note: We do not sell or share personal information)
• Limit use of sensitive personal information (such as affinity group memberships that reveal protected
  characteristics)
• Not be discriminated against for exercising privacy rights

New Jersey Residents (Student Data Privacy Law)

New Jersey law provides additional protections for student data privacy. We comply with requirements regarding data
minimization, security standards, and limitations on data use that apply to vendors serving New Jersey educational
institutions.

Colorado, Connecticut, and Virginia Residents

Residents of these states have similar rights to access, correct, delete, and obtain copies of their data, as well
as
the right to opt out of targeted advertising and profiling. Note that we do not engage in targeted advertising or
profiling.

Other States

As of the effective date of this policy, uConnect also complies with comprehensive privacy and student data
protection laws in Texas (TX-HB 4), Florida, Montana, Oregon, Nevada, and all other states where such laws are in
effect. The rights described in this section apply to residents of all states with applicable privacy laws,
regardless of whether your state is specifically listed. If your state has enacted a student data privacy law or
comprehensive consumer privacy law, you may have rights to access, correct, delete, and port your data, as well as
the right to opt out of targeted advertising and profiling. uConnect does not engage in targeted advertising or
profiling for commercial purposes.

Contact our Privacy Officer at security@gouconnect.com to learn more
about rights specific to your state.

Age Requirements and Minors

The Platform is primarily intended for college and university students who are 18 years or older. uConnect
recognizes that some universities serve dual-enrollment students or other users under the age of 18.

If you are under 18, your university is responsible for obtaining any required parental or guardian consent before
providing you with access to the Platform.

uConnect does not knowingly collect personal information directly from children under 13. If we learn we have
collected information from a child under 13 without appropriate consent, we will promptly delete it and notify the
relevant university.

Universities that enroll minors should contact uConnect at security@gouconnect.com to discuss appropriate data handling
configurations for their institution.

Business Transfers

If the Company is involved in a merger, acquisition, or sale of assets, your personal information may be transferred
as part of that transaction. If the Company is involved in a merger, acquisition, or sale of assets, your personal
information may be transferred as part of that transaction. In accordance with our Software Services Agreement, we
will notify your university of any such transfer. Your university, as the controller of your education records, will
communicate with you regarding any changes to how your data is handled as a result of the transaction.

Legal Compliance

The Company complies with all applicable state and federal privacy laws, including state student data privacy laws
such as CCPA/CPRA (California), New Jersey’s Student Data Privacy Law, and other state regulations, as well as
federal laws including FERPA and the Privacy Act of 1974. We regularly review and update our practices to ensure
ongoing compliance.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or platform
features. When we make material changes, we will:

• Post the updated policy on the Platform with a new effective date
• Notify the university via email at least 30 days before the changes take effect
• Obtain their consent if required by law

Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

Contact Information

For questions, concerns, or to exercise your rights under this Privacy Policy:

Privacy Officer

uConnect Inc.
303 Wyman Street, Suite 300
Waltham, MA 02541

Email: security@gouconnect.com

Response Time: We respond to all inquiries within 10 business days.

Additional Privacy Resources

For more detailed information about privacy at uConnect, please visit:

• Student Privacy FAQ:
  
  gouconnect.com/privacy/student-faq
  
• University Partner Privacy FAQ:
  
  gouconnect.com/privacy/university-faq
  
• Career Center Professional FAQ:
  
  gouconnect.com/privacy/career-center-faq