Privacy Policy

Univio Labs Inc. ("Univio," "we," "us," or "our") provides the operating system for collegiate student organizations. This Privacy Policy details the policies and practices regarding the collection, use, storage, and disclosure of personal data when you interact with our website, progressive web application (PWA), public recruitment pages (/apply/:slug), and associated cloud services (collectively, the "Service").

This Policy applies to all users worldwide, including student officers, active club members, prospective recruitment applicants, and campus community visitors.

By using the Service, you consent to the data collection and processing practices described herein. If you do not agree with this Privacy Policy, please discontinue platform use immediately.

1. Information You Provide Directly:

• Account Data: Full name, university email address, and profile avatar provided via Google OAuth single sign-on or email magic link.
• Club Operational Data: Organization names, officer titles, category budgets, treasury transaction records, reimbursement receipts, and meeting documentation.
• Recruitment Candidate Data: Resumes, graduation year, major, GPA (if requested by the club), contact links (LinkedIn/GitHub), and answers to customized application forms.
• User Content: Documents, meeting minutes, files, images, and notes stored in the Memory Bank.

2. Information Collected Automatically:

• Session & Diagnostic Telemetry: Device type, operating system, browser engine, IP address (used exclusively for security rate-limiting and session verification), and error diagnostics.
• Usage Metrics: Aggregated feature interactions, performance timings, and query response times.

We process collected information for the following operational purposes:

• Maintaining reactive real-time state synchronization across active club members via InstantDB.
• Processing candidate applications and managing interview scoring stages.
• Validating event attendance through cryptographically signed QR code tokens.
• Facilitating treasurer expense approvals and financial reimbursement exports.
• Delivering critical security notifications, account verifications, and customer support.

Zero Commercial Exploitation: Univio never sells student records, resumes, or financial logs to data brokers, corporate recruiters, or advertisers. Furthermore, we do not train external or generative AI models on your private club documents or applicant records.

Controller vs. Processor: When an applicant submits an application via a public form (/apply/:slug), the student club functions as the Data Controller. Univio acts strictly as the Data Processor.

Strict Organizational Isolation: Resumes and applicant submissions uploaded to a given club are partition-isolated in our database. Members or officers of Club A can never view, search, or access applicant submissions belonging to Club B.

Applicant Deletion Rights: Any applicant wishing to withdraw their submission or request permanent deletion of their resume may contact the student organization directly or reach out toprivacy@univio.co for immediate processing.

To operate our distributed platform, Univio engages a selected group of audited third-party service providers:

• InstantDB (Instant Labs Inc.): Cloud database infrastructure, real-time presence sync, and encrypted object storage (db.storage).
• Whop Inc. (Whop Checkout): PCI-DSS Level 1 certified subscription management and payment gateway. Univio never stores or has access to raw credit or debit card numbers.
• Google Identity Services: OAuth 2.0 authentication and collegiate single sign-on verification.
• Vercel / Cloudflare: Edge hosting, server-side rendering execution, and DDoS mitigation.

Univio recognizes that collegiate organizations handle sensitive campus records, including membership standing, internal election ballots, and financial receipts. While student organizations are generally autonomous entities distinct from university administration, Univio aligns its access controls with the privacy principles embodied in the Family Educational Rights and Privacy Act (FERPA).

Student organizations retain complete sovereignty over their data, ensuring that campus activities boards or external groups cannot access internal deliberations without officer consent.

Univio employs defense-in-depth security measures to protect student records:

• Encryption in Transit: 100% of network traffic is encrypted using modern TLS 1.3 standards.
• Granular Authorization Rules: Entity-level permissions in InstantDB ensure that club data is only readable by authenticated members of that organization.
• Signed QR Tokens: Attendance check-in tokens are cryptographically signed with short expiration windows to prevent ticket forging.

The Univio application utilizes browser localStorage solely for functional operations:

• club_sidebar_collapsed: Preserves your preferred sidebar navigation state.
• i18nextLng: Remembers your selected language preference (English/Spanish).
• Authentication session tokens managed securely by InstantDB.

We do not utilize cross-site tracking cookies, behavioral ad-targeting beacons, or invasive marketing trackers.

We retain your organization's data for as long as your club remains active on Univio. If an administrator deletes an organization through Club Settings, all linked memberships, events, files, and channels are queued for permanent deletion from active database indices.

Individual students may delete their accounts via User Settings > Delete Account, which terminates their active memberships and purges their user profile.

If you have questions, feedback, or requests regarding this Privacy Policy or our handling of student data, please contact our Privacy & Data Protection Officer:

Univio Labs Inc.
Data Protection Office
Email: privacy@univio.co
Support: support@univio.co