Privacy Policy

This Privacy Policy explains how Yuni collects, uses, shares, and protects information about you when you use the Yuni service, our websites at getyuni.com and yunidating.com, our SMS / iMessage delivery channel, and any related services (the "Service"). Yuni is operated from Ontario, Canada and is intended for adult students enrolled at supported Canadian universities.

We follow Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), Quebec's Law 25, Canada's Anti-Spam Legislation ("CASL"), and, where applicable, the EU/UK GDPR and the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA").

Snapshot

• What we collect: name, university email, mobile number, age, gender, sexual orientation, photos you choose to send, university and program details, and your matching preferences.
• Why: to verify your university affiliation, build your profile, propose one or more curated matches per week by text, and keep the community safe.
• Who we share with: a short list of vetted service providers (Twilio, Supabase, OpenAI, Resend, Railway, Anthropic where applicable). We do not sell your personal information. We do not share your mobile phone number or SMS opt-in data with third parties or affiliates for marketing.
• Cross-border: some of our service providers process data in the United States. While there, information may be accessible to U.S. courts, law-enforcement, or national-security authorities under U.S. law.
• Automated matching: matches are generated by an automated AI pipeline; the Yuni team may also select matches itself. Where a match is made solely by the pipeline, you can ask for a human review.
• Your controls: reply STOP to unsubscribe, reply DELETE to delete your account, or email [email protected].

1. Who We Are and How to Reach Us

Yuni operates an SMS / iMessage matchmaking service for verified students at supported Canadian universities. There is no Yuni mobile application.

• Privacy Officer / Person in Charge (Law 25 s. 3.1): Ediz Cagan Uysal, Co-Founder
• Contact (privacy, support, legal, safety): [email protected]
• Mailing address: Toronto, Ontario, Canada (street address on request).

We aim to respond to any privacy request within 30 days.

2. Information We Collect

2.1 Information You Provide

• Account information: first and last name, university email address, mobile phone number, date of birth or age, gender, sexual orientation, supported-university email-domain.
• Profile information: photos, program of study, year of study, city / campus, height, lifestyle and "vibe" answers, prompt answers, relationship intent, optional self-identified ethnicity, and other intake answers.
• Private matching preferences: age range, dealbreakers, partner-ethnicity preferences (where you provide them), and other preferences used solely to curate your match. Private preferences are never shown to other users.
• Communications: SMS / iMessage replies you send to Yuni.
• Reports and feedback: any safety report, block, post-introduction 1-to-5 rating, or other feedback you submit.

2.2 Information We Collect Automatically

• Web analytics: device type, browser, OS, language, IP, pages viewed, time spent. We do not run third-party advertising cookies.
• Cookies and local storage to maintain sessions and (on getyuni.com) anonymous product analytics via PostHog.
• SMS / iMessage metadata from our SMS provider (sender phone number, timestamp, delivery status).

2.3 Information from Third Parties

• University domain verification (we read the domain only, never email contents).
• Referral code from a friend who refers you.

2.4 Sensitive Personal Information

Some information we collect is considered sensitive under applicable law: sexual orientation, photos used by our AI tools, age, and (where you provide it) ethnicity. We ask for your explicit consent before collecting it and treat it with heightened care.

3. Four Things to Know Before You Consent

1. What we collect: Section 2.
2. Why: verify your university affiliation, build a profile, propose one or more matches per week, keep the community safe, comply with the law.
3. Who we share with: the sub-processors in Section 5, plus narrow legal disclosures. Your public match excerpt is sent to each user you are matched with.
4. Risks: dating-related personal info is sensitive. A breach involving photos, sexual orientation, or messages could lead to embarrassment, reputation harm, or harm in jurisdictions hostile to your identity. We commit to notifying you and the regulator promptly if a breach poses a real risk of significant harm.

Withdraw consent at any time by replying STOP to any Yuni text, replying DELETE to request account deletion, or emailing [email protected].

4. How We Use Your Information

• Provide the core service: create and maintain your profile, run the onboarding chat, curate weekly introductions, send the Wednesday Drop, support scheduling and venue logistics, and operate post-date feedback.
• Verify identity and protect users: confirm Canadian-university affiliation, moderate photos, detect duplicate or fraudulent accounts, enforce age restrictions, respond to abuse reports.
• Personalize matching: apply your preferences and dealbreakers, score compatibility, propose one or more curated matches per cycle.
• Communicate with you: verification codes, the Wednesday Drop, scheduling reminders, occasional service updates, support replies.
• Improve the service: usage analytics, bug fixes, and feature development. Aggregated or de-identified data wherever possible.
• Comply with the law and protect rights.

If you are in the EEA / UK / Switzerland, our legal bases are contract (Art 6(1)(b)), legitimate interests (Art 6(1)(f)), explicit consent (Art 6(1)(a) and Art 9(2)(a)) for special-category data, and legal obligation (Art 6(1)(c)).

5. How We Share Your Information

We do not sell your personal information.

5.1 With Other Users

• Public match excerpt (first name, age, gender, city, university, program, year, approved photos, interests, prompt answers) goes to each user you are matched with, and you receive theirs.
• Private preferences (age range, dealbreakers, partner-ethnicity preferences, preference vectors, internal scores, contact info beyond what is necessary for the introduction) are never shown to other users.
• Messages between you and a match after the introduction happen outside Yuni.

5.2 Service Providers (Sub-Processors)

• Twilio Inc. — SMS / iMessage delivery (US / CA / EU).
• Supabase Inc. — PostgreSQL database and object storage for photos (US).
• Railway Corp. — backend and website hosting (US).
• Resend Inc. — transactional email (US).
• OpenAI, L.L.C. — powers our SMS conversational agent, persona analysis from your answers and photos, embeddings, and simulated-date scoring used in matching (US). Used under OpenAI's API DPA; not used to train OpenAI models.
• Anthropic, PBC — secondary AI tooling (US).
• PostHog Inc. — website analytics on getyuni.com (US).

5.3 For Legal Reasons

We may disclose information to comply with law or legal process; enforce our Terms; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Yuni, our users, or the public.

5.4 Business Transfers

In a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may transfer. We will notify you before it becomes subject to a different privacy policy.

6. Cross-Border Transfers

Yuni is operated from Canada. Several of our service providers process data in the United States. While processed outside Canada, your information may be accessible to courts, law-enforcement, or national-security authorities under foreign law.

For Quebec residents, we conduct privacy impact assessments before transferring personal information outside Quebec (Law 25 s. 17). For EEA / UK / Switzerland, US transfers rely on the EU-U.S. Data Privacy Framework where certified and on Standard Contractual Clauses otherwise.

7. Security

• TLS encryption in transit.
• Encryption at rest for files and database backups.
• bcrypt password hashing for admin accounts.
• Principle-of-least-privilege access controls and audit logging.
• Automated detection of suspicious activity.
• Database-level triggers preventing accidental deletion of critical records.

No system is one-hundred-percent secure. If we ever experience a breach that poses a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible (PIPEDA s. 10.1).

8. Photos and AI Analysis

We use OpenAI's vision-capable models to check uploaded photos for quality, content (no nudity, no minors, no obvious fraud or generated images), and the presence of a face on your lead photo, and to extract descriptive tags that feed into matching.

Our current production flow does not use facial-recognition embeddings to identify you, does not match your face to any external database, and does not retain a biometric "faceprint." If this ever changes, we will update this Policy, ask for express consent, and, for Quebec users, file the declaration required under sections 44-45 of the Act to establish a legal framework for information technology at least 60 days before launch.

9. Automated Decision-Making (Law 25 s. 12.1, GDPR Art 22)

Matches are generated by an automated pipeline. The pipeline runs:

1. Hard filters: age range, sexual-orientation compatibility, dealbreakers, geography.
2. Compatibility score: deterministic score across stated interests, lifestyle, and vibe answers.
3. Persona enrichment: LLM tagging of profile and photos.
4. Simulated-date scoring: an LLM scores how a first interaction is likely to go.

The pipeline produces a ranked recommendation. A Yuni founder may also review that recommendation and, at their discretion, accept it, adjust it, or select a different pairing themselves; where a person makes the final call, that match is not the product of solely automated processing. Yuni may propose one or more matches to you in a cycle. Match selection is a discretionary curatorial decision; we are not obliged to explain the reasoning behind any individual pairing beyond the rights below.

Your rights:

• Where a match has been made solely by automated processing, reply REVIEW to your Wednesday Drop or email [email protected] to request a human review. A founder will respond within 30 days and you can submit observations; the outcome of the review remains at Yuni's discretion.
• Request correction of any information used in the decision.
• Refuse a match without giving a reason; doing so will not affect future matches.

10. Data Retention

• Active accounts: as long as your account is active.
• Deleted accounts (reply DELETE or email us): we hide your profile and within 30 days permanently remove or anonymize your personal data, except where retention is required by law.
• SMS conversation transcripts: 90 days from last activity, or 30 days post-deletion (whichever is shorter).
• Photos and photo-tag outputs: life of account; deleted on deletion.
• Persona embeddings and match scores: life of account; deleted on deletion.
• Past-match history: life of account, plus 30 days after deletion before anonymization.
• Post-introduction ratings: anonymized signal kept; raw rating deleted within 30 days.
• Abuse / safety records: up to 7 years where reasonably necessary.
• SMS consent records: 3 years after consent withdrawn (CASL).
• Breach records: at least 24 months (PIPEDA Regs).
• Backups: up to 90 days, then overwritten.
• Aggregated and de-identified data: may be retained indefinitely.

11. SMS / iMessage Text Message Program

By providing your phone number and texting Yuni, you consent to recurring automated text messages from Yuni at the number you texted us from.

• Program: Yuni — AI matchmaker for Canadian university students.
• You can expect: onboarding chat, a Wednesday Drop each week with one or more curated matches, scheduling and feedback messages.
• Frequency: approximately 1-5 messages per week (sometimes more during scheduling).
• Message and data rates may apply.
• Reply HELP for help, or email [email protected].
• Reply STOP to unsubscribe (processed immediately, and in any case within ten business days; one confirmation message after which no further messages will be sent).
• Reply DELETE to request full deletion of your account.
• Reply START to opt back in after STOP.

Mobile phone numbers collected for SMS communications, and any data collected as part of SMS consent, are not shared, sold, or otherwise transferred to third parties or affiliates for marketing or promotional purposes. We share phone numbers only with Twilio to transmit your messages, and as otherwise required by law.

12. Your Rights and Choices

• Access: request a copy of personal information we hold.
• Correction / rectification: request correction of inaccurate or incomplete data.
• Deletion: reply DELETE or email us.
• Portability: structured JSON / CSV copy of information you provided.
• Withdraw consent: at any time, without affecting prior processing.
• Stop SMS: reply STOP.
• Opt out of marketing email: unsubscribe link in any marketing email.
• Object / restrict: stop or limit certain processing, including profiling and automated decision-making (see Section 9).
• Deindexation (Quebec residents, Law 25 s. 28.1).

We will respond within 30 days. Where we cannot grant a request, we will tell you why.

12.1 Right to Complain

• Office of the Privacy Commissioner of Canada: priv.gc.ca · 1-800-282-1376.
• Commission d'accès à l'information du Québec: cai.gouv.qc.ca.
• For EEA / UK users: your local data protection authority.
• For California users: the California Privacy Protection Agency or the California Attorney General.

12.2 California Residents (CCPA / CPRA)

California residents have the right to know, delete, correct, limit the use of sensitive personal information, and not be discriminated against for exercising rights. We do not "sell" or "share" personal information for cross-context behavioral advertising as defined under California law.

12.3 Quebec Residents (Law 25)

In addition to the rights above, Quebec residents have rights to data portability (s. 27), deindexation / cessation of dissemination (s. 28.1), and human review of automated decisions (s. 12.1).

13. Children's Privacy

The Service is for adults aged 18 or over. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a minor, we will delete it. If you believe a child has provided us with personal information, please contact [email protected].

14. Third-Party Links and Services

The Service may link to third-party websites or services we do not control. This Policy does not apply to those third parties; please review their own privacy policies.

15. Changes to This Policy

We may update this Policy from time to time. If we make material changes we will notify you by email or SMS and update the "Last Updated" date. Continued use after an update constitutes acceptance of the new Policy.

16. Contact Us

Privacy Officer / Person in Charge: Ediz Cagan Uysal — [email protected]. Mailing address: Toronto, Ontario, Canada (street address on request).