Privacy Policy

Last updated 2026-07-17.

Undergradly.org ("Undergradly", "the Site") is an editorial website operated by an individual based in the European Union. Because the operator is established in the EU, the EU General Data Protection Regulation (GDPR) and the national law of the operator's country of residence apply to the personal data processed through this Site. The Site's editorial content is written for a US audience, but EU and UK readers who use the Site receive the same data-protection rights described below. Primary contact: contact@undergradly.org.

Where the Site is operated from. The Site is operated by an individual in the EU. Personal data processed by the operator is therefore subject to the GDPR and national data-protection law. Some readers will additionally be covered by the UK GDPR or by US state privacy laws (California, Virginia, Colorado, Connecticut, Utah and others); the rights summarized below combine those frameworks.

Data controller

The data controller for personal data processed through the Site is the individual operator of Undergradly.org, reachable at:

Email: contact@undergradly.org

We have not appointed a Data Protection Officer (DPO); under GDPR Article 37 a DPO is not required for this scale of processing. All data-protection enquiries go to the email address above.

Quick summary

We use Google Analytics 4 (GA4) via the standard Google tag to understand Site usage and improve content. No other analytics or advertising trackers.
We do not set our own tracking, analytics, or advertising cookies beyond those used by Google for analytics measurement.
We do not sell personal information and we do not share personal information for cross-context behavioral advertising or targeted advertising.
EU/UK readers have the full set of GDPR / UK GDPR rights described below, and can lodge a complaint with their national supervisory authority.
US readers in states with privacy laws (California, Virginia, Colorado, Connecticut, Utah and others) have the rights described below.
To exercise any right, email contact@undergradly.org with the subject "Privacy Request".

What personal data we process

Categories of personal data:

Online identifiers and technical data — cookie or client IDs, IP address at request time, device and browser type — collected via Google Analytics only after you accept analytics cookies (see Cookies below).
Usage data — pages viewed, clicks, scrolls, time on page, referring URLs.
Approximate geolocation — city or region inferred from IP at request time. We do not collect precise location.

Sources: Your device or browser interacting with the Site, and Google Analytics tags and cookies served from the Site.

Purposes of processing:

Site analytics, performance monitoring, debugging, and security.
Understanding which content is useful to readers, to inform editorial priorities.

Retention. Event-level analytics data is retained in GA4 for the period configured in our property (default: 2 months). Aggregated reports derived from that data may be retained longer for internal trend analysis.

Selling or sharing. We do not sell personal data. We do not share personal data for cross-context behavioral advertising or targeted advertising.

We do not intentionally collect names, email addresses, or other directly identifying data unless you voluntarily email us. We do not enable GA4 User-ID and do not transmit "user-provided data" (such as hashed email addresses) to Google.

Cookies and similar technologies

We do not set our own analytics or advertising cookies. Google Analytics uses cookies and similar identifiers to measure Site engagement — but only after you consent, as described below.

Consent banner. We show a consent banner on your first visit, to all visitors regardless of region. Google Analytics 4 cookies are set only after you click "Accept" on that banner. Before that point — and permanently, if you decline — analytics and advertising storage stay denied under Google's Consent Mode v2, no analytics cookies are set, and no persistent identifiers are stored; Google receives only cookieless, aggregate consent-state signals that contain no user identifiers.

Changing your choice. Your decision is remembered in your browser's localStorage under the key ug_consent_v1, which records only whether you granted or denied consent and when. Clear this site's data (or that localStorage entry) in your browser and the banner will reappear on your next visit. You can additionally use Google's opt-out add-on at tools.google.com/dlpage/gaoptout, block third-party cookies in your browser, or email contact@undergradly.org and we will erase any analytics records associated with the IP address you wrote from, to the extent technically possible.

Google Analytics (GA4)

We use GA4 to generate aggregated statistics about Site usage. GA4 is a service of Google LLC (US) and Google Ireland Ltd. (EU). For EU/UK visitors, Google Ireland is the data importer; data may be onward-transferred to Google LLC in the United States. GA4 does not expose full IP addresses in standard reports; IPs may be used transiently to derive approximate location.

How Google uses data from partner sites: policies.google.com/technologies/partner-sites
Google Privacy Policy: policies.google.com/privacy

Ads & signals. We do not use GA4 User-ID, do not send user-provided data to Google, and do not enable Google signals or remarketing audiences. If we ever change this, we will update this Policy and obtain prior consent where required.

Consent configuration. Our GA deployment runs Google Consent Mode v2 with every consent signal (analytics, advertising, functionality, personalization) denied by default for all visitors — not only EEA / UK — with ads data redaction enabled. Full analytics measurement begins only after you accept on the consent banner.

Legal bases for processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases under Article 6(1):

Legitimate interests (Art. 6(1)(f)) — for Site security, debugging, and high-level aggregated traffic analysis. Our legitimate interest is keeping the Site reliable and improving editorial content; we have weighed this against the limited and indirect impact on readers and judged it proportionate. You may object to this processing — see your rights.
Consent (Art. 6(1)(a)) — for non-essential cookies set by Google Analytics, where consent is required by national ePrivacy law. You can withdraw consent at any time without affecting prior lawful processing — see cookies.
Compliance with a legal obligation (Art. 6(1)(c)) — for responding to verified rights requests, regulatory enquiries, and lawful retention duties.

International data transfers

Personal data processed through GA4 may be transferred to or accessed from the United States, where Google LLC and its sub-processors are established. For transfers from the EEA / UK to the United States we rely on:

The EU–US Data Privacy Framework (and the UK Extension) where the recipient is a certified participant — Google LLC is currently a certified participant; or, where DPF certification does not apply,
The European Commission's Standard Contractual Clauses (2021/914) as incorporated into Google's data-processing terms, with supplementary measures as advised by the EDPB.

We use reputable infrastructure providers (hosting, content delivery) acting as processors under contractual restrictions appropriate to their role. Infrastructure providers may be located in the United States or other countries; where applicable, the same transfer mechanisms above apply.

Your rights

EU / UK readers (GDPR / UK GDPR). You have the right to:

Access — request confirmation of what personal data we process and a copy of it (Art. 15).
Rectification — request correction of inaccurate or incomplete data (Art. 16).
Erasure ("right to be forgotten") — request deletion of your data, subject to the limited exceptions in Art. 17.
Restriction — request that we restrict processing in defined circumstances (Art. 18).
Portability — request a structured, commonly-used, machine-readable copy of data you provided (Art. 20).
Object — object to processing based on legitimate interests (Art. 21).
Withdraw consent — at any time, where processing is based on consent (Art. 7(3)). Withdrawal does not affect lawful processing prior to withdrawal.
Lodge a complaint — see below.

US state-law readers (California, Virginia, Colorado, Connecticut, Utah and other states with comprehensive privacy statutes). You may have the right to:

Know the categories and specific pieces of personal information we collect.
Access, correct, or delete personal information.
Opt out of sale, sharing, or targeted advertising. (We do not engage in any of these.)
Limit use of sensitive personal information. (We do not knowingly collect any.)
Appeal a decision to deny a request.
Be free from discrimination for exercising these rights.

How to submit a request. Email contact@undergradly.org with the subject "Privacy Request" and tell us which right(s) you want to exercise. We will verify your request to a reasonable degree (typically by replying to the address you wrote from). We aim to respond within 30 days, as required by GDPR; we may extend by a further 60 days for complex requests, in which case we will tell you why. If we decline a request, you may appeal by replying "Appeal" to our decision email.

Opt-out signals (Global Privacy Control). If we ever engage in sale or sharing in the future, we will honor browser-based opt-out signals such as GPC. At present, we do not sell or share.

Right to lodge a complaint

EU / EEA readers have the right to lodge a complaint with the data-protection supervisory authority of their country of residence, place of work, or place of the alleged infringement. UK readers may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

A directory of EU / EEA supervisory authorities is maintained by the European Data Protection Board: edpb.europa.eu/about-edpb/about-edpb/members_en.

Data security

We maintain administrative, technical, and organisational measures appropriate to the nature of the limited personal data we process. Site traffic is served over HTTPS. No method of transmission or storage on the internet is completely secure, and we cannot guarantee absolute security.

Children's privacy

The Site's editorial content is aimed at prospective undergraduate students, most of whom are 16 or older, and at their families. We do not knowingly process personal data of children below the digital-consent age set by their country of residence (typically 13–16 under the GDPR; 13 under US COPPA). If you believe a child has nevertheless provided personal data — for example, by emailing us — contact contact@undergradly.org and we will erase it.

Service providers (processors)

We use a small number of reputable service providers acting as processors on our behalf, contractually restricted from using personal data for their own purposes:

Google LLC / Google Ireland Ltd. — analytics (Google Analytics 4).
Infrastructure providers — hosting and content delivery.

We do not engage advertising networks, audience-targeting platforms, or data-broker services.

Third-party links

The Site links to federal data sources, college websites, and other third-party resources we do not control. Their privacy and security practices are governed by their own policies.

Changes to this policy

We may update this Policy from time to time. The "Last updated" date at the top of this page reflects the latest revision. Where a change is material — for example, a new processing purpose or a new category of recipient — we will flag the change clearly on this page.

Contact

Undergradly.org
Email: contact@undergradly.org