Privacy Policy
Effective from 29 October 2026
Key points at a glance
- Who: Studyond AG in St. Gallen, Switzerland, is responsible. We answer questions at privacy@studyond.com.
- What: We process the data you give us for your account and profile, the content you create in the app (for example applications, projects and messages), and data about how you use the website and the app.
- Why: So you can find thesis topics, supervision, experts and jobs, and work together with universities and companies.
- Who can see you: Your profile is only visible while you have activated a signal. If you are a lecturer or an expert, it is then public and can be found via search engines, but you can restrict it to signed-in users. If you are a student, you choose yourself. Only the organisation you apply to sees your application.
- AI: Our AI features run in Frankfurt (Germany). They make suggestions; people make the decisions.
- No selling: We do not sell your data and do not use it to train AI models.
- Where: We process data mainly in the EU. Some service providers process data in the United Kingdom, the USA or India; recognised safeguards apply.
- Your rights: You can request access, have data corrected or deleted, object to processing and take your data with you. You can delete your account yourself at any time.
- 18+: Studyond is intended for people aged 18 and over.
The details follow below.
1. What is this privacy policy about?
This policy describes how Studyond AG ("Studyond", "we") processes personal data. It applies when you
- use our website studyond.com and the Studyond app, whether at app.studyond.com or studyond.com,
- communicate with us, or
- are in business contact with us, for example as a contact person at a university or company.
We comply with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). "Processing" means any handling of personal data, for example collecting, storing, using, disclosing and deleting it.
Universities and companies that receive applications or other data through Studyond are themselves responsible for how they handle it (see section 5.2). We do not process personal data on behalf of organisations.
For individual features, we also inform you directly where the data is collected.
2. Who is responsible, and how can you reach us?
The controller for the processing described in this policy is:
Studyond AG, Zürcherstrasse 45, 9000 St. Gallen, Switzerland, privacy@studyond.com
You can reach us at this address for all questions about data protection and your rights.
3. What data do we process?
3.1 When you visit our website
When you visit the website, we process technical data: IP address, date and time, pages visited, browser, operating system and the page you came from. We need this data so the website works and stays secure. With your consent, we also measure how the website is used (see section 9).
3.2 When you open an account
For an account, we need your email address and your name. You can sign in with a password, a passkey or another service: Google, Apple or SWITCH edu-ID. We then receive from that service, for example, your name, your email address and your profile picture, and with SWITCH edu-ID also your university affiliation. The service shows you exactly which details are shared when you sign in. The respective service is responsible for the sign-in itself; its privacy policy applies.
You can add further email addresses, for example from your university or employer. This confirms that you belong to that organisation.
Studyond is intended for people aged 18 and over. If we learn that an account belongs to a younger person, we delete it.
3.3 Your profile
Depending on your role, your profile contains:
- Everyone: name, profile picture, description ("About me"), areas of interest, education (university, degree, programme, period), link to a professional profile (for example LinkedIn or Xing), language and signals that show what you are currently open to.
- Students: skills, field of study, level of study, preferred period for the thesis and interest in an internship. Signals are, for example, "Looking for a topic", "Career start" or "Looking for supervision".
- Lecturers and supervisors: title, link to research profile, university. Signals are, for example, "Interviews", "Applications for topics", "Topic proposals from students" or "Research collaboration".
- Experts: job title, company, role in the company account. Signals are, for example, "Interviews", "Applications for topics", "Research collaboration" or "Contributing to courses".
Section 5 describes which profile data others can see.
3.4 Applications, projects and messages
When you use the app, we process the content you create there:
- Applications for topics and proposals: your message, your motivation and uploaded documents, for example your CV.
- Applications for jobs: We link jobs such as internships or entry-level positions to the company's own posting. If you apply there, we do not receive your application.
- Projects: members, comments, reactions, status updates and attachments.
- Messages: content, reactions and read time.
- Invitations: the email address of the invited person and your message (see 3.8).
- Feedback you send us through the app.
3.5 AI features
The app offers AI features, for example a chat, topic suggestions, the analysis and creation of thesis topics, and a review of your profile. For these, we process what you enter in the chat, attached files and the profile data a suggestion is based on. More on this in section 6.
3.6 Usage data in the app
We record how the app is used, for example which topics, jobs and profiles are displayed or opened, and when you were last active. We use this to improve the app, show relevant content and create statistics. Section 5.2 describes what universities and companies can see of this.
With your consent, we also measure the use of the website and the app with Google Analytics (see section 9). We do not send any identifier of your account to Google.
We send you notifications in the app and by email, for example when new topics or jobs match your interests. You can turn off email notifications in the settings. They contain no advertising for third parties.
3.7 When you communicate with us
If you contact us by email, phone, video call, contact form or chat, we process your contact details, the content and the metadata of the communication (for example the time). We do not record conversations.
If we need to verify your identity, for example for an access request, we process the data required for this.
3.8 Data about other people
- Invitations: We use the email address of an invited person only to send the invitation. If they do not accept it, we delete the address after 90 days.
- Public postings: We take over publicly advertised thesis topics from the websites of universities and companies. Contact details included in the posting text are shown as published there. We store the email address of the person who posted the topic and inform them by email. They can take over the topic by registering, or have it removed. Otherwise, we delete the address when the posting ends.
If you give us data about other people, for example about employees, we assume that you are allowed to do so and that the data is correct.
3.9 Business contacts and marketing
For contact persons at universities, companies and partners, we process name, role, organisation, contact details and the history of our contacts. We receive this data from you, from your organisation or from publicly available sources such as websites and professional networks.
We only approach potential business contacts if we have their professional contact details from publicly available sources, for example websites or professional networks. If we contact you this way, we tell you in the first message where we got your data, and you can refuse further contact at any time. We then add you to a suppression list and do not contact you again.
Sales emails: We send customers and interested parties emails about our offers. Each of these emails contains an unsubscribe link.
Studyond news: If you have an account, we occasionally inform you by email about new Studyond features. You can unsubscribe from these emails when registering, in the settings and via the link in every email.
We do not send a newsletter.
No email tracking: We do not measure whether you open our emails or which links you click.
Customers: If your organisation takes out a subscription, we process contract and billing data: company, billing address, contact person, chosen plan and payments. Payment is by invoice or card. Card payments are handled by Stripe; we do not receive card details (see section 7.1).
3.10 Do you have to provide data?
- Website: Technical data is generated automatically when you visit. The website does not work without it.
- Account: Email address and name are required so we can maintain your account.
- Profile: All other details are voluntary. The less you provide, the less relevant suggestions are and the harder it is for others to find you.
- Applications: The organisation you apply to decides which details are required.
- Studyond news, analytics cookies: voluntary. Declining has no disadvantages.
You have no legal obligation to provide us with data. Customers have contractual obligations, for example for billing data.
4. Why do we process your data, and on what legal basis?
Under the FADP, processing is permitted if it complies with the principles of the law. The GDPR additionally requires a legal basis for each purpose. The table lists both.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing and protecting the website | Technical data | Legitimate interest in a functioning and secure website (Art. 6(1)(f)) |
| Measuring use of the website and app | Technical data, cookies | Consent (Art. 6(1)(a); for cookies in Germany Section 25 TDDDG) |
| Maintaining your account, sign-in | Account and sign-in data | Contract (Art. 6(1)(b)) |
| Providing the platform: profile, applications, projects, messages | Profile and usage content | Contract (Art. 6(1)(b)) |
| Making your profile visible to others | Profile data, signals | For signed-in users: contract (Art. 6(1)(b)), because visibility is tied to your signals. Public and for search engines: for students, consent (Art. 6(1)(a)); for lecturers and experts, legitimate interest in making professional profiles findable (Art. 6(1)(f)), with the option to restrict at any time |
| Showing organisations profile views and programme lists | Name, profile, time of view, programme | Legitimate interest of organisations in recognising interested people and their own students (Art. 6(1)(f)) |
| AI features | Inputs, attachments, profile data | Contract (Art. 6(1)(b)) |
| Suggesting relevant content and sending notifications | Profile and usage data | Legitimate interest in showing you relevant topics and jobs (Art. 6(1)(f)) |
| Improving the app, statistics | Usage data | Legitimate interest in developing the app (Art. 6(1)(f)) |
| Showing and handing over public postings | Posting text with contact details published in it, email address of the person who posted the topic | Legitimate interest in showing students a complete range of topics and giving posters control over their topic (Art. 6(1)(f)) |
| Communicating with you, answering enquiries | Communication data | Contract or legitimate interest (Art. 6(1)(b), (f)) |
| Studyond news by email | Email address, name | Legitimate interest in direct marketing (Art. 6(1)(f)) |
| Maintaining and acquiring business contacts | Business contact data | Legitimate interest in acquiring and maintaining business relationships (Art. 6(1)(f)) |
| Concluding and performing contracts, accounting | Contract and billing data | Contract, legal obligation (Art. 6(1)(b), (c)) |
| Security, preventing misuse, legal claims | All relevant data | Legitimate interest in secure operation and enforcing rights (Art. 6(1)(f)) |
| Legal obligations | Depending on the obligation | Legal obligation (Art. 6(1)(c)) |
If you have given consent, you can withdraw it at any time with effect for the future: for cookies via the cookie settings, otherwise by email to privacy@studyond.com.
You can object to processing based on a legitimate interest (see section 13). You can object to direct marketing at any time without giving reasons.
5. Who sees your data on the platform?
5.1 Other users and visitors
- Your profile is only visible while you have activated at least one signal. This applies equally to students, lecturers and experts. Without an active signal, your profile is not visible, apart from the exceptions below: not in the directory, not in search, not via a direct link and not in chat. You can switch signals on and off in the settings at any time.
- Public or signed-in users only: As a lecturer or expert, you use Studyond in your professional capacity. With an active signal, your profile is therefore public, meaning visible to all website visitors and findable via search engines such as Google. You can restrict it to "signed-in users only" in the settings at any time. As a student, you choose yourself when activating your first signal whether your profile is public or visible to signed-in users only; there is no preselection, and you can change your choice at any time. If you set your profile to "signed-in users only", it is no longer public on Studyond immediately; it may take a while until search engines remove it from their results.
- What visitors without an account see: the first 24 entries each of published topics and jobs, and of the profiles of companies, universities, programmes, experts and lecturers. Personal profiles only appear there if they are public. People also only appear with name and picture in topics, jobs and organisation profiles if their own profile is public; otherwise only the organisation is shown. All public profiles may be indexed by search engines.
- Exceptions: As a student, the people responsible for your programme can see you even without an active signal (see 5.2). As an expert, the administrators of your company account can see you. People you already have a conversation or a project with continue to see your name and profile picture there and can open your profile.
- Messages are only seen by the people in the respective conversation.
- Project content is seen by the project members. If a project is made public, its title, status and the organisations involved are visible to everyone, even without signing in. You only appear there as a member if you have agreed.
5.2 Universities and companies
- Applications for topics: If you apply for a topic, the responsible people at the university or company receive your application including documents in Studyond and handle it there. We are responsible for the platform, meaning recording, displaying and delivering your application. The organisation itself is responsible for its decision on your application and anything else it does with your data. Studyond does not select or assess applicants.
- Applications for jobs: We link jobs to the company's own posting. Your application then goes through the company's application system; the company alone is responsible for this, and its privacy policy applies.
- Programmes: The people responsible for a degree programme can see which students and alumni of their university have listed the programme in their profile, with name and profile. We verify university affiliation via your university email address or SWITCH edu-ID; you enter the programme yourself. If you remove it from your profile, you no longer appear in this list. The people responsible do not receive analyses of individual persons.
- Profile views: Universities and companies can see who directly opened their profile, their topics and jobs, and the profiles of their experts, with name, profile and time. They cannot see that you only saw a profile in a list or in search results. Without an active signal, your view does not appear with your name.
- Organisation accounts: If you belong to a company account as an expert, the administrators of that account can see your membership and role.
Universities and companies may only use the data they receive through Studyond for the purpose for which you shared it.
6. AI and automated evaluations
Our AI features run on Amazon Bedrock in the AWS region Frankfurt (Germany). The language models come from Anthropic. Your inputs are not used to train the models, and neither AWS nor Anthropic has access to them for their own purposes.
We do not store your chat history on our servers; it stays in your browser (see section 9.2). We use attached files only for the respective request and delete them afterwards.
AI content is labelled as such in the app.
AI suggestions are recommendations. We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you. People decide whether you get a topic, supervision or a job.
We evaluate your profile and usage data automatically to suggest relevant topics, jobs and people (profiling). A suggestion is based mainly on
- your areas of interest and your field of study or expertise,
- your skills and your description,
- your level of study and your preferred period,
- your active signals,
- what you enter in the AI chat.
The more of these details match, the higher a suggestion appears. Companies' paid plans and your usage behaviour do not affect the order. We do not use gender, age or origin for this, and we do not collect this information. You change what influences your suggestions directly in your profile.
We do not use your data to train or fine-tune AI models.
7. Who do we share data with?
We do not sell or rent your data. We only share it with the recipients listed in this section.
7.1 Service providers
We work with service providers that process data on our behalf. They may only use the data according to our instructions and not for their own purposes. We have concluded data processing agreements with all of them.
| Service provider | Purpose | Place of processing | Basis for transfer abroad |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting and delivery of the website and app, file storage, real-time notifications, AI (Amazon Bedrock) | Frankfurt (DE) | EU (adequate); access from the USA possible: Data Privacy Framework |
| Clerk, Inc. (USA) | Sign-in and account management (sub-processors include Google Cloud and Cloudflare, USA) | USA | Data Privacy Framework |
| Google Ireland Ltd. | Analytics for the website and app (Google Analytics, Tag Manager) | EU, USA | Data Privacy Framework |
| Google Ireland Ltd. (Google Workspace) | Email, documents, video calls (Google Meet), appointment booking (Google Calendar) | EU | EU (adequate); access from the USA possible: Data Privacy Framework |
| CookieYes Limited (United Kingdom) | Managing cookie consent | Consent data: EU (AWS Ireland); banner delivered via Cloudflare (USA); support access from India possible | United Kingdom (adequate); USA and India: standard contractual clauses |
| HubSpot Ireland Ltd. (Ireland) | Customer relationship management (CRM) | EU (Germany) | EU (adequate); access from the USA possible: Data Privacy Framework |
| Brevo (Sendinblue SAS, France) | Email delivery | EU | EU (adequate) |
| Stripe Payments Europe Ltd. (Ireland) | Card payments for subscriptions; we do not receive card details | EU, USA | Data Privacy Framework |
Stripe also processes some payment data under its own responsibility, for example to prevent fraud and for legal obligations. Stripe's privacy policy applies to this.
7.2 Other users, universities and companies
As described in section 5.
7.3 Authorities and courts
We disclose data to authorities and courts if we are legally obliged to do so or if it is necessary to protect our rights.
7.4 In the event of a takeover
If Studyond is sold or restructured in whole or in part, data may be passed to the companies involved to the extent necessary.
8. Do we transfer data abroad?
We process data mainly in Germany and other EU member states. Some service providers process data in the United Kingdom, the USA or India (see the table in section 7.1). We do not transfer data to any other countries.
We only transfer data to countries without an adequate level of data protection if
- the recipient is certified under the Data Privacy Framework between the USA and Switzerland or the EU,
- we have concluded the European Commission's standard contractual clauses with the recipient, adapted to Swiss law, or
- a statutory exception applies, for example because the transfer is necessary for a contract with you or you have consented.
You can obtain a copy of the safeguards via privacy@studyond.com.
9. Cookies and similar technologies
9.1 Website and app
On the website and in the app, we use:
- Necessary cookies so that the website and app work, you stay signed in and your cookie settings are saved. We do not need your consent for these.
- Analytics cookies from Google Analytics to understand how the website and app are used. Google Analytics is only loaded once you have consented. We do not send any identifier of your account.
Your cookie settings apply to the website and the app together.
We manage your consent with CookieYes. CookieYes stores a random identifier, your choice, the date and time, your country and a truncated IP address, but neither your name nor your email address. You can change your consent at any time via "Manage cookies" at the bottom of every page.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
cookieyes-consent |
CookieYes | Saves your cookie settings (necessary) | 1 year |
__session, __client_uat |
Clerk | Keeps you signed in (necessary) | 1 year |
__cf_bm |
Cloudflare (on behalf of Clerk) | Protects sign-in from bots (necessary) | 1 hour |
_cfuvid |
Cloudflare (on behalf of Clerk) | Limits the number of requests to protect sign-in from misuse (necessary) | Session |
locale |
Studyond | Saves your language (necessary) | Session |
sidebar_state |
Studyond | Saves whether the sidebar in the app is open (necessary) | Session |
_ga, _ga_* |
Analytics for the website and app, only with consent | 13 months |
9.2 Browser storage
In the app, we use cookies and your browser's storage for sign-in, your language and your settings, for example filters in tables. Your AI chat history is stored only in your browser and deleted when you sign out. On a shared device, you should therefore sign out after use.
These entries in browser storage are necessary for the features you use and are not transmitted to third parties.
10. How long do we keep data?
We keep data only as long as the purpose requires or the law prescribes. After that, we delete or anonymise it.
| Data | Retention |
|---|---|
| Account and profile data | Until you delete your account. We delete inactive accounts after 3 years without sign-in; you receive an email 30 days beforehand. |
| Applications and documents | Until you delete your account |
| Messages and project contributions | Until you delete your account; afterwards without your name (see section 11) |
| AI chats and attachments | Chat history only in your browser, deleted on sign-out; attachments are deleted after the request |
| Usage data in the app | 24 months, then anonymised |
| Technical logs | 6 months |
| Website analytics (Google Analytics) | 14 months |
| Communication with us | 3 years after the last contact |
| Business contacts (acquisition only) | 3 years after the last contact; suppression list indefinitely, so we do not contact you again |
| Invitations not accepted | 90 days |
| Email addresses from public postings | Until the topic is no longer advertised, unless the person registers |
| Contracts, invoices, accounting | 10 years (Art. 958f Swiss Code of Obligations) |
| Backups | 7 days |
11. When you delete your account
You can delete your account in the settings at any time. We then delete your account and profile data, your applications and uploaded files, and your sign-in data with our service providers. The data disappears from our backups after 7 days at the latest.
Data we must keep for legal reasons, for example invoices, is only deleted after the statutory period has expired.
Applications you sent to universities or companies are also held by them. To have them deleted, contact the organisation directly.
Messages you sent to others and your contributions to shared projects remain visible to the other participants so that conversations and projects stay understandable. Instead of your name and profile picture, they then show "Deleted account".
12. How do we protect your data?
We protect your data with technical and organisational measures, for example:
- encrypted transmission (TLS) and encrypted storage,
- access only for employees who need it for their work; access by administrators is logged,
- regular penetration tests.
If a data security breach nevertheless occurs, we report it to the competent supervisory authority where required by law. If there is a high risk to you, we inform you directly.
13. Your rights
Your right to object
If we process your data on the basis of a legitimate interest (see section 4), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims.
You can object to processing for direct marketing at any time without giving reasons. We will then no longer use your data for marketing.
An informal message to privacy@studyond.com is sufficient. For emails, you can also use the unsubscribe link.
Other rights
You have the right
- to obtain information on whether and which data we process about you,
- to have incorrect data corrected,
- to have data deleted,
- to have processing restricted,
- to receive your data in a common electronic format or have it transferred,
- to withdraw consent at any time with effect for the future,
- in the case of an automated individual decision, to express your point of view and request that a person review it.
You can change or delete a lot of data directly in the app. On request, we send you a copy of your data in a common electronic format. For all requests, write to privacy@studyond.com. We respond within 30 days. To prevent misuse, we may ask you to confirm your identity, for example by writing from the email address stored in your account.
Statutory exceptions apply to these rights, for example to protect other people or if we must keep data for legal reasons. In that case, we tell you why we cannot fully comply with a request.
You can lodge a complaint with a supervisory authority:
- in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch,
- in the EU with the supervisory authority at your place of residence, place of work or place of the alleged infringement; you can find a list at www.edpb.europa.eu.
14. Our social media profiles
We have profiles on LinkedIn, Facebook, Instagram and YouTube. When you visit them or interact with us there, the respective operator also processes your data for its own purposes and is itself responsible for this. Its privacy policy and settings apply:
- LinkedIn: LinkedIn Ireland Unlimited Company, privacy policy
- Facebook and Instagram: Meta Platforms Ireland Limited, privacy policy
- YouTube: Google Ireland Limited, privacy policy
The operators provide us with statistics on the use of our profiles, for example how many people have seen a post. These statistics are aggregated; we cannot tell from them who you are. For the statistics on our LinkedIn page, our Facebook page and our Instagram profile, we are joint controllers with the respective operator (Art. 26 GDPR). You can find the essential points in LinkedIn's Page Insights Joint Controller Addendum and Meta's Page Insights Controller Addendum. You can exercise your rights regarding these statistics with the operator or with us.
If you send us a message via one of these platforms, we process it as described in section 3.7.
15. Changes
We update this privacy policy when our processing or the law changes. The version published on this website applies. We inform users with an account about material changes by email or in the app.
This is a translation. In case of discrepancies, the German version prevails.
Last updated: 29 October 2026