Privacy policy

1. Who is the data controller

StudentRefundCheck is the data controller for personal data processed through this service. For any privacy-related question or to exercise your rights, contact privacy@studentrefundcheck.com.

2. What we collect and why

• Documents you upload — processed temporarily to extract a small set of fields (full name, GWF/UAN, visa type, payment date, payment amount) and to build your refund request package.
• Payment information — handled directly by Stripe. We do not receive or store your card details; we only see Stripe's checkout-session reference and payment status.
• Basic technical logs — Cloudflare receives standard request metadata (IP address, user agent, timestamps) for security and abuse prevention.

3. Lawful basis

We rely on performance of a contract (UK GDPR Art. 6(1)(b)) to process your documents in order to deliver the package you paid for. Where extra processing requires it, we rely on your explicit consent (Art. 6(1)(a)), which you give via the consent checkboxes shown before upload.

4. Leads and marketing (eligibility quiz)

When you complete the eligibility quiz at /start, we store your email, first name, university, programme end year, current status, and your quiz answers so we can show your result and allow you to resume it later. Our lawful basis for storing this information is performance of a contract (UK GDPR Art. 6(1)(b)).

The marketing checkbox is optional, unticked by default, and separate from the service email. If you tick it, our lawful basis for marketing emails is your consent (UK GDPR Art. 6(1)(a)) — you can withdraw at any time via the unsubscribe link in every marketing email, or by emailing privacy@studentrefundcheck.com.

Quiz profiles are retained for up to 18 months of inactivity, after which they are automatically deleted by our cleanup job. You can ask us to delete your profile sooner at any time.

5. Retention (processing data)

Documents you upload and the generated package are stored on Cloudflare R2 only for as long as your processing session lasts (up to 24 hours from payment), then automatically deleted by an hourly cleanup job. Database rows tied to the session are deleted at the same time. Stripe retains your payment record under its own terms.

6. Processors and international transfers

• Cloudflare (UK / EU / US) — hosting, R2 storage, D1 database.
• Stripe — payment processing, including UK Data Protection considerations under Stripe's DPA.
• OpenAI (US) — used solely to extract the five fields listed above from the documents you upload. Files are sent over TLS, used for that single extraction call, and deleted from OpenAI immediately afterwards. We use OpenAI's standard API, which does not train on submitted content.

Transfers outside the UK rely on UK Standard Contractual Clauses or equivalent adequacy mechanisms provided by each processor.

7. Your rights

You have the right to:

• Access the personal data we hold about you.
• Ask for correction or deletion.
• Object to or restrict processing.
• Withdraw consent at any time (it does not affect prior lawful processing).
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Because we delete your documents and processing record within 24 hours, requests made after that window will generally find no data to act on.

8. Cookies

We do not use advertising or analytics cookies. The site only stores a short-lived processing token in your browser's session storage (cleared when you close the tab) so that we can guard access to your upload session.

9. Children

This service is intended for individuals who have applied for or paid a UK student visa fee themselves. It is not directed at children under 16.

10. Changes

We may update this policy as the service evolves. The "last updated" date at the top of this page reflects the latest revision.