Edu Swap is built around an explicit deal: you give us a small set of academic info, we give you a fair survey-exchange platform. This policy explains exactly what we collect, why, where it lives, who else sees it, and what control you have over it.
Who we are
Edu Swap is operated by an independent team based in Rabat, Morocco. The platform is currently in pilot mode and is not yet incorporated as a legal entity. For any privacy-related question, write to contact@edu-swap.com. This policy is written in line with Moroccan law n°09-08 on the protection of individuals with regard to the processing of personal data.
What we collect
When you sign up and use Edu Swap, we store the following:
- Account details — email address, full name, password (hashed by Supabase, never stored in plain text), preferred language.
- Academic profile — university, field of study, optional speciality, academic year, city, topics of interest. You provide all of these explicitly during signup or in your profile page.
- Activity data — surveys you post, surveys you answer, time spent on the answer page, credit transactions, in-app notifications, reports filed.
- Technical data — your IP address (handled by Vercel and Supabase as part of normal request handling), browser user-agent, timestamps. We don't fingerprint you.
- Analytics — anonymous usage events sent to Google Analytics 4 (page views, sign-up, login, survey posted, survey answered). We attach your user ID (a UUID, no name or email) so we can analyse the funnel but never the individual.
We do not collect: phone numbers, payment details, government ID, social-media profiles, biometric data, location beyond the city you typed yourself.
Why we collect it
- To run the credit economy — counts of surveys, responses, and credits per user are how the platform works.
- To match responders to your target audience — your field, year, and topics drive the matching algorithm.
- To send you transactional and product-update emails — verification on signup, password resets, deadline reminders, and occasional messages about new features. Product updates are infrequent (typically less than once a month) and every email includes a one-click unsubscribe link.
- To moderate the platform — admin reviews flagged responses and reported surveys.
- To improve the product — anonymous analytics tell us where users get stuck so we can fix it.
Legal basis for processing
We process your data based on (a) your consent — given when you create your account and accept these terms, (b) the execution of the service you signed up for (we can't run a survey exchange without storing your surveys and responses), and (c) our legitimate interest in moderating abuse and improving the platform. You can withdraw consent at any time by deleting your account; see the rights section below.
Sub-processors and data location
We use a small set of external services to run the platform. None of them sells your data. All are contractually bound to handle data only on our instructions:
- Supabase — Hosts the database (PostgreSQL) and handles authentication. Data lives in Supabase's eu-west-3 region (Paris), within the European Union.
- Vercel — Hosts the website. Vercel may temporarily process request logs in regions outside the EU.
- Resend — Sends transactional emails (verification, password resets) on our behalf. Email contents are stored briefly in Resend's logs for delivery diagnostics.
- Google Analytics 4 — Receives anonymized analytics events. We use the standard GA4 setup; data goes to Google's infrastructure (which may include the United States).
How long we keep your data
Your account data is kept for as long as your account exists. If you delete your account, we delete your profile, surveys you authored, your credit history, and the answer rows tied to you. Anonymous analytics events are retained per Google Analytics' standard policy (currently 14 months). Email send logs are retained by Resend per their policy. We may keep aggregated, anonymized counts (e.g., "how many signups happened in May 2026") indefinitely, since they no longer identify you.
Your rights
Under Moroccan law n°09-08 (and equivalent EU/EEA frameworks where applicable), you have the right to:
- Access the personal data we hold about you.
- Correct any inaccurate data — most fields are editable directly from your profile page.
- Delete your account and the personal data tied to it.
- Export your data in a portable format.
- Object to specific processing or withdraw consent for analytics.
To exercise any of these rights, email contact@edu-swap.com. We aim to respond within 30 days. You also have the right to lodge a complaint with the Moroccan data protection authority (CNDP).
Children
Edu Swap is intended for university students (typically 18+). We don't knowingly collect data from children under 13, and we recommend students under 18 review this policy with a parent or guardian.
Changes to this policy
We'll update the "last updated" date at the top whenever this policy changes. For material changes, we'll also send a notification to all active users via email or in-app banner so you have a fair chance to review the change before continuing to use the platform.
Questions
If anything here is unclear or you'd like more detail about how a specific feature handles your data, write to contact@edu-swap.com. We read every message.