Welcome to Happy Student Limited's privacy policy.
Happy Student Limited respects your privacy and is committed to protecting your personal data. This privacy policy explains how we look after your personal data and tells you about your privacy rights and how the law protects you.
It covers everyone whose data we handle. That means students who use the Happy Student app, visitors to happystudent.app, people who sign up to our newsletter, and contacts at the universities, colleges and partner organisations we work with. Where something applies to only one of those groups, we say so.
This privacy policy is provided in a layered format so you can click through to the specific areas set out below. Please also use the Glossary to understand the meaning of some of the terms used in this privacy policy.
This privacy policy explains how Happy Student Limited collects and processes your personal data when you create an account and use the Happy Student app.
The minimum age for a Happy Student account is 16. You confirm that you are 16 or over when you accept our terms.
The app is built for students in higher education, so almost everyone using it is 18 or over. A small number of users on foundation and pathway courses may be 16 or 17. If you are under 18, the following applies to you. We collect the same limited information from you as from anyone else. We do not profile you, we do not use your data to target advertising at you, and we do not sell your data to anyone. You can delete your account and everything in it at any time, in the app or by emailing us.
We keep under review whether the Information Commissioner's Office Age Appropriate Design Code applies to us, and we record that assessment. We will review it again if under-18s become a significant part of our user base.
We do not knowingly collect data from anyone under 16. If you believe a child under 16 has given us their data, email support@happystudent.app and we will delete it.
It is important that you read this privacy policy together with any other privacy notice we may give you on specific occasions when we collect or process personal data about you, so that you are fully aware of how and why we are using your data. This privacy policy supplements those notices and is not intended to override them.
Happy Student Limited is the controller and responsible for your personal data (referred to as "we", "us" or "our" in this privacy policy).
We are registered with the Information Commissioner's Office, registration reference ZC283771.
If you registered with your university or college, we act as an independent controller for the data you give us. Your institution does not pass your data to us and we do not receive or check enrolment records. You choose your institution yourself when you register.
If you have any questions about this privacy policy or our privacy practices, please contact us in the following ways:
Full name of legal entity: Happy Student Limited, company number 11947586, registered in England and Wales.
Email address: support@happystudent.app
Postal address: 3rd Floor, 86-90 Paul Street, London, United Kingdom, EC2A 4NE
You have the right to complain to us directly if you think we have not handled your personal data properly.
Send your complaint to support@happystudent.app, or by post to the address above. You can complain in any way that suits you and you do not have to use a particular form or wording. We will acknowledge your complaint within 30 days of receiving it, start looking into it without undue delay, keep you informed if it is taking time, and give you our answer as soon as we can.
You can also complain to the Information Commissioner's Office at any time, whether or not you have complained to us first. The ICO is the UK supervisory authority for data protection (www.ico.org.uk, helpline 0303 123 1113).
We keep our privacy policy under regular review. This version was last updated on 27 October 2026. We keep a record of previous versions and the dates they applied, which you can request from us.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes while you are using the app.
The app includes links to third-party websites, offers and services. Clicking those links may allow those third parties to collect or share data about you. We do not control them and we are not responsible for their privacy statements. When you leave the app, we encourage you to read the privacy policy of every website you visit.
Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We collect, use, store and transfer the following kinds of personal data about you:
Identity Data: first name and last name.
Contact Data: email address.
Account Data: your institution, your course, your expected graduation year, your preferred language, and your sign-in method (an email address and password, or your Apple or Google account).
Usage Data: the content, deals and checklist items you open or save, your search terms, and the messages you type to the in-app assistant.
Technical Data: device type, operating system, app version, country, your push notification token, and the IP address recorded at the time of an event. Our analytics are keyed to an app-instance identifier rather than to your name or email address.
We also collect, use and share Aggregated Data such as statistical data. Aggregated Data may be derived from your personal data but is not personal data in law, because it does not directly or indirectly reveal your identity. For example, we aggregate Usage Data to calculate the percentage of students using a particular feature. If we ever combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data under this privacy policy.
We do not ask you for Special Categories of Personal Data and you never need to give us any in order to use the service. That category covers your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data. We do not ask for information about criminal convictions and offences either.
Some of our content covers health services and wellbeing. Reading that content tells us nothing about your health, and we do not infer anything about you from what you read.
The in-app assistant answers practical questions about student life. We do not ask you for health or other sensitive information and we advise you not to enter it. If you type something sensitive into the assistant anyway, we do not use it to build a profile of you, we do not use it for advertising, and we do not share it for any purpose other than the emergency circumstances described in section 5. It is deleted when you delete your account.
Visitors to happystudent.app who do not have an account give us very little. We collect your name, email address and message if you use the contact form, your name, email address and institution if you sign up to our newsletter, and analytics about your visit only if you accept analytics on the banner shown when you first arrive. Nothing is stored on your device before you accept.
We use Google Analytics to understand how the website is used. It sets cookies on your device and these are not set unless you press Accept on the banner. You can decline, and the site works normally if you do. If you decline, no analytics cookies are set and no analytics data is collected about your visit. We rely on your consent for this, and you can change your mind by clearing your browser data for our site.
We hold your name, job title, employer, email address and the record of our correspondence, so that we can manage our relationship with you. We rely on our legitimate interests in running our business. You can ask us to stop contacting you at any time.
We collect data from and about you in the following ways:
Direct interactions. You give us your Identity, Contact and Account Data when you register for an account, when you save content or complete checklist items, when you type messages to the in-app assistant, when you sign up for our newsletter, and when you contact us or give us feedback.
Automated technologies. As you use the app we automatically collect Technical Data about your device and your activity, using server logs, app analytics and similar technologies. On iOS we ask for your permission through Apple's App Tracking Transparency prompt before any tracking that requires it.
Third parties. We receive your name and email address from Apple or Google if you choose to sign in with your Apple or Google account.
We will only use your personal data when the law allows us to. Most commonly, we use your personal data in the following circumstances:
Where we need to perform the contract we have entered into with you, which is providing the service you registered for.
Where it is necessary for our legitimate interests in operating, securing and improving the service and in producing aggregated statistics, and your interests and fundamental rights do not override those interests.
Where you have given consent, which applies to marketing emails and, on iOS, to app tracking. We do not currently send marketing emails. You can withdraw consent at any time by contacting us.
Where we need to comply with a legal obligation.
In an emergency, where it is necessary to protect your vital interests or those of another person. This is explained under Disclosures of your personal data below.
See the Glossary for an explanation of each of these lawful bases.
Purpose or activity: To register you as a new user.
Type of data: Identity, Contact, Account.
Lawful basis: Performance of a contract with you.
Purpose or activity: To provide the app, including your saved items, checklist and the in-app assistant.
Type of data: Identity, Contact, Account, Usage.
Lawful basis: Performance of a contract with you.
Purpose or activity: To send you service messages, such as email verification and notifications about changes to our terms or this privacy policy.
Type of data: Identity, Contact.
Lawful basis: Performance of a contract with you. Necessary to comply with a legal obligation.
Purpose or activity: To send you push notifications about content and offers.
Type of data: Technical.
Lawful basis: Necessary for our legitimate interests in keeping you informed about the service. You can turn push notifications off in your device settings.
Purpose or activity: To administer and protect our business and the app, including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting.
Type of data: Identity, Contact, Technical.
Lawful basis: Necessary for our legitimate interests in running our business, network security and preventing fraud. Necessary to comply with a legal obligation.
Purpose or activity: To understand how the app is used, to measure installs and to improve the service.
Type of data: Technical, Usage.
Lawful basis: Necessary for our legitimate interests in developing the service and growing our business. Consent, where required for tracking on iOS.
Purpose or activity: To produce aggregated reporting for partner universities and colleges.
Type of data: Account, Usage, converted into aggregated statistics.
Lawful basis: Necessary for our legitimate interests in demonstrating the value of the service. Figures drawn from fewer than ten students are suppressed, so no individual can be identified.
Purpose or activity: To send you marketing emails.
Type of data: Identity, Contact.
Lawful basis: Consent. We do not currently send marketing emails.
Purpose or activity: To improve how the in-app assistant answers questions.
Type of data: Usage, limited to the messages you send the assistant.
Lawful basis: Necessary for our legitimate interests in making the service work better. We look at patterns rather than individuals wherever we can, and we remove your name and email address before reviewing any individual conversation.
Purpose or activity: To show you offers and deals from partner brands inside the app.
Type of data: Account, Usage.
Lawful basis: Necessary for our legitimate interests in funding a service that is free for students. Some offers are chosen because of your institution, your course or your graduation year. We do not build advertising profiles about you, we do not use special category data to select offers, and we do not share your personal data with partner brands. Where an offer is paid for by the partner, we say so in the app.
Some offers, deals and links in the app are commercial. We may earn a commission or a fee when you open an offer or buy something from a partner, and some placements are paid for by the partner. That does not change the guidance we give you, and any purchase is a contract between you and that partner, not with us.
When you open a partner offer, the affiliate network records the click so the partner knows it came from us. That network acts as its own controller and handles that click under its own privacy policy. We do not pass your name, email address or account details to partner brands.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you would like an explanation of how the processing for a new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.
We may process your personal data without your knowledge or consent where this is required or permitted by law.
We share your personal data with the service providers set out below, who process it on our behalf. The list reflects the position at the date of this policy and a current list is available on request.
Google, for sign-in and account management, for storing your profile, saved items and checklist, for push notifications, and for app analytics.
AppsFlyer, for measuring installs and handling deep links.
ActiveCampaign and Postmark, for sending email verification messages.
Voiceflow, and the provider of the language model it uses, for running the in-app assistant.
Hetzner, for our content system, our assistant gateway and our backups.
Sentry and Grafana Labs, for error reporting and server monitoring.
We also share your personal data with:
Professional advisers acting as processors or joint controllers, including lawyers, bankers, auditors and insurers, who provide consultancy, banking, legal, insurance and accounting services.
HM Revenue and Customs, regulators and other authorities, where reporting is required.
Third parties to whom we may sell, transfer or merge parts of our business. If a change happens to our business, the new owners may use your personal data in the same way as set out in this privacy policy.
Partner universities and colleges receive aggregated engagement reporting only, grouped by course and expected graduation year. Figures drawn from fewer than ten students are suppressed. Your institution does not see your identity or your individual activity, and routine individual-level reporting does not form part of any agreement we have with any institution.
We may review conversations with the assistant to improve how it answers. Most of that work looks at patterns rather than people: which topics come up, and which questions the assistant answers badly. Where we need to investigate a specific fault, we may look at a small sample of individual conversations, with your name and email address removed, and only a small number of named people can do that.
That review is about quality and accuracy. It is not a check on your wellbeing, and we do not scan what you write for signs that you need help. The app is not a monitored service and it is not an emergency service. In an emergency you should call 999, or the emergency number for the country you are in, and contact your institution's own support team.
If a member of our team does become aware of information suggesting a serious and immediate risk to your life or safety, we may share what is necessary with your institution's safeguarding team or with the emergency services. We rely on Article 6(1)(d) of the UK GDPR for this. Where the information concerns your health, we rely on Article 9(2)(c), which applies where a person is physically or legally incapable of giving consent. We share only what is necessary and we record every disclosure.
If you breach our terms and conditions in a way that may be unlawful, we may report it to the relevant authorities and give them your identity and the information relevant to that breach. We rely on our legitimate interests in protecting our service and other users, and on compliance with any legal obligation that applies.
When you sign in with Apple or Google, or open a partner offer through an affiliate link, those companies process the sign-in or the click under their own privacy policies, as independent controllers.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes, and we only permit them to process your personal data for specified purposes and in accordance with our instructions.
Your profile, saved items and checklist are stored in the United Kingdom, in Google Cloud's London region. Our content system and our backups run on servers in Germany. Our error reporting and monitoring are hosted in the United Kingdom and Germany.
Some processing takes place outside the United Kingdom and the European Economic Area. This applies to your sign-in account, our email verification messages, our app analytics and install measurement, and the in-app assistant. These involve transfers to the United States and Canada.
Where we transfer your personal data outside the United Kingdom, we make sure a similar degree of protection is given to it by relying on one of the following safeguards:
The UK Addendum to the EU Standard Contractual Clauses, which forms part of our contracts with those providers.
The UK Extension to the EU-US Data Privacy Framework, where the provider is certified under it.
UK adequacy regulations, where the country has been assessed as providing an adequate level of protection.
Please contact us if you would like further information on the safeguards that apply to a specific transfer.
If you wish to permanently close your account and remove your personal information from our systems, you can do so in the app or by emailing us at support@happystudent.app.
Account deletion is permanent and irreversible. Once confirmed, your data, including your profile information, your history and your preferences, will be removed from our servers. You will not be able to recover this data or reactivate the account later.
Steps to delete your account in the app:
Deleting your account in the app immediately removes your sign-in account, your profile, your saved items, your checklist records and any newsletter sign-up. It clears your conversation record held by our assistant provider, removes your address from our email provider's lists, and, if you signed in with Apple, revokes the Apple authorisation. Analytics data cannot be linked back to you.
Deleted data drops out of our backups on the schedule set out under Data retention below.
If you would prefer us to delete your account for you, please email support@happystudent.app.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
All traffic is encrypted in transit using TLS, and Google Cloud encrypts your stored account data at rest. Our database rules allow you to read and write only your own record. Account deletion and email sending run on our servers and require you to be signed in. Access to our production systems is limited to named individual accounts held by the founder and the engineering lead. Our application servers accept SSH keys only, sit behind a firewall and install security updates automatically. Backups run daily and weekly, and we monitor availability, errors and performance.
We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They process your personal data only on our instructions and they are subject to a duty of confidentiality.
We have procedures in place to deal with any suspected personal data breach. Where we are legally required to do so, we will notify the Information Commissioner's Office within 72 hours, inform you without undue delay, and inform your institution where its students are affected.
We only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including to satisfy any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period if there is a complaint, or if we reasonably believe there is a prospect of litigation.
In practice:
Your account data is kept while your account is active. If you do not sign in for three years, we send you an email notice and then delete the account.
Database backups are kept for 98 days. Point-in-time recovery covers the last 7 days.
Content system backups are kept for 30 days.
Email activity logs held by our email provider expire after 45 days.
App analytics data is kept for at most 14 months.
Error reports and server logs are kept for 14 days.
To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes by other means, and the applicable legal, regulatory, tax, accounting and other requirements.
In some circumstances you can ask us to delete your data. See Your Legal Rights below.
In some circumstances we will anonymise your personal data so that it can no longer be associated with you, for research or statistical purposes. We may use anonymised information indefinitely without further notice to you.
Legitimate Interest means the interest of our business in conducting and managing our business so that we can give you the best and most secure service. We consider and balance any potential impact on you, both positive and negative, and your rights, before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted to by law. You can obtain further information about how we assess our legitimate interests by contacting us.
Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.
Consent means processing your data where you have given us clear permission to do so for a specific purpose. You can withdraw your consent at any time.
Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.
Vital interests means processing your personal data where it is necessary to protect your life or the life of another person. We rely on this only in an emergency, as described under Disclosures of your personal data.
Service providers acting as processors who provide the hosting, sign-in, messaging, assistant, analytics, attribution and monitoring services that the app depends on. These are named under Disclosures of your personal data above, and they are based in the United Kingdom, the European Economic Area, the United States and Canada.
Professional advisers acting as processors or joint controllers, including lawyers, bankers, auditors and insurers based in the United Kingdom and the European Economic Area, who provide consultancy, banking, legal, insurance and accounting services.
HM Revenue and Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom, who require reporting of processing activities in certain circumstances.
Partner universities and colleges, which receive aggregated engagement reporting only, except in the urgent safeguarding circumstances described above.
You have the right to:
Request access to your personal data, commonly known as a data subject access request. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request correction of the personal data we hold about you. This enables you to have any incomplete or inaccurate data corrected, though we may need to verify the accuracy of the new data you provide.
Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue processing it. You can also ask us to delete or remove your personal data where you have successfully objected to processing, where we may have processed your information unlawfully, or where we are required to erase it to comply with local law. We may not always be able to comply with a request for erasure for specific legal reasons, which we will explain to you at the time.
Object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object on that ground. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following situations: if you want us to establish the data's accuracy; where our use of the data is unlawful but you do not want us to erase it; where you need us to hold the data even if we no longer require it, because you need it to establish, exercise or defend legal claims; or where you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal data to you or to a third party. We will provide to you, or to a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. This right only applies to automated information which you initially gave us consent to use, or where we used the information to perform a contract with you.
Withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain features to you. We will tell you if that is the case at the time.
You will not have to pay a fee to access your personal data, or to exercise any of your other rights. We may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We may also refuse to comply with your request in those circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data, or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information about your request, to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is particularly complex or if you have made a number of requests. In that case we will notify you and keep you updated.
If you wish to exercise any of the rights set out above, please contact us at support@happystudent.app.
Happy Student Limited is a UK company and we apply the standards in this policy to every user, wherever you are. If you are in the United States, that means you get the same rights as a UK student: you can ask us what we hold about you, ask us to correct it, ask us to delete it, and ask for a copy of it. Use the same address, support@happystudent.app.
We do not sell your personal data and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy laws. We will not discriminate against you for exercising any privacy right.
Your data is held in the United Kingdom and the other locations named in section 6. Your institution does not give us your education records, so we hold no student records from any US institution and nothing in this service depends on your college releasing information about you.