A CV says a lot about a person, and most of the people who use Corinia are teenagers. This policy explains what we collect, why, who sees it, and what you can do about it. It applies to corinia.com and everything you do there.
1. The short version
- We collect what you give us (your details, your documents, your choices) and a small amount of technical data needed to run the site.
- We use it to provide Corinia to you: to build your profile, suggest universities, write your plan and answer your questions.
- We do not sell personal data. We do not show advertising. We do not use your documents to train artificial intelligence models.
- Your documents are read by automated systems, including AI, run by us or by providers working for us under contract.
- You can download everything, correct it, or delete your account whenever you like, from your account page.
- If you are under 16, a parent or guardian approves your account first and can end it at any time.
2. Who is responsible for your data
The controller of your personal data is Evolona S.R.L., the company that operates Corinia. Its registered office is at Intrarea Witing nr. 2, Sector 1, 010905 Bucharest, Romania. For anything about privacy, write to [email protected].
If you joined through your school. For the part of Corinia that your school uses to follow its students, your school decides why and how your information is used, and we process it on the school's behalf. Section 11 explains this.
3. What we collect
| What | Details | Where it comes from |
|---|---|---|
| Account details | Name, email address, date of birth, country of residence, language, and whether you are a student or a counsellor | You |
| Parental approval | For students under 16: the parent's or guardian's email address and name, and the record of their approval (date, time, and the internet address used) | You and your parent |
| Your profile | School, grades, test scores, languages, activities, awards, work, projects, interests and skills | You, and the documents you upload |
| Your documents | The files you upload: CVs, transcripts, certificates, portfolio pages | You |
| Your preferences | What you want to study, where, in which language, your nationality, a rough budget, and anything you add in your own words | You |
| What you do in Corinia | Your matches and their status, your notes, your plan and what you have ticked off, your drafts and the feedback on them, your questions to the assistant and its answers | You, and Corinia |
| Payments | The plan you bought, dates and amounts, and a reference to your customer record at our payment provider. We never receive your full card number | You and our payment provider |
| Messages | What you write to us through the contact form or by email | You |
| Technical data | Internet address, browser type, and the dates and times of sign-ins and key actions, kept for security and to prevent misuse | Your device |
| School information | For counsellors: the school's name and location, the notes you write about students, and the steps you add to their plans | You |
Information we do not ask for. We do not ask about your health, religion, ethnic origin, political views, sexual orientation or similar matters, and you do not need to include them in anything you upload. Please leave them out. If a document you upload contains such information, it is processed only to provide the service, on the basis of your explicit consent given by choosing to upload it, and you can delete the document at any time.
Information about other people. A CV or a transcript may name teachers or referees. We process those names only as part of your documents.
4. Why we use it, and the legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and signing you in | Performing our contract with you |
| Reading your documents, building your profile, matching you with universities, checking requirements, writing your plan, answering your questions and reviewing your writing | Performing our contract with you. For students under 16 who sign up on their own: the consent of a parent or guardian |
| Processing sensitive information you chose to include in a document | Your explicit consent |
| Sending you the emails the service needs: sign-in codes, approval requests, confirmations | Performing our contract with you |
| Sending you reminders before a step in your plan is due | Performing our contract with you. You can turn them off in your account |
| Taking payment and keeping accounting records | Performing our contract with you, and our legal obligations under tax and accounting law |
| Showing a counsellor the students in their school | For students who joined through a school: see section 11 |
| Keeping Corinia secure, preventing misuse, and enforcing our terms | Our legitimate interest in running a safe and reliable service |
| Understanding how Corinia is used, in aggregate, so we can improve it | Our legitimate interest in improving the service. We use counts and totals, not individual profiles |
| Answering your messages | Our legitimate interest in responding to you, or steps taken at your request before a contract |
| Establishing, exercising or defending legal claims | Our legitimate interest in protecting our rights |
We do not use your information for advertising, and we do not build profiles for marketing.
You do not have to give us any information. Without an email address and a date of birth we cannot open an account, and without a profile Corinia cannot suggest anything useful.
5. Automated analysis and artificial intelligence
Corinia works by automated analysis. Software that uses artificial intelligence reads your documents, estimates how your record compares with what universities usually admit, suggests universities, writes your plan and drafts answers and feedback.
What this means for you.
- The results are suggestions for you to consider. Corinia makes no decision about you that has legal effect or similarly significant consequences. Admission decisions are made by universities, which do not receive anything from Corinia.
- You can see and correct the profile the analysis is based on, run the analysis again, and ignore any suggestion.
- If you think a result is wrong or unfair, write to us and a person will look at it.
Training. Your documents and information are not used to train artificial intelligence models, by us or by the providers we use. Our agreements with those providers forbid it.
Reading official pages. To check requirements, our system visits public pages on university websites. It does not send them any information about you.
6. Who receives your data
We share personal data only with those who need it to provide Corinia, and only as much as they need.
| Recipient | What they receive | Why |
|---|---|---|
| Infrastructure providers | Everything stored in Corinia, in encrypted transit | To host and deliver the service and protect it from attack |
| AI processing providers | The content being analysed: for example, a document when it is read, or your profile when matches are prepared | To perform the analysis on our behalf. They act on our instructions and may not use the content for their own purposes |
| Payment provider (Stripe) | Your name, email address and payment details | To take payment. Stripe is responsible for the payment data it handles under its own privacy policy |
| Email delivery provider | Your email address and the content of the email | To deliver sign-in codes, approvals and reminders |
| Your school | Your profile, matches, plan and progress | Only if you joined a school on Corinia. Your drafts and your conversations with the assistant are not shared |
| Your parent or guardian | For under-16s: your name, email address, date of birth, plan and the names of your documents | So they can exercise their control over the account |
| People you share a link with | Your first name, your shortlist and your plan | Only if you create a sharing link. You can turn it off at any time |
| Authorities | What the law requires | Only when we are legally obliged, or to protect someone's safety |
| A successor | The data needed to continue the service | If Corinia is ever transferred to another company, which must then respect this policy. We would tell you first |
A current list of the providers we use is available on request from [email protected].
We do not sell personal data, and we do not share it with anyone for their own marketing.
Universities. We do not send your information to universities. If we ever offer a way for you to be introduced to a university, it will be switched off by default, it will need your separate and specific agreement each time, and for anyone under 16 it will need a parent's agreement too.
7. Transfers outside the European Economic Area
Some of our providers process data outside the European Economic Area, mainly in the United States. When that happens we rely on a decision of the European Commission that the destination protects personal data adequately, including the EU–US Data Privacy Framework for providers certified under it, or on the standard contractual clauses approved by the European Commission, with additional safeguards where needed. You can ask us for a copy of the safeguards that apply.
8. How long we keep it
| Data | How long |
|---|---|
| Your account, profile, documents, matches, plan, drafts and conversations | Until you delete them or delete your account |
| After you delete your account | Removed from the live service at once, and from backups within 35 days |
| An approval request a parent has not answered | 30 days, then the request and the account are deleted |
| A sign-up that was started and not finished | 7 days |
| Details of a child under 13 who tried to sign up | Not kept. They are deleted immediately |
| Sign-in codes | 15 minutes |
| Copies of emails we sent you | 30 days |
| Messages you sent us | Up to 3 years after our last reply |
| Payment and invoice records | As long as tax and accounting law requires, currently at least five years |
| Security records | Up to 12 months |
If an account has not been used for three years, we may delete it after writing to its email address first.
9. Children and teenagers
Corinia is for students aged 13 and over.
Under 13. We do not open accounts for children under 13. If someone enters a date of birth showing they are under 13, the sign-up is refused and the details entered are deleted at once. If you believe a child under 13 has an account, tell us and we will remove it.
13 to 15. A parent or legal guardian must approve the account before it can be used. Until they do, the student cannot upload documents or use the service, and we hold only the details entered at sign-up. The parent receives an email with a page that explains what Corinia does and what it uses. After approving, the parent keeps a private link from which they can see what is stored and withdraw approval, which deletes the account and everything in it.
Schools. Students who join with a school's code are covered by the school's own arrangements with parents. See section 11.
Purchases. A paid plan for anyone under 18 requires a parent's or guardian's agreement.
We do not show advertising to anyone, we do not profile young people for marketing, and we do not share their information for commercial purposes.
10. Your rights
You have the right to:
- see your data and receive a copy. Your account page has a "Download everything" button;
- correct it. You can edit your profile and your details at any time;
- delete it. You can delete any document, any draft, a conversation, or your whole account;
- move it. The download is in a common machine-readable format;
- restrict or object to our use of it where that use is based on our legitimate interests;
- withdraw consent where we rely on it, without affecting what was done before;
- ask for a person to review any automated result you disagree with;
- complain to a data protection authority.
To exercise a right that the account page does not cover, write to [email protected]. We answer within one month. We may ask you to confirm your identity, usually by replying from the email address on your account. A parent or guardian may exercise these rights for a child under 16.
The authority. In Romania the authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, Bucharest, dataprotection.ro. You may also complain to the authority in the country where you live or work.
11. If you joined through your school
When a school uses Corinia, two things are true at once.
- The school is the controller for its use of Corinia: inviting you, following your progress in its dashboard, adding notes and steps. The school decides this, has its own legal basis for it, and is your first point of contact for questions about it. We act as its processor under the School data agreement.
- You still have your own account. You sign in yourself, and your drafts and your conversations with the assistant are not visible to the school.
Counsellors at your school can see your profile, your matches, your plan and your progress, and can add steps to your plan. They cannot see your documents themselves, your drafts, or your conversations.
You can leave your school on Corinia from your account page. You then keep your account on the free plan, the school can no longer see it, and we become the controller of your data under this policy.
12. Security
We protect your data with measures that include encryption in transit, access controls, private storage for uploaded files, sign-in by one-time code rather than stored passwords, restricted staff access, and regular backups.
No system is perfectly secure. If a breach of your personal data is likely to put your rights at high risk, we will tell you without undue delay, and we will notify the authority where the law requires it.
13. Cookies
Corinia uses only the cookies it needs to work: one to keep you signed in, and others to remember your language and whether you prefer the light or dark appearance. There are no advertising or tracking cookies, which is why you are not shown a cookie banner. The Cookies page lists each one.
14. If you live outside the European Union
We apply the standards in this policy to everyone, wherever they live.
- United Kingdom and Switzerland. You have equivalent rights under your local data protection law, and may complain to the Information Commissioner's Office (UK) or the Federal Data Protection and Information Commissioner (Switzerland).
- United States. We do not sell personal information and do not share it for cross-context behavioural advertising. Depending on your state, you may have rights to access, correct and delete your information, which you can exercise as described in section 10.
- Elsewhere. If the law where you live gives you additional rights, we will respect them. Write to us.
Your information is processed in the European Union and, where section 7 applies, in other countries.
15. Changes to this policy
We may update this policy when Corinia changes or when the law does. If a change affects how we use your data in a significant way, we will tell you by email or in the app before it takes effect, and where the law requires your consent or a parent's, we will ask for it. The date at the top shows the latest version.
16. Contact
Questions about this policy or about your data: [email protected], or by post to the address in section 2.