The matching stays in your browser. The grades, test scores and preferences you type into the search are processed on your own device and saved in its local storage. They are not sent anywhere: we cannot read them, lose them or hand them over. The budget is the one exception, and it is explained below. Clearing your browser data erases them — we have no copy. The same goes for your favourites — unless you are signed in: then your favourite schools are saved to your account, because they are the list we send you deadlines for.
Your profile is a different thing, and it only exists if you ask for it. If you sign in and fill in the Biography or the CV builder, that is stored on our servers — it has to survive you closing the tab. It holds your university, grades, test scores, work and volunteering history, interests and, if you choose to give them, your phone number and LinkedIn.
Your budget is the one exception to the rule above, and it applies only while you are signed in: the annual figure you set in the search is stored with your profile. We keep it because it is the only honest measure we have of what a student can actually afford — without it we cannot tell whether the programmes we put in front of you are within reach. It is a number and a currency, nothing else, and it never appears in your biography or your CV: those are documents you hand to other people.
Two things, and each only if you ask for it. If you sign in: your email address plus your favourite schools (with the track you saved each one for), which are the list we send you deadlines for, and — if you create one — the profile described above. Nothing is stored for a visitor who only searches without signing in.
If you sign in with Google we receive your email address and the fact that Google considers it verified. We store the address. We do not receive, and never ask for, your password, your contacts or anything else in your Google account. You can also sign in without Google: we email you a 6-digit code from info@ateneomatch.com. Until you use it we keep only a scrambled (hashed) copy of the code, for 10 minutes at most, together with the number of attempts, and the form is protected by Cloudflare Turnstile.
Signing in is what turns the deadline emails on: from then on, every university you add to your favourites is followed for you. The record is created when you sign in: at first it holds only your address and the date of your last sign-in, and until you have a favourite the only email we send is one welcome message, at your first sign-in.
If you link your calendar in “When to apply”, your profile also keeps what we need to work out the dates again: the order you put your favourites in, the track and category (Reach, Target…) of each one, whether the EU deadlines apply to you, and your language. Your calendar app (Apple, Google, Outlook) downloads the dates from an address with a secret code that is yours alone, under its own rules. Without a linked calendar, the order stays in your browser.
If you write to us through the suggestions form, your message — and your email address, only if you choose to leave it — arrives in our mailbox. We keep it as long as we need to read it and reply, and delete it whenever you ask.
If you rate AteneoMatch with the stars, we store the number of stars and the time, nothing else: no name, no address, nothing that links the vote to you.
To send you an email when one of your favourite schools opens applications or announces its dates, and to remind you of each of its deadlines two weeks and one week before. That is the only use. We do not profile you, we do not advertise, and we never sell or share your address with anyone.
The budget has a different purpose. Read together, those figures tell us what the students who use AteneoMatch can actually afford, so that the catalogue we build and the programmes we put in front of you stay within reach. It is never sold, never shared, and never attached to anything you make public.
The legal basis is your consent (GDPR art. 6(1)(a)), given by signing in after we have told you — in the sign-in box and in the tip after your first search — that a profile gets the deadlines of its favourites, or by setting a budget while signed in, or by linking your calendar. If you asked for alerts with your email alone before 6 October 2026, the confirmation you clicked then still counts. If you were already signed in before 6 October 2026 we do not take it for granted: we ask you once, and until you say yes you get at most the alerts you had already asked for. You can withdraw it at any moment, instantly and on your own.
The linked calendar has one job: keeping the “When to apply” dates in your calendar up to date when you change your order or your favourites, or when a school changes its dates.
| Who | What for | Where |
|---|---|---|
| Vercel | Hosting, serverless functions & cookieless visit measurement | USA (EU data-processing addendum) |
| Supabase | Database, and the anonymous star rating of the site | Frankfurt, Germany (EU) |
| Resend | Sending email: deadline alerts, and the suggestions you send us | EU (Amazon SES, eu-west-1) |
| Cloudflare | Turnstile anti-bot check (its script loads with the page) | Global CDN |
| Sign in with Google (only if you use it) | USA / global | |
| OpenStreetMap | City name suggestions while you type (Nominatim), and the map on each school page | UK / EU (OpenStreetMap Foundation) |
Some things your browser fetches directly, as it does on any web page: campus photos come from Wikimedia Commons (Wikimedia Foundation, USA) and, for a few schools, from the university's own website. Like every request on the web, those carry your IP address; we send them nothing about you. Fonts, icons and exchange rates come from our own servers.
There is no advertising or tracking cookie on this site, and no cookie is used to measure traffic: we count visits with Vercel Web Analytics, which is cookieless — it stores nothing on your device and never follows you to another site. That is why you have never seen a cookie banner here.
Two strictly necessary cookies exist and only if you sign in: one holds your session (it is httpOnly, so the page's own JavaScript cannot read it), and one short-lived cookie protects the sign-in redirect against forgery. Both disappear when you sign out. The session cookie expires 60 days after your last visit.
Cloudflare's Turnstile, the check that stops bots from submitting the signup form, may set its own technical cookie. It is there to tell humans from scripts, not to follow you.
The campus photos are served by Wikimedia, which may set its own cookie (WMF-Uniq, kept for up to a year). Wikimedia says it uses it to count visitors to its sites, run A/B tests and fend off DDoS attacks (its cookie statement). We never read it and receive nothing from it. If your browser blocks third-party cookies, the photos still load.
Besides cookies, the page uses your browser's local storage to remember what you asked it to: what you typed in the search, your favourites, your language, whether you have already rated the site, and a daily copy of the exchange rates. It stays on your device; what you choose to save in a profile is described above.
Until you say stop. The unsubscribe link in any email, or “I don't want emails” in your favourites, stops the emails at once. If you are signed in we then keep your address with an empty list and a “no emails” mark — only so that the next school you add to your favourites does not switch them back on without asking you. Deleting your profile, or asking us, removes that too; signing in again later starts a new, empty record. If you asked for alerts with your email alone, unsubscribing deletes the record outright.
Your profile stays until you delete it. Ask us and it goes, in full, including the CV material — there is no archived copy.
Our hosting provider keeps ordinary server logs (IP address, browser, page requested) for a short period for security and debugging. We do not use them to build any picture of you.
The linked calendar lasts until you press “Turn off”: the code is deleted and the old address stops working. Deleting your profile removes it too.
You can ask us to show you, correct, export or erase everything we hold about you, and you can object to it being processed at all. Because we hold so little, this is usually a one-line answer.
Write to info@ateneomatch.com and we will reply within 30 days. If you think we have handled your data badly you can complain to your national data-protection authority — in Italy, the Garante per la protezione dei dati personali.
AteneoMatch is built for people choosing a master's degree and is not directed at children. We do not knowingly store data from anyone under 16.
If we start collecting something new, this page changes first and the date at the top moves. Anything that widens what we do with your email will be asked for again, not assumed.