Privacy Policy

Crosena (“Crosena”, “we”, “us”) provides a platform that helps students and professionals find and apply for opportunities to study or work abroad. This policy explains what personal information we collect when you use Crosena, why we collect it, who we share it with, and what you can ask us to do with it.

It applies to our website and to the Crosena application. It does not apply to the universities, employers, licensing bodies or payment providers you deal with through Crosena — they have their own policies.

1. What we collect

Information you give us

Account details — your name, email address and password (stored only as a hash, never in readable form). If you sign in with Google, we receive your name, email address and profile picture from Google instead.
Your profile — the information you enter during onboarding and afterwards: education history, qualifications, test scores, work experience, profession, target countries, budget and preferences. This is what matching runs on.
Documents you upload — transcripts, CVs, statements, certificates, passports and similar files you place in your document vault.
Messages you write — outreach emails you draft or send through Crosena, support tickets, and anything you send us through the contact form on this site.
Payment details — handled entirely by our payment provider. We receive confirmation that a payment succeeded and which pass it was for. We never see or store your card number.

Information we collect automatically

Session data — a secure cookie that keeps you signed in.
Technical data — your IP address, browser type and the pages you request, recorded in server logs for security, debugging and abuse prevention.
Usage data — which features you use, so we can see what is working.

Information from others

Google, if you choose to sign in with it.
Your email provider, if you connect a mailbox so Crosena can send outreach and sync replies. We access only what is needed to send your messages and match replies to your conversations.
Our payment provider, which tells us the outcome of a payment.

2. How we use it

To create and run your account, and to keep you signed in.
To match your profile to programs, funded professors, scholarships, employers and licensing pathways.
To draft outreach emails in your voice, and to review documents you ask us to review.
To track your applications, deadlines, documents and visa steps.
To take payment for an access pass and give you what you bought.
To answer your support requests and messages.
To send you service emails — password resets, receipts, deadline reminders and important account notices.
To keep the platform secure, detect abuse and meet our legal obligations.

We do not sell your personal information, and we do not pass your details to universities, agents, recruiters or advertisers as sales leads. Opportunities shown to you are ranked by how well they fit your profile. Nobody pays for placement in your results.

3. Legal bases

Where the UK GDPR, EU GDPR or a similar law applies to you, we rely on the following bases:

Performance of a contract — to give you the service you signed up for and the pass you bought.
Legitimate interests — to keep the platform secure, prevent abuse, and improve how it works.
Consent — for optional things such as connecting your mailbox, or any marketing email you opt into. You can withdraw consent at any time.
Legal obligation — where we must keep records, for example for tax.

Some of what you give us — for example details in a document that reveal health or immigration status — may be treated as special category data. We process it only because you have chosen to give it to us for the purpose of your application, and we do not use it for anything else.

4. Signing in with Google, and connecting Gmail

Crosena uses Google in two separate places. They request different things, and one of them is entirely optional.

Signing in with Google

If you choose “Continue with Google”, we request the openid, email and profile scopes. Google returns your name, your email address, your profile picture and a stable account identifier. We use them for one purpose: to create your Crosena account and sign you in. The email address becomes the address on your account; the name and picture pre-fill your profile so you do not type them again. We do not receive, and cannot see, your Google password.

Connecting Gmail for outreach (optional)

Crosena can send your outreach emails from your own mailbox and show you the replies. This is off unless you turn it on, and nothing else in the product depends on it. If you connect Gmail, we request:

gmail.send — to send the emails you have written and approved, from your address. It grants no ability to read anything.
gmail.readonly — to read the specific email threads Crosena started, so a reply from a professor or an admissions office appears against the right conversation in your CRM. We fetch a thread by the identifier of a message you sent through Crosena. We do not scan, index or download your mailbox, and we do not read messages in threads Crosena did not send.

How it is stored. Your Google access and refresh tokens are stored on our servers so we can keep sending on your behalf without asking you to sign in each time. The content we keep from a thread is the message body and headers of the outreach conversation itself, shown to you in your own CRM.

How it is shared.It is not. Data obtained through Google APIs is not sold, not used for advertising, not used to build profiles for advertising, not passed to data brokers, and not used to train any AI or machine-learning model — ours or anyone else’s. A reply we fetch from your mailbox is stored against that conversation and shown to you; it is not sent to our AI provider. When the assistant drafts a follow-up for you, what it is given is the email you previously sent, not the reply you received. No human at Crosena reads it, except where you have explicitly asked us to (for example in a support ticket you open about a specific message), where it is necessary for security or to comply with the law, or where the data has been aggregated and anonymised.

How to disconnect. You can remove the connection at any time from your Crosena settings, or from your Google account permissions page. When you do, we delete the stored tokens. Deleting your Crosena account deletes them too.

Crosena’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How AI is used

Crosena uses AI models to do three things: turn your profile into a searchable representation so it can be matched against opportunities, draft outreach emails and application text for you, and answer your questions in the assistant.

To do this we send the relevant parts of your profile, documents or message to our AI provider for processing. That provider acts on our instructions and does not use your content to train its models. We do not send your password, your payment details, or documents you have not asked us to work with.

AI output is a suggestion, not a decision. No decision with a legal or similarly significant effect on you is made by automated means: admissions, funding, licensing and visa decisions are made by the institutions and authorities you apply to, never by Crosena.

We share personal information only with:

Our payment provider (Stripe), to take payment and confirm it.
Our AI provider, as described above.
Our email provider, to deliver service emails and to send outreach you have asked us to send.
Our hosting and storage providers, which run the servers and store your files.
The recipients you choose — when you send an outreach email through Crosena, its contents go to the person you addressed it to.
Authorities or advisers, where we are legally required to disclose something, or need to establish or defend a legal claim.

Each provider is bound by a contract to process your data only on our instructions. If Crosena is ever sold or merged, your information may transfer to the buyer, who would remain bound by this policy until they tell you otherwise.

7. Cookies

We use a small number of strictly necessary cookies. The main one is your session cookie, which keeps you signed in; it is HTTP-only, so scripts on the page cannot read it. We also set a short-lived cookie during sign-in with Google to protect that flow from tampering.

We do not use advertising cookies and we do not allow third parties to track you across other websites from Crosena. Your theme choice is stored in your browser’s local storage, not sent to us.

8. How long we keep it

We keep your account, profile and documents for as long as your account is open. If you delete your account, we delete or anonymise your personal information within a reasonable period, except where we must keep something longer — for example payment records we are required to retain for tax, or logs kept briefly for security. PLACEHOLDER: confirm concrete retention periods before publishing.

You can delete individual documents from your vault at any time.

9. International transfers

Crosena serves people applying from and to many countries, so your information may be processed outside the country you live in, including in the United States and the European Union. Where we transfer personal data out of the UK or EEA, we do so under appropriate safeguards, such as the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses.

10. Your rights

Depending on where you live, you may have the right to:

ask for a copy of the personal information we hold about you;
have inaccurate information corrected;
have your information deleted;
object to, or ask us to restrict, certain processing;
receive your information in a portable format;
withdraw consent where we relied on it; and
complain to your data protection authority — in the UK, the Information Commissioner’s Office.

You can do much of this yourself from your account settings. For anything else, email us at the address below. We will respond within one month, and we will not charge you or treat you differently for asking.

11. Security

Passwords are stored only as hashes. Traffic is encrypted in transit. Session cookies are HTTP-only and scoped to our own site. Access to production data is limited to the people who need it, and admin actions are recorded in an audit log.

No system is perfectly secure. If a breach ever affects your personal information and is likely to put you at risk, we will tell you and the relevant regulator as the law requires.

12. Children

Crosena is not intended for anyone under 16, and we do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes

We may update this policy as the product changes. The “last updated” date at the top always reflects the current version, and we will tell you by email or in the app before any change that materially affects your rights takes effect.

14. Contact us

Questions, requests or complaints about privacy: privacy@crosena.com. PLACEHOLDER: add the legal entity name and registered address of the data controller before publishing.