Security & trust

Nara Abroad ("Nara") helps students, mostly from the Middle East and North Africa, find and apply to universities in the United Kingdom and elsewhere. We are the controller of the personal data described in our privacy policy, under the UK GDPR and the Data Protection Act 2018.

Our ICO registration number will be published on this page as soon as it is issued.

This page is the plain, checkable summary of that policy, written for a student deciding whether to upload a passport and for a university checking the agents it works with. The policy remains the full statement; where the two differ, the policy governs. Questions: privacy@nara-abroad.co.uk.

• Servers, database and the documents you upload: held by our cloud infrastructure provider in one region covered by the UK adequacy regulations, so UK law allows us to store them there without additional transfer safeguards. Encrypted database backups are kept in the same region, and a second encrypted copy is kept in the United Kingdom. Short-lived whole-server snapshots are stored in our cloud provider's European Union multi-region, which is also covered by the UK adequacy regulations.
• This website and the portals' pages: served by our hosting provider. The data they show you is held as above; student accounts and documents are not stored by the hosting provider.
• The AI assistant: the model that writes its replies runs in the European Union. When the assistant searches Nara's help articles, our AI provider turns the text of your question into a numerical representation, and that step can be processed in the United States. The search index behind its answers is held in our own database.
• Providers that process data in the United States: our website and portal hosting provider, our network-security provider, our email mailbox provider, our email-delivery provider, our payment provider, our AI provider for the help-article search step, and — while voice calls are on — our call-audio and speech providers. Our email-delivery provider sends sign-in codes and account emails from Japan, so its processing takes place in the United States and Japan. Our error-monitoring provider stores our error reports in the European Union (Germany). Japan and the European Union are covered by the UK adequacy regulations. For transfers to the United States we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the UK International Data Transfer Addendum.
• Universities outside the UK: when you apply to one, your application goes to it because that is the contract you asked us to perform (Article 49(1)(b) UK GDPR). Its own privacy policy then applies.

These are the controls in place today, in the order a student meets them.

• Transport: every connection to the website, the portals and the API is encrypted, and the API refuses older, weaker encryption versions. Data is encrypted at rest.
• Sign-in: passwordless — a one-time code to your email or, if you choose it, an account you hold with another provider. There is no Nara password to steal. Login cookies cannot be read by scripts on the page and are sent only over encrypted connections, and a session expires 7 days after it was last used.
• Documents: stored in private storage, separately from the database, with public access blocked. A link to a document lasts 15 minutes and is generated only for you, for a partner agent linked to your account, for an administrator handling your application, or for a university user reviewing the documents attached to an application you made to that university. When you replace or delete a document, the earlier version is kept for recovery and deleted automatically within 30 days.
• Database: the database itself, not only application code, limits each account to the rows it is entitled to (your own; for a partner agent or a university user, only the students and applications linked to them).
• Payments: card details go to our payment provider's hosted checkout page and never touch our servers.
• Production access: the servers are reachable only by named administrator accounts over an authenticated, encrypted connection. There is no public remote-login access.
• Abuse controls and records: the API rate-limits requests; sign-ins are recorded (IP address, browser, time); errors go to our error monitoring; actions on applications and document exports are recorded.

No system is perfectly secure. Your email account is your key to Nara — keep it safe, and tell us at privacy@nara-abroad.co.uk if you notice anything wrong.

These kinds of providers run parts of the platform under contracts that limit them to our instructions. Their names are available on request at privacy@nara-abroad.co.uk, and institutions vetting us can have the full register (see "For universities and partners" below). A new category of provider, or a provider in a country not listed on this page, is added to the privacy policy before it is used.

• Cloud infrastructure — servers, database, file storage and backups, in a region covered by the UK adequacy regulations, with a second backup copy in the United Kingdom (short-lived server snapshots: European Union multi-region).
• AI services — the model that writes the assistant's replies (European Union), and the step that turns the text of a question into a numerical representation so the assistant can search Nara's help articles (can be processed in the United States); the search index itself is held in our own database. The provider's terms do not allow our data to be used to train its models.
• Sign-in provider — only if you choose to sign in with an account you hold with it: your account id, name and email. United States.
• Website and portal hosting — this website and the portals' pages, and cookieless page-view counting. United States.
• Network security — domain-name services for our domains; encryption and network protection in front of the API; the check that this website's forms are sent by a person (your IP address and browser details, never what you type). Global network.
• Mailbox hosting — our info@, support@ and privacy@ mailboxes. United States.
• Email delivery — sign-in codes, account emails, contact- and partnership-form messages, and the newsletter list. United States and Japan.
• Payments — card payments for Nara's fees. United States.
• Error monitoring — error reports. European Union (Germany).
• Speech services — speech recognition and the assistant's voice on voice calls. United States. Voice calls are currently switched off.
• Call audio — audio transport for voice calls. United States. Voice calls are currently switched off.
• Website content system — the system behind this website's published text. It holds no student accounts, applications or documents.

Our payment provider and the sign-in provider also act as controllers for their own services — fraud prevention and legal duties for the payment provider, the sign-in service for the sign-in provider — under their own privacy policies.

Recipients that are not processors, because each is its own controller: the universities you apply to, and a partner agent, if one created your account for you. Today we submit applications to universities ourselves. If we ever pass an application to our course-supply partner for submission, we will tell you first, and that partner becomes a controller of it.

The periods below are the ones the privacy policy commits to; each is written into our retention schedule with the store it applies to.

• Account, profile, documents, applications and assistant conversations: while your account is open, and for 12 months after it is closed or after your last sign-in, whichever is later. Then deleted.
• Earlier versions of documents you replace or delete: kept for recovery, then deleted automatically within 30 days.
• Payment records (amount, date, status, payment-provider reference): 6 years after the end of the tax year of the payment, as UK tax law requires. Once your account is gone they carry no name, only an internal reference.
• Sign-in records (IP address, browser, time): each session expires 7 days after it was last used; expired records are purged within 30 days.
• API and web-server logs: up to 30 days. The assistant service's own logs are size-capped and record the length of each turn, not its words. Error reports held by our error-monitoring provider: up to 90 days.
• Database backups: deleted automatically within 30 days, including the second copy in the United Kingdom (whole-server snapshots after 7 days). A deletion reaches the backups when they age out.
• Newsletter: until you unsubscribe — via the link in every newsletter, or by email.
• WhatsApp messages you send us: up to 12 months, then deleted.
• Messages you send us by email or through our forms: up to 12 months after our last reply, then deleted.
• Records of privacy requests: 3 years, as evidence that we handled them.

When a period ends the data is deleted, or anonymised so it can no longer be linked to you.

You can ask for a copy of your data in a machine-readable file, with the names of the organisations that received it — including our service providers. You can also have it corrected, have it deleted, restrict or object to a use, and withdraw any consent you gave.

• How: email privacy@nara-abroad.co.uk from the address on your account. If you write from another address we confirm the request with the account's address first. We never ask for a passport copy to prove who you are.
• When: within one month. If a request is unusually complex we may take up to two further months, and we tell you within the first month if so.
• What deletion means: your account, profile, documents, conversations and any application not yet submitted are deleted. If you have a live application we ask whether you want it withdrawn first. Payment records stay for the period above, without your name. Backups and earlier versions of your documents are deleted within 30 days. We cannot recall data already sent to a university or a partner, so we tell you who received it.
• Complaints: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — helpline 0303 123 1113 — ico.org.uk/make-a-complaint. You can go to the ICO at any time; you do not have to come to us first.

We keep a written breach procedure. In short:

• Contain first, in the first hour — revoke the credential, close the door, stop the leak.
• Assess within 24 hours: what data, whose, how many people, and what could be done with it. Every incident goes into our breach register, whether or not it turns out to be reportable.
• Notify the ICO within 72 hours of becoming aware where the breach is likely to put people at risk. If we do not have every answer by then, we report in phases rather than late.
• Tell the people affected without undue delay, in Arabic and English, where the risk to them is high — passports, credentials usable elsewhere, large numbers.
• Write up the cause and the fix within two weeks and attach it to the register entry.

Our processors are required by contract to tell us without undue delay when a breach happens on their side; our 72 hours start when they do.

• The assistant is an AI system, not a person. Facts about courses, fees and universities come from our catalogue, not from the model's memory. When the assistant searches Nara's help articles, our AI provider turns the text of your question into a numerical representation — a step that can be processed in the United States; the search index itself is held in our own database. When the catalogue does not hold a fact, the assistant is built to say so rather than to invent one. It can still be wrong — check fees, deadlines and entry requirements with the university before relying on them.
• It suggests; it does not decide. Admissions decisions are made by universities. Nothing on your profile or application changes without your confirmation, and the assistant cannot submit an application or take a payment.
• Your messages, with the parts of your profile and applications needed to answer, go to the AI model run by our AI provider in the European Union. The provider's terms do not allow it to use our data to train its models.
• Conversations are stored with your account and follow the same retention rules as the rest of it. The assistant service's own logs record the length of each turn, not its words.
• Voice calls are currently switched off. Every call opens with a notice that you are talking to an AI and that the conversation is transcribed. Audio is never stored; we keep the transcript, in the same way as text conversations.
• A data protection impact assessment of the assistant has been drafted and is awaiting sign-off; once signed off, its summary joins the pack described below.

• Set advertising, analytics or tracking cookies — none, anywhere. Our website (nara-abroad.co.uk) sets no cookies at all. We do count page views with a cookieless measurement service from our hosting provider: it stores nothing on your device and counts visits in aggregate. The portal sets three kinds, all first-party: one cookie that remembers your language, the secure login cookies, and one cookie written only when you collapse or expand the side menu. The sign-in page offers a button to continue with an account you hold with another provider; it is loaded from that provider and shown inside the provider's own frame, and any cookies it uses are the provider's, under its own privacy policy.
• Sell personal data, or share it with advertisers or data brokers.
• Send marketing email without your consent. You can unsubscribe from the newsletter via the link in every issue or by email; account emails (sign-in codes, application updates) are not marketing.
• Buy data about you, or collect it from social media.
• Ask for a passport copy to verify a privacy request.
• Take automated decisions about you with legal or similarly significant effect.

If your institution vets the agents it works with, we can provide, on request: our record of processing activities and processor register (each provider's name, purpose and location), the retention schedule, the breach procedure, a description of the security measures above and — once it is signed off — a summary of the AI-assistant data protection impact assessment. We complete supplier questionnaires.

Write to privacy@nara-abroad.co.uk. Our ICO registration number will be published on this page as soon as it is issued.