Privacy Policy

Built for Students, by Students

Follow Our Socials for More Updates!

Last updated: 11 October 2025

Entity: Campus Culture Limited (“Campus Culture,” “we,” “us,” “our”)

Contact (privacy): support@campusculture.co.nz (preferred) or info@campusculture.co.nz

Registered location: Auckland, New Zealand

​

This Privacy Policy explains how we collect, use, disclose, and protect information in connection with our website, waitlist, pre-release programs, and any future Campus Culture apps and services (the “Services”). By using the Services, you agree to this Policy and our Terms of Service.

​

1) Who we are & scope

Campus Culture is a student-focused platform. This Policy applies to all visitors, waitlist participants, beta users, and (upon launch) registered users of our Services worldwide. If any local law grants you additional rights, we honor those rights as described in Section 14.

​

2) The data we collect

​

2.1 Information you provide

• Waitlist & account details: name, email (often university email), university/tertiary institution, country, year/area of study, preferences, survey responses.

• Profile & content (app): bio, interests/tags, posts, messages, comments, groups joined, events created/RSVPs, study materials you upload.

• Support & safety: messages to support, abuse reports, safety/incident reports (including time, description, and any media you submit).

• Optional features: if you use invitations or friend-finder by contacts, we’ll only process contact details you choose to share (see 2.4).

​

2.2 Information collected automatically

• Usage & device data: IP address, device IDs, app version, browser type, operating system, language, time zone, referring pages, feature usage, crash logs.

• Cookies & similar tech: cookies, local storage, pixels, SDKs for analytics, security, performance, and (if introduced later) ads (see Section 10).

​

2.3 Location data (optional)

• If you enable location features (e.g., Nearby events or safety alerts), we may collect approximate or precise location data. You can disable location at any time via device settings; some features may then be limited.

​

2.4 Contacts (optional)

• If you choose to discover friends via your contacts, we will process the specific contacts you select (phone/email) to find matches and/or send invitations. We do not upload or retain your full address book without your explicit action. Contact data used for invitations may be stored temporarily to deliver messages and prevent spam.

​

2.5 Special categories / sensitive data

• We do not require sensitive data (e.g., health data). Avoid sharing sensitive information in posts or chats. Safety or misconduct reports may incidentally include sensitive details that you choose to provide.

​

2.6 Children

• Our Services are for users 16+ (or the age of digital consent in your country, whichever is higher). We do not knowingly collect personal data from children below that age.

​

3) How we use your data (purposes) & legal bases

We process data to:

• Provide the Services (operate waitlist, accounts, chats, groups, events, study resources, AI tutor, safety tools). (Legal bases: contract, legitimate interests, consent where required).

• Verify eligibility (university enrollment, anti-spam, abuse prevention). (Contract, legitimate interests).

• Secure the platform (fraud detection, incident response, content moderation). (Legitimate interests, legal obligation, vital interests for safety).

• Improve and develop features (analytics, product research, troubleshooting, testing). (Legitimate interests, consent where required for cookies/SDKs).

• Communicate with you (transactional emails, product updates, waitlist notifications, marketing if you opt in; you can opt out). (Legitimate interests, consent where required).

• Comply with law (recordkeeping, responding to lawful requests). (Legal obligation).

• Promote the Services using aggregated or de-identified information. (Legitimate interests).

​

AI Tutor & models. We may use anonymized/de-identified and aggregated interaction data to improve our AI features and safety systems. We do not use your private messages to train third-party foundation models without a separate, clear consent flow.

​

4) When we share information

We do not sell your personal information. We share data only as described:

• Service providers / processors: hosting, storage, analytics, email delivery, customer support, security, fraud prevention, content moderation, A/B testing. Bound by confidentiality and data processing terms.

• University / institutional programs (optional): If we run official collaborations, we will only share your information with your explicit consent or at your request (e.g., to verify enrollment).

• Legal & safety: to comply with law, enforce our Terms, protect rights, property, or safety of users or the public, and to respond to lawful requests by authorities.

• Corporate events: if we undergo a merger, acquisition, financing, or sale, your data may be transferred under continued protections consistent with this Policy.

• Aggregated/de-identified data: for research and insights that do not identify you.

​

5) Your choices

• Email preferences: unsubscribe links in marketing emails; transactional/service emails may still be sent.

• Cookies/SDKs: manage in your browser/device and via our cookie banner (where applicable).

• Location & permissions: disable via device settings; some features may be limited.

• Profile visibility & content: controls will be provided in-app upon launch (e.g., profile fields, groups, or posts you choose to share).

​

6) Retention

We keep personal data only as long as necessary for the purposes above, and to comply with legal, accounting, or reporting obligations. Factors include: account status, legal requirements, dispute resolution, and operational needs. Where feasible, we de-identify or aggregate data instead of retaining it in identifiable form.

​

7) Security

We use administrative, technical, and physical safeguards appropriate to the nature of the data (e.g., encryption in transit, access controls, logging). No system is 100% secure; you are responsible for maintaining the confidentiality of credentials and promptly notifying us of any suspected compromise.

​

8) International transfers

We are based in New Zealand and may process data in other countries. Where required (e.g., EEA/UK), we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs), and implement supplementary measures where needed. By using the Services, you understand your data may be transferred internationally.

​

9) User content, community safety & events

• User content you post may be visible to others per your settings. Think before you share.

• Safety features (e.g., alerts) are informational only and not emergency services. We cannot guarantee delivery or response.

• Events/meetups are user-generated unless stated otherwise; exercise judgment in your interactions.

​

10) Cookies & similar technologies

We use cookies, local storage, pixels, and SDKs to:

• remember settings and keep you signed in;

• analyze usage and performance;

• protect the Services;

• (if later introduced) measure ads or sponsored placements.

​

Where required, we obtain consent via a cookie banner and provide a Preferences link. You can also block cookies in your browser; some features may not work.

​

Do Not Track (DNT). We don’t respond to DNT signals at this time, but you can control cookies and certain SDKs as above.

​

11) Automated decision-making & profiling

We may use limited profiling to personalize features (e.g., friend discovery, event recommendations, study resources) and to protect the platform (e.g., risk scores for spam/abuse).

• You can opt out of certain recommendation personalizations inside the app (when launched).

• For regions with additional rights (e.g., EEA/UK), see Section 14 for information and appeal rights related to significant automated decisions.

​

12) Third-party links & services

Our Services may link to third-party sites or use third-party SDKs. Their practices are governed by their own policies; we do not control them. Review their privacy terms before using those services.

​

13) Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you (e.g., by email, in-product notice, or prominent site banner). Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

​

14) Your rights (by region)

​

New Zealand (Privacy Act 2020)

You have rights to access and request correction of your personal information. Contact support@campusculture.co.nz.

​

European Economic Area & UK (GDPR/UK GDPR)

Where GDPR/UK GDPR applies, our legal bases include contract, legitimate interests, consent, legal obligation, and vital interests (safety). You may have rights to access, rectify, erase, restrict, object, data portability, and to withdraw consent at any time (without affecting prior processing). You may also have rights related to automated decision-making.

• Contact for requests: support@campusculture.co.nz

• EU/UK complaints: You may lodge a complaint with your local supervisory authority.

​

California (CCPA/CPRA)

We do not sell or share your personal information as defined by the CPRA. If this changes, we will provide required notice and an opt-out. California residents may request:

• Access (categories and specific pieces of PI),

• Deletion,

• Correction, and

• Limits on use/disclosure of sensitive PI (if we ever collect it).
  Submit requests to support@campusculture.co.nz. We won’t discriminate for exercising your rights.

​

Australia (Privacy Act & APPs)

You may request access and correction of your personal information. For complaints, contact us first; you may also contact the OAIC if unresolved.

We will authenticate requests and respond within applicable legal timeframes. For security, we may ask for additional information to verify your identity.

​

15) How to exercise your rights

Email support@campusculture.co.nz with the subject line “Privacy Request” and specify your region and request type (e.g., Access/Deletion/Correction/Objection). We will respond as required by law. If we cannot comply (e.g., legal obligations, security, rights of others), we will explain why.

​

16) Data for legal compliance, disputes & enforcement

We may retain and process certain information where necessary to:

• comply with applicable laws;

• respond to lawful requests;

• establish, exercise, or defend legal claims;

• protect users, the public, and our Services.

​

17) Financial information (future premium features)

If paid features are introduced, we will collect limited billing data and use PCI-compliant payment processors. We do not store full payment card numbers on our servers. Additional terms will be provided at the point of purchase.

​

18) Global contact & complaints

Primary contact:
Campus Culture Limited
Auckland, New Zealand
support@campusculture.co.nz

New Zealand Privacy Commissioner:
Office of the Privacy Commissioner, NZ — privacy.org.nz

EEA/UK: Contact your local supervisory authority (details available from the EDPB/ICO websites).
Australia: Office of the Australian Information Commissioner (OAIC).
California: California Privacy Protection Agency (CPPA) / California Attorney General.

​

19) Key definitions (plain English)

• Personal information / personal data: Information that identifies or can reasonably be linked to an individual.

• Processing: Any operation performed on personal data (collecting, storing, using, sharing, etc.).

• Controller / business: Entity deciding why/how data is processed (Campus Culture).

• Processor / service provider: Third parties processing data on our behalf under contract.

• De-identified / aggregated data: Data that cannot reasonably identify you.

​

20) Categories of Information We May Collect

We may collect the following types of personal information:

• Identifiers: such as your name, university email address, device ID, and IP address — used for account creation, waitlist management, security, and communications.

• Student Information: including your university, program, and year of study — used to verify eligibility, suggest relevant groups, and personalise recommendations.

• Usage Data: details about how you interact with the app or website, feature usage, and technical logs — used to operate, improve, and debug the Services.

• Location Data (optional): approximate or precise location — used for nearby events, campus-related features, and safety tools when enabled.

• Content: posts, messages, uploads, or study materials you share — used to provide the core social and study functions of the platform.

• Contacts (optional): selected email addresses or phone numbers you choose to share — used for friend discovery or invitations only.

• Support & Safety Data: reports, tickets, and related metadata — used for trust, safety, and enforcement purposes.

• Cookies and SDKs: session cookies, analytics data, and similar technologies — used for site performance, security, and (in the future) measuring advertising or sponsored placements.