Uni Link Privacy Policy

1. Information We Collect

2. How We Store and Process Authentication Data

When authenticating via Google:

1. Your browser communicates directly with Google's authentication servers to verify your identity.
2. Google returns an ID token (JWT) to your browser, which is transmitted securely over HTTPS to the Uni Link backend.
3. Our backend server cryptographically verifies the token using Google's published public keys (JWKS) at https://www.googleapis.com/oauth2/v3/certs, checking the signature, issuer, and client ID audience.
4. Once verified, Uni Link establishes your session by issuing our own short-lived JWT access token and refresh token. Google access tokens are not stored in our databases.

3. How Application Data Is Used

We use the collected information solely for genuine operational purposes:

• To create, authenticate, and manage your student/staff user account.
• To present live menus, meal times, and kitchens relevant to your selected campus.
• To facilitate order fulfillment by sending the kitchen your name, contact phone number, order items, and campus delivery drop-off point.
• To compute commission statements and kitchen disbursement records.
• To deliver critical transactional communications, such as order status updates and security alerts.
• To enforce security boundaries, prevent fraudulent activities, and maintain rate limits.

Uni Link does not sell, rent, or trade your personal data, and we do not use your information for third-party commercial advertising.

4. Google API Services User Data Policy Compliance

Uni Link's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• Limited Use: Google user data is accessed solely to provide user-facing authentication and account features.
• No Advertising Transfer: We do not transfer or disclose Google user data to third parties for targeted advertising or marketing.
• No Human Access: No humans read your Google user data unless you have given explicit consent, it is strictly necessary for security investigations, or it is required to comply with applicable law.

5. Data Sharing with Third Parties

We share personal data strictly on a need-to-know basis:

• Campus Food Providers: The specific canteen or home kitchen preparing your food receives your full name, phone number, campus drop-off location, and order items solely to fulfill and deliver your meal.
• Infrastructure Providers: Trusted technical service providers that host our cloud servers, PostgreSQL databases, image storage (Cloudflare R2), and transactional email/SMS services. These vendors process data strictly under confidentiality agreements.
• Legal Requirements: Where required by Sri Lankan law, court order, or regulatory authority to protect the safety and rights of users or the public.

6. Payments and Financial Invariants

Uni Link orders in Phase 1 are settled via cash on delivery (COD). No customer credit or debit card numbers are handled, stored, or processed on our servers.

7. Data Retention

We retain personal information for the period necessary to deliver the Service and fulfill legitimate operational needs:

• Account Data: Retained while your account remains active. If you request account closure, personal data is purged or anonymized.
• Order & Financial History: Order snapshots and financial ledger entries are retained in an immutable, snapshotted format for accounting, audit, and tax compliance as mandated by law.
• Authentication Codes: One-time password (OTP) codes and verification tokens automatically expire within minutes and are discarded.

8. Security Safeguards

Uni Link implements robust industry-standard technical and organizational security controls:

• End-to-end HTTPS / TLS 1.3 cryptographic encryption for all data in transit.
• Queryset-level database tenant isolation ensuring data from one university campus cannot be accessed by another campus.
• Role-based access control (RBAC) ensuring staff and administrators have strictly minimized access permissions.
• Automated rate-limiting on all authentication, OTP, and sensitive API endpoints to protect against brute-force attacks.

9. User Rights and Account Deletion Procedures

In accordance with applicable privacy standards and Sri Lanka's Personal Data Protection Act No. 9 of 2022:

• Right to Access & Rectify: You can view and update your account details directly within your user settings.
• Revoking Google Access: You can disconnect Uni Link's access to your Google account at any time through your Google Security settings at myaccount.google.com/permissions. Revoking access prevents subsequent automatic sign-in.
• Requesting Account & Data Deletion: You may request permanent deletion of your Uni Link account and associated personal data at any time by sending an email from your registered address to [email protected] with the subject line "Account Deletion Request". We will process and confirm deletion within 30 days, subject to legally mandated transaction retention.

10. Children's Privacy

Uni Link is directed towards university students, faculty, and business partners. We do not knowingly solicit or collect personal information from individuals under the age of 18 without parental or guardian consent.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our operational practices, features, or legal obligations. When updates occur, the effective date at the top of this policy will be revised. We encourage you to review this page periodically.

12. Contact & Support Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our Google OAuth data practices, please contact our team: