Legal

Privacy Policy

Last updated: 21 October 2026

This Privacy Policy explains how Techuni, LLC, a Delaware limited liability company, and its affiliate Techuni CRM Limited (together "TechUni", "we", "us", "our") collect, use, store, and share information when you use our website (techuni.com), our SaaS CRM platform, our mobile applications, and related services (collectively, the "Services").

1. Who we are

TechUni is a multi-tenant SaaS platform designed for international education agencies. Techuni, LLC is a Delaware limited liability company registered in the United States, with its postal address at 447 Sutter Street, San Francisco, CA 94108, United States. Its affiliate Techuni CRM Limited, a company registered in Pakistan at 49, Block-L, Johar Town, Pakistan 54782, operates the TechUni platform and its Meta (Facebook, Instagram and WhatsApp) integration. In this policy, "TechUni" and "we" mean both companies. Each customer ("Tenant" or "agency") operates their own isolated environment on our platform. Agencies may use the Services under their own brand name, logo and web address, so you may know the CRM by your agency's name rather than ours.

2. Information we collect

From you directly: account details (name, email, phone, company), billing information, support communications.

From your use of the Services: usage logs, IP address, device info, browser type, pages viewed, feature interactions.

From your Tenant data: when you act as a counsellor, admin, or end-user inside a Tenant environment, we process data your agency uploads (student records, applications, documents) strictly on their behalf as a data processor.

From connected Meta services: if an agency connects WhatsApp, Facebook or Instagram, we receive the data described in section 3.

From cookies and similar tech: for authentication, preferences, and analytics. See our Cookie section below.

3. WhatsApp, Facebook and Instagram (Meta) data

Agencies can choose to connect their own WhatsApp Business account, Facebook Pages and Instagram business accounts to the Services. This section explains what we receive when they do. If your agency doesn't connect these services, we receive none of this data.

3.1 What we receive

Through the WhatsApp Business Platform:

• The agency's WhatsApp Business Account (WABA) ID, business portfolio ID, phone number IDs, display phone numbers and verified business name.
• Message templates the agency creates, and their approval status.
• Messages sent and received through the agency's connected numbers: text, and media such as images, documents, audio and video.
• Contact details of the people the agency messages: WhatsApp name (profile name), phone number and WhatsApp user ID.
• Message delivery and read statuses, and error codes.
• Where a contact reaches the agency from an ad, the ad referral details Meta provides.

Through Facebook and Instagram login (used when an agency admin connects its Meta accounts):

• Basic profile details of the agency staff member who connects the account (name and user ID, and email if they allow it).
• An access token that lets the Services act only on the permissions the agency granted.
• The business portfolio, and any Facebook Pages or Instagram business accounts, that the agency chose to connect (IDs and names).
• Page and Instagram profile information, such as name, username, profile picture and category.
• Messages (including Instagram direct messages) sent to those Pages and accounts, and comments on their posts, with the sender's name and ID.
• Lead-form submissions from the agency's Facebook and Instagram lead ads (the fields the agency's form asks for, such as name, email and phone).
• Posts the agency publishes or schedules through the CRM, and basic insights about them, such as reach and engagement.

We only access assets the agency has granted us through Meta's own consent screens, and only with the permissions shown there.

3.2 Why we use it

We use Meta data only to provide the features the agency turned on:

• to send and receive WhatsApp, Facebook and Instagram messages from the CRM, including automated messages the agency sets up;
• to show conversations in the agency's inbox and on the matching lead or student record;
• to reply to Facebook and Instagram messages and comments from the agency's Social Inbox;
• to create or match leads from incoming messages;
• to create leads from lead-ad form submissions;
• to publish and schedule posts to the agency's Pages and Instagram accounts;
• to show the agency how its posts are performing;
• to manage the agency's message templates and connected numbers;
• to keep connections working and troubleshoot problems.

We do not sell Meta data, use it for advertising, or use it to build profiles for anyone other than the agency it belongs to. We do not combine one agency's Meta data with another agency's data.

3.3 Who controls the data

The agency is the controller of its contacts' data, including WhatsApp conversations with its students and leads. We process it on the agency's behalf, as a processor, following the agency's instructions. If you are a student or contact of an agency, the agency is your main point of contact for questions about your data. Meta also processes messages as part of providing WhatsApp, Facebook and Instagram, under Meta's own terms and privacy policy (https://www.facebook.com/privacy/policy and https://www.whatsapp.com/legal/business-policy).

3.4 Where it's stored

All data, including Meta data, is stored with Amazon Web Services in the EU, in the Stockholm region (eu-north-1) only. This covers the database, its backups, and all files and media. We make no copies in other regions. To load quickly, content is delivered to you through a global content delivery network (Amazon CloudFront). Each agency's data is kept separate from every other agency's.

3.5 How long we keep it

• Messages, media, other files and contact details: until the agency deletes them or the agency's account is deleted. When an agency's account closes, its data is deleted within 30 days, and copies in backups roll off within a further 7 days.
• Raw WhatsApp webhook payloads from Meta (used for troubleshooting): deleted after 30 days.
• Database backups: kept for 7 days, then overwritten.
• Access tokens: until the agency disconnects the account, the token expires, or the agency's account closes.
• Disconnecting WhatsApp, Facebook or Instagram stops syncing, but does not delete messages or conversations already stored. Stored data is deleted on request to privacy@techuni.com, within 30 days (see https://techuni.com/data-deletion).

3.6 Sharing

We share Meta data only with:

• Meta, to send messages and operate the connection;
• the agency that connected the account, and the staff it gives access to;
• service providers who help us run the platform, under confidentiality obligations: Amazon Web Services (hosting and storage) and Expo (mobile push notifications, which may show message previews);
• authorities, only where the law requires it.

3.7 Security

All data is encrypted at rest (database storage encryption), and WhatsApp account access tokens get an additional layer of application-level encryption. Data is encrypted in transit, and access inside each agency is controlled by roles.

3.8 Access and deletion

Agencies can view and delete their Meta data in the CRM, disconnect WhatsApp, Facebook or Instagram at any time in Settings > Platform Connections, and remove the TechUni app in their Facebook settings. Leads and conversations in the CRM belong to the agency, which is the controller of that data, so students and other contacts should contact the agency they deal with. We help agencies with these requests at privacy@techuni.com, and we delete our own Meta connection data and access tokens on request. Full steps and timelines are on our Data Deletion page: https://techuni.com/data-deletion.

4. How we use information

• To provide, operate, and improve the Services
• To authenticate users and prevent abuse
• To send service-related communications and security alerts
• To deliver customer support
• To comply with legal obligations and enforce our terms
• To analyse aggregate usage patterns to improve our product

5. Legal bases (GDPR)

For visitors located in the European Economic Area or the United Kingdom, we process personal data under one or more of the following legal bases: (a) performance of a contract, (b) legitimate interest, (c) consent, (d) compliance with legal obligations.

6. Sharing your information

We do not sell personal information. We share data only with: (a) service providers who help us operate the platform, bound by confidentiality: Amazon Web Services (hosting), Twilio SendGrid (email), Stripe (payments), Meta Platforms (WhatsApp, Facebook, Instagram), TikTok (if the agency connects it), Intercom (support chat), Google (if the agency connects Google services) and Expo (mobile push notifications), (b) Meta, for agencies that connect WhatsApp, Facebook or Instagram (see section 3), (c) when required by law or to protect rights, (d) in connection with a business transfer (merger, acquisition).

7. Data retention

We retain personal data for as long as your account is active, and as long as needed to fulfil the purposes outlined in this policy. Tenant data is retained per your agency's instructions and our standard data processing agreement. Meta data retention is described in section 3.5.

8. Your rights

Depending on your jurisdiction, you may have rights to: access your data, correct inaccuracies, request deletion, restrict processing, data portability, and to withdraw consent. To exercise these rights, contact us at privacy@techuni.com. For Meta-sourced data, see https://techuni.com/data-deletion.

9. Cookies

We use essential cookies for authentication and session management, plus analytics cookies (only with your consent) to understand site usage. You can manage cookie preferences via your browser settings or our cookie banner.

10. International transfers

Our infrastructure is hosted in the EU, in the AWS Stockholm region (eu-north-1). Content is delivered through a global content delivery network (Amazon CloudFront). Where a subprocessor outside the EU processes personal data, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

11. Security

We implement industry-standard technical and organisational measures including encryption in transit (TLS 1.2+), encryption at rest (with additional application-level encryption for WhatsApp account tokens), role-based access controls, audit logging, and regular security reviews.

12. Children's privacy

The Services are not directed to individuals under 16. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notice 30 days before they take effect.

14. Contact

Questions or concerns? Email privacy@techuni.com. Postal addresses: Techuni, LLC, 447 Sutter Street, San Francisco, CA 94108, United States; Techuni CRM Limited, 49, Block-L, Johar Town, Pakistan 54782.

This Privacy Policy is provided for general information and does not constitute legal advice. TechUni recommends customers consult independent counsel for their specific compliance obligations.