Privacy policy
What personal data we collect, why, who receives it, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR) and Portuguese law.
Last updated 1 November 2026
In short
Browse without an account
Saved schools and comparisons stay in your own browser. We never see them.
Enquiries go only where you choose
Your message is shared only with the schools you tick, named before you send.
No selling of data
We don't sell personal data or use it for profiling or automated decisions.
You stay in control
Access, correct, delete or export your data, and withdraw consent at any time.
Who is responsible
The controller of your personal data is [operator legal name], [registered address], tax number [NIF/NIPC] (“School Metar”, “we”).
For anything about your data, write to [privacy email] or use our contact form. We are not required to appoint a Data Protection Officer; privacy requests are handled directly by the operator.
What we collect and why
| When | Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| You send an enquiry | Name, email, country of residence, programme, preferred start, budget range, message, the page you sent it from, browser type | Passing your enquiry to the schools you selected; keeping a record of what was shared | Your consent (1)(a), given by ticking the box naming each school |
| You join the newsletter | Email address | Sending news about new schools and price changes | Consent (1)(a) |
| You contact us or request a correction | Name, email, your message | Answering you and correcting school profiles | Steps at your request (1)(b) and our legitimate interest in accurate data (1)(f) |
| A school claims its profile | Name, role, work email, phone, evidence of authority | Verifying that the person represents the school; managing the school relationship | Pre-contractual steps (1)(b) and legitimate interest in preventing false claims (1)(f) |
| You create an account or write a review | Email, review text and ratings, evidence of training you choose to send | Running your account; publishing and verifying reviews | Contract (1)(b); legitimate interest in genuine reviews (1)(f) |
| You use the AI assistant | The questions you type, the assistant's replies, and the page you're on | Generating answers from School Metar's data. We don't store conversations | Providing the service you asked for (1)(b) |
| Anyone visits | IP address and technical request data, held briefly by our hosting provider; IP used in memory to limit form abuse | Delivering the site securely; preventing spam and attacks | Legitimate interest (1)(f) |
| Only if you accept analytics | Pseudonymous usage data (pages viewed, device type, approximate region) | Understanding which pages help students | Consent (1)(a); see the cookie policy |
Stored only on your device: saved schools, comparisons, recently viewed schools, saved searches, checklist ticks and your cookie choice are kept in your browser's local storage. They are not sent to us, and you can delete them by clearing your browser data.
People named in school profiles
School profiles may name people in their professional role, such as a school's chief executive, when that information is published by the school, an authority or the press. We process it on the basis of our legitimate interest in giving students accurate information about who runs a school (Art. 6(1)(f)), and we always cite the public source.
If you are named and want the information corrected or removed, or object to it being shown, contact us and we will review it promptly.
Who receives your data
Schools you select
Your enquiry is shared only with the schools you tick, which are shown by name before you send. Each school then handles your data as an independent controller under its own privacy policy. We do not share enquiries with any other school.
Service providers (processors)
- Vercel Inc. hosts the website.
- Supabase Inc. provides our database and sign-in.
- Resend delivers our emails.
- Google LLC provides analytics, only if you accept analytics.
- Anthropic PBC generates the AI assistant's replies. It processes your messages only to answer them and doesn't use them to train its models.
Each acts only on our instructions under a data processing agreement. When the interactive map loads, map tiles are requested from OpenFreeMap, which receives your IP address as part of that request; it sets no cookies.
Transfers outside the EEA
Some providers are based in the United States. Where data is transferred outside the European Economic Area, we rely on the EU–US Data Privacy Framework for certified providers or on the European Commission's standard contractual clauses (GDPR Art. 45–46).
Authorities
We disclose data to public authorities only when the law requires it.
We never sell personal data, and we don't use it for profiling or decisions made solely by automated means.
How long we keep it
- Enquiries: 24 months after sending, then deleted.
- Newsletter: until you unsubscribe; every email has an unsubscribe link.
- Messages and corrections: 24 months after the matter is closed.
- School claims and business contacts: for as long as the school relationship lasts, plus the periods required by tax and accounting law.
- Accounts and reviews: until you delete your account. Evidence of training is deleted once a review is verified or rejected.
- AI assistant conversations: not stored by School Metar. They disappear when you close or reload the page.
- Security logs: kept briefly by our hosting provider, then deleted automatically.
Your rights
Under the GDPR (Articles 15–22) you have the right to:
- access the data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use it;
- receive it in a portable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting what was done before.
Write to [privacy email] or use the contact form. We reply within one month, and may ask you to confirm your identity first. Exercising your rights is free.
You can also complain to a data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD); you may instead contact the authority in the EU country where you live or work.
Young people
Many future pilots start researching schools as teenagers. In Portugal, people aged 13 or over can consent to online services themselves (Law 58/2019, Art. 16). If you are under 13, please ask a parent or guardian to send any enquiry for you. We do not knowingly collect data from children under 13.
Security
Data is encrypted in transit (HTTPS) and access to our database is restricted to the people who need it. Forms are protected against automated abuse. No system is completely secure; if a breach affects your rights, we will notify you and the authorities as the GDPR requires.
Changes to this policy
We will update this page when our processing changes and show the date at the top. Significant changes will be highlighted on the site, and by email where we have your address.
This document is provided in English. If you need it in Portuguese, ask us.