Privacy policy

Who we are

Vima, at vimaplan.com, is a free degree planner for Rice University students. It is run by Antreas Leonidou, an individual based in Cyprus, in the European Union. He decides what Vima keeps about you and why, which makes him the controller of your personal data under the GDPR and the person accountable for it under Canadian law. “We” and “us” in this policy mean him.

Vima is independent and is not affiliated with or endorsed by Rice University. It does not connect to Rice’s systems and sends nothing to Rice. It knows only what Google sends when you sign in and what you put into the planner.

You can reach us at support@vimaplan.com.

What we keep

• Your account. Sign-in is through Google only. Google sends us your Google account id, email address, name and profile picture, and we keep them with the date you joined and the last time you opened the planner. We never see your Google password, and we cannot reach your email, contacts, files or anything else in your Google account.
• Your plan. What you enter in the planner: your degree and specialization, start year, catalog year, current semester and how long your degree takes; the courses in each semester, including AP and transfer credit and courses you mark as dropped or failed; your wish list; and the notes you write on courses. We keep it with the dates it was created and last saved.
• Usage events. A short record each time you open the planner, sign in, save, use auto-fill, export or print, with the time and a few details: the degree and catalog year, how many courses the plan has or auto-fill added, and the sign-in provider. They never include your notes.
• Technical data. Like every website, Vima receives your IP address and basic browser details with each request. Cloudflare and Supabase use them to deliver pages and to protect the service, and Supabase’s sign-in service records the IP address and browser of each sign-in session to keep your account secure.
• Messages you send us. Emails to the support address, and answers to the feedback form linked from the home page.

We do not ask for your student ID, grades, password, payment details or location, and we do not use advertising identifiers. Please keep sensitive information, such as health details, out of your notes.

Cookies and your browser

The only cookies Vima sets are the sign-in session cookies that keep you signed in. They are strictly necessary for the service you ask for, so they need no consent and Vima shows no cookie banner. Signing out removes them; otherwise they expire 400 days after your last visit. Cloudflare, which delivers the site, may add a security cookie of its own when it needs to check that traffic comes from a person rather than a bot; that cookie is strictly necessary too.

Cloudflare’s traffic statistics use no cookies and do not follow you across sites. They show us totals, such as page views and the countries and browsers visits come from, not individual people.

A few things are kept in your browser’s local storage, on your device, and are not used to track you:

• your light or dark theme, the width of the side panel and the notes you keep open
• whether you have finished the first-run setup and seen the tutorial
• a copy of your plan, so the planner keeps working when the connection drops

They stay until you clear this site’s data in your browser. Signing out does not remove them, so on a shared computer, clear the site data when you finish.

Why we use it, and on what basis

We use your data only to run Vima, never for advertising. Under the GDPR and the UK GDPR each use needs a lawful basis:

• To provide the service you asked for (performance of a contract): signing you in, saving your plan and showing it to you on any device.
• Our legitimate interests: keeping Vima secure and working (rate limits, preventing abuse, fixing faults), answering your messages, and learning which features are used, from usage events, your last visit and Cloudflare’s aggregate statistics, so we can decide what to fix and build. These uses are small and expected, and they are never shared for advertising. You can object to them at any time.
• Your consent, where it applies: for what you choose to send us beyond the planner, such as feedback through the form. You can withdraw it at any time by asking us to delete what you sent.
• Legal obligations: answering requests about your data, and complying with a valid legal order if we ever receive one.

Vima makes no decisions about you by automated means that have legal or similarly significant effects. Auto-fill only proposes courses; you decide what to keep.

Who else handles it

We do not sell your personal data, share it for advertising or track you across other sites, and Rice University receives nothing. These providers handle data for us, only to run Vima and under data processing terms with us:

• Supabase (Supabase, Inc.): the database and sign-in. Your account, plans and usage events are stored in its East US (Ohio) region, in the United States.
• Cloudflare (Cloudflare, Inc.): hosting, delivery and security for vimaplan.com, and the aggregate traffic statistics.
• Google (Google LLC): the email behind the support address, and the feedback form.

Google also provides the sign-in, and for that it acts under its own privacy policy: it knows you signed in to Vima, as it does for any app you sign in to with Google. Vima’s use of the information it receives from Google follows the Google API Services User Data Policy, including its Limited Use requirements. Your profile picture is shown in the planner straight from Google’s servers.

Only the operator, and anyone he authorises to help run Vima under the same duty of confidence, can see stored data, and only to run and support Vima. Other students never see your plan.

We would disclose data to anyone else only if the law requires it, and we would tell you unless the law forbids that. If Vima is ever handed over to someone else, your data would go with it only to keep Vima running under this policy, and we would tell you beforehand so you could delete your account first.

Where your data is kept

Vima is run from Cyprus and its data is stored in the United States, with Supabase in Ohio. Cloudflare handles each request at a data centre near you before passing it on.

Wherever you use Vima from, including the EU, the UK, Switzerland or Canada, your data goes to the United States, where privacy law differs from yours and courts and authorities may be able to reach it under US law. Our providers handle it under data processing terms that include the European Commission’s standard contractual clauses and the UK’s equivalent, which is how a controller in the EU may send data there, and this policy protects it wherever you are.

How long we keep it

• Your account, plans and usage events: until you ask us to delete them, or until two years after you last opened the planner. Signing in again keeps your account. When you ask, we delete them within 30 days.
• Messages you send us: for up to two years after the conversation ends, then deleted. You can ask us to delete them sooner, but when you ask us to delete your account we keep that request and our reply as the record that we did.
• Provider logs and backups: Supabase and Cloudflare keep short-lived logs and backups under their own terms, so deleted data can remain there briefly until those expire.
• Your browser: what is kept in local storage stays on your device until you clear it.

Security

Vima uses encrypted connections everywhere, and Supabase encrypts the data it stores. Database rules let each account reach only its own profile and plans, and your password never reaches us because Google handles sign-in. No service is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

Your rights

Wherever you live, you can ask us to:

• give you a copy of the data we keep about you (access)
• correct anything that is wrong (rectification); you can change your plan yourself at any time
• delete your account, your plans and your usage events (erasure)
• limit what we do with your data while a question about it is settled (restriction)
• give you your data in a common, machine-readable file (portability)
• stop using it for a purpose based on our legitimate interests (objection)

You do not need to ask for your plan: in the planner, open More actions and choose Export, and it downloads as a JSON file that you can keep or import again.

To make a request, write to support@vimaplan.com from the email address you sign in with, so we know it is you; if you write from another address, we may ask you to confirm it is yours. We answer within 30 days, free of charge. Removing Vima from the third-party connections in your Google account does not delete anything Vima keeps, so write to us for that.

In the EU, the UK and Switzerland

The GDPR, the UK GDPR and the Swiss Federal Act on Data Protection give you the rights above. Where we rely on your consent, you can withdraw it at any time without affecting what was done before.

You can also complain to a data protection authority, usually the one where you live or work: in the EU, your national authority, or the Commissioner for Personal Data Protection in Cyprus, where Vima is run; in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would like the chance to put things right first, so please write to us too.

In the United States

Several states, California among them, give their residents rights over their personal data. We give the same rights to everyone in the United States:

• to know what personal data we keep about you and get a copy of it
• to correct it
• to have it deleted
• to opt out of the sale of personal data, targeted advertising and profiling. There is nothing to opt out of: we do not sell personal data, show advertising or profile you, and we do not set out to collect sensitive data.

Make a request as described under Your rights. We will not treat you differently for using these rights. If we turn a request down, reply to say you appeal and we will answer within 60 days; if you are still not satisfied, you can contact your state’s attorney general.

Vima does not track you across other sites, so Do Not Track and Global Privacy Control signals need no action from us: you are already opted out.

In Canada

Under PIPEDA and provincial privacy laws, including Quebec’s, we rely on the consent you give by signing in and using Vima for the purposes in this policy. You can withdraw it at any time by asking us to delete your account. Antreas Leonidou is the person responsible for protecting your personal information, at support@vimaplan.com.

You can see and correct your information as described under Your rights. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or to your provincial commissioner. Your data is stored in the United States, as described under Where your data is kept.

Children

Vima is for university students and is not directed at children. You must be at least 16 to use it. If we learn that someone under 16 has an account, we delete it; a parent or guardian who believes this has happened can write to us.

Changes to this policy

When we change this policy, we post the new version on this page with a new date at the top, and if the change is significant we say what changed. We will not use data you have already given us in a new way without telling you first and, where the law requires it, asking you.

Contact

Questions and requests about your data: support@vimaplan.com. The rules for using Vima are in the Terms of use.