Data Compliance

Our role under FERPA

When Settlyou is contracted by a U.S. educational institution, we operate as a "School Official" with a legitimate educational interest as defined under FERPA (34 CFR §99.31(a)(1)). This means we may access student education records solely to provide the services agreed upon — generating personalized relocation guides and collecting required documents on behalf of the institution.

What this means in practice

• Student data submitted through Settlyou is used exclusively to generate relocation guides and collect required documents.
• We do not disclose student education records to any third party without the written consent of the institution or the student, except as required by law.
• Student data is never sold, shared for marketing, or used to train AI models.
• Institutions remain the data controller — they decide what data is submitted and who has access.
• Student records are available to the institution upon request at any time.
• Data is deleted within 30 days of account termination or written request.

Institution responsibilities

Institutions using Settlyou are responsible for ensuring their use of the platform complies with FERPA, including obtaining any necessary student consents and maintaining appropriate data governance policies. Our Terms of Service include specific institution obligations regarding FERPA compliance.

Our role under GDPR

For institutions and athletes based in the EU or EEA, Settlyou acts as a Data Processor on behalf of the institution (the Data Controller). We process personal data only on the documented instructions of the institution, for the purpose of delivering our relocation guide and document collection services.

Legal basis for processing

• Contractual necessity — Processing is necessary to deliver the services agreed with the institution (Art. 6(1)(b)).
• Legitimate interest — Improving platform reliability and security, where this does not override individual rights (Art. 6(1)(f)).
• Consent — Athletes provide explicit consent when submitting their onboarding form, with a clear statement of how their data will be used.

Your rights under GDPR

EU/EEA residents have the following rights, which we honor within the timeframes required by law:

Data transfers

Settlyou's infrastructure is hosted in the United States (Vercel, Supabase). For EU/EEA institutions, data transfers to the U.S. are covered by Standard Contractual Clauses (SCCs). We can provide our Data Processing Agreement (DPA) upon request for institutions that require it as part of their vendor approval process.

Data breach notification

In the event of a personal data breach, we will notify affected institutions within 72 hours of becoming aware, as required by GDPR Article 33. Notifications will include the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken to address it.