Privacy policy

InTurn operates the platform and is responsible for the personal data processed on it. For any question about your data, or to use one of your rights, write to us at contact@inturn-hub.com.

This policy covers the InTurn website and application. The companies and universities you meet on InTurn handle the data they receive for their own purposes — for example to run an internship or to keep student records — under their own responsibility.

We keep only what the platform needs to work. Depending on how you use InTurn, that is:

• Your account: your name, your e-mail address and your password — stored only as a secure hash, which nobody can read — your phone number and photo if you add them, your account type and role, and whether the sign-in code is on.
• Your professional profile, if you are an intern: your university (or the one you named when signing up), field of study, bio, date of birth, skills, CV, whether you are open to opportunities, and your listing if you publish one.
• Your place in an organisation, if you work for a company or a university: the organisation, your role and your job title. The organisation's own details (name, website, description, logo) belong to the organisation.
• Your activity: offers, applications and their progress, internships, projects, tasks, comments, deliverables, internship documents and their acknowledgements, evaluations and experience records.
• The internship report, if you take part in one: the plan of chapters the academic supervisor sets, the versions the intern sends (their files, links and notes), and the supervisor's reviews and feedback.
• Your use of AI assistance, if you work for a company: a record of each request you made to the AI, never its text (see “AI assistance”).
• Your conversations: the messages you send and receive in InTurn's chat.
• Your notifications and your preferences: what you are notified about, which kinds of notification you chose to receive, and the language of your e-mails.
• Your consents: when you accepted the terms of service and this policy, and whether you agreed to receive marketing e-mails, with the history of every change.
• Your activity status: whether you are online and when you were last seen.
• Security records: your sign-in sessions and sign-in codes, and a log of sensitive actions such as a data export or an account deletion — including the IP address and the browser and device they came from.

A university may also import the e-mail addresses of its students, so that their enrolment is confirmed automatically when they sign up.

We use your data for the following purposes only:

• to create your account, sign you in and keep your account secure — this is needed to provide the service you asked for;
• to connect interns, companies and universities: showing offers and listings, handling applications, and running internships, projects, tasks, documents and evaluations;
• to help companies draft, with AI and only when someone there asks for it, a project's homepage, a sprint plan, the roles a project needs or an offer (see “AI assistance”);
• to let the people you work with reach you, through the chat and through notifications in the app and by e-mail, following your preferences;
• to verify organisations and students: InTurn's staff verify companies, and universities confirm who their students are;
• to keep the platform safe: preventing abuse, handling reports and keeping a record of sensitive actions;
• to send you marketing e-mails, only if you agreed to it. You can withdraw that agreement at any time. InTurn sends no marketing e-mails today.

We do not sell your personal data, we do not show advertising, and we do not use your data to build advertising profiles.

Who can see your data depends on your role, on what you choose to publish and on the work you do together:

• If you publish a listing, everyone at companies and universities, and platform staff, can see it in the Marketplace, with your name, photo, field of study, university, whether your university confirmed you, and your skills.
• Companies can find the profiles of interns who chose to be discoverable — open to opportunities, or with a published listing — including their CV. They see the applications sent to their own offers, and only their own internships.
• Universities see their own students' profiles, the enrolment requests sent to them and their students' internships.
• The people on an internship — the intern, the company side and the university side — see that internship's tasks, documents, evaluations and conversations, each according to their role.
• Anyone who has the share link of an experience record can read that record, without an account.
• Whether you are online, and when you were last seen, is shown to your chat contacts, to the admins of your organisation or your university, and to platform staff.
• InTurn's platform staff can access accounts and content when this is needed to verify organisations, moderate content that breaks the rules, answer a request or protect the platform.
• Our technical providers (hosting, storage, e-mail delivery) process data on our behalf, only to run the service, and are bound to keep it confidential.
• Our AI provider, Anthropic, PBC, processes on our behalf, through its Claude API, what a company sends when someone there asks for an AI draft (see “AI assistance” below).
• Public authorities, only when the law requires it.

AI assistance drafts part of a company's work on InTurn: a project's homepage from a brief, a sprint plan, the roles a project needs, and internship offers. Only people at a company can use it — those whose role lets them create what is drafted — and only by clicking an AI button: the AI never runs on its own.

• What is sent: the brief, the answers to the AI's questions and the text to rework; what the projects concerned already hold (their title, dates, homepage, sprint and task titles, and the roles they need); and the names of the company and of the workspace, with the company's description for an offer. InTurn never adds a person's name, e-mail address or account identifier, and never anything from the chat. E-mail addresses and phone numbers are also masked in everything sent, before it leaves our servers. Names are not: leave people's names out of what you write for the AI.
• Who receives it: our AI provider, Anthropic, PBC, through its Claude API. It is sent from our own servers: your browser never talks to the provider.
• What comes back: a draft. Nothing is saved until someone clicks to create, save or apply it, and everything the AI drafts can be written by hand instead. The AI never judges, ranks or suggests people: who works on a role is always chosen by someone at the company.
• What we keep: InTurn does not store the brief, the AI's questions, the answers or a draft nobody saved. For each request to the AI, we record who made it, what kind of draft it asked for, its cost and how it ended and, once a draft is used, how much of it was changed — never any text. What you save becomes the company's own content, like anything written by hand.
• Your browser: if you stop creating a project with AI and click “Save & exit”, your browser keeps what you have done so far — the brief and the draft — for your account only. You can resume it for a week at most; it is removed when you create the project, discard the draft or sign out.
• Turning it off: a company's super admin can turn AI assistance off for the whole company, in Settings. The AI buttons then disappear for everyone in the company, and nothing of the company's is sent to the AI provider. AI assistance is on by default.
• A monthly allowance: each company has a monthly allowance for AI drafts. When it is used up, InTurn says when it comes back; until then, everything can still be done by hand.

Internship agreements and other internship documents are shared between the parties to the internship. When a party acknowledges a document in the app, we record who did it and when. This in-app acknowledgement, kept with an audit trail, is not a qualified electronic signature.

Supervisors fill in evaluations of the intern. The intern can read an evaluation once it is submitted, and a submitted evaluation can no longer be changed.

When an internship ends, InTurn issues an experience record: a summary of the internship and of its evaluations, fixed when it is issued, which shows who stood behind it (the company, the university, or both). It has a public share link. As the intern, you can turn that link off at any time and turn it back on — the same link then works again. You can also replace it with a new link; the old one then stops working for good. Platform staff can revoke a record that is abused.

Some interns on InTurn may be under 18. Tunisian law sets specific rules for the personal data of minors, including the consent of a parent or guardian.

If you are under 18, create your account only with the agreement of a parent or guardian. They can write to us at contact@inturn-hub.com about your data at any time.

How this agreement is collected is still being reviewed by our legal team.

InTurn uses only cookies that the platform needs to work or that remember a choice you made. There are no advertising cookies and no analytics or tracking cookies, which is why we do not show a cookie banner.

• Session cookies keep you signed in. They are HttpOnly: the scripts running in the page cannot read them.
• A security cookie protects your actions against cross-site request forgery (CSRF).
• A short-lived cookie holds your sign-in while you type your sign-in code.
• A cookie remembers your language.
• A cookie remembers whether you collapsed the side menu.
• Your browser's local storage remembers display choices, such as the light or dark theme or the getting started checklist if you hid it, and short technical timers, such as when to reconnect to live updates.
• If you stop creating a project with AI and click “Save & exit”, your browser's local storage keeps the unfinished draft (see “AI assistance”).

• Passwords are stored only as a secure hash. You can add a second step to sign in: a six-digit code sent to your e-mail address.
• Sessions rely on HttpOnly cookies and are protected against cross-site request forgery. Sensitive actions, such as deleting your account, ask for your password again.
• Inside the platform, each person sees only what their role and their organisation allow.
• Sensitive actions, such as a data export or an account deletion, are recorded in a security log.

No system is perfectly secure. If you think your account has been misused, change your password and write to us at contact@inturn-hub.com.

We keep your data for as long as your account is active.

If your organisation removes you from its team, or InTurn closes your account, that account can no longer sign in, but your personal details are kept rather than erased. To have them erased, write to us at contact@inturn-hub.com.

When you delete your account, your personal details are erased right away: your name, e-mail address, phone number and photo and, for an intern, the profile, skills, CV and listing. What you shared with others stays in place so that their records remain complete — messages, comments, tasks, deliverables, report versions and reviews, and documents — shown as written by “Deleted User”.

A few records are kept after deletion because they are evidence: the history of your consents and the security log of sensitive actions. A university keeps its own record that you were its student.

Student e-mail addresses imported by a university that never became an account are deleted automatically after a retention period.

You have the right to access your personal data, to correct it, to have it deleted, to receive a copy of it, and to object to its use for marketing. On InTurn, you use these rights yourself:

• See and correct your data: your account page shows your personal details and lets you change them, except your e-mail address — to change it, write to us at contact@inturn-hub.com. Interns edit their professional profile on their profile page.
• Download your data: on your account page, “Download my data” gives you a copy of your data in one machine-readable file (JSON), up to 3 times a day.
• Choose your notifications: pick, kind by kind, the notifications you receive.
• Withdraw your marketing consent: turn marketing e-mails off on your account page, at any time. The terms of service and this policy are needed to use InTurn: to withdraw them, close your account as described in the next section.
• Delete your account: see the next section.

If your account is suspended, you can no longer sign in, but you keep these rights: write to us at contact@inturn-hub.com, and we will give you a one-time code to download your data or delete your account.

If you live in the European Union, you also have the rights given by the General Data Protection Regulation (GDPR), including the right to restrict processing and the right to data portability. The tools above are how we honour them; for anything else, write to us.

You can delete your account yourself, from your account page or from the account menu, by confirming your password. Deletion is immediate and final: you are signed out everywhere, the account can never sign in again, and your personal details are erased as described above. Signing up again creates a new, empty account.

Deletion is refused in a few cases, to protect the work of others:

• while you are the intern on an internship that is pending or in progress — your supervisor has to end or cancel it first;
• while you supervise internships that are pending or in progress — they have to be reassigned or ended first;
• when you are the only super admin of your organisation, or of the platform, since it would be left with nobody in charge.

If you are your organisation's only super admin, write to us at contact@inturn-hub.com: the InTurn team can make one of its admins super admin, and you can then delete your account.

InTurn processes personal data in accordance with Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data.

If you think your data is not handled properly, write to us first at contact@inturn-hub.com. You can also complain to the Instance Nationale de Protection des Données Personnelles (INPDP), the Tunisian data protection authority. If you live in the European Union, you can also turn to the data protection authority of your country.

We may update this policy when the platform or the law changes. The date at the top of this page shows the current version. If a change affects how your data is used, we will tell you in the app or by e-mail before it applies.