Privacy Policy

We collect the following categories of information:

• Account information: your name, email address, and password.
• Profile & academic information: date of birth, grade level, current and intended schools, GPA history, SAT/ACT scores, AP/IB courses, intended major, extracurricular activities, and other responses you provide in the intake.
• Preferences: your location, schools you are considering, interests, and goals.
• Content you submit to CORA: the questions you type, and — if you use essay feedback — the text of any essay draft you paste in. See Section 3.
• Voice input: if you speak to CORA, your browser converts your speech to text and gives us only the resulting text. We never receive, and never store, the audio itself. See Section 4.
• What CORA remembers: so that a returning student is not met by an advisor who has forgotten them, CORA keeps a short written note about your advising history — what you are weighing up, what you have worked on, and what she has already suggested — along with a list of topic labels. It is a counsellor’s note, not a transcript: we do not store your conversation, and CORA is instructed never to quote you or record test scores, grades, financial figures or family details in it. You can ask us for a copy of the note or ask us to clear it at any time, and it is deleted with your account.
• Parent or guardian information: when parental or guardian involvement is required for a purchase or other feature, we may collect the parent or guardian’s name, email address, consent acknowledgements, and technical information associated with that consent, such as IP address, user agent, date and time, and the versions of our Terms and Privacy Policy presented.
• Payment information: processed by our payment processor, Stripe. We receive limited billing details such as which one-time purchase you made and when your access expires, but we do not store your full payment card numbers.
• Usage data: device and browser information, pages visited, and interactions with the Service, used to operate and improve it.

We use your information to:

• Generate your personalized college matches, reports, and career-outcomes data.
• Power CORA, our AI college advisor, answer your questions, and — on Six Months — give you feedback on an essay draft you choose to share with her, run a mock admissions interview, and help you plan recommendation letters.
• Provide the features included in your purchase, such as your saved-schools list, the interactive map, the financial aid estimator, the application tracker, and share links.
• Create and manage your account and your purchases.
• Process payments and prevent fraud.
• Communicate with you about your account and the Service.
• Send you deadline reminders by email, if — and only if — you turn them on. These are reminders about application deadlines you entered yourself, they are off unless you switch them on, and every one carries a one-click unsubscribe that works without signing in. See Section 12.
• Maintain, secure, and improve the Service, and comply with legal obligations.

CORA, our narrative features, and our essay feedback all use a third-party AI provider (Anthropic’s Claude) to generate responses. Relevant profile context and the content you send are transmitted to Anthropic to produce a result, and the result is returned to you.

Essay feedback, specifically. If you paste an essay draft into CORA, that draft is sent to Anthropic to generate feedback on it. We want to be precise about what happens to it, because it is your original work: we do not store your essay text in our database, we do not use it to train any model of our own, and we do not use it to improve our matching engine. It is sent to Anthropic, feedback comes back, and we do not retain the draft. Anthropic does not use data submitted through its commercial API to train its models. Your essay remains yours; you grant us only the permission needed to transmit it for the purpose of generating the feedback you asked for.

A caution about your own school’s rules. Feedback on an essay is not the same thing as writing it, and CORA is instructed never to rewrite your work for you. Even so, some colleges and high schools have their own policies on AI assistance and may require you to disclose it. Those policies are theirs, not ours, and it is your responsibility to follow them.

We do not use your personal data to train third-party AI models, and our providers process your data under their own terms and security commitments.

If you speak to CORA, or let her speak to you, the speech processing is performed by your web browser, not by Scholar Placement AI. This matters, so here is exactly what happens.

Speech-to-text (you speaking). Your browser turns your speech into text and hands the text to us. Depending on the browser, that conversion may happen on your own device, or your browser may upload the audio to its vendor’s servers to transcribe it — Google for Chrome, Apple for Safari, Microsoft for Edge. That processing is governed by your browser vendor’s privacy policy, not ours, and those vendors are not our service providers or contractors. Where your browser supports on-device recognition, we ask it to keep the audio on your device. Not every browser offers this, and we cannot force it.

Text-to-speech (CORA speaking). CORA’s replies are spoken either by your browser’s own built-in voice, which may be generated on your device or on your browser vendor’s servers, or, for some replies, by a third-party text-to-speech provider. Where that provider is used, the text of her reply — not your voice, and not your profile — is sent to it, and it returns audio for your browser to play.

What we receive. In both directions, Scholar Placement AI only ever receives text. We do not receive your audio, we do not store your audio, and we do not create voice recordings or voiceprints. Nothing you say is sent to the text-to-speech provider — it receives only what CORA says.

If you would rather no audio ever leave your device, do not use the microphone button, and turn CORA’s voice off with the “Voice” control in the chat window. Typing to CORA sends no audio anywhere.

College information presented in the Service is derived from public federal sources, including IPEDS, the U.S. Department of Education’s College Scorecard, and PSEO/U.S. Census Bureau data. This is institutional data and is not your personal information.

We do not sell personal information, use student personal information for targeted advertising, or disclose student personal information to third parties for their own advertising purposes. We share information as follows:

• With service providers who help us operate the Service — Supabase (database and authentication), Anthropic (AI), ElevenLabs (audio for some of CORA’s spoken replies), Resend (email delivery, used only for deadline reminders you have turned on), and Stripe (payments) — under contractual protections.
• With people you choose to share your report with. If you create a share link (a Six Months feature), anyone who has that link can open a read-only copy of your college match report without signing in and without an account. This is a disclosure you initiate, and it is described in full in Section 7.
• With your browser’s vendor, if you use CORA’s voice features and your browser processes speech on its own servers. See Section 4. These vendors are not our service providers and we have no contract with them; the choice to speak is yours.
• When required by law, or to protect the rights, safety, or property of Scholar Placement AI, our users, or others.
• In connection with a merger, acquisition, or sale of assets, subject to this Policy.

Six Months purchasers can create a share link so a counselor or parent can read their report. Because this hands your information to someone outside the Service, you should understand exactly how it behaves.

Anyone holding the link can view the report. The link is the only credential — whoever has it can open the report without an account, without a password, and without agreeing to our Terms. If the person you send it to forwards it on, the person they forward it to can read the report too. Treat it like a key, and only send it to people you trust.

What a viewer sees, and what they don’t. A share link shows your first name, and your matched schools with their fit scores and explanations. It does not show your surname, email address, date of birth, intake answers, or essays, and it gives the viewer no ability to change anything.

You can revoke it. Revoking a link stops it working immediately, for everyone. We cannot, however, retrieve anything a viewer already read, copied, or saved while the link was live.

Links do not expire on their own, so we recommend revoking a link once the person you sent it to has finished with it.

We keep your account and the information in it for as long as the account exists. There is no period of inactivity after which an account is deleted automatically: if you do not delete your account, we keep it. That includes your profile and intake answers, your reports and matched schools, your saved schools and application information, and your purchase history.

You can delete your account at any time, and you can ask us to delete your information at any time (Section 9). We may keep limited information where we need it to comply with a legal obligation, resolve a dispute, or enforce our agreements.

Some operational records are deleted automatically on a fixed schedule, whether or not you ask. Sign-in records, which include IP addresses, are deleted after 180 days, as are our internal error logs. Partly completed intake forms are deleted after one year, as are parental-consent requests that were sent but never acted on. Records of which features were used, of reminder emails we sent you, and of safety-related events are deleted after two years. Privacy requests are kept for three years after they are closed, so we can show we honoured them, and our internal administrative audit log is kept for seven years.

Two things are never stored at all, rather than stored and later deleted: essay drafts you submit for feedback are not saved to our database (Section 3), and we never receive or store the audio of anything you say to CORA (Section 4).

Records of a parent or guardian's consent are not deleted on any schedule. They are the evidence that an account, or a purchase, was authorised, so we keep them for as long as the account exists. A parental-consent request that was sent but never acted on is deleted after one year; a consent that was actually given is not.

What happens when an account is deleted. Deleting an account removes your profile and intake answers, your reports and matched schools, your saved schools and application information, your purchase and access records, your reminder settings, your sign-in records, the note CORA keeps about your advising history, and the records of any parental or guardian consent given for the account. These are deleted, not archived.

Three things outlast the account, and we would rather name them than imply otherwise. Safety-related event records, privacy requests, and our internal error and feature logs are kept for the periods above, but the link to your account is removed — they no longer identify you. Our administrative audit log records that an account was deleted and by whom, never what it contained. And your payment records are held by Stripe under their own retention obligations for accounting, tax and fraud-prevention purposes; deleting your account here does not delete their record of a payment, and we cannot delete it for you.

You can:

• Access, correct, and update much of your information directly from your dashboard.
• Request a copy of your data or ask us to delete it.
• Revoke any share link you have created, at any time, from your report.
• Turn CORA’s voice off, or simply never use the microphone, so that no audio leaves your device.
• Turn deadline reminder emails on or off at any time, or unsubscribe from any reminder in one click without signing in.
• Delete your account at any time. Purchases are one-time and nothing renews, so there is no subscription to cancel.
• Exercise additional rights that may apply depending on your location by contacting us.

We may take reasonable steps to verify your identity before fulfilling a request to access, correct, obtain, or delete personal information. We may decline or limit a request where permitted or required by applicable law.

Scholar Placement AI is intended for students age 13 and older. The Service is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13.

If we learn that personal information has been collected from a child under 13 through the Service, we will take reasonable steps to delete that information in accordance with applicable law. If you believe a child under 13 has provided personal information to Scholar Placement AI, please contact us at privacy@scholarplacement.ai.

Users between the ages of 13 and 17 should use Scholar Placement AI with the involvement and permission of a parent or legal guardian. We encourage parents and guardians to discuss with their students the information they provide through the Service, including information shared through CORA, share links, and optional voice features.

Additional requirements may apply when Scholar Placement AI is provided through a school or school district. Where applicable, student information provided through an educational institution will be handled in accordance with our agreement with that institution and applicable student-privacy laws.

We use industry-standard safeguards — including encryption in transit, access controls, and row-level security on our database — to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Two things sit outside the safeguards we control, and we would rather say so plainly than imply otherwise. A share link is readable by anyone who has it, so its security depends on who you send it to (Section 7). And audio processed by your browser’s own speech service is handled by that vendor under their safeguards, not ours (Section 4).

There are two kinds of email, and we treat them differently because most of our users are students and many are minors.

Account email. Messages we have to send for the Service to work — confirming your account, resetting your password, and similar. These are part of having an account and are not marketing.

Deadline reminders, which are optional and off by default. If you turn them on, we email you before application deadlines that you entered yourself against your saved schools. We do not obtain these dates from anywhere else and we do not email you about schools you have not saved. Entering a deadline does not switch reminders on — that is a separate choice you make deliberately, and it starts off.

Stopping them. Every reminder carries a one-click unsubscribe link that works without signing in, so you can stop the email even if you no longer have access to the account. You can also turn reminders off from your dashboard at any time. Unsubscribing stops the email only; it does not delete your deadlines, your reports, or your account.

Who delivers it. Reminder email is sent through Resend, our email delivery provider, which receives your email address and the content of the reminder for the purpose of delivering it. We do not sell your address, we do not send marketing email, and we do not share your address with advertisers.

We use cookies and similar technologies for authentication and to keep you signed in. You can control cookies through your browser settings, though some features may not work without them.

We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, for material changes, provide additional notice.

The Service is operated by ScholarMatch AI Inc., a Delaware corporation (File No. 10701067), doing business as Scholar Placement AI. 16192 Coastal Highway, Lewes, DE 19958.

Questions about your privacy or this Policy? Contact us at privacy@scholarplacement.ai.