GraduateSmart
GraduateSmart
Last updated: October 3, 2026
Our Commitment to Your Privacy
GraduateSmart is a nonprofit platform. We never sell your personal data. We collect only what we need to help you plan your future, and we protect it with industry-standard security.
GraduateSmart is operated by GraduateSmart Inc., a nonprofit organization based in New York. Our mission is to help high school students explore careers, find schools, earn college credits through CLEP exams, and build free personalized academic roadmaps.
This Privacy Policy explains how we collect, use, store, and protect information when you use our website and services at graduatesmart.org ("the Service"). Accepting our Terms does not enable optional analytics or profile and preparation emails. Those uses require your separate choice, which you can change in Settings.
GraduateSmart optionally collects certain categories of sensitive personal information — specifically race, ethnicity, gender, disability status, citizenship status, household income range, and military/veteran family status. Providing this information is entirely voluntary. You may skip any or all of these fields without affecting your access to the platform.
Why we collect it: Many scholarships, grants, and opportunities are specifically designated for students from particular backgrounds (e.g., UNCF scholarships for Black students, HSF for Hispanic students, AMVETS for military families). Without this information, our Smart Match engine cannot surface these opportunities to students who qualify for them.
How it is used: This data is used exclusively within the Smart Match algorithm to filter and rank opportunities on the Opportunities & Scholarships page. It is never used for advertising or sold. Our database and hosting providers process it to operate the Service.
Who can see it: Database permissions restrict access to authorized accounts. Approved parents may access your stored profile, including optional answers. Counselors do not receive these fields through the counselor portal. Separately shared scholarship names can indirectly reveal personal circumstances.
How to remove it: You can update or delete any sensitive fields at any time from your Profile page; save the profile to apply the change. Delete your account in Settings → Privacy & Data, or request assistance at privacy@graduatesmart.org.
We do not use advertising cookies or tracking pixels. We use only essential cookies required for authentication and session management.
We use the information we collect to:
We do not use your information to serve targeted advertisements, and we do not sell, rent, or trade your personal information to any third party for their marketing purposes. Optional background answers support scholarship matching, subject to the access controls and provider processing described here.
We may share your information only in the following limited circumstances:
After you approve a school counselor connection, they will be able to view your academic profile (grade level, GPA, test scores, school, interests, roadmaps, and CLEP/AP progress). Counselors cannot view your sensitive demographic information (race, ethnicity, gender, disability status, household income range, or citizenship status) through the counselor portal. You can remove a counselor connection at any time in Settings → Connections.
Opportunity and college application progress require a separate choice for each counselor in Settings → Connections, and start private. If you turn sharing on, that counselor can view the names of opportunities you saved or accepted, recorded application progress, deadlines and cycle status, plus college application names, stages and deadlines. This includes progress you record on automatic recommendations, but excludes automatic matches without your activity. Scholarship names may reveal personal interests or circumstances. Private notes, demographic information and eligibility details are not included. Turn sharing off or remove the connection to stop future access; this cannot erase information the counselor has already seen. This separate sharing option is not yet available for parent-managed accounts.
Approved parents can access profile and planning information permitted by their connection. A parent-created connection becomes removable by the student at age 18 or when the profile enters the college cohort. Review connections in Settings. Removing a connection stops future platform access but cannot erase previously viewed copies. School-provided records may be subject to additional institutional rules.
We use trusted third-party services to operate the platform, including Supabase for database, authentication and storage; Vercel for hosting and content delivery; Anthropic for requested AI assistance; and Resend for email delivery. They process the information needed to deliver their respective services on our behalf.
When you request an AI roadmap or message Grady, relevant academic and planning context, your message, and recent conversation history may be sent to Anthropic's Claude API. Conversations and plans are stored in GraduateSmart. Avoid passwords, financial account numbers, and unnecessary sensitive details in messages. Optional usage analytics is separate from the processing needed to answer your AI request.
We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect the rights, property, or safety of GraduateSmart, our users, or the public.
We may share anonymized, aggregated statistics about platform usage (e.g., "X% of students plan to take CLEP Math") for reporting, research, and nonprofit grant purposes. We assess statistics before external disclosure to avoid identifying students, including through small groups. Aggregate reports do not make underlying account-linked records anonymous.
We implement industry-standard security measures to protect your information, including:
While we take security seriously, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk.
Student accounts require age 13 or older; parent accounts require age 18 or older. We check date of birth before asking for account details. New under-13 child profiles and invitations are paused. A parent-created profile is not a verified parental-consent process.
You have the following rights regarding your personal information:
Additional rights depend on your location, our legal status, and the applicable law. New York's Child Data Protection Act protects covered minors' optional-processing choices. School-provided records may also be governed by FERPA and state education law. Contact us for help exercising an applicable right.
We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it by law or for legitimate business purposes such as fraud prevention.
Account-level product usage history remains until account deletion or analytics withdrawal. Withdrawal deletes that collector's account-level history; earlier reports and copies are not automatically recalled. Privacy decision records remain with the account to document your choices. Specified reminder and opportunity notifications are pruned after 90 days. Other records and backups follow their applicable deletion processes.
GraduateSmart uses only essential cookies that are strictly necessary to operate the Service, including authentication session cookies. We do not use:
Browser storage also remembers language and display preferences. These preferences do not grant permission for analytics or optional emails.
Optional first-party product analytics uses your signed-in account to record predefined feature events. It is linked to your internal account ID; administrator usage reports show aggregates. That collector does not store raw URLs, searches, messages, names, email addresses, IP addresses, or demographic event properties. Paid Vercel Analytics is not enabled. Automatic visitor analytics and performance scripts are paused. First-touch campaign/referrer capture is paused.
You can control cookies through your browser settings, but disabling essential cookies may prevent you from logging into your account.
The Service may contain links to third-party websites, schools, scholarship programs, and organizations. This Privacy Policy applies only to GraduateSmart. We are not responsible for the privacy practices of any third-party sites, and we encourage you to review their privacy policies before providing any personal information.
We may update this Privacy Policy from time to time. We will notify registered users of material changes by sending an email to the address on file or by posting a prominent notice on the Service. The date of the most recent update is always shown at the top of this page. Continued use does not grant permission for a new optional data use. We record the notice version and decision time when you make a separate privacy choice.
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
GraduateSmart Inc. / GraduateSmart
A Nonprofit Organization
New York, NY
We aim to respond to all privacy-related requests within 30 days.