Privacy Policy

1. Who We Are

GraduateSmart is operated by GraduateSmart Inc., a 501(c)(3) nonprofit organization based in New York. Our mission is to help high school students explore careers, find schools, earn college credits through CLEP exams, and build free personalized academic roadmaps.

This Privacy Policy explains how we collect, use, store, and protect information when you use our website and services at graduatesmart.org ("the Service"). By using the Service, you agree to the collection and use of information as described in this policy.

2. Information We Collect

Information You Provide Directly

• Account information: name, email address, password, role (student, parent, counselor)
• Academic profile: grade level, GPA, SAT/ACT scores, current school, ZIP code, state
• Career interests: selected interest areas, extracurricular activities, intended career field
• Languages spoken: Spanish, French, German (used to identify CLEP and scholarship eligibility)
• Optional demographic information: gender, race, ethnicity (used solely to match you with scholarships and opportunities for which you may qualify — see Section 2a below)
• Optional background information: first-generation college student status, household income range, disability status, citizenship status, military/veteran family status (used solely for scholarship matching — see Section 2a below)
• Roadmap data: career goals, target schools, CLEP and AP exam plans, milestone steps, and notes
• Exam tracking: CLEP and AP exam status, scores achieved, and credits earned
• Saved items: careers and schools you save, ratings, and fit categories
• Communications: messages you send to our support team

Information Collected Automatically

• Usage data: pages visited, features used, time spent on the platform
• Device information: browser type, operating system, and screen size
• Log data: IP address, access times, and referring URLs

We do not use advertising cookies or tracking pixels. We use only essential cookies required for authentication and session management.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account and provide the Service
• Personalize career recommendations, school matches, and CLEP and AP exam suggestions
• Power the Smart Match engine to surface scholarships and opportunities you are likely to qualify for based on your academic profile, interests, extracurriculars, and optional demographic and background information
• Calculate estimated CLEP and AP exam tuition savings based on your profile and school selections
• Allow school counselors you authorize to view your academic roadmap and CLEP/AP progress
• Send transactional emails such as account confirmation and password reset links
• Improve the platform through aggregated, anonymized usage analytics
• Respond to your support requests and communications
• Comply with legal obligations

We do not use your information to serve targeted advertisements, and we do not sell, rent, or trade your personal information to any third party for their marketing purposes. Sensitive demographic and income data is used exclusively for scholarship matching within the platform and is never shared externally.

4. Information Sharing

We may share your information only in the following limited circumstances:

With Counselors You Authorize

If a school counselor links your account to their cohort, they will be able to view your academic profile (grade level, GPA, test scores, school, interests, roadmaps, and CLEP/AP progress). Counselors cannot view your sensitive demographic information (race, ethnicity, gender, disability status, household income range, or citizenship status) unless you explicitly share it. You can contact us to remove a counselor connection at any time.

With Service Providers

We use trusted third-party services to operate the platform, including Supabase for database and authentication services. These providers are contractually bound to protect your data and may only use it to provide services on our behalf.

For Legal Reasons

We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect the rights, property, or safety of GraduateSmart, our users, or the public.

Aggregated & Anonymized Data

We may share anonymized, aggregated statistics about platform usage (e.g., "X% of students plan to take CLEP Math") for reporting, research, and nonprofit grant purposes. This data cannot be used to identify individual users.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• All data is encrypted in transit using HTTPS/TLS
• Passwords are hashed and never stored in plain text
• Database access is protected by Row Level Security (RLS) policies
• User authentication is managed by Supabase, an enterprise-grade auth provider
• Access to production systems is restricted to authorized personnel only

While we take security seriously, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk.

6. Children's Privacy (COPPA)

GraduateSmart is designed for high school students, many of whom may be under 18. We comply with the Children's Online Privacy Protection Act (COPPA).

• We do not knowingly collect personal information from children under 13
• If you are under 13, please do not create an account without parental consent
• Parents who believe their child under 13 has created an account may contact us to have the account and associated data deleted
• We do not display advertising to any users, including minors

7. Your Rights & Choices

You have the following rights regarding your personal information:

• Access: You can view and update your profile information at any time from your dashboard
• Correction: You can correct inaccurate data in your profile settings
• Deletion of sensitive fields: You can remove any demographic, income, disability, or citizenship data at any time directly from your Profile page — no need to contact us
• Full account deletion: You may request deletion of your account and all associated data by contacting us at the email below. We will complete deletion within 30 days.
• Data portability: You may request a copy of your data in a portable format
• Opt-out: You may opt out of non-essential email communications by contacting us
• Sensitive data opt-out: You may leave any sensitive fields blank or remove them at any time. Doing so will not affect your ability to use the platform — Smart Match will simply show all eligible opportunities without demographic filtering.

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what sensitive personal information we collect and the right to limit its use. New York residents may have additional rights under the SHIELD Act. Please contact us to exercise any of these rights.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it by law or for legitimate business purposes such as fraud prevention.

9. Cookies & Tracking

GraduateSmart uses only essential cookies that are strictly necessary to operate the Service, including authentication session cookies. We do not use:

• Advertising or tracking cookies
• Third-party analytics that track you across other websites
• Social media tracking pixels

You can control cookies through your browser settings, but disabling essential cookies may prevent you from logging into your account.

10. Third-Party Links

The Service may contain links to third-party websites, schools, scholarship programs, and organizations. This Privacy Policy applies only to GraduateSmart. We are not responsible for the privacy practices of any third-party sites, and we encourage you to review their privacy policies before providing any personal information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by sending an email to the address on file or by posting a prominent notice on the Service. The date of the most recent update is always shown at the top of this page. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: