1. Who we are & scope
GradScholar is a tool that helps prospective graduate students organize supervisor outreach, shortlist universities, and use AI assistance for drafting emails and evaluating their academic profile. This Policy applies to personal data we process as a controller. It does not cover third-party websites or services we link to. Our contact details are in Section 14.
2. Information we collect
We collect the following categories of information:
- Account data — your name, email address, and a securely hashed password. We never store your password in plain text.
- Profile & application data you provide — your academic profile (education, CGPA, standardized test scores, publications, research interests, field of study, intended degree, experience, skills, and similar), your supervisor records, and your university shortlist.
- Third-party contact data you enter — names, email addresses, affiliations, and related details of professors or programs that you add to manage your own outreach (see Section 5).
- Files you upload — CV/résumé PDFs and any research-paper PDFs you attach for AI analysis. Uploaded papers are passed through for processing and are not permanently stored by us.
- AI-generated content — email drafts, profile evaluations, university extractions and analyses, and Compass chat/research conversations created through the Service.
- Usage & technical data — log data, IP address, device/browser information, and activity within the Service, used for security, debugging, and improving the Service.
- Payment data (future) — when paid plans launch, payments will be handled by a third-party payment processor. We do not collect or store full payment-card numbers.
3. How we use your information
- To provide, operate, and maintain the Service and your account.
- To power AI features — parsing your CV, evaluating your profile, drafting and personalizing outreach emails, extracting and analyzing university information, and answering your Compass queries.
- To personalize recommendations and match features to your profile.
- To protect the Service — detecting, preventing, and responding to fraud, abuse, quota circumvention, security incidents, and violations of our Terms.
- To process billing and subscriptions (when paid plans begin).
- To communicate with you about the Service, including service and security notices.
- To comply with legal obligations and enforce our agreements.
4. AI processing & subprocessors
Core features rely on one or more third-party AI processing providers. To deliver these features, we transmit relevant data — such as your profile, uploaded CV/paper content, and supervisor or university details — to our AI provider(s) to generate the requested output. These providers act as our subprocessors and are permitted to process your data only to provide the service to us. Processing may occur on servers located in the United States or other countries (see Section 11).
We also rely on infrastructure subprocessors (for hosting and database services) and, when paid plans launch, a payment processor. We require subprocessors to maintain appropriate safeguards.
5. Third-party (professor/program) contact data
When you add a professor or program, you may enter another person’s contact information. You are responsible for having a lawful basis to input and use that information, and you agree to use it only to manage your own good-faith academic outreach. We process this data solely to provide the Service to you. If a professor contacts us requesting removal of their information, we may remove or restrict it and will make reasonable efforts to notify you.
6. Cookies & similar technologies
We use strictly necessary cookies to keep you signed in and to secure your session. We do not use the Service to sell your data or to run cross-site advertising tracking. Your browser settings can block cookies, but the Service may not function correctly without essential ones.
7. How we share information
We do not sell your personal information. We share it only:
- with subprocessors who process it on our behalf (Section 4);
- when required by law, legal process, or to protect rights, safety, and the integrity of the Service;
- in connection with a merger, acquisition, financing, or sale of assets, where the recipient agrees to honor this Policy.
8. Data retention
We retain your personal data while your account is active and as needed to provide the Service. When you delete your account or ask us to erase your data, we will delete or anonymize it within a reasonable period, except where retention is required for legal, security, or fraud-prevention purposes. Residual copies may persist in backups for a limited time before being overwritten.
9. Security
We use reasonable technical and organizational measures to protect your data, including password hashing and encryption of data in transit. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.
10. Your rights
Depending on where you live, you may have the following rights. We honor access, deletion, correction, and portability requests for all users regardless of location.
EEA/UK (GDPR)
You may request access to, correction, erasure, restriction, or portability of your data; object to certain processing; and withdraw consent. Where we rely on a lawful basis, it is typically the performance of our contract with you, your consent, or our legitimate interests in operating and securing the Service. You may lodge a complaint with your local data protection authority.
California (CCPA/CPRA)
You may request to know, access, correct, or delete your personal information, and you have the right not to receive discriminatory treatment for exercising these rights. We do not “sell” or “share” personal information as those terms are defined under California law.
To exercise any right, email us at privacy@gradscholar.xyz. We may need to verify your identity before acting on a request.
11. International data transfers
We are based in the United States, and your data may be processed in the United States and other countries whose laws may differ from those in your country. Where required, we use appropriate transfer mechanisms (such as Standard Contractual Clauses) to safeguard international transfers.
12. Children’s privacy
The Service is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it.
13. Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance.
14. Contact us
Questions or requests? Contact [Company Legal Name] at privacy@gradscholar.xyz or at [Company Address].