Privacy Policy

Template notice: This is a standard starting-point Privacy Policy, provided as a placeholder so Admitizen has a functioning legal page before launch. It has not been reviewed by an attorney and should be reviewed by qualified legal counsel — including for compliance with COPPA, FERPA, and your state's student-data-privacy laws — before being relied on in production, since this Service is used by families with minors.

1. Information we collect

We collect the following categories of information:

• Account information: name, email address, phone number (optional), and role (parent, student, or teacher/recommender).
• Student academic information: grade level, GPA, standardized test scores, target colleges, major interests, and graduation year, when entered.
• Application content: essays and essay drafts, application tasks and deadlines, and recommendation-letter request details.
• Usage and technical data: log data, IP address, and browser information, used for security (e.g. rate-limiting abusive requests) and diagnosing errors.

2. How we use your information

• To operate core features: timelines, task tracking, and deadline reminders.
• To generate AI-assisted essay feedback and recommendation-request drafts, when you use those features (sent to our AI provider, OpenAI or OpenRouter, solely to generate that response).
• To send account, task, and recommendation-status emails (via our email provider, Resend).
• To detect abuse and protect the Service (e.g. rate-limiting sign-in attempts).
• To monitor and fix errors (via Azure Application Insights, where enabled).

3. Children's privacy and parental consent

Admitizen is designed for use by families, including students under 18. Student accounts can only be created by, and exist under, a parent or guardian's family account — a student cannot sign up independently. Before a parent invites a student under 13 to join their family account, the parent must complete Admitizen's own account verification (email confirmation as the parent account holder) and affirmatively agree, on the student's behalf, to this Privacy Policy and our Terms of Service. This parent-initiated invite-and-consent step is the mechanism by which we obtain verifiable parental consent for children under 13, consistent with COPPA. We do not knowingly permit a child under 13 to create an account directly, and we do not knowingly collect personal information from a child under 13 outside of this parent-managed structure. Parents may review, update, or request deletion of their student's information at any time by contacting us, and may revoke consent by deleting the student's profile from their family account.

4. Cookies and analytics

We use a limited set of cookies and similar technologies:

• Strictly necessary cookies: used to keep you signed in and to secure your session (e.g. via Supabase authentication). These cannot be disabled without breaking core functionality.
• Diagnostic/error monitoring: where enabled, Azure Application Insights may set technical identifiers to help us detect and fix errors. This is not used for advertising.

We do not currently use third-party advertising cookies or cross-site tracking, and we do not sell or share your information for cross-context behavioral advertising. If this changes, we will update this section and, where required, obtain your consent.

5. How we share your information

We do not sell your personal information. We share data only with:

• Service providers who process data on our behalf: Supabase (database and authentication), OpenAI/OpenRouter (AI feature requests), Resend (email delivery), and Azure Application Insights (error monitoring, where enabled).
• Other family members within your own family account (e.g. a parent can see their student's tasks and application progress by design).
• Recommenders (teachers) you explicitly invite to submit a recommendation letter, who receive only the information needed to respond to that request.
• As required by law, or to protect the rights, safety, or property of Admitizen or its users.

6. Data retention

We retain your information for as long as your account is active. If you delete your account, we delete or anonymize your personal information within a reasonable period, except where retention is required for legal or security purposes.

7. Data security and breach notification

We use industry-standard safeguards, including encrypted connections (HTTPS), database row-level security so users can only access their own family's data, and rate limiting on authentication endpoints. No system is completely secure, and we cannot guarantee absolute security of information transmitted to the Service. If we become aware of a security breach that compromises your personal information, we will notify affected users and any applicable regulators without undue delay, and in accordance with applicable law, using the contact information associated with your account.

8. Your rights

Depending on your location, you may have some or all of the following rights regarding your personal information:

• The right to know what personal information we have collected about you.
• The right to access a copy of your personal information.
• The right to correct inaccurate personal information.
• The right to request deletion of your personal information.
• The right to opt out of the sale or “sharing” of personal information for cross-context behavioral advertising (Admitizen does not currently sell or share personal information for this purpose).
• The right not to receive discriminatory treatment for exercising these rights.

Residents of California, and other U.S. states with comparable consumer privacy laws, may exercise these rights, subject to applicable exceptions, by contacting us using the information in Section 10 below. We will verify your identity before fulfilling a request. You can manage most of this directly from your account settings.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will update the effective date above when changes are made.

10. Contact

This Service is operated by Admitizen (“we” or “us”) [placeholder — add your registered business name and entity type here once formed, e.g. “Acme Inc., a Delaware corporation”; until then this can be omitted]. Questions about this Privacy Policy, or requests to access, correct, or delete your data, can be sent to info@admitizen.com.