Privacy Policy

1. Introduction

Corvessa Partners LLC (“we,” “us,” or “our”) operates My School List at getmyschoollist.com. This Privacy Policy describes how we collect, use, and protect your information when you use our Service.

2. Information We Collect

Account Information

We collect your email address and an encrypted password when you create an account. This information is used for authentication, account access, and communication about your subscription.

Subscription and Payment Information

When you subscribe, we collect your selected plan and billing cycle. Payments are processed by Stripe. We do not store, process, or have access to your credit card numbers or full payment details. Stripe handles all payment processing in accordance with PCI-DSS standards. We store your Stripe customer ID and subscription ID to manage your account. For more information, see Stripe's Privacy Policy.

Uploaded Documents

You may upload student transcripts (PDF files) for analysis. These documents are processed in real-time to generate your college recommendations and are not permanently stored on our servers.

Student Profile Data

When you use the Service, we store data associated with your analysis results, including your college list, saved scholarships, application tracking data, financial aid preferences, essay prompt bookmarks, AI counselor conversation history, and any notes you add. Activity list entries including activity descriptions, hours, grade levels, and timing; interview preparation answers and practice responses; and recommendation request tracking data including recommender names, deadlines, and status updates. This data is stored in your account to provide the platform features.

Shared Link Data

When you create a shared link, a token-based URL is generated that provides read-only access to your dashboard data. The link, its label, creation date, and expiration date are stored in our database.

Usage Data

We collect basic usage data to operate the Service, including authentication sessions and subscription status. We do not use third-party analytics or advertising trackers.

3. How We Use Your Information

We use your information to:

• Provide the college planning platform and its features
• Authenticate your account and manage your subscription
• Process payments through Stripe
• Generate AI-powered college recommendations, counselor responses, and scholarship matches
• Enable shared links with parents, counselors, or advisors
• Communicate important updates about your account or the Service

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Third-Party Services

We use the following third-party services to operate the Service:

• Stripe — Payment processing and subscription management, PCI-DSS compliant. See stripe.com/privacy.
• Supabase — Database hosting and authentication. Stores account information, subscription data, college lists, application tracking data, scholarships, and all platform data. Data encrypted at rest.
• Anthropic — AI analysis and counselor. Uploaded documents and counselor conversations are sent to Anthropic's Claude API for processing. Anthropic does not use API data to train its models. See anthropic.com/privacy.
• Vercel — Web hosting. Hosts the application and processes serverless API requests.

5. AI Processing Disclosure

The Service uses artificial intelligence provided by Anthropic (Claude) to generate college recommendations and power the AI College Counselor. When you use these features:

• Your uploaded transcripts, student profile data, and counselor messages are transmitted to Anthropic's API for processing;
• Anthropic processes this data solely to generate your results and does not use API-submitted data to train its models;
• AI-generated recommendations and counselor responses are probabilistic and may contain errors or reflect outdated information;
• No human reviews your uploaded documents, counselor conversations, or the AI-generated output as part of the standard service.

We are transparent about our use of AI because we believe you have the right to know how your information is processed and how your recommendations are generated.

6. Document Handling

Uploaded PDF files (transcripts) are transmitted securely via HTTPS, processed in real-time by our serverless functions and the Anthropic API, and are not permanently stored on our servers or in our database. We do not keep copies of your uploaded documents after analysis is complete. The results of the analysis (college list, scores, recommendations) are stored in your account.

7. Cookies and Local Storage

We use essential cookies and browser storage to manage your authentication session. This is required for the Service to function. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

8. Data Retention

• Account data (email, password hash) is retained as long as your account exists.
• Subscription data is retained as long as your account exists and in accordance with Stripe's retention policies.
• Platform data (college lists, applications, scholarships, counselor history) is retained as long as your account exists.
• Uploaded documents are not retained after processing.
• Shared links are retained until they expire or are revoked by the user.

You may request deletion of your account and all associated data at any time by contacting us at info@getmyschoollist.com.

9. Children's Privacy (COPPA)

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. The Service is intended for use by parents, guardians, and students aged 18 or older (or with parental consent for students aged 13–17). If you believe a child under 13 has provided us with personal information, please contact us immediately at info@getmyschoollist.com.

10. Virginia Consumer Data Protection Act

If you are a Virginia resident, you have the right under the Virginia Consumer Data Protection Act (VCDPA) to:

• Confirm whether we are processing your personal data
• Access your personal data
• Correct inaccuracies in your personal data
• Delete your personal data
• Obtain a portable copy of your personal data

To exercise these rights, contact us at info@getmyschoollist.com. We will respond within 45 days.

11. Security

We use industry-standard security measures to protect your data, including:

• HTTPS encryption for all data in transit
• Secure authentication via Supabase with encrypted password storage
• Row-level security policies on all database tables
• Encrypted database storage

Payment data is handled exclusively by Stripe's PCI-DSS compliant infrastructure. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the email address associated with your account. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at info@getmyschoollist.com.

Corvessa Partners LLC
Commonwealth of Virginia