Privacy Policy

1. Introduction

Corvessa Partners LLC (“we,” “us,” or “our”) operates My School List at getmyschoollist.com. This Privacy Policy describes how we collect, use, and protect your information when you use our Service.

2. Information We Collect

Account Information

We collect your email address and an encrypted password when you create an account. This information is used for authentication, account access, and communication about your subscription.

Subscription and Payment Information

When you subscribe, we collect your selected plan and billing cycle. Payments are processed by Stripe. We do not store, process, or have access to your credit card numbers or full payment details. Stripe handles all payment processing in accordance with PCI-DSS standards. We store your Stripe customer ID and subscription ID to manage your account. For more information, see Stripe's Privacy Policy.

Uploaded Documents

You may upload student transcripts (PDF files) for analysis. These documents are processed in real-time to generate your college recommendations and are not permanently stored on our servers. See Section 7 for the full details, including the identifiers we derive from a transcript and retain.

Student Profile Data

When you use the Service, we store data associated with your analysis results, including your college list, saved scholarships, application tracking data, financial aid preferences, essay prompt bookmarks, AI counselor conversation history, and any notes you add. Activity list entries including activity descriptions, hours, grade levels, and timing; interview preparation answers and practice responses; and recommendation request tracking data including recommender names, deadlines, and status updates. This data is stored in your account to provide the platform features.

Optional student biographical profile information (such as legal name, preferred name, date of birth, home address, phone number, high school details, parent or guardian details, languages, number of siblings, and demographic information including race or ethnicity and citizenship or visa status) is a separate, optional data category and is described in detail in Section 10.

Shared Link Data

When you create a shared link, a token-based URL is generated that provides read-only access to your dashboard data. The link, its label, creation date, and expiration date are stored in our database.

Usage Data

We collect basic usage data to operate the Service, including authentication sessions and subscription status. We also use third-party analytics and advertising services as described in the next section.

3. Third-Party Analytics and Advertising

We use the following third-party services:

PostHog

We use PostHog (posthog.com) to analyze product usage, understand which features help families, and identify where users experience friction. PostHog collects event data about pages viewed, buttons clicked, and flows completed.

Meta Pixel

We use the Meta Pixel (provided by Meta Platforms, Inc.) to measure the effectiveness of our advertising on Facebook and Instagram, and to show our ads to people who may be interested in our service. The Meta Pixel sets cookies and collects information about your visit.

You can opt out through your browser settings, ad blockers, or our cookie consent banner. Disabling these does not affect your ability to use My School List. For more on the specific cookies we set, see our Cookie Policy.

4. How We Use Your Information

We use your information to:

• Provide the college planning platform and its features
• Authenticate your account and manage your subscription
• Process payments through Stripe
• Generate AI-powered college recommendations, counselor responses, and scholarship matches
• Enable shared links with parents, counselors, or advisors
• Communicate important updates about your account or the Service
• Measure product usage and advertising performance through the analytics services disclosed above

We do not sell personal information. We do share limited information with advertising partners such as the Meta Pixel as disclosed above.

5. Other Service Providers

In addition to the analytics and advertising services above, we rely on the following providers to operate the Service:

• Stripe: Payment processing and subscription management, PCI-DSS compliant. See stripe.com/privacy.
• Supabase: Database hosting and authentication. Stores account information, subscription data, college lists, application tracking data, scholarships, financial inputs, academic inputs, optional biographical profile data, and other platform data. Data is encrypted at rest.
• Anthropic and OpenAI: AI analysis and AI College Counselor. Specific categories of information are sent to each provider, and only for specific features. The full itemization of what is and is not sent to these providers is in Section 6 (AI Processing Disclosure). Neither provider uses API-submitted data to train its models. See anthropic.com/privacy and openai.com/policies/privacy-policy.
• Vapi (vapi.ai): Voice interview platform. When you use the voice interview feature, live microphone audio from your browser is streamed to Vapi. Vapi performs speech-to-text on the audio, routes the resulting interview transcript to Anthropic for processing, and performs text-to-speech on the response so it can be played back in your browser. Vapi relies on its own sub-processors for the STT and TTS steps. See vapi.ai/privacy.
• Resend: We use Resend (resend.com) to send transactional emails including welcome messages, quiz results, deadline alerts, payment confirmations, and account notifications. Email addresses are provided to Resend solely for delivery purposes.
• Vercel: Web hosting. Hosts the application and processes serverless API requests.
• Sentry: Error monitoring. Records application errors and diagnostic context so we can find and fix bugs.

6. AI Processing Disclosure

The Service uses artificial intelligence provided by Anthropic (Claude) and OpenAI to power several features. We are precise below about which features send which information to which provider, because previous versions of this policy described this in broader terms than what the Service actually does.

What is sent to AI providers

• Transcript analysis. When you upload a high school transcript PDF, the file is transmitted to the AI provider that powers the analysis (currently OpenAI). The provider extracts your first name and current grade level from the transcript. Those two identifiers are then persisted in your account in the saved_lists table and are reused as context each time you use the AI College Counselor, so that the counselor can address you by name and tailor responses to your grade level. The PDF itself is not stored after analysis. See Section 7.
• AI College Counselor. When you use the AI College Counselor, your typed messages, the conversation history, and a limited set of profile fields are sent to OpenAI. The profile fields are limited to your display name, account type, intended major, class year (graduation year), and the first name and grade level derived from your transcript when present.
• Progress and Next Steps recommendations. When you use the Progress feature's “Next Steps” recommendations, a limited set of profile fields (display name, account type, intended major, class year) are sent to Anthropic to generate the recommendations.
• Essay AI Coach. When you use the Essay AI Coach, the full text of your essay draft is sent verbatim to Anthropic, along with the essay prompt and any rubric or coaching configuration you have selected. Anthropic processes the essay solely to generate the feedback you request.
• Voice interview feature. When you use the voice interview feature, live microphone audio from your browser is streamed to Vapi (see Section 5). Vapi performs speech-to-text on the audio and routes the resulting interview transcript to Anthropic. Anthropic generates the interviewer's response, which Vapi converts back to speech and streams to your browser. Voice audio is sensitive personal information and is handled under Vapi's privacy and security practices and the practices of its STT and TTS sub-processors.

What is not sent to AI providers

• Your financial inputs (income bracket, SAI, family size, number of children in college, target budget) are not sent to Anthropic, OpenAI, Vapi, or any other AI provider. See Section 8.
• Your raw academic inputs (GPA, SAT total, ACT composite) stored in the academic_inputs table are not sent to Anthropic, OpenAI, Vapi, or any other AI provider. See Section 9.
• Your student biographical profile (legal name, date of birth, home address, phone, high school details, parent or guardian details, languages, number of siblings, demographic information, citizenship or visa status) stored in the student_bio_profile table is not sent to Anthropic, OpenAI, Vapi, or any other AI provider. The same rule applies to the biographical sub-tables that hold the repeating Common App records (siblings, languages_detail, prior_secondary_schools, prior_colleges_universities, current_year_courses, honors, community_based_organizations, and test_scores): none of them is sent to Anthropic, OpenAI, Vapi, or any other AI provider, and none of them is used for advertising or for analytics about you. The biographical profile and its sub-tables are a distinct, AI-free data path. See Section 10.

General terms for AI processing

• The AI providers above process the data they receive solely to generate your results and do not use API-submitted data to train their models.
• AI-generated recommendations, counselor responses, essay feedback, and interview output are probabilistic and may contain errors or reflect outdated information.
• No human reviews your uploaded documents, counselor conversations, essay drafts, voice transcripts, or the AI-generated output as part of the standard service.

We are transparent about our use of AI because we believe you have the right to know how your information is processed and how your recommendations are generated.

7. Document Handling

Uploaded PDF files (transcripts) are transmitted securely via HTTPS, processed in memory by our serverless functions, and streamed through to the AI provider described in Section 6. These files are not written to Supabase Storage, Vercel blob storage, or any database. We do not keep copies of your uploaded PDF files after analysis is complete.

The results of the analysis (college list, scores, recommendations) are stored in your account. As part of the analysis, the AI provider also extracts two identifiers from your transcript: your first name and your current grade level. These derived identifiers are persisted in the saved_lists table in our Supabase database and are reused as context each time you use the AI College Counselor, so that the counselor can address you by name and tailor responses to your grade level. You can clear these stored identifiers by clearing your saved list data or by requesting account deletion under Section 14.

8. Financial Information

The Affordability tools at /tools/affordability and /dashboard/my-college-list let you estimate your personal cost at each school on your list. To do that, you can choose to provide:

• A household income bracket (for example, $75,000 to $110,000) rather than your exact income
• Your Student Aid Index (SAI), obtained from the U.S. Department of Education's Federal Student Aid Estimator at studentaid.gov/aid-estimator
• Your family size and number of children currently in college
• A target annual education budget

Our affordability estimates work from broad inputs rather than detailed financial records, so we do not ask for your exact adjusted gross income, tax forms, bank statements, asset values, or any other financial documents. We do not integrate with the IRS, FAFSA, or any bank.

Where it is stored

Financial inputs you provide are stored in a dedicated table (financial_inputs) in our Supabase database, separate from other account data. Row-level security policies ensure that only your authenticated account can read or modify your row. The table is encrypted at rest as part of Supabase's default infrastructure.

How it is used

These inputs are used only by our affordability calculations. They are processed by our server-side code and are not sent to OpenAI, Anthropic, Vapi, or any other AI provider. They are not used for advertising, analytics, or any purpose other than producing your net price and Parent PLUS gap estimates.

Retention and deletion

Financial inputs are retained as long as your account exists, and are deleted within 30 days of an account deletion or financial data deletion request, matching the 30-day window in Section 14 for all account data. You can clear your financial inputs at any time from your account settings without deleting your account.

9. Academic Information

Our Affordability Estimator and Major Odds Calculator can use a student's academic profile to surface merit aid qualification and to calibrate admission odds. To support those features, you may choose to provide:

• Cumulative high school GPA, both unweighted (0.00 to 4.00) and weighted (0.00 to 6.00) if you have both
• SAT total score (Math plus Evidence-Based Reading and Writing, 400 to 1600)
• ACT composite score (1 to 36)

These are summary indicators only. We do not ask for individual section scores, subject test scores, AP scores, course-level grades, or your full transcript as part of these tools. Transcripts uploaded to other parts of the platform are covered separately in Section 7.

Where it is stored

Academic inputs you provide are stored in a dedicated table (academic_inputs) in our Supabase database, separate from your financial inputs and from other account data. Row-level security policies ensure that only your authenticated account can read or modify your row. The table is encrypted at rest as part of Supabase's default infrastructure.

How it is used

These inputs are used only by our merit aid qualification matching in the Affordability Estimator and by our admit-odds calibration in the Major Odds Calculator. They are processed by our server-side code and are not sent to OpenAI, Anthropic, Vapi, or any other AI provider as part of these tools. They are not used for advertising, AI model training, or analytics events that include the raw values; any analytics derived from these tools logs behavior signals only (presence flags, counts, qualification booleans), never the GPA, SAT, or ACT numbers themselves.

Retention and deletion

Academic inputs are retained as long as your account exists, and are deleted within 30 days of an account deletion or academic data deletion request, matching the 30-day window in Section 14 for all account data. You can clear your academic inputs at any time from your account settings without deleting your account.

10. Student Biographical Profile

The Service offers optional tools that let a family collect, review, and reuse the student's own biographical information when filling out the family's own college applications. To support those tools, you may choose to provide a student biographical profile. Every field in this section is optional. You are not required to provide any of it to use the Service.

The biographical profile mirrors the fields a family fills out on the Common App, organized into the same sections the Common App uses. Information you may choose to provide includes:

Profile information

• Legal name, preferred name, middle name, and suffix
• Whether you have application materials under a former legal name, and that former legal name
• Date of birth
• Permanent home address, and an optional alternate mailing address (street, city, state, ZIP, and country for each)
• Preferred and alternate phone numbers, including the phone type and country code for each
• Gender identity (a multi-select field that allows custom additions you enter yourself) and, captured separately, legal sex
• Pronouns (a multi-select field that allows custom additions)
• U.S. Armed Forces status
• Whether you are Hispanic or Latino, captured separately from race or ethnicity
• Race or ethnicity
• The number of languages you are proficient in, and per-language detail (the language, your proficiency, whether you speak, read, write, or understand it, whether it is your first language, and whether it is spoken in your home)
• Birth country, birth city, and the number of years you have lived in the United States
• Citizenship or visa status, and, for students under the U.S. resident umbrella, a citizenship sub-status (such as DACA, asylum, refugee, Deferred Enforced Departure, Temporary Protected Status, undocumented, pending status, or noncitizen federal aid eligibility)

Family information

• Your parents' marital status relative to each other
• With whom you make your permanent home
• Whether you have children
• For up to two parents or guardians: parent type, living status, prefix, first name, middle initial, last name, former last name, suffix, occupation, highest education level, email, and relationship to you
• The number of siblings you have, and per-sibling detail (name, age, relationship, education level, and the school or workplace) for any siblings you choose to list

Education information

• High school name and CEEB code
• The date you entered your current high school, whether it is a boarding school, whether you did or will graduate from it, and any progression details (such as graduating early or late, taking time off, or a gap year)
• Per-school detail for prior secondary or high schools you attended (name, CEEB code, city, state, country, entry and exit dates, whether it was a boarding school, and the reason you left)
• Per-institution detail for colleges or universities where you have taken coursework (name, CEEB code, location, term type, start and end terms, any degree earned, and credit hours earned)
• Class rank and class rank reporting context
• Your graduating class size and the GPA scale you report on
• Per-course detail for your current or most recent year courses (name, level, credit units, scheduling, term, and grade), and the course scheduling system you use
• Honors detail (the honor's title, its level, and the grade in which you received it) for any honors you choose to report
• Community-based organization affiliations (organization name, counselor name, and counselor email) for organizations that have provided you free assistance with your application
• Your future plans, including applicant type, the highest degree you intend to earn, and your career interest
• Intended major
• Graduation year

Testing information

• Whether you wish to self-report standardized test scores or future test dates
• Self-reported scores and planned future test dates for the ACT, SAT, AP, IB, TOEFL, IELTS, Duolingo English Test, Cambridge, PTE Academic, and international leaving examinations, including the test type, the test date, whether the date is a planned future date, the total score, and section-level scores
• Whether you participate in an international leaving examination

Activities information

• Whether you have activities to report. The activity entries themselves continue to live in your activity list and are covered by the platform data described in Section 2.
• A “Responsibilities” selection that can disclose your caregiving load, family translation work, household financial contribution, transportation you provide, and care of family members including your own children
• A “Circumstances” selection that can disclose housing instability, homelessness, lack of utilities, lack of internet access, independent living, and a long commute

Writing information

• A reference to the personal essay you select as your Common App personal statement, and the “I understand” acknowledgment on that selected essay
• Two optional free-text Additional Information fields: one for challenges or circumstances you have experienced (which may include disclosures about topics such as violence, discrimination, family disruption, addiction, military deployment, natural disasters, mental health, and war), and one for qualifications not reflected elsewhere in your application

Every field above is optional. The demographic, citizenship, family, and free-text fields are provided only if your family wants them transferred into your own college applications. None of these fields are required to use the Service, and you can leave any or all of them blank.

Where it is stored

Biographical profile data you provide is stored in a dedicated table (student_bio_profile) in our Supabase database, separate from your financial inputs, your academic inputs, and other account data. Row-level security policies ensure that only your authenticated account can read or modify your row. The table is encrypted at rest as part of Supabase's default infrastructure.

How it is used

This data is used solely so that your family can review its own information and transfer that information into its own college applications using tools you control. The autofill tool that places the data into application forms runs entirely in your browser. It does not transmit your biographical profile to us or to any third party in order to perform the fill.

Your biographical profile is not sent to Anthropic, OpenAI, Vapi, or any other AI provider. It is not used for advertising, and it is not used for analytics about you. The biographical profile is a distinct, AI-free data path that is separate from the AI College Counselor, the AI college recommendations, the Essay AI Coach, the voice interview feature, and the transcript analysis flows described in Sections 6 and 7.

Sensitive personal information

Several of the fields above are treated as “sensitive personal information” under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), and a number of them are also special-category personal data under the GDPR and the UK GDPR. We collect each of these fields only if you choose to provide it. The sensitive categories in the biographical profile are:

• Date of birth: CCPA and CPRA sensitive personal information, and special-category personal data under the GDPR and the UK GDPR, when the applicant is a minor.
• Race or ethnicity, and whether you are Hispanic or Latino: CCPA and CPRA sensitive personal information, and special-category personal data under the GDPR and the UK GDPR.
• Citizenship or visa status: CCPA and CPRA sensitive personal information, and special-category personal data under the GDPR and the UK GDPR.
• Gender identity, legal sex, and pronouns: CCPA and CPRA sensitive personal information, and special-category personal data under the GDPR and the UK GDPR.
• U.S. Armed Forces status: CCPA and CPRA sensitive personal information.
• Citizenship sub-status (DACA, asylum, refugee, Deferred Enforced Departure, Temporary Protected Status, undocumented, pending status, or noncitizen federal aid eligibility): CCPA and CPRA sensitive personal information, and treated as special-category-adjacent under the GDPR and the UK GDPR.
• Birth country and birth city: national origin under the GDPR and the UK GDPR special-category rules, and CCPA and CPRA sensitive personal information.
• A parent or guardian's living status (deceased status), a parent or guardian's occupation, and a parent or guardian's highest education level: CCPA and CPRA sensitive personal information.
• Whether you have children: sensitive personal information in the context of a minor applicant.
• The “Responsibilities” and “Circumstances” selections: sensitive because they disclose caregiving status, household poverty signals, and housing insecurity.
• The reason you give for leaving a prior secondary school: sensitive when you fill it in, because the entry can describe difficult personal circumstances.
• The Additional Information challenges narrative: this is the highest-sensitivity surface in the biographical profile and is addressed in its own paragraph below.
• Community-based organization affiliations: sensitive in aggregate, because membership can reveal socioeconomic and immigration status.

A parent or guardian's occupation and highest education level were collected under an earlier version of this policy as standard personal information. We have reclassified them as sensitive personal information. The fields themselves are unchanged, and we have not moved or repurposed any data you previously entered.

The citizenship sub-status field can describe immigration status that is sensitive to disclose, including undocumented or DACA status. We never share this field with any third party, and it is never sent to any AI provider. If you are deciding whether to record undocumented, DACA, or similar status, consider reviewing that decision with a trusted adult or an attorney first. You can leave the field blank and enter the information directly on the Common App instead.

The “Responsibilities” and “Circumstances” selections can disclose caregiving load, family translation work, household financial contribution, housing instability, homelessness, lack of utilities, and lack of internet access. These selections are required on the Common App but are optional here. We use them only so that your family can transfer them into its own applications, and we never send them to any AI provider.

The Additional Information challenges field is a free-text field. The Common App's own suggested topics invite disclosure of violence, discrimination, family disruption, addiction, military deployment, natural disasters, mental health, war, and similar subjects, so anything you write here may be a sensitive personal narrative. The reason-for-leaving field on a prior secondary school can carry the same kind of content. Both fields are optional. You can leave them blank and write directly into the Common App instead, both fields are never sent to any AI provider, and you can clear them at any time from your account settings.

Community-based organization affiliations are treated as sensitive as a whole rather than field by field, because the affiliation itself can reveal socioeconomic status and, for programs that serve specific populations, immigration status. We never send these affiliations to any AI provider.

For every sensitive category above, we use the information solely so that your family can transfer it into its own college applications. We do not use it for any secondary purpose, including advertising, analytics, profiling, model training, or input to any AI provider. You can leave these fields blank, fill them in later, or clear them at any time from your account settings without affecting your access to the Service.

Retention and deletion

Biographical profile data is retained as long as your account exists, and is deleted within 30 days of an account deletion or biographical data deletion request, matching the 30-day window in Section 14 for all account data. You can clear your biographical profile, or any individual field within it, at any time from your account settings without deleting your account.

11. Parent and Student Account Linking

Our platform supports linked family accounts. A student can invite a parent or guardian to link to their account. Linked parents receive read access to the student's college list, application tracker, essay drafts, scholarship list, and other dashboard content. Students control whether to invite a parent and can revoke access at any time from their account settings. Parents do not have editing access to student content.

Parent-to-Student Suggestions

Linked parents can suggest colleges to their student through the platform. These suggestions appear in the student's dashboard with any notes the parent includes.

Deadline Email Alerts

We send automated deadline reminder emails to both students and their linked parents when alerts are enabled. These emails are sent 30, 14, 7, and 3 days before each deadline and on the day of. Users can disable alerts at any time from account settings.

12. Administrative Access

Authorized personnel at Corvessa Partners LLC may access user accounts for customer support, abuse investigation, and platform maintenance. Access is limited to what is necessary for the specific task and logged where possible.

13. Cookies and Local Storage

We use essential cookies and browser storage to manage your authentication session. We also use analytics and advertising cookies as described in Section 3. See our Cookie Policy for a detailed list of cookies and instructions on how to manage them.

14. Data Retention

• Account data (email, password hash) is retained as long as your account exists.
• Subscription datais retained as long as your account exists and in accordance with Stripe's retention policies.
• Platform data (college lists, applications, scholarships, counselor history) is retained as long as your account exists.
• Uploaded documents are not retained after processing. Identifiers derived from your transcript (first name, grade level) are persisted in your saved_lists record as described in Section 7.
• Financial inputs (income bracket, SAI, family size, budget) are retained as long as your account exists and can be cleared at any time from settings. See Section 8 for details.
• Academic inputs (GPA, SAT total, ACT composite) are retained as long as your account exists and can be cleared at any time from settings. See Section 9 for details.
• Biographical profile (legal name, preferred name, date of birth, home address, phone, high school details, parent or guardian details, languages, number of siblings, demographic information, citizenship or visa status) is retained as long as your account exists and can be cleared at any time from settings. See Section 10 for details.
• Biographical sub-tables (siblings, language detail, prior secondary schools, prior colleges, current-year courses, honors, community-based organizations, and self-reported test scores) are retained as long as your account exists and can be cleared at any time from settings.
• Shared links are retained until they expire or are revoked by the user.

Within 30 days of a deletion request, we will remove your account and associated data from our production systems. Database backups are retained for up to 30 days and are overwritten through normal backup rotation. Analytics data in PostHog and Meta may be retained according to those services' own retention policies.

You may request deletion of your account and all associated data at any time by contacting us at info@getmyschoollist.com.

15. Users Under 18 and Children's Privacy (COPPA)

My School List is intended for users 18 and older, or for users 13 to 17 with verifiable parental consent and supervision. For users under 18, we expect a parent or guardian to create and manage the account. Students under 13 may not use our platform.

If you are a parent and believe your child under 13 has provided us with personal information, please contact us at info@getmyschoollist.com and we will delete the information promptly.

16. FERPA Statement

My School List is a direct-to-consumer service. We are not a school, school district, or a “school official” under the Family Educational Rights and Privacy Act (FERPA). Academic records we collect come directly from parents or students, not from educational institutions. If your student's school uses our platform through a formal institutional agreement in the future, that arrangement will be governed by a separate agreement with appropriate FERPA provisions.

17. Virginia Consumer Data Protection Act

If you are a Virginia resident, you have the right under the Virginia Consumer Data Protection Act (VCDPA) to:

• Confirm whether we are processing your personal data
• Access your personal data
• Correct inaccuracies in your personal data
• Delete your personal data
• Obtain a portable copy of your personal data

To exercise these rights, contact us at info@getmyschoollist.com. We will respond within 45 days.

18. European Union and United Kingdom Residents

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and the UK GDPR give you the following rights with respect to your personal data:

• Access a copy of the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Request a portable copy of your data
• Object to or restrict certain processing
• Withdraw consent to optional processing (including analytics and advertising cookies, and the optional biographical profile described in Section 10, including the special-category fields within it such as race or ethnicity, Hispanic or Latino identity, gender identity, legal sex, pronouns, citizenship and citizenship sub-status, and birth country and city) at any time
• Lodge a complaint with your local data protection authority

Corvessa Partners LLC acts as the data controller for personal information collected through My School List. To exercise any of these rights, contact us at info@getmyschoollist.com.

19. California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you the following rights:

• Right to know what personal information we collect, use, and share
• Right to delete personal information we have collected
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information
• Right to limit use of sensitive personal information, including the race or ethnicity, Hispanic or Latino identity, citizenship or visa status, gender identity, legal sex, pronouns, U.S. Armed Forces status, citizenship sub-status, birth country and birth city, parent or guardian deceased status, parent or guardian occupation and education level, whether you have children, the Responsibilities and Circumstances selections, the reason for leaving a prior secondary school, the Additional Information challenges narrative, and community-based organization affiliations described in Section 10
• Right to non-discrimination for exercising these rights

We do not sell personal information. We may share limited information with advertising partners like the Meta Pixel as disclosed above; California residents can opt out through our cookie consent banner or by using the “Do Not Sell or Share My Personal Information” link in our site footer.

To exercise these rights, contact us at info@getmyschoollist.com.

20. Security

We use industry-standard security measures to protect your data, including:

• HTTPS encryption for all data in transit
• Secure authentication via Supabase with encrypted password storage
• Row-level security policies on all database tables
• Encrypted database storage

Payment data is handled exclusively by Stripe's PCI-DSS compliant infrastructure. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

21. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the email address associated with your account. Your continued use of the Service after changes constitutes acceptance of the updated policy.

22. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at info@getmyschoollist.com.

Corvessa Partners LLC
Commonwealth of Virginia