Last updated: May 13, 2026
Corvessa Partners LLC (“we,” “us,” or “our”) operates My School List at getmyschoollist.com. This Privacy Policy describes how we collect, use, and protect your information when you use our Service.
Account Information
We collect your email address and an encrypted password when you create an account. This information is used for authentication, account access, and communication about your subscription.
Subscription and Payment Information
When you subscribe, we collect your selected plan and billing cycle. Payments are processed by Stripe. We do not store, process, or have access to your credit card numbers or full payment details. Stripe handles all payment processing in accordance with PCI-DSS standards. We store your Stripe customer ID and subscription ID to manage your account. For more information, see Stripe's Privacy Policy.
Uploaded Documents
You may upload student transcripts (PDF files) for analysis. These documents are processed in real-time to generate your college recommendations and are not permanently stored on our servers.
Student Profile Data
When you use the Service, we store data associated with your analysis results, including your college list, saved scholarships, application tracking data, financial aid preferences, essay prompt bookmarks, AI counselor conversation history, and any notes you add. Activity list entries including activity descriptions, hours, grade levels, and timing; interview preparation answers and practice responses; and recommendation request tracking data including recommender names, deadlines, and status updates. This data is stored in your account to provide the platform features.
Shared Link Data
When you create a shared link, a token-based URL is generated that provides read-only access to your dashboard data. The link, its label, creation date, and expiration date are stored in our database.
Usage Data
We collect basic usage data to operate the Service, including authentication sessions and subscription status. We also use third-party analytics and advertising services as described in the next section.
We use the following third-party services:
PostHog
We use PostHog (posthog.com) to analyze product usage, understand which features help families, and identify where users experience friction. PostHog collects event data about pages viewed, buttons clicked, and flows completed.
Meta Pixel
We use the Meta Pixel (provided by Meta Platforms, Inc.) to measure the effectiveness of our advertising on Facebook and Instagram, and to show our ads to people who may be interested in our service. The Meta Pixel sets cookies and collects information about your visit.
You can opt out through your browser settings, ad blockers, or our cookie consent banner. Disabling these does not affect your ability to use My School List. For more on the specific cookies we set, see our Cookie Policy.
We use your information to:
We do not sell personal information. We do share limited information with advertising partners such as the Meta Pixel as disclosed above.
In addition to the analytics and advertising services above, we rely on the following providers to operate the Service:
The Service uses artificial intelligence provided by Anthropic (Claude) and OpenAI to generate college recommendations and power the AI College Counselor. When you use these features:
We are transparent about our use of AI because we believe you have the right to know how your information is processed and how your recommendations are generated.
Uploaded PDF files (transcripts) are transmitted securely via HTTPS, processed in memory by our serverless functions, and streamed through to the AI provider described in section 6. These files are not written to Supabase Storage, Vercel blob storage, or any database. We do not keep copies of your uploaded documents after analysis is complete. The results of the analysis (college list, scores, recommendations) are stored in your account.
The Affordability tools at /tools/affordability and /dashboard/my-college-list let you estimate your personal cost at each school on your list. To do that, you can choose to provide:
Our affordability estimates work from broad inputs rather than detailed financial records, so we do not ask for your exact adjusted gross income, tax forms, bank statements, asset values, or any other financial documents. We do not integrate with the IRS, FAFSA, or any bank.
Where it is stored
Financial inputs you provide are stored in a dedicated table (financial_inputs) in our Supabase database, separate from other account data. Row-level security policies ensure that only your authenticated account can read or modify your row. The table is encrypted at rest as part of Supabase's default infrastructure.
How it is used
These inputs are used only by our affordability calculations. They are processed by our server-side code and are not sent to OpenAI, Anthropic, or any other AI provider. They are not used for advertising, analytics, or any purpose other than producing your net price and Parent PLUS gap estimates.
Retention and deletion
Financial inputs are retained as long as your account exists, and are deleted within 30 days of an account deletion or financial data deletion request, matching the 30-day window in Section 13 for all account data. You can clear your financial inputs at any time from your account settings without deleting your account.
Our Affordability Estimator and Major Odds Calculator can use a student's academic profile to surface merit aid qualification and to calibrate admission odds. To support those features, you may choose to provide:
These are summary indicators only. We do not ask for individual section scores, subject test scores, AP scores, course-level grades, or your full transcript as part of these tools. Transcripts uploaded to other parts of the platform are covered separately in Section 7.
Where it is stored
Academic inputs you provide are stored in a dedicated table (academic_inputs) in our Supabase database, separate from your financial inputs and from other account data. Row-level security policies ensure that only your authenticated account can read or modify your row. The table is encrypted at rest as part of Supabase's default infrastructure.
How it is used
These inputs are used only by our merit aid qualification matching in the Affordability Estimator and by our admit-odds calibration in the Major Odds Calculator. They are processed by our server-side code and are not sent to OpenAI, Anthropic, or any other AI provider as part of these tools. They are not used for advertising, AI model training, or analytics events that include the raw values; any analytics derived from these tools logs behavior signals only (presence flags, counts, qualification booleans), never the GPA, SAT, or ACT numbers themselves.
Retention and deletion
Academic inputs are retained as long as your account exists, and are deleted within 30 days of an account deletion or academic data deletion request, matching the 30-day window in Section 13 for all account data. You can clear your academic inputs at any time from your account settings without deleting your account.
Our platform supports linked family accounts. A student can invite a parent or guardian to link to their account. Linked parents receive read access to the student's college list, application tracker, essay drafts, scholarship list, and other dashboard content. Students control whether to invite a parent and can revoke access at any time from their account settings. Parents do not have editing access to student content.
Parent-to-Student Suggestions
Linked parents can suggest colleges to their student through the platform. These suggestions appear in the student's dashboard with any notes the parent includes.
Deadline Email Alerts
We send automated deadline reminder emails to both students and their linked parents when alerts are enabled. These emails are sent 30, 14, 7, and 3 days before each deadline and on the day of. Users can disable alerts at any time from account settings.
Authorized personnel at Corvessa Partners LLC may access user accounts for customer support, abuse investigation, and platform maintenance. Access is limited to what is necessary for the specific task and logged where possible.
We use essential cookies and browser storage to manage your authentication session. We also use analytics and advertising cookies as described in Section 3. See our Cookie Policy for a detailed list of cookies and instructions on how to manage them.
Within 30 days of a deletion request, we will remove your account and associated data from our production systems. Database backups are retained for up to 30 days and are overwritten through normal backup rotation. Analytics data in PostHog and Meta may be retained according to those services' own retention policies.
You may request deletion of your account and all associated data at any time by contacting us at info@getmyschoollist.com.
My School List is intended for users 18 and older, or for users 13 to 17 with verifiable parental consent and supervision. For users under 18, we expect a parent or guardian to create and manage the account. Students under 13 may not use our platform.
If you are a parent and believe your child under 13 has provided us with personal information, please contact us at info@getmyschoollist.com and we will delete the information promptly.
My School List is a direct-to-consumer service. We are not a school, school district, or a “school official” under the Family Educational Rights and Privacy Act (FERPA). Academic records we collect come directly from parents or students, not from educational institutions. If your student's school uses our platform through a formal institutional agreement in the future, that arrangement will be governed by a separate agreement with appropriate FERPA provisions.
If you are a Virginia resident, you have the right under the Virginia Consumer Data Protection Act (VCDPA) to:
To exercise these rights, contact us at info@getmyschoollist.com. We will respond within 45 days.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and the UK GDPR give you the following rights with respect to your personal data:
Corvessa Partners LLC acts as the data controller for personal information collected through My School List. To exercise any of these rights, contact us at info@getmyschoollist.com.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you the following rights:
We do not sell personal information. We may share limited information with advertising partners like the Meta Pixel as disclosed above; California residents can opt out through our cookie consent banner or by using the “Do Not Sell or Share My Personal Information” link in our site footer.
To exercise these rights, contact us at info@getmyschoollist.com.
We use industry-standard security measures to protect your data, including:
Payment data is handled exclusively by Stripe's PCI-DSS compliant infrastructure. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
We may update this Privacy Policy from time to time. Material changes will be communicated via the email address associated with your account. Your continued use of the Service after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at info@getmyschoollist.com.
Corvessa Partners LLC
Commonwealth of Virginia
We use essential cookies to run the site, plus optional analytics and advertising cookies (PostHog and the Meta Pixel) to improve the product and measure ad performance. See our Cookie Policy and Privacy Policy.