Privacy Policy

This Privacy Policy explains how Sweet An Business LLC, a California limited liability company doing business as “My School Advisor” (“we,” “us,” or “our”), collects, uses, and protects personal information when you use the My School Advisor website and services (the “Service”). It works together with our Terms of Service.

1. Who this policy covers

This policy applies to people who use the Service directly (students, parents/guardians, and counselors who sign up themselves). If your account was provided by a school or district, the school or district is the owner and controller of the student education records, and our handling of that data is governed by our separate agreement with the institution (including, where applicable, a FERPA data privacy agreement). In that case, please also refer to your school’s privacy notice.

2. Information we collect

• Account information: email address, role (student, parent/guardian, counselor), and authentication details (we store passwords only in hashed form via our authentication provider).
• Profile and planning information you provide: name, grade level, GPA, goals, intended major, target schools and programs, career interests, learning style, general location, financial-situation notes, and FAFSA status. Sensitive financial-situation notes are encrypted in our database.
• Academic records you add or upload: courses, schedules, and documents you scan or import (such as transcripts).
• Conversations and usage: the messages you exchange with our AI features and your activity within the Service.
• Payment information: handled by our payment processor (Helcim). We receive limited transaction details (such as plan and status) but do not store your full card number.
• Technical information: standard log and device data needed to operate and secure the Service.

3. How we use information

• to provide and personalize college- and career-planning features and AI-generated guidance;
• to operate accounts, process payments, and provide customer support;
• to run safety and academic-progress checks (these run as fixed database rules, not AI inference);
• to secure, maintain, and improve the Service;
• to comply with law and enforce our Terms.

4. AI processing and our service providers

We use a small set of trusted providers to run the Service:

• AI providers — Anthropic (Claude) and Google (Gemini): process your inputs to generate guidance. We use these providers on their paid/commercial terms, under which your content is not used to train their models.
• Hosting — Supabase and Vercel: store and serve data on certified cloud infrastructure located in the United States.
• Payments — Helcim.
• Email — Resend.

5. We do not sell your data or run ads

We will never sell, rent, or shareyour personal information — or your child’s — with third parties for their own marketing, advertising, recruitment, or other purposes. We do not run ads, we do not build advertising profiles, and we do not allow our AI providers to use your content to train their models. With us, you are the customer — not the product.

Children’s and students’ information receives the strongest protection.We will never use it for advertising or commercial purposes, and we will never sell or share it for anyone else’s purposes, under any circumstances. This is both our promise and our legal obligation under FERPA and applicable student-privacy laws.

6. When we share information

We share personal information only:

• with the service providers listed above, only to operate the Service on our behalf, under contracts that bar them from using your information for their own purposes;
• with your school, district, or counselor where you use the Service through them, consistent with our agreement with that institution;
• when required by law or to protect rights, safety, and the security of the Service;
• in connection with a business transfer — see Section 11.

7. Security

We protect data in transit with TLS and at rest with AES-256 encryption, isolate every organization’s records, enforce database row-level security so the system denies access by default, and offer multi-factor authentication. No system is perfectly secure, but we work to protect your information using established safeguards.

8. Data retention and deletion

We keep your information for as long as your account is active or as needed to provide the Service, then delete or de-identify it within a reasonable period, except where we must retain it to comply with law. You can request deletion of your account and associated data at any time by emailing privacy@myschooladvisor.app. For accounts provided by a school or district, deletion requests are handled through that institution, which controls the records.

9. Children’s privacy

The Service is intended for users 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact privacy@myschooladvisor.app and we will delete it. Where the Service is used in a school context, student information is handled consistent with FERPA and applicable state student-privacy laws under our agreement with the school or district. A parent or guardian of a student user may contact us to review or request deletion of their child’s information.

10. Your privacy rights (including California)

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to not be discriminated against for exercising these rights. California residents have these rights under the California Consumer Privacy Act (as amended by the CPRA), including the right to know what we collect and the right to opt out of sale — and as noted above, we do not sell personal information. To exercise any right, email privacy@myschooladvisor.app. We will verify and respond as required by law.

11. Business transfers and successor entity

If the My School Advisor product is reorganized or moved into a separate company, or in connection with a merger, financing, or sale of the business or its assets, personal information may be transferred to the successor entityas part of that transaction. The successor entity will be bound by this Privacy Policy (or a policy at least as protective) with respect to your information. Our core commitments — including our promise never to sell your personal information— bind any successor, and we will not use a change in ownership to do what this Policy forbids.

12. Cookies

We use only the cookies needed to sign you in, keep you signed in, and remember basic preferences (such as your language and theme). We do not use third-party advertising or cross-site tracking cookies.

13. Where data is processed

We are based in the United States and process and store data in the United States. If you use the Service from outside the U.S., you understand your information will be processed in the U.S.

14. Changes to this policy

We may update this policy from time to time. We will update the “Last updated” date above and, for material changes, provide additional notice where appropriate. If we ever materially change how we use your personal information, we will give you advance notice, and we will not apply the new use to information we already collected from you without your explicit, opt-in consent.

15. Contact us