Privacy Policy

This Privacy Policy explains how Sweet An Business LLC, a California limited liability company doing business as “My School Advisor” (“we,” “us,” or “our”), collects, uses, and protects personal information when you use the My School Advisor website and services (the “Service”). It works together with our Terms of Service.

1. Who this policy covers

This policy applies to people who use the Service directly (students, parents/guardians, and counselors who sign up themselves). If your account was provided by a school or district, the school or district is the owner and controller of the student education records, and our handling of that data is governed by our separate agreement with the institution (including, where applicable, a FERPA data privacy agreement). In that case, please also refer to your school’s privacy notice.

2. Information we collect

• Account information: email address, role (student, parent/guardian, counselor), and authentication details (we store passwords only in hashed form via our authentication provider).
• Profile and planning information you provide: name, grade level, GPA, goals, intended major, target schools and programs, career interests, learning style, general location, financial-situation notes, and FAFSA status. Sensitive financial-situation notes are encrypted in our database.
• Academic records you add or upload: courses, schedules, and documents you scan or import (such as transcripts).
• Conversations and usage: the messages you exchange with our AI features and your activity within the Service.
• Payment information: handled by our payment processor (Helcim). We receive limited transaction details (such as plan and status) but do not store your full card number.
• Technical information: standard log and device data needed to operate and secure the Service.

3. How we use information

• to provide and personalize college- and career-planning features and AI-generated guidance;
• to operate accounts, process payments, and provide customer support;
• to run safety and academic-progress checks (these run as fixed database rules, not AI inference);
• to secure, maintain, and improve the Service;
• to test and improve our own advice using de-identified information, as described in Section 5;
• to comply with law and enforce our Terms.

4. AI processing and our service providers

We use a small set of trusted providers to run the Service:

• AI providers — Anthropic (Claude) and Google (Gemini): process your inputs to generate guidance. We use these providers on their paid/commercial terms, under which your content is not used to train their models.
• Hosting — Supabase and Vercel: store and serve data on certified cloud infrastructure located in the United States.
• Payments — Helcim.
• Email — Resend.

5. We do not sell your data or run ads

We will never sell, rent, or shareyour personal information — or your child’s — with third parties for their own marketing, advertising, recruitment, or other purposes. We do not run ads, we do not build advertising profiles, and we do not allow our AI providers to use your content to train their models. With us, you are the customer — not the product.

How we improve our own guidance.We may use de-identified information — with names, contact details, and other identifiers removed — to test and improve our own advice. We never share that improvement data, we never use it to train a model for anyone else, and we never try to re-identify it. This use takes effect on September 16, 2026 and applies only to information collected on or after that date; information collected before then is not used this way.

Children’s and students’ information receives the strongest protection.We use it only to provide the Service and, de-identified as described above, to improve our own guidance. We will never use it for advertising, never sell it, and never share it for anyone else’s purposes, under any circumstances. This is both our promise and our legal obligation under FERPA and applicable student-privacy laws.

6. When we share information

We share personal information only:

• with the service providers listed above, only to operate the Service on our behalf, under contracts that bar them from using your information for their own purposes;
• with your school, district, or counselor where you use the Service through them, consistent with our agreement with that institution;
• when you confirm that a course on your record covers a school’s course expectation, we may share that course-to-requirement answer with other users in anonymous, aggregated form (never your name, school, or any other personal details);
• when required by law or to protect rights, safety, and the security of the Service;
• in connection with a business transfer — see Section 11.

7. Security

We protect data in transit with TLS and at rest with AES-256 encryption, isolate every organization’s records, enforce database row-level security so the system denies access by default, and offer multi-factor authentication. No system is perfectly secure, but we work to protect your information using established safeguards.

8. Data retention and deletion

We keep your information for as long as your account is active or as needed to provide the Service. You can delete your account and associated data at any time from your account settings, or by emailing privacy@myschooladvisor.app — we fulfill verifiable deletion requests within 30 days. If you cancel a paid plan, your enriched data (profile, chat history, Academic History, and other saved details) is preserved in read-only form for 30 days so you can resubscribe without re-entering anything; after that it is deleted. We may keep de-identified information for the improvement purpose described in Section 5, and may retain limited information where required to comply with law. For accounts provided by a school or district, deletion requests are handled through that institution, which controls the records.

9. Children’s privacy

The Service is intended for users 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact privacy@myschooladvisor.app and we will delete it. Where the Service is used in a school context, student information is handled consistent with FERPA and applicable state student-privacy laws under our agreement with the school or district. A parent or guardian of a student user may contact us to review or request deletion of their child’s information. A parent or guardian who manages a student’s account can also delete that account and its data at any time from their family dashboard, in addition to emailing privacy@myschooladvisor.app.

10. Your privacy rights (including California)

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to not be discriminated against for exercising these rights. California residents have these rights under the California Consumer Privacy Act (as amended by the CPRA), including the right to know what we collect and the right to opt out of sale — and as noted above, we do not sell personal information. To exercise any right, email privacy@myschooladvisor.app. We will verify and respond as required by law.

11. Business transfers and successor entity

If the My School Advisor product is reorganized or moved into a separate company, or in connection with a merger, financing, or sale of the business or its assets, personal information may be transferred to the successor entityas part of that transaction. The successor entity will be bound by this Privacy Policy (or a policy at least as protective) with respect to your information. Our core commitments — including our promise never to sell your personal information— bind any successor, and we will not use a change in ownership to do what this Policy forbids.

12. Cookies

We use only the cookies needed to sign you in, keep you signed in, and remember basic preferences (such as your language and theme). We do not use third-party advertising or cross-site tracking cookies.

13. Where data is processed

We are based in the United States and process and store data in the United States. If you use the Service from outside the U.S., you understand your information will be processed in the U.S.

14. Changes to this policy

We may update this policy from time to time. We will update the “Last updated” date above and, for material changes, provide additional notice where appropriate. If we ever materially change how we use your personal information, we will give you advance notice, and we will not apply the new use to information we already collected from you without your explicit, opt-in consent.

15. Contact us