Privacy Policy

Effective Date: May 8, 2026 (v2.2 — Parent-buyer + minor-data-subject hardening) Last Updated: May 8, 2026 Prior version: v2.1 effective May 7, 2026

PLAIN-ENGLISH SUMMARY (not the legal contract): We collect what we need to compute college matches, score practice tests, generate AI essay feedback (when enabled), parse aid letters you upload, deliver receipts, and run the Service for you. We never sell your personal information, never share for cross-context behavioral advertising, never sell to data brokers, and never authorize any AI provider to train its models on your data. We collect academic and household-financial information about your student that you supply; we do not run background checks, scrape social media, or buy household data from data brokers. The legal text below controls.

1. Who We Are

The Service is operated by Digent LLC d/b/a Project College, a Florida limited liability company ("Digent," "Digent LLC," "Project College," "we," "us," or "our"). Digent LLC is the controller of personal information processed through projectcollege.ai, our subdomains, our APIs, and our mobile or desktop interfaces (collectively, the "Services"). This Privacy Policy ("Policy") describes how we collect, use, disclose, retain, and protect personal information. This Policy is incorporated into our Terms of Service.

By using the Services, you consent to the collection and use of personal information as described in this Policy. If you do not agree, do not use the Services.

This Policy applies to personal information we process as a business or controller. Where we process personal information on behalf of a school, employer, or other entity that has its own users (which is not currently the case), we would act as a service provider or processor for that entity under a written agreement.

2. Personal Information We Collect

2.1. Information you give us directly.

2.2. Information collected automatically.

2.3. Information from third parties.

2.4. Information we do not collect.

• Government identifiers about parents or students (no Social Security Number, driver's-license number, passport number, or similar) — except (a) the encrypted Tax-ID a parent voluntarily provides if the parent enrolls in the future Survey Program for an IRS Form 1099-MISC, or (b) data inadvertently included in a parent-uploaded aid letter, in which case we redact it during parsing where reasonably practicable;
• Health, mental-health, or disability information about parents or students (we do not ask about disabilities, accommodations, mental-health status, or special-needs status);
• Sexual orientation, gender identity, religion, race, ethnicity, citizenship, or political affiliation of parents or students (we do not ask; if a student volunteers any such information in an essay draft, we do not categorize it for any purpose other than returning AI essay feedback to the student);
• Biometric identifiers (no fingerprint, face geometry, voiceprint, or similar);
• Precise real-time geolocation (we use the address you provide; we do not track real-time location);
• Social-graph or contact-list data (we do not import contacts, friends, or social graphs);
• Raw card numbers, CVV, or bank-account numbers (those are handled exclusively by the payment processor);
• Information from a child under 13 (see Section 9).

3. Sources Other Than You

We may combine information you give us with public information (College Scorecard, IPEDS, Clery, Common Data Set, BLS, Census, EPA AQI, FIRE rankings, Wikipedia, Wikidata, and similar public data sources) and with metadata from our service providers, in order to compute match scores, chancing outputs, financial projections, and related Service outputs. We do not buy personal information about you or your student from data brokers. We do not buy commercial lists of student names, contact information, or academic profiles. We do purchase or use public-data feeds and tooling licenses (for example, mapping APIs, geocoding APIs, and federal-agency data aggregators) that contain only public, institution-level information, not personal information about you.

4. How and Why We Use Personal Information (Purposes; Lawful Bases)

We use personal information for the purposes below. For users in the EEA, UK, or another GDPR-equivalent jurisdiction, the lawful bases are noted in brackets. (See Section 12 — we do not direct the Services to the EEA or UK.)

4.1. Provide the Services.

Authenticate you, deliver matches and chancing outputs, score AP/SAT practice, parse aid letters, generate AI essay feedback (when enabled), render share cards, store profile and history, and route email and notifications. [Contractual necessity.]

4.2. Process payments and deliver licenses.

Pass billing data to the payment processor, return receipts, mark a Per-Student License active on success, reconcile chargebacks and refunds, and respond to processor disputes. [Contractual necessity; legal obligation.]

4.3. Communicate with you.

Send transactional and service emails (account confirmation, password reset, license delivery, security alerts, deadline reminders, policy updates, billing receipts). Send marketing email or SMS only with your express prior opt-in consent. [Contractual necessity for transactional; consent for marketing.]

4.4. Improve, debug, and secure the Services.

Diagnose errors, measure performance, prevent abuse, detect fraud, enforce rate limits, investigate reports of unauthorized access, and harden the Services. [Legitimate interests; legal obligation.]

4.5. Comply with law.

Respond to lawful subpoenas, court orders, or government requests; meet tax, accounting, and record-keeping obligations; cooperate with consumer-protection authorities. [Legal obligation.]

4.6. Enforce our Terms.

Investigate suspected violations of our Terms of Service, including scraping, model-training misuse, account-sharing, license abuse, chargeback abuse, and impersonation. [Legitimate interests.]

4.7. AI features.

We use third-party AI models (currently Anthropic's Claude; this list may change) to support enrichment of public school data, internal extraction tasks, AI-assisted essay feedback (when feature-flagged on), and similar features. We do not authorize any AI provider to use your personal information to train its models on a non-customer basis. Where we send your queries, essay drafts, or messages to a model provider, we use providers that contractually agree not to train their models on our customer data. We do not retain raw model inputs and outputs longer than necessary to deliver the feature. Specifically, we may transmit to an AI model provider: (a) public-data enrichment queries that contain no personal information about you or your student; (b) draft essay text and a content-quality prompt where you have explicitly enabled the AI essay-feedback feature flag; and (c) text extracted from an aid-letter you have uploaded for the limited purpose of identifying numeric award fields, with personal identifiers redacted before transmission where reasonably practicable. We do not send raw aid-letter image or PDF files to an AI provider; we extract text first and redact identifiers we recognize as Social Security Numbers, Tax-IDs, account numbers, or driver's-license numbers. [Legitimate interests; contractual necessity.]

4.8. Truth Bounty Survey Program (future).

If and when the survey program is activated and you opt in, we will use your survey responses, payout-account information, and Tax-ID solely to administer the survey program (including IRS Form 1099-MISC where applicable). Tax-IDs are encrypted at rest using a strong, industry-standard encryption-at-rest scheme (currently AES-256-GCM with provider-managed keys); the specific algorithm and key-management vendor may change over time as best practices evolve. The survey program is dark-launched; no live participation occurs without your explicit opt-in.

4.9. Aggregate and de-identified analytics.

We may produce statistical, aggregate, or de-identified data (for example, "x% of users in the 110k-plus income band gave Yale a 'high' chancing score") and use or disclose it without restriction, provided it cannot reasonably be used to identify you.

5. How We Share Personal Information

We share personal information only as described in this Section.

5.1. Service providers we use to operate the Services.

We share the minimum necessary information with vendors who process personal information on our behalf, under written contracts that restrict their use to the services they provide to us. Categories include:

• Hosting and infrastructure (currently Fly.io; database via libSQL/Turso)
• Payment processor / merchant of record (currently Stripe and/or Lemon Squeezy)
• Email delivery (currently Resend)
• AI model providers (currently Anthropic Claude; per Section 4.7)
• Analytics and error monitoring (limited, first-party-leaning)

5.2. Educational institutions.

We do not share your information with colleges, universities, or any institution listed in our catalog. The match scores, comparisons, and chancing outputs you see are computed locally for your account; they are not transmitted to any school. If you choose to apply to a school, you do that directly through the school's own application channels (Common Application, Coalition, school portal, etc.), independent of Project College.

5.3. Legal disclosures.

We may disclose personal information to comply with applicable law, a binding subpoena, court order, or governmental request; to protect our rights, property, safety, or those of our users or third parties; to enforce our Terms; or to investigate fraud, security incidents, or abuse. Where legally permitted, we will attempt to give you advance notice of a third-party request that involves your information.

5.4. Corporate transactions.

If Digent LLC or substantially all the assets relating to Project College are sold, merged, reorganized, or financed, personal information may be transferred as part of that transaction, subject to confidentiality and to a successor's obligation to honor this Policy. We will notify affected users by email and provide rights where required by law.

5.5. With your consent.

We may share personal information for any other purpose with your consent, including, when activated, your opt-in to the Survey Program.

5.6. What we do not do.

• We do not sell personal information for money.
• We do not "share" personal information for cross-context behavioral advertising, as that term is defined under the California Privacy Rights Act ("CPRA").
• We do not sell or share the personal information of consumers we have actual knowledge are under 16, in any case.
• We do not authorize AI providers to train their models on our customer data.
• We do not sell student-profile information to data brokers, marketers, college recruiters, or test publishers.
• We do not run third-party advertising on the Services.

6. Cookies and Tracking Technologies

We use only the cookies and storage we need to operate the Services. There are three categories:

1. Strictly necessary — session authentication, CSRF protection, license-state caching. Cannot be turned off without breaking the Services.
2. Preference — remembers your selected income band, parent-vs-student view, and similar non-tracking choices.
3. Limited first-party analytics — page-view counts, error rates, performance timing.

We do not use third-party advertising cookies, retargeting pixels, ad-network identifiers, fingerprinting libraries, or cross-context behavioral-advertising trackers. We honor the Global Privacy Control ("GPC") signal as a valid opt-out of any "sale" or "sharing" under California law.

7. Data Retention

We keep personal information only as long as we need it for the purposes described above and as required or permitted by law.

You may request earlier deletion. See Section 10.

8. Security

We implement administrative, technical, and physical safeguards that we believe are reasonably designed to protect personal information against unauthorized access, destruction, alteration, or disclosure, including encryption of data in transit using industry-standard TLS, hashing of passwords using a memory-hard password-hashing function (currently Argon2 or bcrypt), encryption-at-rest using AES-256-GCM or an equivalent for sensitive fields where in use (currently encrypted Tax-IDs and payment-processor account identifiers, both for the future Truth Bounty Survey Program), API-key hashing and least-privilege access, application-layer authorization checks on all multi-tenant data access, row-level access controls on parent and student data, standard cloud-provider security at the host level, periodic review of access privileges, segregation of production and non-production environments, and a practice of processing AI essay drafts in memory and not persisting them to disk except where the user explicitly saves a draft. The specific cryptographic algorithms, key-management vendors, and security tooling we use may change over time as best practices evolve; we describe our practices generally rather than guarantee any specific implementation. No safeguards are perfect.

If you suspect a security incident affecting your account, contact [email protected] immediately. We will notify affected users of any incident as required by applicable law (including state data-breach-notification statutes), and in any event within forty-five (45) days of confirming a security incident that creates a reasonable risk of identity theft, fraud, or other material harm to you, unless a law-enforcement agency requests a longer notification delay.

9. Children Under 13 (COPPA)

The Services are intended for use by adult parents and guardians and by high-school students aged 13 and over under a parent's account. The Services are not "directed to children" under the Children's Online Privacy Protection Act ("COPPA," 15 U.S.C. § 6501 et seq.). We do not knowingly collect personal information from a child under 13. The Student Portal account-creation flow requires the parent's prior approval (the parent creates the student profile and PIN; the student logs in using parent email plus first name plus PIN).

We collect the following information about a student aged 13 to 17 only with parental consent (the parent is the account holder): first name, grade level, GPA, SAT/ACT scores, AP scores, intended major, interests, activities, list of target schools. We do not collect a student's last name, photograph, telephone number, home address (other than the parent's household address used for tuition calculations), Social Security Number, biometric identifier, or precise geolocation.

If we learn that we have inadvertently collected personal information from a child under 13, we will delete it. To make a deletion request or to inquire about our practices regarding minors, contact [email protected]. The parent or legal guardian may at any time review, delete, or refuse further collection of the student's information by deleting the student profile or the parent account, or by emailing [email protected].

Data-subject hierarchy. Although the Service collects information about the Student (with the Parent's consent), the Parent is the data subject for all data we hold under the Parent's account. The Student does not have separate consumer rights against Project College in addition to those exercised by the Parent. The Parent exercises all access, correction, deletion, portability, and opt-out rights as the Student's parent or legal guardian. This is consistent with our consumer relationship: the Parent is our customer, the Service is sold to the Parent, and the Student is a person to whom the Parent has granted access. Where applicable state student-data law nonetheless grants a Student independent rights, the Student may exercise those rights through the Parent or, after the Student reaches the age of majority in their state of residence, directly. The Parent and the Student are bound by the Terms of Service § 4 and § 4.5 (no Project College supervision of the Student) and § 11.5 (no counseling; crisis resources) in addition to this Policy.

10. Your Rights and How to Exercise Them

Subject to verification of your identity and to limited exceptions permitted by law, you have the rights below. To exercise any of them, email [email protected] with the email address on your account and a clear description of your request. We respond within 45 days (extendable by an additional 45 days where allowed and on notice).

• Access / Know. Request a copy of the personal information we hold about you, the categories we collected, the sources, the purposes, and the categories of recipients.
• Correction. Request that we correct inaccurate information.
• Deletion. Request deletion of your account and personal information.
• Portability. Request a portable copy of your information in a structured, commonly used format (JSON or CSV).
• Opt-out of "sale" and "sharing." We do not sell or share for cross-context behavioral advertising. Where you have nonetheless submitted a GPC signal or an opt-out request, we will honor it.
• Limit use of sensitive personal information. We do not collect "sensitive" personal information for purposes other than those reasonably necessary to deliver the Services.
• Opt-out of marketing. Unsubscribe from any marketing email, reply STOP to any marketing SMS, or update your account notification preferences. Service messages cannot be opted out of while your account is active.
• Non-discrimination. We will not discriminate against you for exercising a privacy right.
• Authorized agent. You may designate an authorized agent to make a request on your behalf with proof of authorization.
• Appeal. If we deny a request, you may appeal by replying to our denial; we will respond to the appeal within 60 days.

We will not charge a fee unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, as permitted by law.

11. State-Specific Disclosures

This Section describes additional rights and disclosures for residents of certain U.S. states. Where state law provides greater protection than this Policy generally, that protection applies.

11.1. California (CCPA / CPRA).

In the prior 12 months we collected the following categories of personal information for the purposes described in Section 4: identifiers, household location, internet/network activity, education information (for the named student), commercial information (transaction records), inferences (match scores, chancing outputs), and a parent-supplied Tax-ID (where the parent voluntarily enrolls in the Survey Program). Sensitive personal information is not used or disclosed for purposes other than those permitted under Cal. Civ. Code § 1798.121(a). We do not sell or share personal information for cross-context behavioral advertising. California residents have all rights described in Section 10. Submit "Right to Know," "Right to Delete," "Right to Correct," and "Right to Limit" requests to [email protected]. We honor the GPC signal.

11.2. Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Delaware (DPDPA), New Hampshire, New Jersey, Tennessee, Indiana, Iowa, Minnesota, and other state comprehensive privacy laws.

Residents of these states have rights to access, correction, deletion, portability, and opt-out of targeted advertising and sale (we do not engage in either). Sensitive-data processing requires opt-in consent where the law requires it; we do not process sensitive data outside what is necessary to deliver the Services. Appeal a denial to [email protected]. Where a specific state requires additional or different disclosures, those disclosures are provided in the version of this Policy posted at projectcollege.ai/privacy on the date of your access, and the state-specific disclosures supersede the general disclosures in this Section to the extent of any conflict.

11.3. Florida.

Florida residents are covered by the Florida Digital Bill of Rights (Fla. Stat. § 501.701 et seq.) to the extent applicable. We comply with the Florida Telephone Solicitation Act (Fla. Stat. § 501.059) for any voice or SMS marketing. We comply with the Florida Online Protections for Minors Act (Fla. Stat. ch. 501, "HB 3"); the Services are not a "social media platform" within the meaning of that statute.

Florida HB 3 — Parental consent revocation. Where the Service collects or retains information about a Student under your account, you may revoke consent and request deletion of the Student's information at any time by emailing [email protected]. We will delete or de-identify the Student's information within thirty (30) days of receiving a verified request, except for fields we are required to retain by law (for example, transaction records and consent logs). Revocation of consent does not retroactively undo any prior processing of the Student's information.

11.4. Nevada.

Nevada residents may opt out of any "sale" of "covered information" under Nev. Rev. Stat. § 603A.340 by emailing [email protected]. We do not sell.

11.5. Illinois (BIPA).

We do not collect biometric identifiers or biometric information as defined by the Illinois Biometric Information Privacy Act.

11.6. New York (SHIELD Act).

We comply with the New York SHIELD Act with respect to the security of personal information of New York residents.

11.7. Student-data laws (FERPA, state SOPIPA-style laws).

Project College is a consumer-facing service purchased by a parent or legal guardian, not a service provided to a school under contract. Accordingly, the Family Educational Rights and Privacy Act ("FERPA," 20 U.S.C. § 1232g) does not apply to our processing in our consumer relationship with you. Where applicable consumer-facing state student-data-protection statutes (such as California SOPIPA, Cal. B&P § 22584; the New York Education Law § 2-d "Parents' Bill of Rights"; the Illinois Student Online Personal Protection Act; the Connecticut student-data law; the Colorado Student Data Transparency and Security Act; the Louisiana Student Privacy Act; and analogous laws in other states) impose obligations on operators of consumer services that handle student educational records, we comply with those obligations as applied to a consumer-facing operator: (a) we do not target advertising to a student or to any device or browser identified as a student's based on information acquired through the Services; (b) we do not amass a student profile for any non-Service purpose; (c) we do not sell student information; (d) we do not knowingly disclose covered student information except as described in this Policy. If we ever provide Services to a school, district, or institution under contract, we will execute a school-specific data-sharing agreement, designate the school as the controller, and act as the school's "school official" for FERPA's exception or as a "service provider" under applicable state law.

12. International Users; Data Transfers

The Services are operated from the United States and are intended for users in the United States. If you access them from outside the United States, your personal information will be transferred to and processed in the United States, which may have different data-protection laws than your country. We rely on appropriate transfer mechanisms (such as the EU Standard Contractual Clauses) where applicable. By using the Services from outside the United States, you consent to the transfer.

EEA / UK users have the rights described in Section 10 plus the right to lodge a complaint with their local supervisory authority. Our legal bases are described in Section 4. Project College does not direct the Services to data subjects in the European Economic Area or the United Kingdom and is not "established" in the EEA or UK. We do not have an appointed Article 27 representative because we do not offer the Services to EEA or UK data subjects within the meaning of Article 3(2)(a) of the GDPR. If you are in the EEA or UK and access the Services from there, you do so on your own initiative and we ask that you not purchase a Per-Student License. We will not knowingly enroll an EEA or UK resident, and a parent who indicates an EEA or UK billing or residence address will be redirected away from purchase. If we determine that we have inadvertently received an EEA or UK enrollment, we will refund and delete the data. If we choose to direct the Services to the EEA or UK in the future, we will appoint a representative under Article 27 and update this Policy.

13. Do Not Track

Different browsers offer different "Do Not Track" mechanisms. Because there is no industry standard for honoring DNT, we do not currently respond to DNT browser signals separately from the controls described above. We do honor the Global Privacy Control (GPC) signal as an opt-out of any "sale" or "sharing."

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated by email to the address on your account, or by a conspicuous in-product notice, at least thirty (30) days before the effective date, unless a shorter period is required by law or by an exigent security or legal need. Non-material changes (clarifying edits, contact-information updates) take effect when posted. The "Last Updated" date at the top reflects the most recent revision. Continued use of the Services after the effective date of any change constitutes acceptance.

15. Contact

For privacy questions or requests:

• Privacy email: [email protected]
• Security incident reports: [email protected]
• General legal: [email protected]
• Mailing address: Digent LLC, c/o Northwest Registered Agent LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702

Prepared by Digent LLC for the Project College Service. This Policy should be reviewed by qualified counsel before any material change to data practices and at the earlier of (a) MRR exceeding $10,000, (b) the first regulatory inquiry or demand, (c) the first reportable security incident, (d) any expansion of the Survey Program beyond a dark-launched state, (e) any expansion outside the United States or to users under 13, or (f) any direct contractual relationship with a school district or institution.