Privacy Policy

1. What Information Do We Collect?

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us, participate in platform activities, sync calendars, use our browser extension, or otherwise contact us.

A. Personal & Academic Profile Data

Collected during onboarding and managed within your Scholar Vault settings:

• Account Identity: Real full name, email address, username, password, and contact phone number.
• Academic Identifiers: Unweighted GPA, Academic Major / Field of Study, Grade Level / Academic Standing, school name, and academic interests.
• Demographic & Regional Data: While ScholarRank offers specialized local scholarship features and matching tailored for San Antonio and Texas students, our Privacy Policy, security standards, and data protections apply universally to all users everywhere across the United States and globally. Optional demographic details (Ethnicity and Household Income Level) are used strictly for specialized local, regional, and national match scoring.

B. Sensitive Information & Student Data

When necessary, with your explicit consent or as otherwise permitted by applicable law, we process the following sensitive categories:

• Racial or Ethnic Origin: Provided voluntarily during onboarding to calculate eligibility for minority-focused scholarship programs.
• Student Educational Data: Academic transcripts, GPA records, and directory details entered by the user into the Scholar Vault.

C. Social Media Login Data

We may provide you with the option to register or log in using your existing third-party social media account details (such as Facebook, X, or Google). Where you choose to do this, we receive profile information from your social provider, including your name, email address, profile picture, friend list, and any information you choose to make public.

D. Google API Services Compliance

Our use of information received from Google APIs will strictly adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google API data to train generalized AI models or transfer it to third-party data brokers.

E. Financial Tracking & Application Data

Stored within our secure database infrastructure:

• Financial Metrics: Target funding goals, total dollars awarded, and remaining tuition funding gaps.
• Application Pipelines: Custom-imported opportunities (via CSV or manual entry), application statuses (Saved, Applied, Awarded, Rejected), and personal notes or essay reminders.
• Self-Attestation Metadata: User-submitted attestation dates, confirmation references, or application notes to validate claimed submissions and award competitive points.

F. Gamification, Duels & Social Data

• Engagement Metrics: Points, daily login streaks, platform leaderboards, and Scholar Tier badges (Bronze, Silver, Gold, Platinum).
• Social Connections: Your unique Friend Code and connected peer network activity.
• Duels & Challenges: Head-to-head application challenge details, including wager amounts, challenge durations, scores, and winner statuses.

G. Calendar & Integration Data

• Calendar Tokens: A unique UUID (calendar_token) generated per profile to authorize secure external calendar access without needing account passwords.

H. Copilot Browser Extension & Local Storage Data

• Autofill Mappings: Temporary local mapping of your saved profile fields (such as academic credentials, major, contact details, and full name) to populate external application forms upon command.
• Local Session Tokens: Authentication session tokens stored in secure local browser storage to maintain active logins.

2. How Do We Process Your Information?

We process your personal information to provide, improve, and administer our Services, communicate with you, ensure security and fraud prevention, and comply with applicable laws. Specific operational uses include:

• Core Matching Algorithm: Processing GPA, major, grade level, school, and regional focus to calculate personalized match alignment scores, eligibility indices, and win probability percentages.
• Account Management & Authentication: Facilitating account creation, user logins, credential management, and maintaining your account in active working order.
• Financial Analytics: Displaying dashboard progress metrics toward your tuition funding goals and calculating remaining funding gaps.
• Form Auto-Fill: Enabling the Copilot Browser Extension to locate and fill matching input fields on external scholarship application portals upon user command.
• Calendar Deadlines: Generating dynamic .ics subscription feeds (/api/calendar?token=...) to sync deadlines with Google Calendar, Apple Calendar, or Outlook.
• Gamification & Duels: Updating leaderboards, assigning tier badges, tracking login streaks, and resolving head-to-head application challenges.
• Self-Attestation & Verification: Reviewing self-attested submission details to confirm user claims and award points fairly.
• Service Improvement & Evaluation: Identifying usage trends, measuring campaign effectiveness, fixing bugs, and improving platform usability.

3. When & With Whom Do We Share Personal Information?

ScholarRank does not sell, rent, trade, or share your personal or academic information with third-party advertisers or data brokers. We share your information only under the following specific circumstances:

• Google Maps Platform APIs: When using location-based scholarship features, we may share location data with Google Maps Platform APIs (e.g., Google Maps API, Places API). Google Maps uses GPS, Wi-Fi, and cell tower signals to estimate location (accurate to approximately 20 meters under optimal conditions) to provide accurate location directions.
• Connected Friends & Public Leaderboards: If you participate in social features or share your Friend Code, connected friends can view your tier status, leaderboard rank, streak count, and duel activity.
• External Application Portals: When you explicitly trigger the Copilot Browser Extension to auto-fill an application form, saved profile data is transmitted directly into that external website's form fields.
• Service Providers: We share data with trusted third-party service providers (cloud hosting, database management, authentication providers, and customer support) who operate under strict contractual data protection agreements.
• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Legal Obligations & Protection: We may disclose information where required by subpoena, court order, search warrant, or legal process, or to protect the rights, safety, and property of ScholarRank, our users, or the public.

4. Browser Extension & Local Session Disclosures

The ScholarRank Copilot Browser Extension:

• Only accesses web page DOM content to locate relevant scholarship application inputs (e.g., input fields for gpa, major, email, full_name).
• Operates locally within your web browser using isolated local session storage.
• Does not track, record, store, or sell your general web browsing history or activity on non-scholarship websites.

5. Do We Use Cookies & Other Tracking Technologies?

We may use cookies, local storage, web beacons, and pixels to store session information and enhance platform functionality.

• Essential Session Cookies & Local Storage: We use strictly necessary session cookies and secure authentication tokens (with SameSite=Strict and Secure flags over HTTPS) to maintain your logged-in state, prevent CSRF attacks, and persist local preferences across pages. These cannot be disabled.
• Bug Fixing & Crash Prevention: Internal online tracking mechanisms help us monitor platform health, diagnose system crashes, and resolve technical bugs.
• No Third-Party Ad or Behavioral Tracking Cookies: ScholarRank does not use third-party advertising cookies, retargeting beacons, social media tracking widgets, or third-party analytics services (such as Google Analytics or Facebook Pixel) for cross-site behavioral tracking.
• No Sale of Cookie Data: Cookie data is never sold, rented, or commercialized under any state or federal privacy standard.

6. How Long Do We Keep Your Information & How Is It Secured?

Data Security Measures: We implement robust organizational and technical security measures, including TLS 1.2+ encryption for data in transit and AES-256 encryption at rest. User credentials are managed via secure cloud authentication infrastructure. Isolated UUID tokens (calendar_token) prevent third-party calendar tools from accessing your account credentials.

Retention Period: We retain personal information for as long as you maintain an active account with us to fulfill the purposes described in this policy, unless a longer retention period is required by tax, accounting, or legal obligations.

Deletion Timelines: When you delete your account using the "Delete My Account & Private Data" feature in your Scholar Vault:

• All primary database records (profile, tracked scholarships, friend links, duel records) are permanently erased within 30 calendar days.
• Encrypted backup archives are completely overwritten and purged within 90 calendar days.

Data Breach Notification (Texas Bus. & Com. Code Ch. 521): In the event of a confirmed security breach involving sensitive personal data, ScholarRank will notify affected users without unreasonable delay and no later than 30 days after discovery of the breach. If the breach involves 250 or more Texas residents, ScholarRank will also submit formal electronic notification to the Texas Attorney General's Office via the official OAG Data Breach Reporting Portal.

7. Comprehensive US State Privacy Rights & Data Inventory

While specific state privacy frameworks establish statutory rights for residents of 19+ US states — including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — ScholarRank extends core consumer privacy rights (access, correction, deletion, data portability, and verification) to all users nationwide regardless of state of residence:

• Right to confirm processing and access personal data.
• Right to correct inaccuracies in personal records.
• Right to request permanent deletion of personal data.
• Right to obtain a portable copy of personal data in a machine-readable format (JSON).
• Right to list third-party disclosures and categories (California, Delaware, Maryland, Minnesota, Oregon, Connecticut).
• Right to limit use/disclosure of sensitive personal data (California, Texas).
• Right to opt out of sensitive data collection and voice/facial recognition (Florida).

Categories of Personal Information Collected (Past 12 Months)

8. California Consumer Privacy Rights (CCPA/CPRA) & Shine The Light

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you specific statutory rights:

• No Selling or Sharing: ScholarRank does not sell or share your personal information to third parties for monetary or valuable consideration.
• California Consumer Rights: Right to Know, Right to Delete, Right to Correct, and Right to Non-Discrimination.
• California "Shine The Light" Law (Civil Code § 1798.83): California residents may request and obtain from us once a year, free of charge, information regarding any disclosures of personal information to third parties for direct marketing purposes. Submit requests in writing to privacy@scholarrank.com.

9. Texas Consumer Privacy Rights (TDPSA - Tex. Bus. & Com. Code Ch. 541)

Texas residents are entitled to consumer privacy rights under the Texas Data Privacy and Security Act (TDPSA):

• Right to Confirm & Access: Confirm processing and instantly download a complete .json archive via Scholar Vault settings.
• Right to Correct & Delete: Update profile details or execute immediate data erasure using self-serve account tools.
• Right to Data Portability: Receive data in a structured, readily usable format.
• No Opt-Out Required: ScholarRank does not engage in targeted advertising, sell data, or perform profiling with legal effects.

We respond to verified requests within 45 days. If a request is declined, you may submit an appeal by emailing privacy@scholarrank.com with "TDPSA Appeal" in the subject line. If denied, you may file a complaint with the Texas Attorney General at texasattorneygeneral.gov.

10. Sensitive Data Processing & Consent (TDPSA §541.101 & DPA)

Under TDPSA §541.101, racial or ethnic origin is classified as sensitive data requiring explicit opt-in consent.

• Ethnicity Consent: Entering your optional ethnicity during onboarding constitutes explicit opt-in consent to process ethnicity solely for specialized match scoring. You may withdraw consent at any time by clearing the field in your Scholar Vault.
• Data Protection Assessment (TDPSA §541.105): ScholarRank maintains documented Data Protection Assessments for sensitive data processing, evaluating benefits, risks, and safeguards.

11. Do-Not-Track (DNT) & Universal Opt-Out Signals (GPC)

Do Not Track (DNT): DNT browser signals are not currently acted upon because ScholarRank does not engage in cross-site tracking or third-party ad targeting.

Global Privacy Control (GPC): Pursuant to TDPSA §541.055, ScholarRank honors Global Privacy Control (GPC) signals and Universal Opt-Out Mechanisms (UOOMs). Detecting a GPC signal automatically enforces opt-out preferences for targeted advertising and data sales (which are already disabled by default).

12. Identity Verification, Authorized Agents & Appeals Process

Request Verification: Upon receiving a data request, we verify your identity by matching request details with existing account records. We only use verification data for security purposes.

Authorized Agents: Authorized agents submitting requests on your behalf must provide written, signed authorization or power of attorney. We may verify user identity directly before completing agent requests.

Formal Appeals: If we decline your request, email benicioanguiano@gmail.com or privacy@scholarrank.com. We will provide a formal written explanation of our decision. You may escalate denied appeals to your state Attorney General.

13. European Union & UK GDPR Legal Bases & Data Subject Rights

If located in the EEA or UK, we process personal data under GDPR Article 6 legal bases:

• Contract Performance (Art. 6(1)(b)): Running core scholarship matching, profile Vault, and duels.
• Legitimate Interests (Art. 6(1)(f)): Platform security, fraud prevention, and system maintenance.
• Consent (Art. 6(1)(a)): Optional demographic fields and dynamic calendar feeds.

GDPR Articles 15–22 grant rights of Access, Rectification, Erasure (Right to be Forgotten), Restriction, Portability, and Objecting to processing, as well as lodging complaints with EU Data Protection Authorities.

14. International Data Transfers

ScholarRank operations are hosted in the United States. International data transfers from the EEA or UK are governed by European Commission-approved Standard Contractual Clauses (SCCs) pursuant to Decision (EU) 2021/914.

15. Children's & Minor Privacy (14+ Age Limit)

ScholarRank is restricted to students 14 years of age or older. We do not knowingly collect or maintain data from children under 14. Inadvertently collected data from users under 14 will be erased immediately upon notice.

16. Texas SCOPE Act Compliance (HB 18) — Minor Protections

In compliance with the Texas SCOPE Act (HB 18) for minors (ages 14–17):

• Parental/guardian consent is required during registration for minors aged 14–17.
• No targeted advertising or behavioral marketing is served to minors.
• Social features (Friend Codes, duels) are restricted to connected friends and not visible publicly.
• No financial transactions occur on the platform.

17. Comprehensive Student Privacy: FERPA & PPRA Disclosures

ScholarRank upholds federal student privacy rights under FERPA (20 U.S.C. § 1232g) and PPRA (20 U.S.C. § 1232h):

• FERPA Compliance: Academic vault data is entered voluntarily by individual users. Where operating under school district contracts, ScholarRank acts as a designated "school official" under 34 CFR § 99.31(a)(1)(i)(B).
• Protection of Pupil Rights Amendment (PPRA): ScholarRank does not administer surveys concerning PPRA's 8 protected areas. Voluntary household income entry for financial aid scoring does not constitute a PPRA survey.

18. Texas Student Privacy Act Compliance (Tex. Ed. Code §32.151)

Under Texas Education Code Chapter 32, Subchapter D, ScholarRank strictly prohibits targeted advertising (§ 32.152(1)), non-educational data mining/profiling (§ 32.152(2)), and selling or renting student information (§ 32.152(3)).

19. Texas Student Privacy Alliance (TxSPA) & TX-NDPA Readiness

ScholarRank supports the Texas Student Privacy Alliance (TxSPA) and stands ready to execute the standardized TX-NDPA (Texas National Data Privacy Agreement) and Exhibit E (General Offer of Terms) with Texas K–12 school districts. All student data remains the property of the contracting district or student.

20. Accessibility Commitment (ADA & WCAG 2.1 Level AA)

ScholarRank is committed to digital accessibility pursuant to ADA Title III, Section 508, and Texas HR Code §121.003. We align with WCAG 2.1 Level AA standards. Contact accessibility@scholarrank.com for accessibility support.

21. Do We Make Updates to This Notice?

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice via email and dashboard notification. Material changes apply prospectively only.

22. How Can You Contact Us About This Notice?

For questions, privacy inquiries, or data access requests, please reach out to our team: