Privacy Policy

==============

Last updated: June 1, 2026

This Privacy Policy describes Our policies and procedures on the collection,

use and disclosure of Your information when You use the Service and tells You

about Your privacy rights and how the law protects You.

We use Your Personal Data to provide and improve the Service. By using the

Service, You agree to the collection and use of information in accordance with

this Privacy Policy.

Interpretation and Definitions

——————————

Interpretation

~~~~~~~~~~~~~~

The words whose initial letters are capitalized have meanings defined under

the following conditions. The following definitions shall have the same

meaning regardless of whether they appear in singular or in plural.

Definitions

~~~~~~~~~~~

For the purposes of this Privacy Policy:

* Account means a unique account created for You to access our Service or

parts of our Service.

* Affiliate means an entity that controls, is controlled by, or is under

common control with a party, where “control” means ownership of 50% or

more of the shares, equity interest or other securities entitled to vote

for election of directors or other managing authority.

* Application refers to GradMap, the software program provided by the

Company.

* Business , for the purpose of CCPA/CPRA, refers to the Company as the

legal entity that collects Consumers’ personal information and determines

the purposes and means of the processing of Consumers’ personal

information, or on behalf of which such information is collected and that

alone, or jointly with others, determines the purposes and means of the

processing of consumers’ personal information, that does business in the

State of California.

* CCPA and/or CPRA refers to the California Consumer Privacy Act (the

“CCPA”) as amended by the California Privacy Rights Act of 2020 (the

“CPRA”).

* Company (referred to as either “the Company”, “We”, “Us” or “Our” in this

Diego, California, 92127.

* Consumer , for the purpose of the CCPA/CPRA, means a natural person who is

a California resident. A resident, as defined in the law, includes (1)

every individual who is in the USA for other than a temporary or

transitory purpose, and (2) every individual who is domiciled in the USA

who is outside the USA for a temporary or transitory purpose.

* Country refers to: California, United States

* Device means any device that can access the Service such as a computer, a

cell phone or a digital tablet.

* Do Not Track (DNT) is a concept that has been promoted by US regulatory

authorities, in particular the U.S. Federal Trade Commission (FTC), for

the Internet industry to develop and implement a mechanism for allowing

internet users to control the tracking of their online activities across

websites.

* Personal Data (or “Personal Information”) is any information that relates

to an identified or identifiable individual.

For the purposes of the CCPA/CPRA, Personal Data means any information

that identifies, relates to, describes or is capable of being associated

with, or could reasonably be linked, directly or indirectly, with You.

We use “Personal Data” and “Personal Information” interchangeably unless a

law uses a specific term.

* Service refers to the Application.

* Service Provider means any natural or legal person who processes the data

on behalf of the Company. It refers to third-party companies or

individuals employed by the Company to facilitate the Service, to provide

the Service on behalf of the Company, to perform services related to the

Service or to assist the Company in analyzing how the Service is used.

* Usage Data refers to data collected automatically, either generated by the

use of the Service or from the Service infrastructure itself (for example,

the duration of a page visit).

* You means the individual accessing or using the Service, or the company,

or other legal entity on behalf of which such individual is accessing or

using the Service, as applicable.

Collecting and Using Your Personal Data

—————————————

Types of Data Collected

~~~~~~~~~~~~~~~~~~~~~~~

Personal Data

*************

While using Our Service, We may ask You to provide Us with certain personally

identifiable information that can be used to contact or identify You.

Personally identifiable information may include, but is not limited to:

* Email address

* First name and last name

* Phone number

* Address, State, Province, ZIP/Postal code, City

Usage Data

**********

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device’s Internet Protocol

address (e.g. IP address), browser type, browser version, the pages of our

Service that You visit, the time and date of Your visit, the time spent on

those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect

certain information automatically, including, but not limited to, the type of

mobile device You use, Your mobile device’s unique ID, the IP address of Your

mobile device, Your mobile operating system, the type of mobile Internet

browser You use, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit Our

Service or when You access the Service by or through a mobile device.

Use of Your Personal Data

~~~~~~~~~~~~~~~~~~~~~~~~~

The Company may use Personal Data for the following purposes:

* To provide and maintain our Service , including to monitor the usage of

our Service.

* To manage Your Account: to manage Your registration as a user of the

Service. The Personal Data You provide can give You access to different

functionalities of the Service that are available to You as a registered

user.

* For the performance of a contract: the development, compliance and

undertaking of the purchase contract for the products, items or services

You have purchased or of any other contract with Us through the Service.

* To contact You: To contact You by email, telephone calls, SMS, or other

equivalent forms of electronic communication, such as a mobile

application’s push notifications regarding updates or informative

communications related to the functionalities, products or contracted

services, including the security updates, when necessary or reasonable for

their implementation.

* To provide You with news, special offers, and general information about

other goods, services and events which We offer that are similar to those

that you have already purchased or inquired about unless You have opted

not to receive such information.

* To manage Your requests: To attend and manage Your requests to Us.

* For business transfers: We may use Your Personal Data to evaluate or

conduct a merger, divestiture, restructuring, reorganization, dissolution,

or other sale or transfer of some or all of Our assets, whether as a going

concern or as part of bankruptcy, liquidation, or similar proceeding, in

which Personal Data held by Us about our Service users is among the assets

transferred.

* For other purposes : We may use Your information for other purposes, such

as data analysis, identifying usage trends, determining the effectiveness

of our promotional campaigns and to evaluate and improve our Service,

products, services, marketing and your experience.

We may share Your Personal Data in the following situations:

* With Service Providers: We may share Your Personal Data with Service

Providers to monitor and analyze the use of our Service, for payment

processing, to contact You.

* For business transfers: We may share or transfer Your Personal Data in

connection with, or during negotiations of, any merger, sale of Company

assets, financing, or acquisition of all or a portion of Our business to

another company.

* With Affiliates: We may share Your Personal Data with Our affiliates, in

which case we will require those affiliates to honor this Privacy Policy.

Affiliates include Our parent company and any other subsidiaries, joint

venture partners or other companies that We control or that are under

common control with Us.

* With business partners: We may share Your Personal Data with Our business

partners to offer You certain products, services or promotions.

* With other users: If Our Service offers public areas, when You share

Personal Data or otherwise interact in the public areas with other users,

such information may be viewed by all users and may be publicly

distributed outside.

* With Your consent : We may disclose Your Personal Data for any other

purpose with Your consent.

Retention of Your Personal Data

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The Company will retain Your Personal Data only for as long as is necessary

for the purposes set out in this Privacy Policy. We will retain and use Your

Personal Data to the extent necessary to comply with our legal obligations

(for example, if We are required to retain Your data to comply with applicable

laws), resolve disputes, and enforce our legal agreements and policies.

Where possible, We apply shorter retention periods and/or reduce

identifiability by deleting, aggregating, or anonymizing data. Unless

otherwise stated, the retention periods below are maximum periods (“up to”)

and We may delete or anonymize data sooner when it is no longer needed for the

relevant purpose. We apply different retention periods to different categories

of Personal Data based on the purpose of processing and legal obligations:

* Account Information

* User Accounts: retained for the duration of your account relationship

plus up to 24 months after account closure to handle any post-

termination issues or resolve disputes.

* Customer Support Data

* Support tickets and correspondence: up to 24 months from the date of

ticket closure to resolve follow-up inquiries, track service quality,

and defend against potential legal claims

* Chat transcripts: up to 24 months for quality assurance and staff

training purposes.

* Usage Data

* Application usage statistics: up to 24 months to understand feature

adoption and service improvements.

* Server logs (IP addresses, access times): up to 24 months for security

monitoring and troubleshooting purposes.

* Marketing Data

* Email Marketing: retained until you unsubscribe or up to 24 months from

your last engagement (last email opened or clicked), whichever comes

first.

* Financial and Transaction Data

* Payment information: credit/debit card details are not stored on Our

servers; they are processed by our Payment Service Providers. We retain

transaction records (invoice details, purchase history, amounts) for up

to 10 years from the date of transaction to comply with tax laws and

financial regulations.

* Billing and invoice records: up to 10 years to meet accounting and tax

compliance requirements.

Usage Data is retained in accordance with the retention periods described

above, and may be retained longer only where necessary for security, fraud

prevention, or legal compliance.

We may retain Personal Data beyond the periods stated above for different

reasons:

* Legal obligation: We are required by law to retain specific data (e.g.,

financial records for tax authorities).

* Legal claims: Data is necessary to establish, exercise, or defend legal

claims.

* Your explicit request: You ask Us to retain specific information.

* Technical limitations: Data exists in backup systems that are scheduled

for routine deletion.

You may request information about how long We will retain Your Personal Data

by contacting Us.

When retention periods expire, We securely delete or anonymize Personal Data

according to the following procedures:

* Deletion: Personal Data is removed from Our systems and no longer actively

processed.

* Backup retention: Residual copies may remain in encrypted backups for a

limited period consistent with our backup retention schedule and are not

restored except where necessary for security, disaster recovery, or legal

compliance.

* Anonymization: In some cases, We convert Personal Data into anonymous

statistical data that cannot be linked back to You. This anonymized data

may be retained indefinitely for research and analytics.

Transfer of Your Personal Data

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Your information, including Personal Data, is processed at the Company’s

operating offices and in any other places where the parties involved in the

processing are located. It means that this information may be transferred to —

and maintained on — computers located outside of Your state, province, country

or other governmental jurisdiction where the data protection laws may differ

from those from Your jurisdiction.

Where required by applicable law, We will ensure that international transfers

of Your Personal Data are subject to appropriate safeguards and supplementary

measures where appropriate. The Company will take all steps reasonably

necessary to ensure that Your data is treated securely and in accordance with

this Privacy Policy and no transfer of Your Personal Data will take place to

an organization or a country unless there are adequate controls in place

including the security of Your data and other personal information.

Delete Your Personal Data

~~~~~~~~~~~~~~~~~~~~~~~~~

You have the right to delete or request that We assist in deleting the

Personal Data that We have collected about You.

Our Service may give You the ability to delete certain information about You

from within the Service.

You may update, amend, or delete Your information at any time by signing in to

Your Account, if you have one, and visiting the account settings section that

allows you to manage Your personal information. You may also contact Us to

request access to, correct, or delete any Personal Data that You have provided

to Us.

Please note, however, that We may need to retain certain information when we

have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Business Transactions

*********************

If the Company is involved in a merger, acquisition or asset sale, Your

Personal Data may be transferred. We will provide notice before Your Personal

Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

***************

Under certain circumstances, the Company may be required to disclose Your

Personal Data if required to do so by law or in response to valid requests by

public authorities (e.g. a court or a government agency).

Other legal requirements

************************

The Company may disclose Your Personal Data in the good faith belief that such

action is necessary to:

* Comply with a legal obligation

* Protect and defend the rights or property of the Company

* Prevent or investigate possible wrongdoing in connection with the Service

* Protect the personal safety of Users of the Service or the public

* Protect against legal liability

Security of Your Personal Data

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The security of Your Personal Data is important to Us, but remember that no

method of transmission over the Internet, or method of electronic storage is

100% secure. While We strive to use commercially reasonable means to protect

Your Personal Data, We cannot guarantee its absolute security.

Role-Based Access

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

GradMap provides role-based access to the Service, meaning that different users — students, parents, and counselors — have different levels of visibility into account information. Each role is designed to support the college planning process while protecting the privacy of all users, particularly minors.

All non-student roles are strictly read-only. No parent or counselor may edit, modify, or delete any information within a student’s account.

Parent Role

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Parents or guardians may create their own separate GradMap account and request access to a student’s account, or may be invited directly by the student. A connection between a parent account and a student account is only established when the student either sends an invitation to the parent or accepts an invitation from the parent. Parents cannot access any student account information until this mutual connection is confirmed. A student may be connected to more than one parent or guardian account.

Once connected, parents may have read-only visibility into:

The student’s activity and accomplishment records
Academic information such as GPA data and course history
Application-related information including audit and review status
Saved programs and planning progress
Upcoming tasks, reminders, and planning milestones (when available)
In-platform communications relevant to the student’s planning process

Students may modify or revoke parent access at any time through their account settings. Personal information viewed through the Parent Role is subject to the same data protection practices described in this Privacy Policy.

Counselor Role

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

School counselors and independent educational consultants may create their own separate GradMap account and request access to a student’s account, or may be invited directly by the student. A connection between a counselor account and a student account is only established when the student either sends an invitation to the counselor or accepts an invitation from the counselor. Counselors cannot access any student account information until this mutual connection is confirmed. A student may be connected to more than one counselor account.

Once connected, counselors may have read-only visibility into:

The student’s activity and accomplishment records
Academic information such as GPA data and course history
Application-related information including audit and review status
Saved programs and planning progress
Upcoming tasks, reminders, and planning milestones (when available)
In-platform communications relevant to the student’s planning process

Students may modify or revoke counselor access at any time through their account settings. Personal information viewed through the Counselor Role is subject to the same data protection practices described in this Privacy Policy.

Detailed Information on the Processing of Your Personal Data

————————————————————

The Service Providers We use may have access to Your Personal Data. These

third-party vendors collect, store, use, process and transfer information

about Your activity on Our Service in accordance with their Privacy Policies.

Email and SMS Marketing

~~~~~~~~~~~~~~~

We may use Your Personal Data to contact You with newsletters, marketing or

promotional materials and other information that may be of interest to You.

You may opt-out of receiving any, or all, of these communications from Us by

following the unsubscribe link or instructions provided in any email We send

or by contacting Us.

We may use Email Marketing Service Providers to manage and send emails to You.

* Mailchimp

Mailchimp is an email marketing sending service provided by The Rocket

Science Group LLC.

For more information on the privacy practices of Mailchimp, please visit

their Privacy policy: <https://mailchimp.com/legal/privacy/>

We may use SMS and Email Marketing Service Providers to manage and send emails to You.

* Twilio

Twilio is a cloud communications platform used to send SMS and/or email notifications and

in-app messages to users regarding platform updates, reminders, and

communications between counselors, parents, and students when such electronic

communications have been consented to. SMS features are available to users who have opted in during registration or through account settings

For more information on the privacy practices of Twilio, please visit their

Payments

~~~~~~~~

We may provide paid products and/or services within the Service. In that case,

we may use third-party services for payment processing (e.g. payment

processors).

We will not store or collect Your payment card details. That information is

provided directly to Our third-party payment processors whose use of Your

personal information is governed by their Privacy Policy. These payment

processors adhere to the standards set by PCI-DSS as managed by the PCI

Security Standards Council, which is a joint effort of brands like Visa,

Mastercard, American Express and Discover. PCI-DSS requirements help ensure

the secure handling of payment information.

* Stripe

Their Privacy Policy can be viewed at <https://stripe.com/us/privacy>

CCPA/CPRA Privacy Notice (California Privacy Rights)

—————————————————-

This privacy notice section for California residents supplements the

information contained in Our Privacy Policy and it applies solely to all

visitors, users, and others who reside in the State of California.

Categories of Personal Information Collected

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

We collect information that identifies, relates to, describes, references, is

capable of being associated with, or could reasonably be linked, directly or

indirectly, with a particular Consumer or Device. The following is a list of

categories of personal information which We may collect or may have been

collected from California residents within the last twelve (12) months.

Please note that the categories and examples provided in the list below are

those defined in the CCPA/CPRA. This does not mean that all examples of that

category of personal information were in fact collected by Us, but reflects

our good faith belief to the best of Our knowledge that some of that

information from the applicable category may be and may have been collected.

For example, certain categories of Personal Information would only be

collected if You provided such personal information directly to Us.

* Category A: Identifiers.

Examples: A real name, alias, postal address, unique personal identifier,

online identifier, Internet Protocol address, email address, account name,

driver’s license number, passport number, or other similar identifiers.

Collected: Yes.

* Category B: Personal information categories listed in the California

Customer Records statute (Cal. Civ. Code § 1798.80(e)).

Examples: A name, signature, physical characteristics or description,

address, telephone number, passport number, driver’s license or state

identification card number, insurance policy number, education,

employment, employment history, bank account number, credit card number,

debit card number, or any other financial information, medical

information, or health insurance information.

Some personal information included in this category may overlap with other

categories.

Collected: Yes.

* Category C: Protected classification characteristics under California or

federal law.

Examples: Age (40 years or older), race, color, ancestry, national origin,

citizenship, religion or creed, marital status, medical condition,

physical or mental disability, sex (including gender, gender identity,

gender expression, pregnancy or childbirth and related medical

conditions), sexual orientation, veteran or military status, genetic

information (including familial genetic information).

Collected: No.

* Category D: Commercial information.

Examples: Records of personal property, products or services purchased,

obtained, or considered, or other purchasing or consuming histories or

tendencies.

Collected: Yes.

* Category E: Biometric information.

Examples: Genetic, physiological, behavioral, and biological

characteristics, or activity patterns used to extract a template or other

identifier or identifying information, such as, fingerprints, faceprints,

and voiceprints, iris or retina scans, keystroke, gait, or other physical

patterns, and sleep, health, or exercise data.

Collected: No.

* Category F: Internet or other similar network activity.

Examples: Browsing history, search history, information on a consumer’s

interaction with a website, application, or advertisement.

Collected: Yes.

* Category G: Geolocation data.

Examples: Approximate physical location, physical location or movements.

Collected: No.

* Category H: Sensory data.

Examples: Audio, electronic, visual, thermal, olfactory, or similar

information.

Collected: No.

* Category I: Professional or employment-related information.

Examples: Current or past job history or performance evaluations.

Collected: No.

* Category J: Non-public education information (per the Family Educational

Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

Examples: education records directly related to a student maintained by an

educational institution or party acting on its behalf, such as grades,

transcripts, class lists, student schedules, student identification codes,

student financial information, or student disciplinary records.

Collected: Yes.

* Category K: Inferences drawn from other personal information.

Examples: Profile reflecting a person’s preferences, characteristics,

psychological trends, predispositions, behavior, attitudes, intelligence,

abilities, and aptitudes.

Collected: Yes.

* Category L: Sensitive personal information.

Examples: Government-issued identifying numbers, financial account

details, genetic data, precise geolocation, race or ethnicity, religious

or philosophical beliefs, union membership, mail, email, text messages,

biometric data, health data, and sexual orientation or sex life.

Collected: Yes.

Under CCPA/CPRA, Personal Information does not include:

* Publicly available information from government records

* Deidentified or aggregated consumer information

* Information excluded from the CCPA/CPRA’s scope, such as:

* Health or medical information covered by the Health Insurance

Portability and Accountability Act of 1996 (HIPAA) and the California

Confidentiality of Medical Information Act (CMIA) or clinical trial data

* Personal Information covered by certain sector-specific privacy laws,

including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley

Act (GLBA) or California Financial Information Privacy Act (FIPA), and

the Driver’s Privacy Protection Act of 1994

Sources of Personal Information

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

We obtain the categories of personal information listed above from the

following categories of sources:

* Directly from You. For example, from the forms You complete on our

Service, preferences You express or provide through our Service, or from

Your purchases on our Service.

* Indirectly from You. For example, from observing Your activity on our

Service.

* Automatically from You. For example, through cookies We or our Service

Providers set on Your Device as You navigate through our Service.

* From Service Providers. For example, third-party vendors for payment

processing, or other third-party vendors that We use to provide the

Service to You.

Use of Personal Information

~~~~~~~~~~~~~~~~~~~~~~~~~~~

We may use or disclose personal information We collect for “business purposes”

or “commercial purposes” (as defined under the CCPA/CPRA), which may include

the following examples:

* To operate our Service and provide You with Our Service.

* To provide You with support and to respond to Your inquiries, including to

investigate and address Your concerns and monitor and improve our Service.

* To fulfill or meet the reason You provided the information. For example,

if You share Your contact information to ask a question about our Service,

We will use that personal information to respond to Your inquiry. If You

provide Your personal information to purchase a product or service, We

will use that information to process Your payment and facilitate delivery.

* To respond to law enforcement requests and as required by applicable law,

court order, or governmental regulations.

* As described to You when collecting Your personal information or as

otherwise set forth in the CCPA/CPRA.

* For internal administrative and auditing purposes.

* To detect security incidents and protect against malicious, deceptive,

fraudulent or illegal activity, including, when necessary, to prosecute

those responsible for such activities.

* Other purposes consistent with the context in which the information was

collected, or as otherwise disclosed to You at the time of collection.

Please note that the examples provided above are illustrative and not intended

to be exhaustive. For more details on how we use this information, please

refer to the “Use of Your Personal Information” section.

If We decide to collect additional categories of personal information or use

the personal information We collected for materially different, unrelated, or

incompatible purposes, We will update this Privacy Policy.

Disclosure of Personal Information

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

We may use or disclose and may have used or disclosed in the last twelve (12)

months the following categories of personal information for business or

commercial purposes:

* Category A: Identifiers

* Category B: Personal information categories listed in the California

Customer Records statute (Cal. Civ. Code § 1798.80(e))

* Category D: Commercial information

* Category F: Internet or other similar network activity

Please note that the categories listed above are those defined in the

CCPA/CPRA. This does not mean that all examples of that category of personal

information were in fact disclosed, but reflects our good faith belief to the

best of our knowledge that some of that information from the applicable

category may be and may have been disclosed.

When We disclose Personal Information for a business purpose or a commercial

purpose, We enter a contract that describes the purpose and requires the

recipient to both keep that personal information confidential and not use it

for any purpose except performing the contract.

Sharing of Personal Information

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

We may share, and have shared in the last twelve (12) months, Your personal

information identified in the above categories with the following categories

of third parties:

* Service Providers

* Payment processors

* Our affiliates

* Our business partners

* Third-party vendors to whom You or Your agents authorize Us to disclose

Your personal information in connection with products or services We

provide to You

Sale of Personal Information

~~~~~~~~~~~~~~~~~~~~~~~~~~~~

GradMap does not sell your Personal Information for money. We do not and will not disclose your Personal Information to third parties in direct exchange for monetary payment, and we do not share your Personal Information with third parties for their own marketing or advertising purposes.

However, under the broad definitions established by the CCPA/CPRA, certain routine data sharing with our Service Providers that is necessary to operate the Service may technically qualify as a “sale” or “sharing” of personal information even when no money changes hands. For example, when you create an account or make a purchase, basic account information such as your name and email address is shared with our payment processor, Stripe, solely for the purpose of processing your transaction. This information is used only to facilitate the Service and is not used by Stripe for their own marketing purposes.

To the extent any such sharing may be considered a “sale” or “share” under the CCPA/CPRA, the following categories of Personal Information may be involved:

Category A: Identifiers (such as name, email address, or IP address)
Category B: Personal information categories listed in the California Customer Records statute (such as name and contact details shared with Stripe for payment processing)
Category D: Commercial information (such as subscription or purchase history)
Category F: Internet or other similar network activity (such as usage data collected to operate and improve the Service)

We do not sell or share the Personal Information of any user we know to be under the age of 16 without affirmative consent from their parent or guardian.

If you are a California resident and wish to opt out of any sharing that may qualify as a “sale” under the CCPA/CPRA, please contact us at [email protected] or visit https://gradmap.com/#/support.

Retention of Personal Information

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

We retain California residents’ Personal Information for as long as reasonably

necessary to achieve the purposes described in this Privacy Policy (including

the purposes disclosed in this CCPA/CPRA notice), taking into account: (i) how

long we need the information to provide and maintain the Service and Your

Account; (ii) whether You have requested deletion (subject to applicable

exceptions); (iii) Our legal, tax, accounting, and regulatory obligations;

(iv) security, fraud prevention, and abuse monitoring needs; and (v) the time

periods needed to resolve disputes and enforce Our agreements.

Specific retention periods for major data categories are described in the

“Retention of Your Personal Information” section of Our Privacy Policy, and We

may retain certain information longer where required or permitted by law (for

example, to comply with recordkeeping obligations or to establish, exercise,

or defend legal claims).

Sale of Personal Information of Minors Under 16 Years of Age

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

We do not sell the Personal Information of Consumers We actually know are less

than 16 years of age, unless We receive affirmative authorization (the “right

to opt-in”) from the parent or guardian of a Consumer less than 16 years of

age. Consumers who opt-in to the sale of personal information may opt-out of

future sales at any time. To exercise the right to opt-out, You (or Your

authorized representative) may submit a request to Us by contacting Us.

If You have reason to believe that a child under the age of 16 has provided Us

with personal information, please contact Us with sufficient detail to enable

Us to delete that information.

Your Rights under the CCPA/CPRA

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The CCPA/CPRA provides California residents with specific rights regarding

their personal information. If You are a resident of California, You have the

following rights:

* The right to notice. You have the right to be notified which categories of

Personal Information are being collected and the purposes for which the

Personal Information is being used.

* The right to know/access. Under CCPA/CPRA, You have the right to request

that We disclose information to You about Our collection, use, sale,

disclosure for business purposes and share of personal information. Once

We receive and confirm Your request, We will disclose to You:

* The categories of personal information We collected about You

* The categories of sources for the personal information We collected

about You

* Our business or commercial purposes for collecting or selling that

personal information

* The categories of third parties with whom We share that personal

information

* The specific pieces of personal information We collected about You

* If we sold Your personal information or disclosed Your personal

information for a business purpose, We will disclose to You:

* The categories of personal information categories sold

* The categories of personal information categories disclosed

* The right to say no to the sale or sharing of Personal Information (opt-

out). You have the right to direct Us to not sell Your personal

information. To submit an opt-out request, please see the “Do Not Sell or

Share My Personal Information” section or contact Us.

* The right to correct Personal Information. You have the right to correct

or rectify any inaccurate personal information about You that We

collected. Once We receive and confirm Your request, We will use

commercially reasonable efforts to correct (and direct our Service

Providers to correct) Your personal information, unless an exception

applies.

* The right to limit use and disclosure of sensitive Personal Information.

You have the right to request to limit the use or disclosure of certain

sensitive personal information We collected about You, unless an exception

applies. To submit, please see the “Limit the Use or Disclosure of My

Sensitive Personal Information” section or contact Us.

* The right to delete Personal Information. You have the right to request

the deletion of Your Personal Information under certain circumstances,

subject to certain exceptions. Once We receive and confirm Your request,

We will delete (and direct Our Service Providers to delete) Your personal

information from our records, unless an exception applies. We may deny

Your deletion request if retaining the information is necessary for Us or

Our Service Providers to:

* Complete the transaction for which We collected the personal

information, provide a good or service that You requested, take actions

reasonably anticipated within the context of our ongoing business

relationship with You, or otherwise perform our contract with You.

* Detect security incidents, protect against malicious, deceptive,

fraudulent, or illegal activity, or prosecute those responsible for such

activities.

* Debug products to identify and repair errors that impair existing

intended functionality.

* Exercise free speech, ensure the right of another consumer to exercise

their free speech rights, or exercise another right provided for by law.

* Comply with the California Electronic Communications Privacy Act (Cal.

Penal Code § 1546 et. seq.).

* Engage in public or peer-reviewed scientific, historical, or statistical

research in the public interest that adheres to all other applicable

ethics and privacy laws, when the information’s deletion may likely

render impossible or seriously impair the research’s achievement, if You

previously provided informed consent.

* Enable solely internal uses that are reasonably aligned with consumer

expectations based on Your relationship with Us.

* Comply with a legal obligation.

* Make other internal and lawful uses of that information that are

compatible with the context in which You provided it.

* The right not to be discriminated against. You have the right not to be

discriminated against for exercising any of Your consumer’s rights,

including by:

* Denying goods or services to You

* Charging different prices or rates for goods or services, including the

use of discounts or other benefits or imposing penalties

* Providing a different level or quality of goods or services to You

* Suggesting that You will receive a different price or rate for goods or

services or a different level or quality of goods or services

Exercising Your CCPA/CPRA Data Protection Rights

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please see the “Do Not Sell or Share My Personal Information” section and

“Limit the Use or Disclosure of My Sensitive Personal Information” section for

more information on how to opt out and limit the use of sensitive information

collected.

Additionally, in order to exercise any of Your rights under the CCPA/CPRA, and

if You are a California resident, You can contact Us:

* By email: [email protected]

* By visiting this page on our website: <https://gradmap.com/#/support>

Only You, or a person registered with the California Secretary of State that

You authorize to act on Your behalf, may make a verifiable request related to

Your personal information.

Your request to Us must:

* Provide sufficient information that allows Us to reasonably verify You are

the person about whom We collected Personal Information or an authorized

representative

* Describe Your request with sufficient detail that allows Us to properly

understand, evaluate, and respond to it

We cannot respond to Your request or provide You with the required information

if We cannot:

* Verify Your identity or authority to make the request

* And confirm that the personal information relates to You

We will disclose and deliver the required information free of charge within 45

days of receiving Your verifiable request. The time period to provide the

required information may be extended once by an additional 45 days when

reasonably necessary and with prior notice.

Any disclosures We provide will only cover the 12-month period preceding the

verifiable request’s receipt.

For data portability requests, We will select a format to provide Your

personal information that is readily usable and should allow You to transmit

the information from one entity to another entity without hindrance.

Do Not Sell or Share My Personal Information

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

As defined in the CCPA/CPRA, “sell” and “sale” mean selling, renting,

releasing, disclosing, disseminating, making available, transferring, or

otherwise communicating orally, in writing, or by electronic or other means, a

Consumer’s personal information by the Business to a third party for valuable

consideration. This means that We may have received some kind of benefit in

return for sharing personal information, but not necessarily a monetary

benefit.

You have the right to opt-out of the “sale” of Your personal information. Once

We receive and confirm a verifiable consumer request from You, We will stop

“selling” Your Personal Information. To exercise Your right to opt-out, please

Limit the Use or Disclosure of My Sensitive Personal Information

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If You are a California resident, You have the right to limit the use and

disclosure of Your sensitive personal information to that use which is

necessary to perform the services or provide the goods reasonably expected by

an average consumer who requests such services or goods.

We collect, use and disclose sensitive personal information in ways that are

necessary to provide the Service. For more information on how We use Your

personal information, please see the “Use of Your Personal Information”

section or contact us.

To submit a request to limit the use or disclosure of sensitive personal

information, please contact Us using the methods listed in the “Contact Us”

section of Our Privacy Policy.

“Do Not Track” Policy as Required by California Online Privacy Protection Act

(CalOPPA)

————————————————————————

Our Service does not respond to Do Not Track signals.

However, some third-party websites do keep track of Your browsing activities.

If You are visiting such websites, You can set Your preferences in Your web

browser to inform websites that You do not want to be tracked. You can enable

or disable DNT by visiting the preferences or settings page of Your web

browser.

Your California Privacy Rights (California’s Shine the Light law)

—————————————————————–

Under California Civil Code Section 1798 (California’s Shine the Light law),

California residents with an established business relationship with Us can

request information once a year about sharing their Personal Data with third

parties for the third parties’ direct marketing purposes.

If you’d like to request more information under the California Shine the Light

law, and if You are a California resident, You can contact Us using the

contact information provided below.

California Privacy Rights for Minor Users (California Business and Professions

Code Section 22581)

————————————————————————————————–

California Business and Professions Code Section 22581 allows California

residents under the age of 18 who are registered users of online sites,

services or applications to request and obtain removal of content or

information they have publicly posted.

To request removal of such data, and if You are a California resident, You can

address associated with Your Account.

Be aware that Your request does not guarantee complete or comprehensive

removal of content or information posted online and that the law may not

permit or require removal in certain circumstances.

Children’s Privacy

——————

The Service may contain content appropriate for children under the age of 13.

As a parent, you should know that through the Service children under the age

of 13 may participate in activities that involve the collection or use of

personal information. We use reasonable efforts to ensure that before we

collect any personal information from a child, the child’s parent receives

notice of and consents to our personal information practices.

We also may limit how We collect, use, and store some of the information of

Users between 13 and 18 years old. In some cases, this means We will be unable

to provide certain functionality of the Service to these Users. If We need to

rely on consent as a legal basis for processing Your information and Your

country requires consent from a parent, We may require Your parent’s consent

before We collect and use that information.

We may ask a User to verify its date of birth before collecting any personal

information from them. If the User is under the age of 13, the Service will be

either blocked or redirected to a parental consent process.

Information Collected from Children Under the Age of 13

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The Company may collect and store persistent identifiers such as cookies or IP

addresses from Children without parental consent for the purpose of supporting

the internal operation of the Service.

We may collect and store other personal information about children if this

information is submitted by a child with prior parent consent or by the parent

or guardian of the child.

The Company may collect and store the following types of personal information

about a child when submitted by a child with prior parental consent or by the

parent or guardian of the child:

* First and/or last name

* Date of birth

* Gender

* Grade level

* Email address

* Telephone number

* Parent’s or guardian’s name

* Parent’s or guardian’s email address

For further details on the information We might collect, You can refer to the

“Types of Data Collected” section of this Privacy Policy. We follow our

standard Privacy Policy for the disclosure of personal information collected

from and about children.

Parental Access

~~~~~~~~~~~~~~~

A parent who has already given the Company permission to collect and use his

child personal information can, at any time:

* Review, correct or delete the child’s personal information

* Discontinue further collection or use of the child’s personal information

To make such a request, You can write to Us using the contact information

provided in this Privacy Policy.

Links to Other Websites

———————–

Our Service may contain links to other websites that are not operated by Us.

If You click on a third party link, You will be directed to that third party’s

site. We strongly advise You to review the Privacy Policy of every site You

visit.

We have no control over and assume no responsibility for the content, privacy

policies or practices of any third party sites or services.

Changes to this Privacy Policy

——————————

We may update Our Privacy Policy from time to time. We will notify You of any

changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior

to the change becoming effective and update the “Last updated” date at the top

of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes.

Changes to this Privacy Policy are effective when they are posted on this

page.

———-

If you have any questions about this Privacy Policy, You can contact us:

* By email: [email protected]

* By visiting this page on our website: <https://gradmap.com/#/support>

⚡ New: the College Application Manager is almost here — be first to try it free for 7 days

Privacy Policy