Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

Account Information:

• Full name and email address (required for registration)
• Password (stored as a bcrypt hash — we never store plain text)
• Google account information (if you sign in with Google)

Academic Profile:

• Current degree level and field of study
• GPA, academic grades, and test scores (IELTS, TOEFL, GRE, GMAT)
• Target countries and universities for study abroad
• Work experience and extracurricular activities
• Research interests and professor preferences
• Current country of residence and nationality

Documents:

• Content you provide for SOP and CV generation
• Uploaded documents and files (if applicable)

1.2 Information Collected Automatically

Usage Data:

• Pages visited and features used within the platform
• Time spent on each feature
• Search queries within the platform
• AI features accessed and generated outputs

Technical Data:

• IP address (used for rate limiting and security)
• Browser type and version
• Device type and operating system
• Session tokens and authentication data

1.3 Information from Third Parties

If you sign in with Google, we receive your Google account name and email address, and Google profile picture (if public). We do not receive your Google password or payment information.

Job search queries and results are processed through third-party job APIs (Adzuna, JSearch via RapidAPI). We store your search preferences and results to improve your experience.

2. How We Use Your Information

2.1 Providing Our Services

• Matching your academic profile to relevant universities and programs
• Generating personalized Statements of Purpose and CVs
• Identifying scholarships you may be eligible for
• Sending scholarship deadline reminders
• Providing career outcome predictions based on your field
• Powering the AI Advisor chatbot with your profile context
• Finding relevant job listings for your location and field

2.2 Improving Our Platform

• Analyzing aggregated usage patterns to improve AI accuracy
• Identifying bugs and performance issues
• Developing new features based on user behavior

2.3 Communications

• Sending scholarship deadline alerts (you can unsubscribe)
• Sending important account and security notifications
• Responding to your support inquiries
• Sending product updates (only with your consent)

2.4 Security and Legal Compliance

• Detecting and preventing fraud and abuse
• Enforcing our Terms of Service
• Complying with legal obligations and responding to lawful requests

3. AI and Data Processing

3.1 AI Model Providers

EducAI uses the following AI providers to process your data and generate content:

• OpenAI (GPT-4o-mini) — Primary AI for document generation, career predictions, and chatbot responses
• Groq — Fallback AI provider
• Google Gemini — Fallback AI provider
• OpenRouter — Additional fallback provider

When you use AI features, relevant portions of your profile are sent to these providers as part of the AI prompt. These providers process data according to their own privacy policies.

3.2 Data Minimization

We only send the minimum necessary data to AI providers for each specific request. We do not send your full profile for every AI call — only the relevant context.

3.3 AI Output Storage

AI-generated content (SOPs, CVs, career reports) is stored in our database associated with your account so you can access your documents later. You can delete these at any time.

4. Data Storage and Security

4.1 Where We Store Your Data

Your data is stored in a PostgreSQL database hosted on Neon (serverless PostgreSQL, ap-southeast-1 region). Our servers are hosted on Render.com. Our frontend is hosted on Vercel.

4.2 Security Measures

We implement the following security measures:

• All data transmitted over HTTPS (TLS encryption)
• Passwords hashed using Argon2 (industry best practice)
• JWT tokens with 15-minute expiry and secure refresh flow
• Rate limiting on all API endpoints via Arcjet
• Account lockout after 5 failed login attempts
• Regular security dependency updates

4.3 Data Retention

• Active accounts: data retained while account is active
• Inactive accounts: data retained for 12 months after last login
• Deleted accounts: data permanently deleted within 30 days
• Scholarship deadline alerts: cron job logs retained 90 days
• AI-generated documents: retained until you delete them

4.4 Security Incidents

In the event of a data breach affecting your personal information, we will notify you within 72 hours as required by applicable law.

5. Data Sharing

5.1 We Do Not Sell Your Data

EducAI does not sell, rent, or trade your personal information to third parties for commercial purposes. Ever.

5.2 Service Providers

We share data with trusted service providers who help us operate:

• Neon (database hosting) — stores your profile and documents
• Render.com (server hosting) — hosts our API servers
• Vercel (frontend hosting) — serves the web application
• OpenAI/Groq/Gemini (AI processing) — generates AI content
• Serper API (web search) — powers professor finder and news
• Adzuna/JSearch (job APIs) — provides job listings
• Resend/SMTP (email) — sends deadline alerts and notifications
• Google (OAuth) — optional authentication method

All service providers are contractually required to protect your data and use it only for the specified purpose.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or to protect the rights and safety of EducAI, our users, or the public.

5.4 Business Transfers

If EducAI is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6. Your Rights and Choices

6.1 Access Your Data

You can view all personal data we hold about you by logging into your account and visiting your profile settings.

6.2 Update Your Data

You can update your academic profile, preferences, and account information at any time from your dashboard settings.

6.3 Delete Your Account

You can request permanent deletion of your account and all associated data by emailing support.educai@gmail.com. We will process deletion requests within 30 days.

6.4 Data Portability

You can request an export of your personal data in JSON format by contacting support.educai@gmail.com.

6.5 Email Preferences

You can unsubscribe from scholarship deadline alerts and marketing emails at any time using the unsubscribe link in any email or from your account settings.

6.6 GDPR Rights (EU/UK Users)

If you are located in the European Union or United Kingdom, you have additional rights under GDPR:

• Right to erasure (‘right to be forgotten’)
• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with your national data authority

6.7 CCPA Rights (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act including the right to know what personal information is collected and the right to non-discrimination for exercising your privacy rights.

7. Cookies and Tracking

7.1 Cookies We Use

EducAI uses only essential cookies required for the service to function:

• Session cookie — maintains your login state (iron-session)
• CSRF token — protects against cross-site request forgery

7.2 Local Storage

We use browser localStorage to store:

• Your last job search parameters (for convenience)
• Saved job bookmarks
• UI preferences (sidebar state)

This data stays on your device and is never sent to our servers unless you explicitly perform an action.

8. Children's Privacy

EducAI is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal information, we will delete it immediately.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support.educai@gmail.com.

9. International Data Transfers

EducAI operates globally and your data may be processed in countries outside your country of residence, including the United States. These countries may have different data protection laws than your country.

When we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses and data processing agreements with our service providers.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by:

• Sending an email to your registered address
• Displaying a prominent notice on our platform
• Updating the ‘Last Updated’ date at the top of this page

Your continued use of EducAI after changes are posted constitutes acceptance of the updated Privacy Policy.

11. Contact Us

For privacy-related questions, requests, or concerns: