Privacy Policy

Overview

Ivysion, Inc. (“Ivysion,” “we,” “us,” or “our”) is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use the Ivysion platform, including our website, mobile applications, and related services (collectively, the “Service”).

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service. We encourage you to read this policy carefully and contact us if you have any questions.

Information We Collect

Personal Information

When you create an account, we collect personally identifiable information such as your name, email address, phone number, date of birth, and mailing address. For students, we may also collect demographic information relevant to the college admissions process, including citizenship status, ethnicity, and first-generation college student status. For parents, we collect contact information and billing details necessary to manage your subscription.

If you are an advisor, we collect professional credentials, employment history, educational background, and any certifications relevant to your role on the platform.

Academic Information

To provide our college matching and admissions guidance services, we collect academic records including GPA, class rank, standardized test scores (SAT, ACT, AP, IB), course history, extracurricular activities, awards, and honors. This information may be entered manually or uploaded via transcripts and score reports, which are processed using our document intelligence technology.

We also collect information about your college preferences, application status, essay drafts, and communications with your assigned advisor. This data is used to personalize your experience and provide tailored recommendations.

Usage Data

We automatically collect certain information when you access or use the Service, including your IP address, browser type, operating system, device identifiers, pages viewed, links clicked, and the date and time of your visit. We use this information to analyze trends, administer the Service, and improve the user experience.

We may also collect information about how you interact with our AI features, including queries submitted to our AI chat assistant, college matching preferences, and essay feedback requests. This data helps us improve the accuracy and relevance of our AI-powered tools.

Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to collect usage data and improve our Service. Cookies are small data files stored on your device that help us remember your preferences and understand how you use our platform. You can instruct your browser to refuse all cookies or indicate when a cookie is being sent. However, some features of the Service may not function properly without cookies.

We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until deleted). We also use analytics cookies provided by third-party services to help us understand usage patterns, and Google’s measurement of our Google ads, all loaded through Google Tag Manager; those load only if you accept them on our cookie banner (see “Google Analytics and Google Ads Measurement” below). We also use Meta’s advertising-measurement cookie (the Meta Pixel) on our public website pages, and a first-party cookie that remembers which ad or link brought you to Ivysion, both described below.

Google Analytics and Google Ads Measurement

On our public website pages, and on the sign-in and sign-up pages, we use Google Tag Manager to run Google Analytics and to measure whether our Google ads lead to sign-ups. It loads only after you accept cookies on our cookie banner, never while you are signed in, never on pages reached through a personal link (such as a payment, invitation or consent link), and not at all when your browser sends Do-Not-Track or Global Privacy Control. Google receives the pages you visit, the ad or link that brought you, and basic device and browser information. Google’s advertising cookies stay off: our ad measurement runs without them, and ad click identifiers are redacted. You can withdraw your consent at any time with “Cookie settings” at the bottom of every page.

Advertising Measurement (Meta)

We use the Meta Pixel and Meta’s Conversions API to learn whether our ads on Facebook and Instagram work. The Meta Pixel loads on our public website pages for visitors who are not signed in, whatever you choose on our cookie banner (the banner covers our analytics cookies only). We share: visits to our public website pages; and, for adults only, when you start a checkout, start a free trial (the price of its first payment and currency), complete a purchase (the plan price and currency), or create an account. When a free trial’s first payment goes through, about a week after the trial started, we report that purchase too, with only your hashed email address and hashed account ID. With those events we send a hashed (scrambled) email address, a hashed account ID, your IP address, your browser type, and Meta’s cookie identifiers. We never send checkout, free-trial, purchase, or account-creation events about students under the age of majority (18 in most countries) or about accounts provided through a school, never load the Meta Pixel while you are signed in or on any page inside your account, and never send anything you write or store in Ivysion. Nothing is sent if your browser sends Global Privacy Control or if you opt out with the button below. Meta handles this data under its own privacy policy. An opt-out applies to the browser you use it in, from then on: a purchase you started before opting out may still be reported. We keep the identifiers used for this (IP address, browser type, hashed email, and Meta’s cookie identifiers) for about 7 days. After that we keep a short record that an event was sent for up to 90 days: for a sign-up it includes your hashed account ID, for a purchase the payment reference, and for a free trial only the subscription reference, which tells us whether to report the trial’s first payment. When you delete your account, we delete the records tied to your account ID.

Ad and Link Attribution

When you arrive at our website from an ad or a link, a first-party cookie remembers where you came from for up to 90 days: the campaign tags in the link (such as utm_source and utm_campaign), the ad click identifier Facebook, Instagram or Google adds to it, the page you landed on, and the website that sent you. If you then create an account or apply as an advisor, we store this with your contact record in our customer relationship management system (GoHighLevel; see “Sub-Processors” below) so we can tell which of our ads and links work. We do not send it to advertising platforms, and it is deleted with your contact record.

How We Use Your Information

We use the information we collect to provide, maintain, and improve the Service, including to generate personalized college recommendations, facilitate advisor-student communications, process payments, and deliver AI-powered admissions guidance. We also use your information to send you important updates about your account, application deadlines, and platform changes.

We may use aggregated, de-identified data for research and analytical purposes, including to improve our AI models and develop new features. This aggregated data cannot be used to identify any individual user. We do not use your personal information to train AI models in a way that could expose your data to other users.

We may also use your information to detect, prevent, and address fraud, abuse, security risks, and technical issues, and to comply with applicable laws and regulations.

How We Share Your Information

We do not sell your personal information to third parties. We share limited data with Meta to measure our ads unless you opt out (see “Advertising Measurement (Meta)” above). We may also share your information in the following limited circumstances:

• With your assigned advisor: Your academic records, application data, and communications are shared with your assigned advisor to facilitate guidance services.
• With parents or guardians: If you are a minor student, certain information may be shared with a linked parent or guardian account in accordance with applicable laws and your account settings.
• With service providers: We share information with third-party vendors who help us operate the Service, including cloud hosting providers, payment processors, email delivery services, and analytics providers. These providers are contractually obligated to protect your information.
• For legal compliance: We may disclose your information if required to do so by law or in response to valid legal requests by public authorities.
• With your consent: We may share your information for any other purpose with your explicit consent.

Sub-Processors

We use the following third-party sub-processors to operate the Service. Each is bound by a data-processing agreement and may only use data to provide services to us — never to sell it or for their own advertising:

• Vercel — application hosting and delivery
• Neon — managed PostgreSQL database hosting
• Cloudflare (R2) — encrypted file/document storage
• Google (Gemini / Vertex AI) — AI-assisted features (e.g., essay feedback, document parsing). When operated through Vertex AI, your content is covered by Google’s Cloud Data Processing Addendum and is not used to train Google’s models.
• Stripe — payment processing
• Resend — transactional email delivery
• Sentry — error monitoring (configured to minimize personal data)
• Upstash — rate-limiting and caching
• Google (Tag Manager, Analytics, Ads measurement) — public-site analytics and Google ad measurement only, loaded solely after you accept cookies and never on signed-in application pages; see “Google Analytics and Google Ads Measurement” above
• GoHighLevel — customer relationship management. For account holders who sign up (students only once they are old enough to use Ivysion without a parent’s consent, 13 in the United States): name, email, account type, how you signed up, country, time zone, for students their graduation year, and the ad or link that brought you to Ivysion. For advisors who apply: the details on their application other than credentials, and the ad or link that brought them. Used to send account and product emails; never anything about children who need a parent’s consent to use Ivysion or about school accounts. It is deleted when you delete your account; if you applied as an advisor but never opened an account, email us and we will delete it.
• Microsoft Clarity — session recordings and heatmaps of our public Parents page only, loaded solely after you accept cookies, never while you are signed in, and never on any other page; form inputs are masked. Microsoft also uses this data under its own privacy statement, including to improve its products and for advertising, which is why it also stays off when your browser sends Global Privacy Control

Meta is not one of our sub-processors; see “Advertising Measurement (Meta)” above.

Connected Calendar Services (Google)

Ivysion lets you optionally connect a Google Calendar account so that your Ivysion items can appear on your own calendar. This integration is entirely opt-in: nothing is connected unless you explicitly authorize it, and you can disconnect at any time.

When you connect Google Calendar, we request the following Google permissions (OAuth scopes) and use the resulting access only as described:

• See, edit, share, and permanently delete the calendars you can access using Google Calendar (calendar.events): used solely to create, update, and remove calendar events that represent your own Ivysion items — application deadlines, tasks, standardized-test dates, and advisor meetings. We do not read, analyze, or store the contents of events you or others created outside of Ivysion.
• View the list of Google calendars you're subscribed to (calendar.calendarlist.readonly): used only to show you the calendars you can write to, so you can choose which one Ivysion should sync to. This permission cannot read the events on any calendar.
• Your primary email address and basic profile (openid, userinfo.email): used only to identify which Google account you connected and to label the connection in your settings.

We store the access and refresh tokens needed to maintain this connection in encrypted form (AES-256-GCM) and use them only to perform the calendar synchronization you requested. We do not sell this data, use it for advertising, or use it to train any artificial-intelligence or machine-learning models, and we do not transfer it to third parties except the minimal infrastructure sub-processors listed above that are required to operate the Service.

Ivysion's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Ivysion's access to your Google Calendar at any time from Settings → Integrations within the app, or from your Google Account permissions page. Disconnecting stops all future synchronization and removes the stored tokens.

Data Security

We implement industry-standard security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3. We employ role-based access controls, multi-factor authentication, and regular security audits to ensure the integrity of our systems.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to promptly notifying affected users in the event of a data breach in accordance with applicable laws.

Children's Privacy

Ivysion serves students from Grade 9 (approximately age 14). We are committed to complying with the Children's Online Privacy Protection Act (COPPA) and other applicable laws regarding children's privacy. For users under the age of 13, we require verifiable parental consent before collecting personal information.

Parents and guardians may review, modify, or request deletion of their child's personal information at any time by contacting us at privacy@ivysion.ai or through the parent dashboard. We collect only the information necessary to provide our services and do not condition a child’s participation on the disclosure of more information than is reasonably necessary.

For students aged 13 to 17, we provide age-appropriate privacy notices and obtain consent in accordance with applicable state and federal regulations. We encourage parents and guardians to actively participate in their child's use of the platform through our Parent Portal. We never send account, checkout, purchase, or sign-up events about students under the age of majority (18 in most countries) to advertising platforms, and we never send anything about accounts provided through a school.

Your Rights

Right to Access

You have the right to request a copy of the personal information we hold about you. You can access most of your data directly through your account dashboard. For a comprehensive data export, contact us at privacy@ivysion.ai and we will respond within 30 days.

Right to Deletion

You have the right to request the deletion of your personal information. You can initiate account deletion through your account settings or by contacting us at privacy@ivysion.ai. Upon receiving a verified deletion request, we will delete your personal information within 30 days, except where retention is required by law or necessary to complete a pending transaction.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may request a data export at any time through your account settings or by emailingprivacy@ivysion.ai. We will provide your data in JSON or CSV format within 30 days of your request.

Data Retention

We retain your personal information for as long as your account is active. After an account is closed, identity records are retained for up to one year to facilitate potential reactivation, and user-generated content (such as essays, conversations, and tasks) is purged within roughly six months. Security and access-audit logs are retained for up to seven years to meet legal and FERPA obligations.

If you request account deletion, your request is processed after a short grace period, during which sensitive records (essays, financial profile, academic records, and AI conversations) are promptly scrubbed; remaining identity records are then purged on the schedule above. We retain only the minimum data we are legally required to keep (such as billing records). Aggregated, de-identified data that cannot be linked back to you may be retained for analytical purposes.

Advertising-measurement data shared with Meta follows the shorter schedule described in “Advertising Measurement (Meta)” above.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: You have the right to opt out of the sale or sharing of your personal information. Ivysion does not sell personal information. Sharing limited data with Meta for ad measurement may count as “sharing” under California law. You can opt out at any time with the button under “Advertising Measurement (Meta)” above, and we treat a Global Privacy Control signal as an opt-out, which also turns off Google’s ad measurement on our site.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your California privacy rights, please contact us at privacy@ivysion.ai with the subject line “CCPA Request.”

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by email and/or by posting a prominent notice on our platform at least 30 days before the changes take effect.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to periodically review this page for the latest information on our privacy practices.

Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Ivysion, Inc.
Privacy Team
Email: privacy@ivysion.ai

We will make every effort to respond to your inquiry within 30 business days.