Privacy Policy

College Visit, Inc. ("College Visit," "we," "our," or "us") provides personalized tools that help prospective college students and their families prepare for, experience, and reflect on college visits.

This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information when you access or use CollegeVisit.ai and our related products and services (collectively, the "Services"). It does not apply to third-party websites or services that you visit independently, even when the Services link to them.

1. Information we collect

The information we collect depends on how you interact with the Services.

Information you provide

We may collect:

• Account and contact information, including your name, email address, login and account information, age confirmation, legal-document acceptance records, and information you provide when joining an email list or contacting support.
• Student interests and preferences, including academic interests, potential areas of study, extracurricular interests, food preferences, campus and community preferences, priorities, and other personalization information.
• College and visit information, including colleges under consideration, visit dates, campus-tour information, origin location, transportation preferences, travel-party composition, budget category, and other trip details.
• Free-text information, such as goals, concerns, student context, notes, observations, reflections, or feedback. Please do not provide medical records, detailed medical history, financial-account information, government identification numbers, passwords, or other account credentials unless we specifically request that information for a stated purpose.
• Email-capture information, when you ask us to save or deliver a guest trip or Visit Guide, join a notification list, or request product updates.
• Communications, including information in support requests, surveys, feedback, and other messages.
• Transaction information, including the product purchased, amount, date, payment status, Stripe customer or checkout identifiers, and the start and expiration dates of purchased access. Stripe processes card information; College Visit does not directly store full payment-card numbers.

A parent or guardian may provide information about a student while using the Services on the student's behalf. In that case, the information may be personal information about the student.

Guest trips and session credentials

You may begin building a trip without an account. We assign the guest trip a random session identifier and place an HTTP-only cookie named cv_builder_session in the browser. The cookie is used to authorize access to that guest trip and is configured to expire after 30 days. The trip and its content may remain in our database after the cookie expires unless the trip is claimed, deleted, or removed under our retention practices.

Information collected automatically

When you use the Services, we and our service providers may automatically collect:

• device type, operating system, and browser type;
• Internet Protocol address and approximate region derived from it;
• pages, screens, and features viewed;
• clicks and other interactions;
• dates, times, and duration of use;
• referring pages, links, campaigns, or sources;
• technical, performance, error, and diagnostic information; and
• browser, device, account, cookie, or similar identifiers.

We do not currently request precise GPS location from your device. When you provide an origin city, airport, or address for trip planning, that information is information you provided, not device GPS data.

Information we derive or generate

We use information you provide to generate and store itineraries, Visit Guides, Decision Guides, recommendations, suggested questions, prompts, summaries, and structured personalization attributes. These outputs and inferences may reflect stated or inferred student interests, priorities, constraints, and college-decision criteria.

Information from other sources

We may receive transaction information from Stripe, account information from authentication services, campaign or referral information from analytics services, and college, place, event, map, venue, or travel information from public sources and data providers.

2. How we use personal information

We use personal information to:

• provide, operate, maintain, and support the Services;
• create, authenticate, secure, and manage accounts and guest trips;
• verify and record age confirmation and acceptance of our legal documents;
• personalize trips, guides, questions, prompts, and recommendations;
• generate and deliver requested content;
• process purchases, credits, and fixed-term access;
• send verification, password-recovery, transaction, security, support, and requested product-update communications;
• respond to requests and feedback;
• analyze use and improve usability, reliability, quality, and performance;
• monitor errors and protect against fraud, misuse, and security incidents;
• understand how users find the Services;
• understand broad patterns in prospective student interests, preferences, priorities, questions, and college-visit experiences;
• create aggregated or deidentified information and develop analytics and institutional insight products as described in this Policy;
• comply with law and protect or exercise legal rights; and
• carry out another purpose disclosed when information is collected or with your direction or consent.

College Visit does not make admissions decisions and does not process personal information to make admissions decisions for a college or university.

3. Artificial intelligence

College Visit uses artificial intelligence and automated technologies to provide personalization and content-generation features. We use Anthropic's Claude services for AI processing.

Information sent for AI processing may include free-text responses, intended majors, extracurricular interests, trip style, selected colleges, visit details, preferences, and other context needed to generate or personalize the requested output. AI providers process this information as service providers to College Visit under their applicable service terms.

We use AI to generate and personalize itineraries, recommendations, questions, prompts, Visit Guides, Decision Guides, summaries, and structured personalization attributes. We may evaluate inputs, outputs, feedback, and interactions to assess quality, troubleshoot failures, and improve the Services.

AI-generated information may be incomplete, inaccurate, or outdated. Independently confirm information important to a college or travel decision. We do not use AI features to make decisions that produce legal or similarly significant effects for a college or university.

4. Cookies and analytics

We use cookies and similar technologies for:

• Authentication and security. Supabase authentication cookies keep users signed in and protect account access.
• Guest-trip access. The cv_builder_session cookie allows the browser to retrieve an unclaimed trip.
• Analytics. In production, Google Analytics and PostHog help us understand pageviews, feature use, and interactions. We configure our own pageview tracking to omit URL query strings because query parameters may contain functional identifiers.
• Reliability and error monitoring. Sentry receives diagnostic data used to detect and investigate application errors. We configure error monitoring to redact known guest-session query parameters.

Analytics and error-monitoring services may receive an IP address, browser and device information, page path, event information, timestamps, and identifiers associated with their technologies. We do not intentionally send raw free-text personalization responses or guest-session credentials as analytics event properties.

You can control cookies through browser settings, but blocking essential authentication or guest-session cookies may prevent account access or trip retrieval. We do not currently respond to the browser's Do Not Track setting because there is no uniform standard for that signal.

5. Service providers and data sources

We disclose information to service providers only as reasonably necessary for the function they perform. Current categories and providers include:

• Supabase for authentication, database, and storage services;
• Anthropic for AI processing;
• Stripe for payment processing;
• Google Analytics and PostHog for product and website analytics;
• Sentry for application monitoring and error diagnostics;
• Upstash for Redis-based rate limiting and caching;
• Google Maps and Places and Yelp for maps, place, venue, and business information; and
• hosting, network, email, and other technical providers used to operate the Services.

Some itinerary features may obtain college, event, map, place, hotel, flight, or vehicle information from public websites or third-party data APIs.

The information given to a provider depends on its role. For example, Stripe receives account, email, product, and transaction identifiers; Anthropic receives information needed for an AI request; analytics providers receive usage events; and map or place providers receive search locations and queries.

6. Other disclosures

At your direction

If you enable a public sharing link, anyone with that link can view the shared page. Depending on the trip, it may display colleges, visit dates, itinerary details, origin or transportation context, traveler information, budget category, and selected preferences. You can disable sharing, but recipients may retain information they previously viewed, copied, or captured.

We may otherwise disclose information when you direct or authorize us to do so.

Legal, security, and safety reasons

We may disclose information to comply with law, legal process, or lawful government requests; enforce agreements; protect the rights, property, or safety of College Visit, users, or others; or detect, investigate, prevent, or address fraud, misuse, security incidents, or unlawful activity.

Business transactions

Information may be disclosed or transferred in connection with an actual or proposed merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction.

7. Sale, sharing, and targeted advertising

College Visit does not sell personal information for money. We do not currently use personal information for cross-context behavioral advertising, and we do not disclose personal information to third parties for their independent targeted advertising.

We do not provide colleges or other institutional partners with identifiable student profiles or access to an individual student's notes, reflections, or personal college-decision process, except when a user directs or authorizes us to share information through a Service feature.

We may use and disclose aggregated or deidentified information as described in Section 8.

If our practices change in a way that creates a legal right to opt out of sale, sharing, or targeted advertising, we will update this Policy and provide the required method before beginning that practice.

8. Aggregated and deidentified information

We may aggregate information or process information in deidentified form so that it cannot reasonably be used to infer information about, or otherwise be linked to, a particular person or household.

We may use aggregated or deidentified information to:

• understand prospective student interests, preferences, and priorities;
• analyze college-visit patterns and experiences;
• identify commonly raised questions, concerns, or areas of confusion;
• understand factors that may influence perceptions of college fit;
• improve College Visit and its recommendations;
• conduct analysis; and
• develop analytics and institutional insight products.

We may disclose aggregated or deidentified information and insights to colleges, universities, schools, college-counseling organizations, and other education-related institutions or partners.

For example, these insights may describe patterns among groups of prospective students concerning what they value, notice, ask about, find confusing, or experience during college visits.

Our institutional insight products are not intended to provide an institution with an identifiable student profile or access to an individual student's notes, reflections, or personal college-decision process.

We do not treat information as aggregated or deidentified merely because a name, email address, or other direct identifier has been removed.

When we maintain information in deidentified form, we use reasonable measures designed to prevent the information from being associated with a particular person or household. We maintain and use deidentified information in deidentified form and do not attempt to reidentify it except as permitted by applicable law, such as to evaluate the effectiveness of our deidentification processes.

When we disclose deidentified information to a third party, we contractually require the recipient to maintain and use the information in deidentified form and not attempt to reidentify it except as permitted by applicable law.

Aggregated or deidentified information that is not reasonably linkable to a person or household may be retained, used, and disclosed for the purposes described in this Policy and as otherwise permitted by applicable law.

9. Retention

We retain personal information for as long as reasonably necessary for the purpose for which it was collected and for legitimate operational, security, legal, accounting, and dispute-resolution needs.

Current practices include:

• cached Visit Guide content is configured with a seven-day expiration;
• the guest-trip browser cookie expires after 30 days, although the associated trip is not automatically deleted solely because the cookie expired;
• account and trip information is generally retained while the account or trip remains active and until deletion is requested or the information is no longer needed;
• email-notification records are retained while the subscription remains active or until removal is requested;
• payment, consent, security, and transaction records may be retained longer where necessary for accounting, fraud prevention, dispute resolution, enforcement, or legal compliance; and
• backups may retain information for a limited period until overwritten under backup cycles.

When information is deleted, some copies may remain temporarily in backups or systems where immediate deletion is not reasonably practicable. We continue to protect such information and do not use it for new purposes while retained, except as permitted by law.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These include access controls, authenticated account and guest-trip access, encrypted network transport, restricted service credentials, row-level database controls, rate limiting, and monitoring. Safeguards vary based on the information and processing involved.

No transmission or storage system is completely secure, so we cannot guarantee absolute security. Contact support@collegevisit.ai if you believe an account or trip has been compromised.

11. Privacy rights and choices

Depending on where you live and applicable law, you may have rights to:

• confirm whether we process personal information and access information we maintain;
• correct inaccurate information;
• request deletion;
• obtain a portable copy of certain information;
• opt out of processing for sale, targeted advertising, or certain profiling where applicable;
• limit certain uses of sensitive personal information where applicable;
• withdraw consent where processing is based on consent;
• appeal a privacy-request decision where applicable; and
• receive equal service and pricing without unlawful discrimination for exercising privacy rights.

To make a request, email support@collegevisit.ai and describe the request and the account or information involved. We may verify your identity and, for an authorized-agent request, the agent's authority. Information submitted for verification will be used to process the request.

If applicable law provides an appeal right, email the same address and state that you are appealing a privacy-request decision.

You may unsubscribe from product-update or marketing emails using an unsubscribe link where provided or by contacting us. We may continue sending account, transaction, security, or other non-marketing messages.

12. Students and minors

Accounts are intended for people at least 16 years old. A person independently creating an account must confirm that they are at least 16. A user who is 16 or 17 may use the Services only with permission from a parent or guardian.

A parent or guardian may use the Services on behalf of a younger student and provide information about that student. The parent or guardian should avoid providing information that is unnecessary for trip planning.

The Services are a general-audience service and are not directed to children under 13. We do not knowingly collect personal information directly from a child under 13 without legally sufficient parental consent. If we learn that we collected such information, we will take appropriate steps to delete it. Contact support@collegevisit.ai if you believe information about a child or minor has been collected or processed inappropriately.

We do not use a minor's personalization information, notes, or reflections for third-party targeted advertising or to make admissions decisions for an educational institution.

13. Third-party websites and services

The Services may link to college, venue, map, travel, or other third-party websites. When you visit or interact with a third party, it may collect information under its own terms and privacy policy. College Visit does not control those practices. Review a third party's policies before providing information to it.

14. United States processing

The Services are currently intended for users in the United States. College Visit and its service providers may process and store information in the United States and other locations where providers operate. If you access the Services outside the United States, information may be transferred to jurisdictions with different data-protection laws. The Services are not currently directed specifically to users outside the United States.

15. Changes to this Policy

We may update this Policy to reflect changes to the Services, data practices, or law. We will revise the Last Updated date. For material changes, we may provide additional notice through the Services or by email. Where required, we will obtain consent before using information for a materially different purpose.

16. Contact us

Questions, privacy requests, deletion requests, or concerns may be sent to:

College Visit, Inc.
720 14th Street
Sacramento, CA 95814
support@collegevisit.ai
(424) 652-6919