PRIVACY POLICY

Candid College Advisors, LLC ("CCA," "we," "us," or "our") is a New Jersey limited liability company that provides college-admissions advising services to students and families. We are located in Montvale, New Jersey. This Privacy Policy (this "Policy") describes how CCA collects, uses, stores, shares, and protects personal information in connection with candidcollegeadvisors.com, our client portal, and related online services (together, the "Platform"), and in connection with our advising engagements, including information we receive from Google when a user signs in with Google or connects a Google account.

This Policy applies to parents and guardians, students, and CCA personnel who use the Platform, and to information collected through the Platform, through advising engagements, and through Google services connected to the Platform. This Policy does not apply to third-party websites or services that the Platform links to, which are governed by their own privacy policies. If a signed engagement agreement addresses the handling of information, the engagement agreement controls to the extent of any conflict. The Platform is operated from the United States, and the information we collect under this Policy is stored on servers located in the United States. Our infrastructure providers may route network traffic through global locations in transit, and content delivery and security services may briefly process network requests outside the United States before forwarding them to our United States servers.

3.1 Account Information. Name, email address, telephone number, and the parent or guardian relationship associated with each student account. If a user signs in with Google, CCA receives the user's basic Google profile: name, email address, and profile photo.

3.2 Student Education Information. Information that families and students provide in the course of an advising engagement, including academic records and transcripts, test scores, activities, essay drafts, college lists, application timelines, and advising meeting notes. CCA treats this information as confidential student education records, as described in Section 10.

3.3 Communications. Messages exchanged with an advisor through the Platform, email correspondence, and consultation requests.

3.4 Technical Information. Standard log data, including IP address, browser type, device information, and pages visited, used to operate and secure the Platform. CCA does not embed third-party advertising or analytics trackers on the Platform. CCA does not use Google Analytics, advertising pixels, or social-media tracking pixels. The only measurement cookie CCA sets is the first-party marketing-attribution cookie described in Section 3.5.

3.5 Marketing Attribution. When a visitor arrives at the public website from a CCA advertisement, email, or campaign link, the link may carry campaign tags (commonly called UTM parameters) and, for paid advertisements, a Google or Facebook click identifier (gclid or fbclid). CCA stores these values in a single first-party cookie on the visitor's browser, named "cca_attrib," for up to ninety (90) days. If the visitor submits a contact form, CCA saves those values with the inquiry. CCA uses this information solely to measure which of its outreach efforts are effective. CCA does not sell this information, does not share it with advertisers or data brokers, does not transmit it to Google, Facebook, or any other advertising platform, and does not use it to serve targeted advertising.

The Platform uses a limited number of cookies: a cookie that keeps users signed in to the client portal, and the first-party marketing-attribution cookie described in Section 3.5. CCA does not use cookies for third-party advertising. Some browsers can transmit a "Do Not Track" (DNT) or Global Privacy Control (GPC) signal. Our website honors these signals: when a visitor's browser transmits a DNT or GPC signal, the website does not set the marketing-attribution cookie. Third parties do not collect personally identifiable information about a user's online activities over time and across different websites when the user uses the Platform. Visitors may also decline or delete cookies through their browser settings. Declining the marketing-attribution cookie does not affect any feature of the Platform.

5.1 OAuth Scopes. The Platform integrates with Google APIs. Depending on the user's role, the Platform requests the following OAuth scopes when a user signs in with Google or connects a Google account:

Important Note on Student Folders. The Platform does not request permission to create, read, edit, or delete files in any family's personal Google Drive. Each student's advising folder is created, managed, and owned by CCA's own institutional Google Workspace account, and the Platform organizes those folders using CCA's internal service credentials. Families are never asked to grant the Platform administrative access to their personal Google Drives.

5.2 Use of Google User Data. CCA uses Google Drive and Google Calendar data solely to provide and improve user-facing features of the Platform: importing meeting transcripts for advisor note-taking, scheduling, updating, and canceling advising meetings on the advisor's calendar, associating those meetings with a student's record, and displaying document status in the portal. CCA uses basic profile data solely for authentication and account management. CCA does not use Google user data for any other purpose, including advertising or the development, improvement, or training of generalized artificial-intelligence models.

5.3 Storage and Protection. Document content remains in Google Drive. The Platform stores the file references, folder identifiers, and OAuth tokens necessary to operate. OAuth tokens are encrypted at rest, and all data is transmitted over TLS-encrypted connections. CCA retains only the minimum data necessary to operate the features described above.

5.4 Access. Each student's Drive folder is maintained in CCA's institutional Google Workspace account and is restricted to the student, the student's assigned advisor, and the engineering personnel who build and maintain the Platform. Human access to Google user data by engineering personnel occurs only with the user's affirmative agreement (for example, in response to a support request), for security purposes (such as investigating a bug or abuse), or where required by law, and such access is logged. No other clients, staff, or third parties can access a student's folder.

5.5 Sharing. CCA does not sell Google user data and does not share it with advertisers or data brokers. CCA shares Google user data only with the infrastructure providers identified in Section 8 that process data on CCA's behalf under contractual confidentiality obligations, or where required by law. CCA does not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.

5.6 Limited Use Disclosure. CCA's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

CCA uses Google Workspace artificial-intelligence features, including Google Gemini AI note-taking tools, to assist in preparing notes and summaries of advising meetings. Meeting notes and summaries prepared with these tools are treated as confidential student education records under Section 10. CCA does not permit client information to be used to train generalized artificial-intelligence models. CCA obtains consent to this use in its engagement agreements, and a parent or guardian may withdraw that consent at any time by written notice, in which case meeting notes will be taken manually.

CCA uses the information described in this Policy to: provide admissions advising and operate the client portal; build and maintain each student's college list, timeline, and document folder; schedule and document advising meetings; communicate with families about their engagements; secure, maintain, and improve the Platform; conduct internal research to improve CCA's services; and comply with legal obligations. CCA does not use personal information for third-party advertising and does not sell personal information.

CCA may also use information in de-identified, aggregated form, from which individual students and families cannot reasonably be identified, to analyze admissions outcomes and trends and to improve its advising services. De-identified, aggregated information is not personal information under this Policy.

CCA does not use a student's name, essays, admissions outcomes, or other personal information in its marketing, advertising, or promotional materials without prior written consent from the family.

CCA shares personal information only with the service providers that host and operate the Platform, each bound by contractual confidentiality and data-protection obligations:

Beyond these providers, CCA discloses personal information only where required by law (for example, in response to a valid subpoena), where necessary to protect the safety of a student, or at the direction and with the consent of the parent or student (for example, materials the family asks CCA to share with a school). CCA does not share one family's information with another.

The Platform is not directed to children under thirteen (13) years of age, and CCA does not knowingly collect personal information from children under 13, even with parental consent. If CCA learns that it has collected personal information from a child under 13, CCA will delete it promptly. Students between 13 and 17 years of age may hold portal accounts only after a parent or guardian has provided written consent as part of the engagement agreement. The consenting parent or guardian is responsible for the student's use of the Platform. Parents and guardians may review their student's information, request corrections, or request deletion at any time, as described in Section 12.

The Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g (FERPA), applies to educational agencies and institutions that receive federal funding. CCA is not an educational agency or institution covered by FERPA. CCA nevertheless voluntarily handles student education records consistent with FERPA principles: student records are disclosed only to the parent or guardian, the student, and the student's assigned advisor; parents and eligible students may inspect and review the records CCA holds and request corrections; CCA obtains written consent before disclosing student records to anyone else, except as required by law; and school records provided to CCA (such as transcripts and score reports) are used only for the student's advising engagement.

CCA retains personal information, including Google user data, while an account is active. After an engagement ends, CCA retains records for up to three (3) years for legitimate business purposes, including service to returning families, and then deletes or de-identifies them, except that CCA retains the advising file for each engagement for seven (7) years after the engagement ends. The advising file consists of the engagement agreement, advising meeting notes and summaries, correspondence with the family, college lists and application plans, and records of the advice CCA provided. CCA retains the advising file for this longer period because New Jersey law permits a claim arising out of a written agreement or the services provided under it to be brought for six (6) years after the claim accrues, see N.J.S.A. 2A:14-1, and CCA must be able to establish what advice it actually gave. Access to the advising file during this extended period is restricted to the personnel who need it for that purpose. Marketing-attribution data (campaign tags and click identifiers) is retained in the browser cookie for up to ninety (90) days and, where attached to a contact inquiry, for as long as CCA retains the inquiry record. OAuth tokens are deleted immediately when a user disconnects a Google account or closes an account. CCA may retain limited records where required by law or for legitimate accounting purposes (for example, invoices), and retains them no longer than necessary. CCA will delete personal information sooner on request, as described in Section 12.

CCA extends the following rights to all users of the Platform, regardless of place of residence:

12.1 Access and Correction. Users may request access to, or correction of, the personal information CCA holds about them or their student.

12.2 Deletion. Users may request deletion of their account and personal information, including Google user data CCA holds, the student's advising folder maintained in CCA's Google Workspace account, and stored OAuth tokens. CCA completes verified deletion requests within thirty (30) days and confirms completion in writing, except that CCA retains the advising file for the period described in Section 11 and any records it is required by law to retain.

12.3 Export. Before deletion, CCA will return essay drafts and other student documents on request.

12.4 Revocation of Google Access. Users may revoke the Platform's access to their Google account at any time at myaccount.google.com/permissions. Upon revocation, the Platform immediately loses the access the user granted. For families, revocation disables signing in with Google but does not affect a student's advising documents, which are maintained in CCA's own Google Workspace account. For advisors, revocation disables the calendar and meeting-transcript features. Revocation does not end an advising engagement.

12.5 Exercising Rights; Verification. Requests may be submitted to privacy@candidcollegeadvisors.com. Before acting on a request, CCA may require reasonable verification of the requester's identity and, for requests concerning a student's information, of the requester's status as the student or the student's parent or guardian. While an advising engagement is active, CCA will not act on a deletion request under Section 12.2, or an export request under Section 12.3, that is submitted by a student under eighteen (18) years of age until CCA has notified the consenting parent or guardian described in Section 9 and that parent or guardian has confirmed the request in writing. This confirmation requirement reflects Section 9, under which the consenting parent or guardian is responsible for the student's use of the Platform; it does not apply to a request submitted after the engagement has ended or after the student has reached eighteen (18) years of age. CCA responds within thirty (30) days and does not treat any user differently for exercising these rights.

CCA protects personal information with industry-standard measures, including TLS encryption in transit, encryption at rest for stored data and OAuth tokens, role-based access controls that restrict each student's records to the assigned advisor, multi-factor authentication for staff accounts, and least-privilege access for engineering personnel. No method of transmission or storage is completely secure. If a breach affecting personal information occurs, CCA will notify affected individuals promptly, as required by applicable law.

If CCA changes this Policy, CCA will post the updated version on the website with a new effective date and, for material changes, will notify account holders by email before the changes take effect. CCA will not reduce users' rights with respect to Google user data without explicit consent.

Questions about this Policy or about personal information held by CCA may be directed to: