Privacy Policy — WaveScholar

This Privacy Policy explains how WaveScholar, LLC ("WaveScholar," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the WaveScholar website, mobile application, and related services (the "Service"). WaveScholar, LLC is the data controller responsible for your personal information under this Policy.

1. Information We Collect

We collect the following categories of personal information:

Account information: name, email address, password (hashed), graduation year, role (student, parent, counselor).
Academic and profile information: GPA, school, test scores, extracurriculars, essays, resumes, college lists, and other content you enter.
Counselor–student connection data: messages, feedback, homework, and shared documents between connected users.
Usage and device data: pages viewed, features used, IP address, browser type, device identifiers, and log data.
Support communications: messages you send to us and our responses.
Payment-related data: collected and processed by Paddle as Merchant of Record (see Section 4). We do not store full payment card numbers.

2. How We Use Your Information

To create and maintain your account and provide the Service (legal basis: performance of a contract).
To generate suggestions, checklists, and AI-assisted features you request (contract / legitimate interests).
To connect students with their chosen counselor or parent (contract).
To prevent fraud, abuse, and security incidents (legitimate interests, legal obligation).
To improve, debug, and develop new features (legitimate interests).
To provide customer support (contract / legitimate interests).
To send transactional emails and, with your consent, product updates (consent, contract).
To comply with legal obligations (legal obligation).

3. AI Processing

Some features use third-party AI providers to generate suggestions (for example, essay ideas, checklists, or counselor drafting help). Content you submit for these features may be transmitted to those providers solely to generate the response. We do not permit identifiable User Content to be used by third parties to train their models in a way that exposes it to other users or the public.

4. How We Share Information

We share personal information only with the following categories of recipients:

Service providers / subprocessors: cloud hosting, database, authentication, analytics, email delivery, and error monitoring vendors that process data on our behalf under contract.
Merchant of Record — Paddle: Paddle.com Market Limited acts as the Merchant of Record for all purchases and handles payment processing, subscription management, tax compliance, invoicing, refunds, and related buyer support. See the Paddle Privacy Notice.
Counselors, parents, and other users you connect with: content you explicitly share (essays, homework, college lists, messages) is visible to those users.
Professional advisers: legal, accounting, and compliance advisers, under confidentiality.
Authorities: where required by law, valid legal process, or to protect rights, safety, or the integrity of the Service.
Successors: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell your personal information.

5. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When personal information is no longer needed, we delete or anonymize it. Routine backups may retain residual copies for a limited period.

6. Security

We use appropriate technical and organizational measures to protect personal information, including encryption in transit, access controls, and least-privilege permissions on our database. No system is 100% secure; we cannot guarantee absolute security.

7. Your Rights

Subject to applicable law, you may have the right to access, correct, delete, or export your personal information; object to or restrict certain processing; and withdraw consent where processing is based on consent. Residents of the EEA, UK, and certain U.S. states may have additional rights, including the right to lodge a complaint with a supervisory authority. To exercise any right, contact us at privacy@wavescholar.app.

8. Children

The Service is intended for users 13 and older. We do not knowingly collect personal information from children under 13. Users under 18 must have a parent or guardian consent to their use of the Service.

9. International Transfers

We are based in the United States. If you access the Service from outside the U.S., your information may be transferred to, stored, and processed in the U.S. and other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Cookies

We use strictly necessary cookies and similar technologies to keep you signed in and to operate the Service, and limited analytics cookies to understand usage. You can control cookies through your browser settings.

11. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice through the Service or by email before the changes take effect.

12. Contact

WaveScholar, LLC — Privacy questions: privacy@wavescholar.app. General support: support@wavescholar.app.