Privacy Policy

1. Introduction

At Stellar Advisers ("we", "us", or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at stellaradvisers.com or use our services. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

2. Data Controller

For the purposes of the General Data Protection Regulation (GDPR), UK GDPR, and other applicable data protection laws, the data controller is:

3. Information We Collect

We may collect information about you in a variety of ways, including:

3.1 Personal Data You Provide

Personal information you voluntarily provide to us when you:

• • Create an account (name, email, profile photo)
• • Subscribe to our services (payment information)
• • Buy store merchandise (order, contact, billing, and shipping information; payment-card details are handled by Stripe)
• • Book advising sessions (educational background, preferences)
• • Submit essays for review (academic writing samples)
• • Use our application tracker (university choices, deadlines)
• • Participate in our forum (posts, comments)
• • Contact us (name, email, message content)
• • Use our AI adviser or Tutor (prompts, uploaded learning materials, and conversation history only when retention is enabled)
• • Use the Wellbeing Guide (ephemeral prompts by default, user-requested summaries, and limited safety-event metadata)
• • Call our AI phone assistant (consent state, redacted caller metadata, intent, outcome, transfer state, and a short redacted summary; audio is not recorded by default)
• • Use optional scholarship identity filters, which remain in your browser session and are not added to your profile

3.2 Automatically Collected Data

Information automatically collected when you visit our site:

• • IP address and approximate location
• • Browser type and version
• • Device type and operating system
• • Pages visited and time spent on pages
• • Referring website addresses
• • Session identifiers

4. Legal Basis for Processing (GDPR)

Under GDPR and UK GDPR, we process your personal data based on the following legal grounds:

5. How We Use Your Information

We use the information we collect to:

• • Provide, operate, and maintain our advising services
• • Process your subscriptions and transactions
• • Match you with appropriate advisers and mentors
• • Review and provide feedback on your essays
• • Power our AI advisor with relevant responses
• • Personalize your experience on our platform
• • Communicate with you about updates and services
• • Improve and optimize our website and services
• • Detect, prevent, and address security issues
• • Comply with legal obligations

6. How We Share Your Information

We may share your information in the following situations:

• • With Advisers: When you book a session, relevant information is shared with your matched adviser
• • Service Providers: Third-party vendors who perform services on our behalf (see section 9)
• • Legal Purposes: When required by law or to protect our rights
• • Business Transfers: In connection with a merger, sale, or acquisition
• • With Your Consent: When you explicitly agree to share your information

6.1 Adviser Profiles

Adviser profiles displayed on our website are drawn from Stellar's verified public adviser directory. Advisers provide guidance based on lived experience; they do not make, and have no authority to make, admissions decisions on behalf of any university.

Important: We do not sell your personal information to third parties. California residents can opt-out of any future data sharing via our Data Rights page.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• • Encryption of data in transit (TLS/SSL)
• • Encryption of data at rest
• • Access controls and authentication
• • Regular security assessments
• • Employee training on data protection

While we take reasonable steps to protect your data, no method of transmission over the Internet or electronic storage is 100% secure.

8. Data Retention

We retain personal data only as long as reasonably necessary for the stated purpose, an active relationship, security and dispute handling, and legal, tax, or accounting obligations. The criteria currently applied include:

• • Account data: Retained while your account is active and then only as needed to complete deletion, prevent abuse, resolve disputes, or meet legal obligations
• • Transaction records: Retained for the period required by applicable tax, accounting, chargeback, and fraud-prevention rules
• • User content: Essays, application records, and forum content remain available while needed for the feature or account and may be removed through available controls or a verified deletion request, subject to legal exceptions
• • AI adviser conversations: Retained where conversation history is enabled until removed under product controls, account deletion, or a verified request, subject to limited safety and legal records
• • Tutor conversations: Raw text is retained only when you opt in; learning goals and progress summaries remain until account deletion or an earlier deletion request
• • Wellbeing conversations: Ephemeral by default; only a summary you explicitly request to save and limited safety-event metadata may be retained
• • Phone calls: Audio is not recorded by default; redacted operational metadata and summaries are retained only as long as needed for safety, support, and legal obligations
• • Contact and privacy requests: Retained while the request is handled and for a reasonable recordkeeping period afterward
• • Analytics: Controlled by our configured retention settings for Google Analytics and, where enabled, PostHog product analytics. Both are collected only after analytics consent, and any session replay data, where enabled, is kept only as long as needed for that same purpose

9. Third-Party Services

We use the following third-party service providers:

• • Clerk (clerk.com) - Authentication and user management
• • Convex (convex.dev) - Database and real-time data sync
• • Vercel (vercel.com) - Website hosting, deployment, and private media storage
• • Stripe (stripe.com) - Subscription billing, payment processing, customer billing portal, tax calculation where enabled, and provider onboarding and payouts through Stripe Connect
• • OpenRouter and OpenAI - AI model routing and AI-powered advising features
• • Google Analytics - Consent-based website measurement
• • PostHog (posthog.com) - Consent-based product analytics and, where enabled, masked session replay, processed in the United States
• • Sentry - Error and performance monitoring when configured
• • Resend - Transactional and support email delivery
• • Daily - Embedded video rooms for eligible events and non-clinical sessions
• • Google Calendar - Stellar-owned event and booking calendar synchronization and optional attendee invitations
• • Twilio (twilio.com) - SIP telephony and phone-number routing
• • Fly.io (fly.io) - Long-lived call-controller hosting
• • Reddit (reddit.com) - Disclosed community assistance where enabled

Each provider has their own privacy policy governing their use of your data.

10. Your Privacy Rights

10.1 Rights Under GDPR (EU/UK)

If you are in the European Union or United Kingdom, you have the following rights:

• • Right of Access (Art. 15): Request a copy of your personal data
• • Right to Rectification (Art. 16): Request correction of inaccurate data
• • Right to Erasure (Art. 17): Request deletion of your personal data
• • Right to Restrict Processing (Art. 18): Request limitation of processing
• • Right to Data Portability (Art. 20): Receive your data in a machine-readable format
• • Right to Object (Art. 21): Object to processing based on legitimate interests
• • Right to Withdraw Consent (Art. 7): Withdraw consent at any time

10.2 Rights Under CCPA (California)

California residents have the following additional rights:

• • Right to know what personal information is collected
• • Right to delete personal information
• • Right to correct inaccurate personal information
• • Right to opt-out of sale/sharing of personal information
• • Right to limit use of sensitive personal information
• • Right to non-discrimination for exercising rights

10.3 Rights Under PIPEDA (Canada)

Canadian residents have the following rights:

• • Right to access your personal information
• • Right to challenge accuracy and completeness
• • Right to withdraw consent at any time

To exercise any of these rights, please visit our Data Rights page or contact us at privacy@stellarfoundation.org.

11. Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority:

• • EU: Your national Data Protection Authority
• • UK: Information Commissioner's Office (ICO) - ico.org.uk
• • Canada: Office of the Privacy Commissioner - priv.gc.ca
• • California: California Privacy Protection Agency - cppa.ca.gov

12. International Data Transfers

Your information may be transferred to and processed in countries outside your country of residence, including:

• • United States (where our service providers operate)
• • Canada (where Stellar Advisers is based)

When we transfer data internationally, we use appropriate safeguards including:

• • Standard Contractual Clauses (SCCs) approved by the EU
• • UK International Data Transfer Agreements
• • Adequacy decisions where applicable

13. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

You can manage your cookie preferences at any time through our cookie consent tool or your browser settings.

13.1 Product Analytics and Session Replay

If you accept analytics cookies, we use PostHog, a product analytics service, to understand how visitors use our website: which pages are opened, which links and buttons are used, how far a page is scrolled, and where people leave. This helps us find the parts of the site that confuse or fail our students. PostHog loads only after you accept analytics cookies in our consent tool, and it processes data in the United States.

Session replay, a masked reconstruction of how a visitor moves through a page, is part of PostHog but is not currently active on our site. If we turn it on in the future, every text node and everything you type will be masked before it ever leaves your browser, replay will never run on signed-in, application, intake, checkout, or contact pages, and this policy will be updated first.

If you are signed in, PostHog identifies you only by a one-way cryptographic hash of your account ID — never your name, your email address, your school, your marks, your essays, your messages, or any other detail from your account. Web addresses are stripped of everything except a short list of campaign parameters (such as utm_source) before they are recorded, so tokens, ids, and other sensitive values in a link never reach PostHog.

You can withdraw analytics consent at any time through "Cookie Settings" in the footer, which stops collection and clears the identifiers PostHog stored in your browser. We also honour Do Not Track and Global Privacy Control browser signals as a hard block: if either is on, PostHog does not run, even if you previously accepted cookies. Legal basis: consent (GDPR Article 6(1)(a)); in Canada, we rely on your express consent under PIPEDA.

14. Children's Privacy

Our services are intended for users who are at least 13 years old. Users under the age of majority should involve a parent, guardian, school counsellor, or another trusted adult when using paid advising, telephony, or wellbeing features. We do not knowingly collect personal information from children under 13. We use age-appropriate disclosures and data minimization for teen users. Because many of our visitors are secondary-school students, we apply the same extra care to analytics: PostHog session replay, where enabled, always masks page text and everything typed and never runs on signed-in, application, intake, or checkout pages, and we do not use analytics data to build advertising or marketing profiles of any visitor. If you are a parent or guardian and believe your child has provided us with personal information, contact privacy@stellarfoundation.org to request review or deletion.

15. AI Systems, Sensitive Information, and Automated Assistance

We identify AI experiences at the point of use. AI output may be incomplete or wrong and is not used by Stellar to make final admission, scholarship, clinical, employment, or legal decisions. Identity characteristics such as race, religion, gender, or disability are optional and may be used only to filter funding opportunities at your request; they are not used to rank program suitability and are not persisted to your profile.

The Wellbeing Guide is non-clinical and not an emergency service. Safety-event records are restricted, minimized, and used to operate crisis interruption and human-escalation safeguards. We do not use private prompts, wellbeing content, or phone audio to train our own general-purpose model.

16. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page, updating the "Last Updated" date, and where required by law, sending you an email notification. You are advised to review this Privacy Policy periodically for any changes.

17. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact our privacy team:

We aim to respond to all privacy-related inquiries within 30 days.