Privacy Policy

1. Introduction

At Stellar Advisers ("we", "us", or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at stellaradvisers.com or use our services. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

2. Data Controller

For the purposes of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's privacy law (Law 25), the General Data Protection Regulation (GDPR), UK GDPR, and other applicable data protection laws, the organization responsible for your personal information is:

3. Information We Collect

We may collect information about you in a variety of ways, including:

3.1 Personal Data You Provide

Personal information you voluntarily provide to us when you:

• Create an account (name, email, profile photo)
• Subscribe to our services (payment information)
• Buy store merchandise (order, contact, billing, and shipping information; payment-card details are handled by Stripe)
• Book advising sessions (educational background, preferences)
• Submit essays for review (academic writing samples)
• Use our application tracker (university choices, deadlines)
• Participate in our forum (posts, comments)
• Contact us (name, email, message content)
• Use our AI adviser or Tutor (prompts, uploaded learning materials, and conversation history only when retention is enabled)
• Use the Wellbeing Guide (ephemeral prompts by default, user-requested summaries, and limited safety-event metadata)
• Call our AI phone assistant (consent state, redacted caller metadata, intent, outcome, transfer state, and a short redacted summary; audio is not recorded by default)
• Use the Scholarship Finder (school stage, status, provinces, average, programs, schools, activities and financial need are saved with your latest search when you are signed in). Optional details (identity, gender, disability, first in family, time in care, protected-person status) stay in your browser session unless you choose "Keep these answers with my saved results"; they are never added to your profile or shared, and you can delete the saved search at any time

3.2 Automatically Collected Data

Information automatically collected when you visit our site:

• IP address and approximate location
• Browser type and version
• Device type and operating system
• Pages visited and time spent on pages
• Referring website addresses
• Session identifiers
• If you arrive from one of our school-visit QR codes or campaign links, which campaign it was. We count visits to each campaign without identifying you. If you create an account in that visit, we note the campaign on your account (for example, the school where we gave a talk) so we can see how many people each visit helped. Deleting your account removes it

4. Legal Basis for Processing (GDPR)

Under GDPR and UK GDPR, we process your personal data based on the following legal grounds:

5. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our advising services
• Process your subscriptions and transactions
• Match you with appropriate advisers and mentors
• Review and provide feedback on your essays
• Power our AI adviser with relevant responses
• Personalize your experience on our platform
• Communicate with you about updates and services
• Improve and optimize our website and services
• Detect, prevent, and address security issues
• Comply with legal obligations

Email. We send three kinds of email. Each one says who we are and why you got it.

• Service email you need: messages about your account, your requests, bookings, payments, and replies from our team.
• Deadline reminders, only for the applications and saved scholarships you turn reminders on for. We email 14, 3 and 1 days before an application deadline, and on the reminder date you pick for a scholarship, at 9 a.m. Eastern. We use the school, program, scholarship name and dates you saved. Every reminder has an unsubscribe link, and you can turn reminders off in Account, Email.
• The Stellar weekly: your upcoming deadlines, updated guides for your schools, scholarships closing soon that fit your profile (province, domestic or international, grade), and one how-to tip. It has no ads, offers or prices. We send it only if you tick an unticked box to say yes, and we keep a record of when you agreed, where, and the exact wording you saw. Every weekly email has a one-click unsubscribe link, and unsubscribing takes effect right away. We don't send marketing email. If we ever do, it will need your separate consent, as Canada's Anti-Spam Legislation (CASL) requires.

Parents and guardians. You can give us a parent or guardian's email so they get copies of your deadline reminders. If you tell us you're under 16, they must also agree before we send you the weekly email. We email them once with a link to confirm or decline, and we send them nothing else unless they confirm. They can stop at any time.

6. How We Share Your Information

We may share your information in the following situations:

• With Advisers: When you book a session, relevant information is shared with your matched adviser
• Service Providers: Third-party vendors who perform services on our behalf (see section 9)
• Legal Purposes: When required by law or to protect our rights
• Payments: Our payments currently run through a Stripe account shared with our nonprofit partner, Stellar Foundation, so checkout and card statements may show that name and payment records sit in that account
• Business Transfers: In connection with a merger, sale, or acquisition
• With Your Consent: When you explicitly agree to share your information

6.1 Adviser Profiles

Adviser profiles displayed on our website are drawn from Stellar's verified public adviser directory. Advisers provide guidance based on lived experience; they do not make, and have no authority to make, admissions decisions on behalf of any university.

6.2 Family View Links You Create

From your Applications page you can make a read-only link to share your progress with a parent or guardian. Anyone who has the link can open that page without signing in, so share it only with people you trust. It shows your first name, the schools and programs in your tracker with their stage, checklist progress and dates, and your saved results as counts plus open awards from your latest scholarship search (never awards limited to an identity or personal group). It never shows your messages, essays, notes, My Stellar Profile, marks, cost estimates, email address or other contact details. You choose whether the link ends after 7, 30 or 90 days or has no end date, and you can turn it off at any time; it stops working at once. We store only a scrambled (hashed) copy of the link's code, when you made it, when it ends, and when it was last opened, which we show to you. Deleting your account turns the link off immediately and erases this record.

6.3 Testimonials and Review Invitations

If you choose to write a testimonial, we store your quote, the name or initials you want shown, and the time you ticked the permission box (with the wording you agreed to). A testimonial is only published after we approve it, and only with the name or initials you chose. You can withdraw it at any time from your dashboard and it comes down at once. After a completed consultation or service we may send you one invitation to review us on Trustpilot; we record that the invitation was sent so we never send it twice. We never offer anything in exchange for a review. Deleting your account removes your testimonials and the invitation record.

Important: We do not sell your personal information to third parties. California residents can opt-out of any future data sharing via our Data Rights page.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL)
• Encryption of data at rest
• Access controls and authentication
• Security reviews of our code and access rules
• Access to student information limited to the founder and approved advisers who need it

While we take reasonable steps to protect your data, no method of transmission over the Internet or electronic storage is 100% secure.

8. Data Retention

We retain personal data only as long as reasonably necessary for the stated purpose, an active relationship, security and dispute handling, and legal, tax, or accounting obligations. The criteria currently applied include:

• Account data: Retained while your account is active and then only as needed to complete deletion, prevent abuse, resolve disputes, or meet legal obligations
• Transaction records: Retained for the period required by applicable tax, accounting, chargeback, and fraud-prevention rules
• User content: Essays, application records, and forum content remain available while needed for the feature or account and may be removed through available controls or a verified deletion request, subject to legal exceptions
• AI adviser conversations: Retained where conversation history is enabled until removed under product controls, account deletion, or a verified request, subject to limited safety and legal records
• Tutor conversations: Raw text is retained only when you opt in; learning goals and progress summaries remain until account deletion or an earlier deletion request
• Wellbeing conversations: Ephemeral by default; only a summary you explicitly request to save and limited safety-event metadata may be retained
• Phone calls: Audio is not recorded by default; redacted operational metadata and summaries are retained only as long as needed for safety, support, and legal obligations
• Email choices: Your email settings, a parent or guardian's address and the record of your consent choices are kept while your account is open and erased when you delete it. Email delivery records (which email was sent and when, without its content) follow the account deletion review described above
• Dashboard visits and family view links: When you last opened your dashboard Home (used to show what's new since your last visit) and the items you marked as seen, plus any family view link record (section 6.2), are kept while your account is open and erased when you delete it. Turning a link off erases its record at once
• Contact and privacy requests: Retained while the request is handled and for a reasonable recordkeeping period afterward
• Analytics: Kept under our configured retention settings for Google Analytics and PostHog. Google Analytics and public-page recordings need your analytics consent. PostHog also counts visits without cookies and receives public-page error reports and text-free AI Adviser usage statistics. Withdrawal stops new recordings but can't recall data already sent

9. Third-Party Services

We use the following third-party service providers:

• Clerk (clerk.com) - Authentication and user management
• Convex (convex.dev) - Database and real-time data sync
• Vercel (vercel.com) - Website hosting, deployment, and private media storage
• Stripe (stripe.com) - Subscription billing, payment processing, customer billing portal, tax calculation where enabled, and provider onboarding and payouts through Stripe Connect
• OpenRouter and OpenAI - AI model routing and AI-powered advising features, including web searches of official university, college and government sites (through OpenRouter's search partner). A search receives a rewritten question without your personal details; your own message and chat history are never sent to the search provider
• Google Analytics - Consent-based website measurement
• PostHog (posthog.com) - Visit counts without cookies, optional cookie-based return-visit counts and public-page recordings, heatmaps, error reports and text-free AI Adviser usage statistics. Hosted and processed in the United States
• Sentry - Error and performance monitoring when configured
• Resend - Email delivery (service email, deadline reminders and the Stellar weekly)
• Daily - Embedded video rooms for eligible events and non-clinical sessions
• Jitsi Meet (meet.jit.si) - Video meeting links for some booked sessions
• Cloudflare Turnstile - Bot protection on sign-in and sign-up, loaded by Clerk
• Google Calendar - Stellar-owned event and booking calendar synchronization and optional attendee invitations
• Twilio (twilio.com) - SIP telephony and phone-number routing
• Fly.io (fly.io) - Long-lived call-controller hosting
• Reddit (reddit.com) - Disclosed community assistance where enabled

Each provider has their own privacy policy governing their use of your data.

10. Your Privacy Rights

10.1 Rights Under GDPR (EU/UK)

If you are in the European Union or United Kingdom, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Request correction of inaccurate data
• Right to Erasure (Art. 17): Request deletion of your personal data
• Right to Restrict Processing (Art. 18): Request limitation of processing
• Right to Data Portability (Art. 20): Receive your data in a machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time

10.2 Rights Under CCPA (California)

California residents have the following additional rights:

• Right to know what personal information is collected
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt-out of sale/sharing of personal information
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising rights

10.3 Rights Under PIPEDA (Canada)

Canadian residents have the following rights:

• Right to access your personal information
• Right to challenge accuracy and completeness, and to have it corrected
• Right to withdraw consent at any time, subject to legal or contractual limits
• Right to ask us to delete information we no longer need
• Right to complain to the Office of the Privacy Commissioner of Canada

10.4 Rights in Quebec (Law 25)

If you live in Quebec, you also have the right to:

• Receive computerized personal information you gave us in a structured, commonly used format
• Ask us to stop sharing your information or to de-index it where the law allows
• Be told when a decision about you is made only by automated processing (we do not make admission, scholarship, or account decisions that way)
• Complain to the Commission d'accès à l'information du Québec

To exercise any of these rights, please visit our Data Rights page or contact us at privacy@stellarfoundation.org.

11. Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority:

• EU: Your national Data Protection Authority
• UK: Information Commissioner's Office (ICO) - ico.org.uk
• Canada: Office of the Privacy Commissioner - priv.gc.ca
• Quebec: Commission d'accès à l'information du Québec - cai.gouv.qc.ca
• California: California Privacy Protection Agency - cppa.ca.gov

12. International Data Transfers

Your information may be transferred to and processed in countries outside your country of residence, including:

• United States (where our service providers operate)
• Canada (where Stellar Advisers is based)

When we transfer data internationally, we use appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the EU
• UK International Data Transfer Agreements
• Adequacy decisions where applicable

13. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

You can change your cookie choice at any time in Cookie settings in the footer, or through your browser settings.

13.1 Visit counts and public-page recordings

PostHog counts public page views, where visits came from and clicks without cookies, even before you choose or after you press Reject. It doesn't save a visitor ID in your browser. On its servers, PostHog uses your internet address and browser type to make a code that changes each day. It can't recognise a cookieless visitor on a later day. Accept adds cookies and browser storage to count return visits. It also turns on Google Analytics.

Pressing Accept also allows PostHog to record how you use public marketing and resource pages, including clicks, scrolling and movement. All typed fields are hidden. Public page text can appear in recordings. Content we mark as private stays blocked. We never record account pages, admin screens, sign-in or password-reset pages, checkout or order pages, family views or messaging. The AI Adviser chat is never recorded. Opening it stops page recording until you close it. Recordings don't include network request contents, console logs or embedded pages from other websites.

Public marketing and resource pages also have heatmaps. They show where visitors click and how far they scroll, with text and element attributes hidden. Heatmaps stay off on the private pages listed above. PostHog also receives error reports from public pages, with or without analytics cookies. We remove personal details from error messages to help us fix bugs without collecting field values or chat text. We don't collect age for site analytics. PostHog hosts and processes these counts, recordings and reports in the United States.

If you opt in, our first-party guide, pathway, and tool measurement records are linked to your account when you are signed in. When signed out, they use a random visitor identifier. If you are signed in, PostHog identifies you only by a one-way scrambled code based on your account ID, never your name, your email address, your school, your marks, your essays, your messages, or any other detail from your account. Web addresses are stripped of everything except a short list of campaign parameters (such as utm_source) before they are recorded, so tokens, ids, and other sensitive values in a link never reach PostHog.

To withdraw analytics consent, open "Cookie settings" in the footer. Turn Analytics cookies off and save, or press Reject all. This stops recordings and clears lasting identifiers. Cookieless counting and public-page error reports continue. Do Not Track or Global Privacy Control stops browser analytics, including recordings and error reports, even after Accept. Our servers' text-free AI Adviser usage statistics are separate from cookie choices and these browser signals. Withdrawal can't recall data already sent.

14. Children's Privacy

Many of our visitors are high-school students, so many are under 18. This is how we handle that:

• Minimum age: you must be at least 13 to create an account. If you live in Quebec and are under 14, a parent or guardian must consent for you.
• We don't verify age: we don't ask for your date of birth. If we learn that an account belongs to a child under 13, or to a Quebec child under 14 without a parent's consent, we will delete it.
• Payments: if you are under the age of majority where you live, a parent or guardian should make or approve any paid membership or service.
• Email: if you tell us you're under 16, a parent or guardian must confirm by email before we send you the weekly email. Deadline reminders you turn on are service email and don't need that step.
• Consultations and messages: we encourage students under 18 to involve a parent or guardian. A parent or guardian can also request a consultation for their child.
• Minimal data: we only ask for what we need to answer or serve you. We don't use analytics data to build advertising or marketing profiles. Public-page recordings need your Accept choice. Typed fields and private content stay hidden. We never record account, payment or chat screens.

If you are a parent or guardian and want to see, correct, or delete your child's information, contact privacy@stellarfoundation.org or use our Data Rights page.

15. AI Systems, Sensitive Information, and Automated Assistance

We identify AI experiences at the point of use. AI output may be incomplete or wrong and is not used by Stellar to make final admission, scholarship, clinical, employment, or legal decisions. Identity characteristics such as race, religion, gender, or disability are optional and may be used only to match funding opportunities at your request; they are not used to rank program suitability and are not persisted to your profile. They are kept with a saved scholarship search only if you choose to keep them.

When you are signed in, the AI Adviser can use a short summary of your saved My Stellar Profile (such as your grade, province, whether you are a domestic or international applicant, interests, target programs and activity totals) to personalise its answers. It never receives your current school, employer names, contact details, or citizenship or immigration details, and the summary is not stored with your conversation. You can turn this off at any time with "Let the AI Adviser use my profile" in My Stellar Profile.

Our servers send PostHog text-free usage statistics for the public AI Adviser. These include reply counts, response time and which knowledge source answered. They include model usage and cost when available, plus existing flags for unanswered questions or safety responses. We don't send message text, prompts, retrieved passages or reply text to PostHog. These statistics use a random or scrambled conversation code, without a user ID, email address or sign-in ID. PostHog hosts and processes them in the United States.

The Wellbeing Guide is non-clinical and not an emergency service. Safety-event records are restricted, minimized, and used to operate crisis interruption and human-escalation safeguards. We do not use private prompts, wellbeing content, or phone audio to train our own general-purpose model.

16. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page, updating the "Last Updated" date, and where required by law, sending you an email notification. You are advised to review this Privacy Policy periodically for any changes.

17. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact our privacy team:

We aim to respond to all privacy-related inquiries within 30 days.