Privacy Policy Addendum: Counselors & Administrators
Effective Date: August 2, 2026
Linkage Note: This Addendum supplements the core OlyAdmit Privacy Policy and specifically details how we process data for educational professionals using the platform's B2B channel. By using the professional channel, you are governed by this Addendum read in conjunction with the primary Privacy Policy.
1. Covered Data Subjects
This policy expansion governs data processing for three specific adult user categories:
- School Administrators
- School Counselors
- Independent Counselors
Note: OlyAdmit students are governed by the primary D2C Privacy Policy and strict multi-state children's data frameworks.
2. Legal Basis for Processing
We process professional user data based on the following legal grounds:
- Contractual Necessity: To provision your account, facilitate subscriptions, and deliver the core educational tools required by our Terms of Service.
- Legitimate Interests: To ensure platform security, verify professional authorization, maintain institutional audit logs, and enforce multi-state privacy compliance frameworks.
3. Professional Data Collection
To provision your professional account, we collect specific identity and operational metrics.
| Category | Data Points Collected |
|---|---|
| Identity & Contact | First name, last name, email address |
| Professional Context | Title/position (optional), school name or business name |
| System Metadata | Counselor code, access level, account/subscription status |
| Compliance Audits | Consent records, version timestamps, IP addresses at signing (Retained for 60 months) |
4. Sub-Processors, Data Sharing, and Cross-Border Transfers
To operate the platform, we utilize a secure infrastructure stack. Counselor data flows through the following authorized sub-processors:
- Supabase: Primary database hosting and user authentication.
- Vercel: Edge network hosting and application delivery.
- Sentry: Error tracking and performance monitoring.
- Resend: Transactional email delivery.
- Stripe: Independent controller for subscription payment processing.
- Zoho Mail: Processing and routing of counselor support inquiries and business communications.
Cross-Border Transfers: Because our sub-processors (such as Vercel) utilize global edge networks to optimize application delivery, some data may be processed internationally. OlyAdmit relies on legally approved data transfer mechanisms, including Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework (DPF), to ensure your data remains protected regardless of edge location.
5. School Administrator Allowlist Data
To ensure a secure B2B environment, School Administrators must provide the email addresses of authorized counselors prior to those counselors registering.
- Pre-Interaction Storage: We securely store these emails before the counselor interacts with the platform solely for the purpose of registration authorization.
- Notification: OlyAdmit may send automated email notifications to counselors when they are added to an active allowlist.
6. Authentication Methods
Counselor and Administrator accounts utilize the platform's unified authentication infrastructure, which supports Google OAuth, Discord OAuth, and Email Magic Link.
7. Privacy Controls and Session Security
Global Privacy Control (GPC): OlyAdmit natively supports Global Privacy Control signals. When detected by our client or server, we automatically disable all analytics tracking (e.g., Vercel Analytics) for your session.
Session Behavior: To balance professional convenience with student data security, counselor sessions are governed by adult-tier timeouts. Sessions remain active for 7 days but will automatically lock after 1 hour of idle inactivity. Professionals may opt-in to a 30-day persistent login on trusted personal devices.
8. Access to Minor Student Data
Based on the Access Tier assigned by the platform or your School Administrator, you will process personal and educational data belonging to students. You explicitly acknowledge that this includes sensitive data generated by minors (ages 13-17). The platform does not provide data export functionality for counselor-accessed student data, and access is restricted strictly to in-platform viewing within your assigned tier.
9. Essay Commenting and Platform Activity
Any comments, edits, or feedback you provide on student essays are stored by OlyAdmit and made visible to the respective student while their account remains active.
10. Payment Data (Independent Counselors)
Subscription payments are processed entirely by Stripe, acting as an independent Data Controller. OlyAdmit receives secure cryptographic identifiers and subscription status updates from Stripe. We never collect, process, or store your payment card numbers or banking information.
11. Data Retention, Suspension, and Deletion
Account Suspension: If a School Administrator or OlyAdmit suspends your account, your access is immediately revoked, but your data is retained in a frozen state to allow for potential reactivation.
Account Deletion: Upon permanent deletion of your account, your profile data and authentication credentials are hard-deleted.
Comment Anonymization: To preserve the student's historical educational record, your essay comments are permanently anonymized. Your identifying information is removed, and no metadata linking the comment to your identity is retained.
Admin Continuity: If a School Administrator account is deleted, the allowlist entries they created are preserved with a nullified administrator reference strictly to maintain institutional audit logs.
12. Counselor Data Subject Rights
As a professional user, you possess full data subject rights under applicable state privacy laws (including the CCPA, the NYCDPA, and other respective state frameworks). You have the right to access, correct, delete, and port your personal data. The processes and timelines for exercising these rights are identical to those provided to all platform users. Please refer to the Data Subject Rights section in the primary OlyAdmit Privacy Policy for detailed instructions on submitting a verifiable consumer request.