Privacy Policy

This Privacy Policy describes how ScholarLedger (“ScholarLedger,” “we,” “us,” or “our”) collects, uses, and shares personal information when you use our website and platform. By using the platform, you agree to the collection and use of information as described in this policy.

We collect the following categories of information:

• Account information. Name, email address, password (hashed and managed by Firebase Authentication), role (parent, tutor, or admin), and profile picture.
• Student information. Student legal first and last name, grade, county of residence, and FTC-PEP scholarship year.
• Tutor information. Tutor profile, credentials, certifications, hourly rate, and contact details displayed on invoices.
• Session and invoice records. Dates, durations, subjects, payment status, signatures, and audit metadata related to tutoring services.
• Payment metadata. Stripe Customer ID, Stripe Connect Account ID, payment intent IDs, amounts, and timestamps. We do not store payment-card numbers, bank account numbers, or full tax-identification numbers — these are collected and held by Stripe.
• Communications. Messages you send through our support form, email exchanges, and in-app notifications.
• Usage and device data. IP address, browser type, operating system, pages visited, timestamps, and similar diagnostic information.

We collect information:

• Directly from you when you create an account, add records, or contact us;
• Automatically through your browser and our hosting infrastructure (Vercel) when you visit the platform;
• From service providers such as Stripe (payment status updates) and Firebase (authentication events);
• From other users who invite you (for example, a parent inviting a tutor or vice versa).

We use information to:

• Provide, operate, and maintain the platform and its features;
• Generate compliant invoices and reimbursement documentation;
• Facilitate payments between parents and tutors via Stripe;
• Authenticate users and protect against fraud, abuse, and unauthorized access;
• Communicate with you about account activity, support inquiries, and important changes;
• Comply with legal obligations, including recordkeeping for scholarship audits;
• Improve and develop new features.

W-9 information, tax-identification numbers, and bank-account details for tutors are collected and stored by Stripe, not ScholarLedger. ScholarLedger stores only the Stripe Connect Account ID and high-level onboarding status flags. Tax forms (such as Form 1099-K) are issued by Stripe in accordance with applicable thresholds and regulations.

We do not sell your personal information. We share information only as described below:

• With service providers who perform services on our behalf (see list below) under contractual confidentiality and security obligations;
• Between platform users as needed to deliver the service— for example, a tutor's name, credentials, and rate are visible to the parents who hire them, and a parent's name and contact information are visible to their tutors;
• With scholarship administrators only when you explicitly export documentation and submit it yourself;
• To comply with law, respond to lawful requests, enforce our terms, or protect the rights, property, or safety of ScholarLedger, our users, or the public;
• In a business transfer such as a merger, acquisition, or sale of assets, subject to standard confidentiality protections.

The platform relies on the following third-party processors:

Each provider processes data only as necessary to deliver its service and is contractually required to maintain appropriate security and privacy controls.

We use a small number of strictly necessary cookies to keep you signed in and to protect against abuse. Specifically, an httpOnly session cookie is set after you authenticate with Firebase, and our security provider may set short-lived cookies during bot challenges. We do not use advertising cookies or third-party trackers for marketing purposes.

ScholarLedger is not directed to children under 13, and we do not knowingly create accounts for children. Account holders must be at least 18 years old.

Parents using the platform may enter limited information about their minor children (such as legal name, grade, and county) for the sole purpose of generating scholarship documentation. We do not collect this information directly from children, do not use it for marketing, and do not share it with third parties except as needed to operate the platform or as required by law. If you believe a child's information has been collected in error, contact support@scholarledger.org and we will promptly address the request.

Compliance documentation is retained for a minimum of five (5) years to support scholarship audit requirements. Account information is retained while your account is active and for a reasonable period afterward to comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account information; some records may be retained as required by law or to fulfill scholarship-program obligations.

Data is stored in Google Firebase with role-based Firestore security rules. All data is encrypted in transit (TLS) and at rest. We use authentication best practices, principle-of-least-privilege admin access, and ongoing monitoring. No system is perfectly secure, however, and we cannot guarantee absolute security. You are responsible for keeping your password confidential.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Request deletion of your information, subject to legal retention requirements;
• Receive a portable copy of information you have provided;
• Object to or restrict certain processing.

To exercise these rights, email privacy@scholarledger.org. We may need to verify your identity before fulfilling certain requests. You will not be discriminated against for exercising your rights.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides additional rights, including the right to know what personal information we collect, the right to delete personal information, the right to correct, and the right to opt out of “sale” or “sharing.” ScholarLedger does not sell or share personal information for cross-context behavioral advertising. To exercise CCPA rights, contact privacy@scholarledger.org.

ScholarLedger is operated from the United States. If you access the platform from outside the United States, your information will be transferred to and processed in the United States, which may have different data-protection laws than your country of residence.

In the event of a security incident affecting your personal information, we will notify affected users and applicable regulators as required by law and without undue delay.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, for material changes, provide additional notice. Your continued use of the platform after the changes take effect constitutes acceptance of the updated policy.

Questions, requests, or concerns about your privacy? Reach us at:

• Email: privacy@scholarledger.org
• Support: scholarledger.org/support