Privacy Policy

Last updated: October 1, 2026

Introduction

Mascot AI Labs, Inc. ("Mascot AI," "we," or "us"), a California corporation, is committed to protecting your privacy and being transparent about how we collect, use, and protect your personal information. This policy explains our practices.

What data we collect

• Account information: email address, name, password (stored hashed), and account type (student or parent).
• Profile information: academic history (GPA, test scores, coursework), extracurricular activities, honors, hometown, graduation year, college preferences, and free-text responses about your goals and experiences.
• Uploaded documents: transcripts and other files you choose to upload for parsing.
• Voice conversations: your voice audio is processed in real time by Google's Gemini model on Google Cloud Vertex AI to hold the conversation and generate a text transcript. We store the text transcript in your account. We do not store the audio recording ourselves, and under Google Cloud's terms Google does not use it to train its models; see "Service providers and AI processing" below for details.
• Essay content: drafts you write and the feedback conversations you have about them.
• Usage data: features used, pages visited, and time spent, to operate and improve the service.
• Device information: browser type, device type, IP address, and operating system, for support and security.
• Billing information: subscription status and payment metadata. Card details are handled by Stripe and are not stored on our servers.

Why we collect this data

• Account creation and authentication: to create and maintain your account and verify your identity.
• Voice counseling and profile building: to hold conversations, remember what you've discussed, and build your profile.
• College matching: to analyze your profile and produce personalized university recommendations with explanations.
• Essay assistance: to analyze drafts and provide coaching feedback.
• Product improvement: to understand how the platform is used and improve it.
• Communication: to send important updates about your account and the service.
• Security: to protect against fraud, abuse, and unauthorized access.

Before your first voice session, you'll be asked to confirm you understand that the conversation is processed in real time by Google's Gemini model on Google Cloud Vertex AI, as described below.

Service providers and AI processing

We do not sell your personal data. We share data only with providers that help us run the platform, and only as needed to deliver the service:

• MongoDB Atlas: database hosting and storage.
• Google Cloud Platform: application hosting.
• Stripe: subscription payments.
• Anthropic (Claude), via Google Cloud Vertex AI: AI processing for university matching, essay analysis, and transcript parsing.
• Google (Gemini), via Google Cloud Vertex AI: AI processing for real-time voice conversations. Under Google Cloud's terms, Google does not use this data to train its models. Google also handles optional "Sign in with Google" authentication.
• Google Analytics: aggregate traffic and usage measurement for our public website.

When you use AI features, your relevant content is processed by these third-party AI services under their own privacy terms. We do not use your data to train AI models, and we do not share personally identifiable information with third parties for their own purposes without your consent. Content processed through Google Cloud Vertex AI is handled under Google Cloud's terms, as described above.

Analytics and cookies

Our public website at mascot-ai.com uses Google Analytics 4 to understand how visitors find and use the site: pages viewed, referring source, approximate location, device type, and similar aggregate measures. Google Analytics sets cookies in your browser to do this. We have turned off Google Signals, so this data is not linked to your Google account or used for ad personalization, and we have set the shortest practical data retention.

You can block these cookies through your browser settings or with the Google Analytics opt-out browser add-on. The rest of the website works without them.

Data security

• Passwords are stored using secure hashing algorithms.
• Data is transmitted over HTTPS.
• Access to personal data is restricted to authorized personnel.
• We review and update our security practices regularly.

Data sharing

We do not sell your personal data to third parties. We may share information only:

• with your explicit consent;
• with the service providers listed above;
• when required by law or to protect our legal rights;
• in connection with a business transfer such as a merger or acquisition.

If parent linking is enabled for your account, a parent you approve can be granted read-only access to parts of your profile, matches, and essays. You control which sections are shared.

Your rights

• Access: view and export your profile information from your account settings.
• Correction: update your information at any time in your account.
• Deletion: request deletion of your account and associated data by contacting us.
• Data portability: request a copy of your data in a machine-readable format.
• Opt-out: opt out of certain data collection and communications.

California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the following rights over the personal information we hold about you:

• Right to know: the categories and specific pieces of personal information we have collected about you, the categories of sources, our purpose for collecting it, and the categories of third parties we disclose it to.
• Right to delete: request deletion of personal information we have collected from you, subject to certain legal exceptions.
• Right to correct: request correction of inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing: we do not sell personal information for money, and we do not "share" it for cross-context behavioral advertising as CPRA defines that term. Google Signals is turned off on our Google Analytics property, so analytics data is not linked to ad profiles. Because we do not sell or share, there is nothing to opt out of, but you can reach us at any time to confirm this for your account.
• Right to limit use of sensitive personal information: some information you provide (such as academic records or content revealing your background) may qualify as sensitive personal information under CPRA. We use it only to provide the counseling, matching, and essay features you request, which is a permitted use that does not require a separate opt-out.
• Right to non-discrimination: we will not deny you service, charge you a different price, or provide a different level of service because you exercised any of these rights.
• Authorized agent: you may designate an authorized agent to make a request on your behalf; we may require proof of the agent's authorization and verification of your identity.

To exercise any of these rights, contact us at team@mascot-ai.com. We verify your identity using your account email before fulfilling a request, and we respond within 45 days as required by CCPA/CPRA (with one 45-day extension when reasonably necessary). We have not sold or shared personal information, and have not used or disclosed sensitive personal information for purposes beyond those permitted under CPRA, in the preceding 12 months.

Minors: we do not sell or share the personal information of consumers we actually know are under 16 years of age. Because our student users are high schoolers, this may include minors; we require parental or guardian consent as described under "Children's privacy" below, and we do not need separate opt-in consent to sell or share their data because we do not sell or share it.

Shine the Light: California Civil Code Section 1798.83 lets California residents ask what personal information we share with third parties for those third parties' direct marketing purposes. We do not share personal information for third-party direct marketing, so there is nothing to disclose under this law.

Data retention

We retain your personal information for as long as your account is active or as needed to provide the service. Deleted content is first marked inactive and then removed. If you request account deletion, we delete your personal information within 30 days, except where we are required to retain it for legal or regulatory purposes.

Voice recordings: we do not retain audio ourselves; only the text transcript is stored under the retention terms above. Audio processed through Google Cloud Vertex AI is handled under Google Cloud's terms, as described in "Service providers and AI processing."

Children's privacy

Mascot AI is intended for students aged 13 and older, and for parents assisting students. For users under 18 we require parental or guardian consent, and for users under 13 we require verifiable parental consent before an account is activated. If you believe we have collected information from a child without the required consent, contact us and we will delete it.

Payments

Paid subscriptions are processed by Stripe. We receive subscription status and limited billing metadata, and we do not receive or store full card numbers.

International users

If you access the service from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the service, you consent to this transfer.

Changes to this policy

We may update this policy from time to time. We will post the updated policy on this page and change the "Last updated" date, and we will notify users of material changes.

Contact us

For questions or requests about this policy or your data, including account deletion, data access or portability, privacy complaints, and GDPR or CCPA requests, contact us at team@mascot-ai.com. We respond to all requests within a reasonable time, usually within 30 days.