Privacy Policy

1. Introduction

This Privacy Policy explains how Nebelo LLC (“we,” “us,” or “our”) collects, uses, and shares information when you use College Essay Panel (the “Service”), available at collegeessaypanel.com. By using the Service, you agree to this Policy. The Service is intended for users in the United States. Accounts may be created only by adults 18 or older; students ages 13-17 may use the Service through an account created and controlled by their parent or legal guardian, as described in our Terms of Service.

2. Information We Collect

Information you provide:

• Account information: your first and last name, email address, and password (stored hashed by our authentication provider); your date of birth (used to confirm you are 18 or older); your account-use designation (whether a student age 13-17 will use the account); optionally, your graduation year and how you heard about us; and whether you opted in to occasional product news.
• Essay content: your essay drafts and versions, the essay title and type you choose, the prompt, word limit, target schools, and any optional context you add (activities summary, a school's AI policy, deadline). See Section 4 for how we handle it.
• Acceptance records: which version of the Terms and this Policy you accepted, which boxes you checked, when, and the IP address and browser it came from.
• Referrals: your referral code and, if you signed up through someone's link, which account referred you, so the referral credit can be granted.
• Support messages: messages you send through the contact form, with the name and email you provide.
• In-app notifications: the receipts, review updates, and account notices we show you in the app. These can include your essay titles, never essay text.
• Payment information: processed by our third-party payment processor, Stripe. We do not store full payment card numbers ourselves; we store the purchase record (pack, amount, status, refunds) and your credit balance.

Information collected automatically:

• Operational logs: security and account events (sign-ins, signups, purchases, refunds, and deletions), kept as a security audit trail. Sign-in and account events also record the IP address and browser they came from, and deletion events record the deleted essay's title (never its text). The signup event records your age in years at that moment, so we can show the 18-or-older check ran and what it concluded; it does not record your date of birth, which is kept on your account and deleted with it. When a free review is used, we also record hashed identifiers derived from the account email and the browser; these hashes cannot be read back into the original values, and they survive account deletion so the one-per-person free review cannot be reset by deleting the account (Section 6).
• Session data: the strictly necessary cookies our authentication provider needs to keep you signed in, a short-lived signup-protection cookie, and a fraud-prevention identifier so the free review is one per person (Section 8).
• How you found us: on your browser's first visit, we note the page you landed on, the site that linked you here, and any campaign tags in the link's address (Section 8). If you create an account, that record is kept on it so we can tell which of our outreach reaches students. It records where you came from, never where you go, and it is deleted with your account.
• Aggregate traffic measurement: we count page views to see which pages people reach and where they arrived from. This uses no cookies, no device fingerprint, and no identifier that follows you between sites or between visits. It is not tied to your account, and it never touches your essay text (Section 8).

3. How We Use Your Information

We use your information to:

• Provide the Service, including generating your scores and written reports;
• Process your credit pack purchases and grant referral credits;
• Maintain your account and let you view your past results and draft history;
• Respond to support requests;
• Understand which sites, searches, and campaigns bring people to the Service;
• Protect against fraud, abuse, and security risks;
• Comply with legal obligations.

We do not use your essays or feedback to train or improve any machine-learning model, and we do not sell your personal information. We do not run ads, and password-reset and account emails are not marketing.

4. How We Handle Your Essay (Important)

• Your essay is transmitted to our third-party AI provider, Anthropic, solely to generate your scores and written feedback. Under our commercial agreement, your content is not used to train that provider's models.
• Your drafts and versions are stored under your account to power your draft history and revision rounds; each revision round re-reads your prior draft. We also store the scores and written reports the panel produces.
• Deleting an essay is a true, permanent delete. The draft, its versions, and every review generated from it are hard-deleted; there is no recycle bin.
• We deliberately keep your essay text out of our own error-tracking and logging tools (Section 5).

5. How We Share Information

We share information only as needed to run the Service. These are the only third parties that touch your data, and what each one sees:

• Anthropic (AI provider): receives your essay text, prompt, target schools, and optional context to generate your review.
• Supabase (database and authentication hosting): your account, essays, reviews, and credit ledger live here.
• Stripe (payment processor): your card details go directly to Stripe and never touch our servers; we store only the purchase record.
• Sentry (error tracking): deliberately configured to protect your writing. Request bodies are never attached to error reports, so essay text cannot ride along; user identifiers are stripped; session replay is off.
• Google Workspace (email): hosts our support and legal inboxes, so contact-form messages and any email you send us are delivered to and stored there.
• Resend (email delivery): carries the email our service sends. That is account confirmations, password resets, a notice when a review you started has finished or was interrupted, a reminder if a finished report sits unread for a few days, a warning before inactivity deletes your stored work, the notification we send to ourselves when you use the contact form, and the operational notices we send to ourselves when an account is created, a review is started, or credits are bought. Those operational notices go only to us, never to anyone else, and they name the account holder and summarize the event: for a review, whether it was the free one, which round, the length of the draft, and how many target schools were listed. Your email address passes through Resend on the way to you, along with anything you typed into the contact form. It never receives your essay, and none of these notices name your essay or quote a word of it; the unread reminder does include your overall panel score.
• Cloudflare (network edge, bot protection, and traffic measurement): every request to this site passes through Cloudflare before it reaches our servers, which means Cloudflare handles the traffic your browser sends us, including pages you submit an essay from. Cloudflare also provides the cookieless page-view counting described in Section 8, and the bot check on our sign-up form (Cloudflare Turnstile). That check runs in your browser and sends Cloudflare technical signals about the browser and the request, so it can tell a person from an automated script. Those signals do not include your name, your email, or your essay. It is there to stop bulk automated account creation, which is what protects the free review from being drained by scripts. We do not send your essay text to Cloudflare as data to be stored or analyzed; it passes through as part of the request, the same way it passes through your internet provider.
• Legal and safety: if required by law, legal process, or to protect rights and safety.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Our only analytics is the cookieless page-view count in Section 8; there are no advertising networks and no data brokers.

6. Data Retention

• Essays, drafts, and reports: retained until you delete them or your account. If your account has no activity for 365 days, we delete your stored essays and results, with a warning through the Service beforehand.
• Account records: retained while your account exists. Deleting your account removes your profile, essays, reviews, notifications, and credit balance.
• Purchase and refund records, our security and acceptance logs, and support messages you sent: retained after deletion as needed to meet legal, tax, accounting, fraud-prevention, and support obligations. The acceptance log records your agreement to these documents and survives account deletion. The hashed free-review identifiers described in Section 2 are retained the same way, for the same fraud-prevention purpose.

7. Your Choices and Rights

• Delete any essay, or your entire account, at any time within the app. Deleting your account removes your stored results, including your essays, scores, and reports.
• Depending on your state of residence, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to not be discriminated against for exercising these rights. To make a request, contact support@collegeessaypanel.com or use the contact form. We will verify your request before acting on it.

8. Cookies and Analytics

We use only the strictly necessary session cookies our authentication provider needs to keep you signed in, short-lived cookies that protect signup, and two first-party cookies of our own. The first is fraud prevention: a random identifier, kept for up to two years, that lets us tell that a free review was already used from the same browser. It carries no personal information and is never used for advertising. The second is a first-visit note, kept for up to 90 days: the page this browser first landed on, the site that linked it here, and any campaign tags in that link's address, so that if you create an account we know which of our outreach brought you (Section 2). It is written once, is never updated as you browse, and is read only when you sign up. Neither cookie follows you to another site or is shared with anyone. There are no advertising or cross-site tracking cookies. You can control cookies through your browser settings; disabling some will prevent sign-in.

Page-view measurement. We use Cloudflare Web Analytics to count how many people reach each page and which site or search sent them. It sets no cookies and builds no device fingerprint, so it cannot follow you between visits or to any other site, and there is nothing here to opt out of storing on your device. What it records is the page address, the referring site, and coarse technical details your browser sends to every website anyway: country, browser, and device type. It is never joined to your account, and it never sees your essay text. We use it to answer “are people finding us and which pages help”, nothing more.

Do Not Track. Some browsers offer a “Do Not Track” (DNT) signal. Because there is no common industry standard for DNT, the Service does not currently respond to DNT signals; we also do not track you across other sites in the first place.

Third-party tracking. We do not authorize third parties to collect personally identifiable information about your online activities over time and across different websites when you use the Service.

9. Security

We use reasonable administrative, technical, and physical safeguards to protect your information. Traffic is encrypted in transit; database access is locked down with row-level security; review content is only served through our API, which enforces ownership on every request; payments never touch our servers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Students Under 18; Children's Privacy

Students ages 13-17. Students who are at least 13 but under 18 may use the Service only through an account created and controlled by a parent or legal guardian, who consents to the collection and processing of the student's information as described in this Policy. For these students:

• We collect and process the student's essay content solely to generate the scores and feedback requested through the parent's account, with the same handling described in Section 4: drafts and reports are stored under the parent's account until deleted.
• We do not sell students' personal information, do not share it for cross-context behavioral advertising, and do not use it for targeted advertising or to train any machine-learning model.
• The parent or guardian who controls the account can review the student's stored results and delete them, or the entire account, at any time within the app.

No one under 13. The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will delete it and terminate the associated account. If you believe a child under 13 has used the Service, contact us at support@collegeessaypanel.com.

11. California Residents

If you are a California resident, California law may provide you with additional rights regarding your personal information, subject to the applicability of those laws to our business. These may include the right to know what personal information we collect, use, and share; the right to request deletion of your personal information; the right to correct inaccurate personal information; and the right not to be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising. To exercise any available right, contact us at support@collegeessaypanel.com; we will verify your request before responding.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will update the effective date above and ask you to re-accept in the app before your next review.

13. Contact

Questions or requests can be sent to support@collegeessaypanel.com or through the contact form.