Privacy Policy

1. Who We Are

Project Bridge is a service of Saka One Enterprises, doing business as Project Bridge. The platform lives at projectbridge.co. Our role is to help students prepare college and scholarship applications by organizing their stories, brag sheet entries, academic profile, and matched opportunities in one place, and to give counselors visibility into student readiness.

2. How You Use Project Bridge

Two ways:

As a student rostered by your school. Your counselor or school administrator uploaded your name, email, grade, and student ID through a secure roster process. You received an invite email and set up your password. The school is the data controller in this relationship. We are the service provider operating under FERPA's school-official exception.

As a counselor or administrator. You signed up using your school-provided account or invitation. You agreed to our terms of service when you accepted the role.

We do not currently allow direct student self-signup outside of a school relationship.

3. What We Collect

From students:

• Name, email address, grade level, and student ID number (provided by your school's roster import)
• Academic information you enter: GPA, intended major, intended pathway, career interests
• Demographic information you choose to provide: gender, race or ethnicity, first-generation status, disability status. All demographic fields include a “prefer not to say” option, and providing them is voluntary.
• Brag sheet entries: activities, roles, time commitments, accomplishments
• Story bank entries: written narratives about your experiences, structured as Challenge-Action-Result paragraphs with optional context details
• Coach session transcripts: the conversational text you and the AI coach exchange during structured intake sessions
• Scholarship matches and starred opportunities, including the gaps your profile shows for each
• Login activity, including last sign-in date and session counts

From counselors and administrators:

• Name, email, title, role, school assignment
• Notes and pull-quotes you write about students, including the share-with-recommender opt-in flag on each
• Caseload assignments

Automatically collected:

• IP address and browser type for security and abuse prevention
• Page views and feature usage (we use this to improve the product)
• Email delivery and open rates for emails we send you

What we do NOT collect:

• Grades or transcripts
• Discipline records
• Test scores (unless you choose to include them in your profile)
• Financial information about you or your family
• Health information
• Information about people who are not our users

4. Why We Collect It

We collect the information above for these specific purposes:

• To provide the service: organize your stories and brag sheet, match you to scholarships and colleges, generate readiness reports for your counselor, and produce recommender packets
• To send you product emails: weekly nudges, account verification, password setup, security notifications
• To improve the product: understand which features help students and counselors most
• To meet legal and contractual obligations: respond to legitimate legal requests, fulfill our agreement with your school

We do NOT use your data to train AI models without your explicit, separate opt-in. The “agree to privacy policy” checkbox at signup does not constitute training opt-in. Training opt-in, if we ever offer it, will be a separate, clearly-labeled choice.

5. Who Can See It

Your counselor and school administrator

Your assigned counselor at your school sees your full profile, story bank, brag sheet, scholarship matches, and coach session transcripts. School administrators with the school_admin role see aggregate caseload data and can see individual student profiles within their school. This access is the basis for the service: counselors cannot help you if they cannot see your work.

Other students

Other students see nothing about you. Project Bridge is not a social product.

Parents and guardians

Parents and guardians of students under 18 do not have direct accounts. Your school notified parents when your school enrolled in Project Bridge. If you are under 18 and your parent or guardian wants to see your data, they should contact your school counselor or write to us at privacy@projectbridge.co.

Recommenders (teachers, mentors)

Teachers and other recommenders do not have accounts on Project Bridge. When your counselor exports a recommender packet for you, only the content you and your counselor have specifically marked shareable is included. Counselor notes are private by default and only appear in a packet when the counselor explicitly checks the share-with-recommender box on each note.

Our staff

A small number of Project Bridge staff have access to user data for support, debugging, and operational purposes. Access is logged and audited.

Our sub-processors

We use these third-party services to operate the platform. Each is a sub-processor under our DPA with your school. None of them sell your data:

• Anthropic powers our AI coach (Claude Sonnet for pilot conversations, Claude Haiku for some support functions). We have requested Zero Data Retention with Anthropic; once enabled, conversation transcripts sent to Anthropic are not retained on their servers beyond the API request itself. Anthropic does not train its models on our data under our terms.
• Supabase hosts our database (Postgres) and authentication system. Your account, profile, story bank, and all other persistent data live in Supabase.
• Resend sends our emails (account invites, password setup, weekly digests, counselor nudges).
• Vercel hosts our application code and serves the website.

We do not currently use advertising trackers, marketing pixels, or third-party analytics that profile users.

Law enforcement and legal requests

We will respond to lawful subpoenas, court orders, or other legal demands. We will tell you if we receive a request about your data unless legally prohibited from doing so.

6. How Long We Keep It

• Active student accounts: as long as you are enrolled at a school using Project Bridge
• After you leave a participating school or after the school ends its agreement with us: we keep your data for 12 months, then automatically de-identify or delete it
• Coach session transcripts: 12 months from the date of the session, then automatically de-identified
• Counselor notes: as long as the counselor's account is active; archived for 12 months after, then deleted
• Email logs: 90 days
• Audit logs (recommender packet exports, roster imports): 24 months for accountability

You can request earlier deletion at any time by writing to privacy@projectbridge.co.

7. Your Rights

You have the right to:

• Access the data we hold about you. Most of it is visible inside the product. For anything not visible, write to privacy@projectbridge.co.
• Correct inaccurate information. You can edit most fields directly. For fields you cannot edit, contact your counselor.
• Delete your data. Write to privacy@projectbridge.co. We will delete within 30 days unless we have a legal obligation to retain it. If you are under 18, your school may need to be involved in this decision per their policies.
• Pause notifications at any time without deleting your account. Click the unsubscribe link in any email or change your settings inside the product.
• Export a copy of your data. Write to privacy@projectbridge.co. We provide your data in a portable format (JSON or CSV).
• Object to specific uses of your data. Write to privacy@projectbridge.co with your concern.
• Withdraw consent for any optional data collection (such as model training, if we ever offer it).

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what categories of data we sell or share for cross-context behavioral advertising. We do neither, so we have nothing to disclose under those categories.

If you are a student or parent in a state with student-specific privacy laws (such as California's Student Online Personal Information Protection Act, SOPIPA), those laws also apply, and we comply with their additional requirements.

8. Security

We protect your data using industry-standard technical and organizational measures:

• All data in transit is encrypted using TLS
• All data at rest is encrypted by Supabase
• Access to production data is limited to a small number of authorized staff
• We use multi-factor authentication on administrative accounts
• We log access to production data and audit logs regularly
• We have a documented incident response plan

If we detect a breach affecting your data, we will notify you and your school within 72 hours of confirming the breach, in accordance with applicable law.

9. Children's Privacy

Project Bridge is designed for students 13 and older. We do not knowingly collect personal information from children under 13. If we learn we have, we will delete it. Schools enrolling students under 13 must obtain verifiable parental consent in compliance with the Children's Online Privacy Protection Act (COPPA).

For students aged 13 to 17, we operate under FERPA's school-official exception when serving rostered students, and your school has notified parents of our role. Parents may contact the school counselor or write to privacy@projectbridge.co with questions.

10. Cookies and Similar Technologies

We use cookies for these purposes:

• Authentication. A session cookie keeps you logged in. Required for the service to work.
• Security. A CSRF token prevents cross-site request forgery. Required.
• Preferences. Optional cookies that remember settings like dark mode if you choose to use them.

We do not use third-party advertising cookies. We do not use cross-site tracking pixels.

11. International Data Transfers

Our infrastructure is hosted in the United States. If you are accessing Project Bridge from outside the United States, your data is transferred to and stored in the U.S. We do not currently serve users in jurisdictions where this transfer requires a separate legal mechanism (such as the EU under GDPR). If we expand to those jurisdictions, we will update this policy and implement appropriate transfer safeguards.

12. Changes to This Policy

We may update this policy as the product changes. When we do, we will:

• Update the “Last Updated” date at the top
• Notify users by email at least 14 days before any material change takes effect
• Post a summary of the changes at projectbridge.co/privacy/changes

If a change is material and you do not agree, you can delete your account before the change takes effect.

13. Contact

For any privacy question, request, or concern:

Email: privacy@projectbridge.co

Mail: Project Bridge, c/o Saka One Enterprises (mailing address available on request)

We respond to privacy requests within 5 business days.

14. For Schools

Schools using Project Bridge sign a Data Processing Agreement (DPA) that specifies our obligations as a service provider. The current DPA is available from your account representative or by writing to privacy@projectbridge.co. Key terms include:

• We act only on the school's instructions
• We do not sell or share student data with third parties for marketing
• We notify the school of any breach within 72 hours
• We provide audit logs on request
• We delete or return data at the end of the service relationship
• We comply with FERPA, COPPA, SOPIPA (for California schools), and other applicable student privacy laws

This policy was drafted to be readable. If anything is unclear, that is on us, not you. Write to privacy@projectbridge.co and we will explain.