Privacy Policy

This Privacy Policy explains how VerifyED LLC (“VerifyED,” “we,” “us,” or “our”) collects, uses, and shares information when you use the VerifyED “School Lookup” website and API (the “Service”).

If you are using the Service on behalf of an organization, this Policy applies to that organization’s use, and administrators may be able to access and manage your account.

1. Summary

We collect account, usage, and query information to operate and secure the Service.
Credential extraction may process student records that an authorized user deliberately uploads.
Do not submit personal data in search queries, feedback, or other fields that are not designed for it.
We retain data for limited periods (details below) and keep aggregated analytics longer.

2. Information we collect

2.1 Account information

If you create an account (now or in the future), we may collect information like your name, email address, organization name, and user preferences.

2.2 Usage information (logs)

When you use the Service, we automatically collect information such as IP address, user agent, request timestamps, pages/endpoints accessed, approximate location derived from IP, and other diagnostic/security data.

2.3 Query information

We collect and store search/enrichment queries and timestamps to monitor usage, prevent abuse, debug issues, and improve the Service. We design our analytics workflows to minimize personal identifiers, and we may use de-identified or aggregated query data for product improvement.

2.4 Cookies and similar technologies

We use login/session cookies and similar technologies that are necessary to provide the Service (e.g., to keep you signed in and maintain session state). We may also use cookies or local storage for preferences (e.g., your default country filter).

2.5 Uploaded credential documents

The credential extraction demo accepts academic records that may contain student names, dates of birth, student IDs, grades, and other education-record data. You may use extraction without signing in. Anonymous source documents and extracted results are processed for the request and are not intentionally retained by VerifyED.

When you are signed in, we store the source document in a private, server-only object bucket and store its structured result and processing metadata in our application database for comparison, support, and debugging. The record may include an opaque object key, content hash, file type and size, lifecycle status, model, latency, token and cost metadata, review flags, and sanitized failure information. The default retention period is 30 days. You can delete the retained source and result from the extraction screen before that date, and scheduled cleanup removes expired records. Stored documents have no public URL, their contents are kept out of application logs, and they are not sent to an additional model or training workflow.

The document is transmitted to our AI routing and model provider for the extraction you request. We configure those requests to require provider endpoints that represent that they do not retain prompt content, but those service providers still process the document transiently to provide the extraction. Request metadata, such as the endpoint, status, timing, account or hashed network identifier, and usage count, may be logged without the document contents.

The document review workspace also accepts uploaded documents as evidence for a review, and is available only when you are signed in. We store the source document in the same private, server-only object bucket and record file metadata and review events in our application database. Review documents are not sent to an AI model. The default retention period is 30 days, capped at 90 days; you can delete a document from the review before then, and scheduled cleanup removes expired documents. Deleting a document, or its expiry, removes the stored file but not the review record it supported. Stored review documents have no public URL and are readable only through authenticated, access-checked requests.

2.6 Feedback and support communications

If you use our feedback button or contact us, we collect the information you provide (such as message content and contact details). Do not include personal data in these messages.

2.7 Billing information

If you purchase a paid plan, we (and our payment processors) collect billing and transaction information. Payment card details are typically handled by our payment processor; we do not store full card numbers ourselves.

3. Restricted and sensitive data

Only upload a credential when you are authorized by the student, your institution, or applicable law to process that record for a legitimate education, admissions, compliance, or verification purpose. Do not upload unrelated medical, financial, biometric, government-identifier, or other sensitive records.

The rest of the Service is not designed to receive personal data. Do not place student records, home addresses, personal emails, phone numbers, or government identifiers in search queries, feedback, or support messages. If we detect personal data outside the credential extraction and document review features, we may delete it and related logs and may suspend the related account or API key.

4. How we use information

We use information to:

provide, maintain, and improve the Service;
operate features you request (including enrichment);
authenticate users and administer accounts;
monitor usage, enforce limits, and prevent fraud/abuse;
provide customer support and respond to inquiries;
send service-related communications (e.g., important updates, billing notices); and
comply with legal obligations and protect our rights and users.

We do not sell personal information.

We share information in limited circumstances, including:

Service providers (processors) who help us operate the Service, such as hosting/CDN, analytics, database and infrastructure, payment processing, email delivery, customer support tooling, mapping/geocoding, and AI research providers.
We maintain a list of current service providers and can provide it upon request (subject to reasonable confidentiality and security restrictions).
Legal and safety: to comply with law, respond to lawful requests, or protect rights, safety, and security.
Business transfers: in connection with a merger, acquisition, financing, or sale of assets.
Aggregated or de-identified data: we may share data that cannot reasonably be used to identify you or an individual.

6. Data retention

We retain information for as long as reasonably necessary for the purposes described in this Policy. Our typical retention periods are:

Account/profile data: while the account is active, plus up to 24 months after deactivation.
Billing and tax records: up to 7 years.
Raw API and website logs (e.g., IP + request metadata): up to 90 days.
Security/audit logs: up to 12 months.
Query analytics (de-identified/aggregated): up to 24 months for query-level analytics; aggregates may be retained longer.
Credential documents and extracted contents (not signed in): not retained by VerifyED after the extraction response.
Credential documents and extracted contents (signed in): 30 days by default, or until you delete them from the extraction screen, whichever is sooner. A scheduled job removes expired records. The retention period is capped at 90 days.
Documents uploaded to a review: 30 days by default, or until you delete them from the review, whichever is sooner. The same scheduled cleanup and 90-day cap apply. Removing a document does not remove the review record it supported.
In both cases, transient copies may remain in service-provider systems according to the processing settings and provider commitments described above.

We may retain data longer where required by law, for litigation/security purposes, or to maintain abuse-prevention records.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. International data transfers

VerifyED is based in the United States. Information may be processed and stored in the United States and other locations where our service providers operate.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your information, and to object to or restrict certain processing.

You can request help by contacting us at [email protected]. We may need to verify your identity and/or authority to act on behalf of your organization.

10. US state disclosures (California and others)

If applicable law in your state provides privacy rights (e.g., California), you may have the right to request access to, deletion of, or correction of certain personal information.

We do not sell personal information, and we do not knowingly share personal information for cross-context behavioral advertising.

11. EEA/UK disclosures

If you are located in the EEA or UK and applicable law applies, we process personal data based on:

performance of a contract (to provide the Service);
legitimate interests (e.g., security, abuse prevention, and improving the Service); and/or
compliance with legal obligations.

You may also have the right to lodge a complaint with your local supervisory authority.

12. Changes to this Policy

We may update this Policy from time to time. If changes are material, we will provide reasonable notice (for example, by posting the updated Policy on the Service or by email). The “Last updated” date above indicates when this Policy was last revised.

13. Contact

Privacy questions or requests: [email protected].