Privacy Policy

Meridian Pathways LLC (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what personal information we collect, how we use and store it, and your rights with respect to that information. It applies to all users of the Meridian Pathways web platform and related services.

1. Information We Collect

1a. Information You Provide Directly

When you register for an account or complete the intake form, we collect:

• Parent / guardian details: first name, last name, email address, and contact phone number;
• Student academic profile: current grade, high school name, GPA (optional), intended major, SAT/ACT scores (optional), AP/IB courses, and academic interests;
• Extracurricular information: sports, clubs, community service, and awards;
• College preferences: target colleges, preferred location, school size, and budget range;
• Goals and context: college goals, challenges, and any additional notes you choose to share.

1b. Google OAuth Sign-In Data

When you sign in with Google, we receive and store the following from Google’s OAuth service:

• Your Google account email address;
• Your display name (as set in your Google profile);
• A unique Google account identifier used to link your account.

We do not receive your Google password, payment methods, contacts, or any other Google account data. We do not request access to your Gmail, Google Drive, or Google Calendar. The OAuth connection is used solely for authentication — to confirm your identity and create or log in to your Meridian Pathways account.

Google’s own privacy practices are governed by the Google Privacy Policy.

1c. Automatically Collected Information

Like most web platforms, we may automatically collect standard technical information when you use our site, including IP address, browser type, device type, referring pages, and session duration. This information is used for security monitoring and platform improvement only.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account and authenticate your identity;
• Generate personalized college admissions recommendations using AI;
• Facilitate consulting sessions between your family and our advisors;
• Send transactional emails (intake confirmations, session reminders, account notifications);
• Process payments securely via Stripe;
• Comply with applicable legal obligations.

We do not sell your personal information to third parties. We do not use your information for targeted advertising.

3. Data Storage — Supabase (PostgreSQL)

All data stored in our Supabase database is:

• Encrypted at rest using AES-256 encryption;
• Transmitted over TLS (HTTPS) in transit;
• Stored in data centers located in the United States;
• Accessible only to authorized Meridian Pathways personnel and necessary service integrations.

Supabase is SOC 2 Type II compliant. Their privacy practices are described in the Supabase Privacy Policy. We use Supabase solely for secure data storage and do not enable any Supabase features that would expose your data to third parties.

Passwords for email/password accounts are hashed using bcrypt before storage. We never store plaintext passwords.

4. Artificial Intelligence Processing

When you submit an intake form, we send relevant profile data — including academic interests, intended major, target colleges, grade, and stated goals — to one or more third-party cloud-based AI service providers (such as Anthropic’s Claude API). This data is used solely to generate your personalized recommendations report.

Specifically:

• We do not send your name, email address, phone number, or payment information to any AI service provider;
• Data transmitted to AI service providers is used only for inference (generating your report) and is not used to train AI models under our enterprise API agreements;
• All AI API calls are made server-side — your data is never sent directly from your browser to any AI service provider;
• Generated recommendations are stored in our database and linked to your account.

Each AI service provider we engage is selected subject to contractual data-handling obligations consistent with the guarantees above. Their individual privacy practices are governed by their respective privacy policies and terms of service.

5. Payment Processing — Stripe

Payments are processed by Stripe, Inc. We do not store your credit card number or full payment details on our servers. Stripe handles all payment data and is PCI-DSS Level 1 certified. You can review Stripe’s privacy practices at stripe.com/privacy.

6. Email Communications

We send transactional emails (account creation, intake confirmation, session reminders, and payment receipts) to the email address associated with your account. These emails are necessary for service delivery and cannot be opted out of while you maintain an active account.

If we send any optional marketing or informational emails, we will obtain your separate consent and include an unsubscribe link in every message.

7. Data Retention

We retain your account and intake form data for as long as your account is active or as needed to provide Services. If you request account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or maintaining payment records).

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: request a copy of the personal data we hold about you;
• Correction: request correction of inaccurate or incomplete data;
• Deletion: request deletion of your personal data (subject to legal retention requirements);
• Portability: request your data in a machine-readable format;
• Objection: object to certain processing of your data.

To exercise any of these rights, please email us at hello@meridianpathwaysllc.com. We will respond within 30 days.

9. Children’s Privacy

Our platform is designed for use by parents and guardians, not directly by minors. We do not knowingly collect personal information directly from children under the age of 13. Student academic data entered on the platform is provided by the parent or guardian on the student’s behalf.

If you believe a child under 13 has provided personal information to us without parental consent, please contact us immediately at hello@meridianpathwaysllc.com and we will promptly delete it.

10. Security

We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These include HTTPS encryption for all data in transit, encrypted database storage, hashed passwords, and role-based access controls limiting which personnel can view user data.

While we take security seriously, no system is completely impenetrable. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

11. Third-Party Links

Our platform may contain links to external websites (such as college websites or informational resources). We are not responsible for the privacy practices of those sites and encourage you to review their policies separately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date and notify you by email. Your continued use of the Services after changes take effect constitutes your acceptance of the revised policy.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: