Privacy Policy

1. Scope

This policy explains how Gateway collects, uses, stores, and protects information when you use our college-search and planning service. It applies to Gateway's website, accounts, support forms, and related product features.

2. Information we collect

• Account information: email address, name, password credentials handled by our authentication provider, and date of birth used to enforce the 16+ requirement.
• Student profile information: optional academic interests, intended majors, location preferences, goals, activities, GPA, and test scores.
• Planning information: saved colleges, milestones, notes, deadlines, and documents that you choose to upload.
• Communications: information included in support, waitlist, or feedback submissions.
• Technical information: basic device, browser, request, security, and service-performance information needed to operate and protect Gateway.

Do not upload Social Security numbers, bank information, medical records, or other information that is not necessary for college planning.

3. How we use information

• Authenticate users and maintain accounts.
• Enforce the age requirement and prevent abuse.
• Provide college search, saves, planning tools, and private document storage.
• Respond to support requests and communicate service changes.
• Diagnose errors, secure the service, and improve reliability.
• Comply with applicable legal obligations and enforce our Terms of Service.

4. College data

Gateway's launch catalog uses institution-level data from the U.S. Department of Education College Scorecard. Source dates are displayed where available. Gateway does not claim endorsement by the Department of Education, individual institutions, or other data providers.

Public college data is not your personal information. You should verify deadlines, prices, admission requirements, and program availability directly with each institution before acting.

5. Service providers and disclosures

Gateway uses service providers to operate the product, including Supabase for authentication, database, and storage services, and Vercel for application hosting and operational telemetry. Providers receive information only as needed to perform those services and are subject to their own security and privacy obligations.

We do not sell personal information. We may disclose information when required by law, to protect users or the service, or as part of a legitimate organizational transaction with appropriate safeguards.

Stripe billing and OpenAI-powered features are disabled at launch. This policy will be updated before those services process production user information.

6. Storage, security, and retention

Gateway uses access controls, row-level database policies, private storage, encrypted network transport, and operational monitoring. No system can guarantee absolute security, so use a unique password and report suspected account misuse.

We retain account and planning information while your account is active and as reasonably necessary to operate the service, resolve disputes, secure the product, and meet legal obligations. Test and temporary operational data is removed when it is no longer needed.

7. Your choices and requests

• Review and update editable profile information in Gateway.
• Remove saved items and uploaded documents that you control.
• Request access, correction, export, or deletion through the support page.
• Unsubscribe from optional communications where an unsubscribe option exists.

We may need to verify your identity before completing a request. Some information may be retained when required for security, fraud prevention, or legal compliance.

8. Age requirement

Gateway does not permit accounts for people under age 16. We request a date of birth during registration and reject under-16 account creation at the database boundary. If we learn that an under-16 account or inaccurate age information bypassed these controls, we may suspend the account and delete the associated information.

9. Changes to this policy

We may update this policy when Gateway's features, providers, or legal obligations change. Material changes will be posted here with a revised date and, when appropriate, communicated to account holders.

10. Contact

Submit privacy questions and account-data requests through Gateway's support page.