Privacy

Effective [EFFECTIVE DATE] · [COMPANY LEGAL NAME]

Who this covers

Iter is an academic and career coaching tool used by students, by counselors a student invites, and by schools or programs that provision access for their members. Some students may be minors, so we build for data minimization and explicit, student-held consent by default.

What we collect

• Account details: your email and a securely hashed password (we never store your password in readable form), your display name, and your role (student or counselor). For student self-signup, your date of birth is processed once to enforce the 13+ screen; the exact date is not retained, only the time that the age gate was passed. Counselor signup is available only to an email invited by a student or provisioned as active institution staff.
• Workspace content you create: your profile facts, target, route milestones, evidence records, saved reviews, and chat messages with the agent. You enter this; you can edit or delete it.
• Usage counts: per-day AI token totals used to enforce plan limits. These are numeric totals, not the content of your messages.
• Payment: if you subscribe, payment is handled by Stripe. We store a plan status and Stripe reference identifiers — not your card number.

What we deliberately limit

• Uploaded originals. A chat or Roleplay attachment is processed for that request and is not persisted by Iter's server. Draft Coach keeps a preview of an opened file in IndexedDB on this browser so the document can reopen after a reload. File bytes are excluded from localStorage, JSON workspace exports, and account sync; those may retain document metadata, extracted text, and review data. Deleting the Draft Coach session, resetting the workspace, deleting the account, or clearing this site's browser data removes the browser-local preview.
• Saved Radar privacy. Saved Radar queries, live query/result caches, and the approximate map point stay in this browser's local workspace and in any JSON backup you choose to export; query-bearing activity labels are not written to the account copy. These fields are removed from account sync, including again at the server boundary for older clients. Running a Radar is a separate action that sends its query for a live search. The approximate point itself is used only in this browser to filter returned listings and is not sent with that search.
• Opportunity monitors and source settings. Weekly regional tracker settings, public Watchlist links, compact page fingerprints, their bounded Opportunity Inbox, and your source-directory include/exclude choices are part of your workspace so they can persist with your account. Directory recommendations are calculated in your browser from the saved country, stage, target, and interests; national portals require an exact home or named target country unless you explicitly broaden a region. Iter does not infer citizenship, residency, or eligibility from that profile. A tracker sends its saved category, keywords, and region to Iter's public opportunity search only when its weekly check runs or when you choose Run now. A Watchlist check sends only the public URL to Iter's protected page reader; Iter stores a compact fingerprint, page title, and short summary rather than a copy of the page. Signed-in account checks can run on Iter's server at the saved weekly time even while the browser is closed, and the next Inbox refresh merges their results into the device copy. Guest workspaces are not account-synced, so their checks run and catch up only while Iter is open. Private or login-gated sources are not accessed without an authorized connector.
• No sale of personal data. We do not sell or rent your data or use it for third-party advertising.
• No invented facts about you. The agent will not fabricate a grade, requirement, deadline, or acceptance chance; claims are tied to sources you can check.

Where processing happens

Core analysis (text metrics, OCR, evidence and route logic) runs locally on the Iter server without sending your workspace to a third-party model. If an operator configures an external language model, agent chat requests may be sent to that provider to generate replies; that is a deployment choice disclosed by whoever runs your instance.

How sharing works

• Counselors see a student only with that student's approval. Buying a school plan or being added to an organization does not open a student's workspace. A counselor gains read access to a student's Counselor Brief only after the student invites and approves them, and the student can revoke it at any time.
• Service providers. We use Stripe as our payment processor. [LIST ANY OTHER SUB-PROCESSORS, e.g. hosting, email, LLM provider].
• Schools. When a school provisions access, we act on the school's behalf for its members under a data processing agreement. [DESCRIBE YOUR SCHOOL DPA TERMS].

Minors, FERPA & COPPA

Where Iter is used by a school, student workspace content may constitute education records; we handle it on the school's behalf and do not use it for unrelated purposes or redisclose it. The current self-service account path is 13+: student signup declines under-13 users, and choosing the counselor role is not a workaround because that role requires a prior student or institution invitation. Iter does not currently provide a school-authorized under-13 path; that path must remain unavailable until a reviewed school or parental consent mechanism and its required records are implemented. See the project's COMPLIANCE.md for how the architecture maps to these regimes and what remains to be completed.

Keeping your data, and deleting it

Your workspace is retained while your account is active. Operational metadata is count-bounded to the 200 most recent agent runs and 100 most recent correction signals per workspace. Public Opportunity Intelligence snapshots and source-health records do not contain your private saved Radar query or approximate map point; they expire after 180 days without another observation and also have count limits. A visitor's normal guest workspace stays in that browser and is not account-synced. Anonymous preview-usage counters, limited agent execution records, and any guest snapshot created by a legacy or direct API client are deleted after 30 days without activity. Deleting your account first requires a different claimed administrator for any organization you administer and cancels any active individual Stripe subscription; if either check fails, deletion stops so an organization or recurring charge is not orphaned. Once confirmed, deletion removes your user record, sessions, subscription record, usage counters, counselor grants where you are the student, and organization memberships, revokes counselor grants where you are the counselor, and asks the browser to clear this site's cache, cookies, and storage across tabs. Iter also sends bounded, concurrent revocation requests to connected Google and GitHub accounts before deleting every local encrypted connector token; if a provider does not confirm the remote revocation, the final message names it so you can verify that provider's connected-app settings. The app performs browser cleanup directly for browsers that do not honor the clearing header. [STATE YOUR RETENTION PERIOD FOR ANY RESIDUAL BACKUPS AND HOW TO REQUEST DELETION].

Security

Passwords are salted and hashed, sessions are server-side and expire, and provisioning and billing actions are gated so no user can grant themselves a paid plan. No system is perfectly secure; [DESCRIBE YOUR INCIDENT-RESPONSE AND BREACH-NOTIFICATION PROCESS].

Your choices & contact

You can edit or delete your workspace content, cancel a subscription from the billing portal, and delete your account. For privacy requests, contact [PRIVACY CONTACT EMAIL]. We will update this page and its effective date when the software's data handling changes.