Privacy Policy

Scope and contact

This notice describes how Counselora handles information in its counselor workspace, website, account and billing services, and email communications. Contact hello@counselora.com for privacy questions or requests. It does not replace a school’s own privacy policies or create a district data-processing agreement.

Information we collect

Account information includes your name, email address, account identifiers, authentication information, and profile settings. Our authentication provider processes passwords and account-verification or recovery requests. Do not send passwords to support.

Workspace information includes requests you submit to Cora, revision instructions, settings such as grade band and format, and content you choose to save. Usage records track AI-credit reservations and consumption. We also receive messages you send to support.

Billing information includes customer and subscription identifiers, plan, payment status, invoice and transaction information, and related records. Payment details are entered with Stripe. Counselora’s application does not store full payment-card numbers or card security codes.

Technical information may include IP addresses, browser or device information, request and security logs, and public-site usage measurements. Our service providers may process technical records in operating their services. Public-page analytics is described below.

Why we use information

We use information to authenticate accounts, provide drafting and editing tools, save and retrieve work, administer subscriptions and credits, deliver requested account emails, respond to support, protect the service, investigate problems, and comply with legal obligations. We use limited public-site measurements to understand visits and improve the website.

Marketing email is separate from essential account, billing, and security messages. Unsubscribing from marketing does not stop messages needed to operate your account or subscription. Creating an account is not presented as permission to add you automatically to a marketing campaign.

AI requests and service providers

When you request an AI draft or revision, the request, selected settings, and any draft content needed for a revision are sent through Vercel AI Gateway to the configured model provider. The current implementation uses an OpenAI model by default; routing or models may change as the service develops. Do not include identifying or confidential student information.

Supabase provides account authentication and database services. Vercel hosts the application and provides AI routing and public-site analytics. Stripe processes payments and billing. Brevo delivers account emails and manages marketing communications where applicable. These providers receive information needed for their functions and may retain technical, transaction, or processing records under their applicable terms, agreements, and configuration.

We do not promise zero provider retention or make a blanket promise about AI-model training. Provider processing, retention, and training restrictions depend on the applicable service terms and settings; contact us before considering any use requiring specific contractual protections. We may disclose information when required by law, to protect rights and security, with your direction, or as part of a business transaction subject to applicable protections.

Analytics, cookies, and browser storage

Authentication uses browser storage and cookies to maintain sign-in and support secure email confirmation or password recovery. Some drafting features use session storage to carry a request between workspace pages. Blocking necessary storage may affect those features.

Our public-site analytics is limited to the homepage and these legal pages. The application filters out workspace and authentication pageviews and removes query strings and fragments before submitting allowed pageviews. We do not intentionally include prompts, saved document content, account emails, or resource identifiers in those analytics events. Hosting, security, payment, AI, and email providers may separately process operational logs.

Counselora does not currently use advertising pixels or cross-site behavioral-advertising features in this application. A browser Do Not Track signal does not change necessary account or operational processing. A universal cookie-consent banner is not a substitute for explaining actual data practices; contact us about privacy preferences.

Student and children’s information

The service is intended for adult education professionals, not student accounts or direct use by children. Do not submit identifiable student education, health, counseling, or other confidential records. Generic descriptions can still identify a student when combined with context, so omit unnecessary details.

If you believe a child has provided information or that prohibited student information was submitted, contact hello@counselora.com so we can assess and address it. Using a disclaimer does not create permission to process student records. Additional arrangements and legal review would be needed before supporting district records or regulated health information.

Retention, access, and deletion

Saved work remains associated with your account until it is removed through available features or handled through a verified deletion request. Archiving hides work from active views and does not delete it. Canceling a subscription does not automatically delete saved work. You can edit your profile and export supported materials through the workspace.

To request access, correction, account deletion, or information about our practices, email hello@counselora.com. We may verify your identity and authority before responding and will apply rights and response periods required by applicable law. We retain information for the service purposes described here and as needed for legal, financial, security, dispute, or recordkeeping obligations; provider backups and operational records may persist under their retention processes. We do not promise immediate deletion from every provider or backup.

Security, location, and changes

We use account authentication, access controls, and other safeguards to protect information, but no online service can guarantee absolute security. Service providers may process information in the United States and other locations where they operate. Contact us before any use requiring a specific storage location or security agreement.

We may update this notice to reflect changes in service or data practices. The version and effective date appear on this page; material changes will be communicated as appropriate. California and other privacy rights depend on the applicable law and circumstances. This notice does not claim that a particular privacy statute applies or does not apply solely because of a mailing-list size.