Scholar Spark

Privacy Policy

Last updated: May 29, 2026

1. Data We Collect

We collect academic records you upload (transcripts, grade reports), account information (email, name), and usage analytics necessary to operate the service.

2. How We Use Your Data

Uploaded academic records are processed solely to generate your academic analysis and career recommendations. We never sell your data or share it with advertisers.

3. FERPA Compliance

Scholar Spark acts as a "school official" with a legitimate educational interest when used through a School Plan. Educational records are accessed only by authorized users and protected under FERPA (20 U.S.C. § 1232g).

4. COPPA Compliance

Scholar Spark does not knowingly collect personal information from children under 13. Accounts for users under 13 require verifiable parental consent provided through the Parent Pro plan.

5. Data Security

  • Encryption at rest (AES-256) and in transit (TLS 1.3) via Lovable Cloud.
  • Row-Level Security on every user-data table.
  • Audit logging of access to academic records.
  • Private storage buckets with signed URLs for transcript files.

6. Your Rights

You may request export or deletion of your data at any time by contacting privacy@scholarspark.app. Account deletion removes all uploads, analyses, and recommendations within 30 days.

7. Retention

Academic records are retained while your account is active. Audit logs are retained for 24 months for security and compliance review. See Record Deletion & Destruction for details on when and how academic records are destroyed.

8. Record Deletion & Destruction

Consistent with FERPA (34 CFR § 99.10) and COPPA (16 CFR § 312.10), Scholar Spark destroys academic records once they are no longer needed for the educational purpose they were collected for, or upon a valid deletion request — whichever comes first.

When records are deleted or destroyed:

  • User-initiated deletion: When you delete your account or an individual upload, transcripts, extracted text, analyses, and recommendations are removed from active systems within 30 days.
  • Account inactivity: Accounts with no sign-in for 24 consecutive months are flagged for deletion; users receive email notice 30 days before academic records are destroyed.
  • Schools plan students: Records are destroyed within 90 days of the student leaving the institution, graduation, or termination of the institution's contract — whichever comes first, unless the user has migrated the account to a personal plan.
  • Children under 13 (COPPA): Records are destroyed promptly when a parent or guardian revokes consent, or when the account is no longer needed to provide the service.
  • Parental / guardian request: Parents of minor users may request deletion at any time via privacy@scholarspark.app; verified requests are honored within 30 days.
  • Encrypted backups: Records may persist in encrypted, access-restricted backups for up to 60 additional days before being overwritten on the backup rotation cycle.

How records are destroyed:

  • Transcript files in private storage buckets are deleted and the underlying blocks are zeroed by the storage provider.
  • Database rows (extracted text, analyses, recommendations) are hard-deleted — not soft-deleted — and removed from read replicas during the next sync.
  • Derived AI artifacts (career matches, projections, snapshots) are deleted alongside the source record.
  • Audit logs are retained in a separate append-only store for 24 months for security and compliance, then permanently purged. Audit entries contain no transcript content.

To request deletion or a copy of records before destruction, email privacy@scholarspark.app.

9. Contact

Questions? Email privacy@scholarspark.app.