Privacy Policy

Last updated: 2026-10-25. Version: 1.2.

This policy explains what personal data Accepted processes, why, and on what basis. For school-licensed deployments, the licensing school is the data controller and this policy operates alongside the school's own privacy information and Data Processing Agreement.

1. Who is responsible for your data

Direct-to-student purchases (individual users): Sunny Soft LTD (Cyrillic: "СЪНИ СОФТ" ООД, UIC 175446747, trading as Accepted) is the data controller. Registered at Racho Dimchev 2 str., Sofia, Bulgaria.

School-licensed deployments: the licensing school is the data controller. Sunny Soft LTD acts as data processor under a signed Data Processing Agreement with the school.

Contact for data-protection matters: hello@getaccepted.io

2. What we collect

Account data

  • Email address and a hashed password
  • Display name and role (student, parent, counsellor)
  • School name as entered at registration, and — if you give it — your date of birth
  • How you heard about Accepted (optional)
  • When you confirmed the age/consent statement and the privacy notice at registration, and the purchase consents at checkout

Educational profile (students)

  • IB students: IB subjects and predicted grades
  • IB students: Extended Essay, Theory of Knowledge, and CAS information
  • A-level students: A-level, AS-level and GCSE subjects and grades, each marked as predicted (and, if you say so, whether the prediction is your school's or your own) or achieved
  • A-level students: Extended Project Qualification (EPQ) type, title and grade; exam board, where it is regulated, and exam session
  • Career interests, language proficiencies, extracurricular activities
  • Target country and budget preferences

Application data

  • University shortlists, applications and their status
  • Deadlines, tasks, documents created in Accepted (personal statements, motivation letters, CV content)
  • Offers received and their conditions
  • Files you upload: attachments to application tasks, files exchanged with your counsellor, and portfolio PDFs you submit for analysis; a CV photo if you add one
  • Your answers in interview practice sessions
  • Counsellor notes (visible only to assigned counsellors)

Family preferences (parents) — budget, preferred countries, free-text notes about family priorities

Technical

  • Login session metadata
  • Your chosen language preference, stored locally in your browser so the site loads in the same language on future visits. This is strictly necessary technical storage and does not require consent under EU rules.
  • Page-view analytics and product-usage events via Google Analytics 4 (pages visited, time on page, and key in-product actions to help us understand and improve the product). For users who are logged in and have accepted analytics cookies, a pseudonymous account identifier is associated with analytics events. The identifier is a randomly generated reference — not a name, email, or other personal information — and cannot on its own identify you. It is used solely to understand product usage across visits and improve the service. Google Analytics 4 does not log or store IP addresses. You can change your cookie choice at any time via the Cookie preferences link in the footer.
  • Purchase metadata for direct-to-student users (pass tier, expiry date, payment-processor IDs — no card numbers)
  • If you use the mobile app: a push-notification token for your device

We do not ask for: passport or ID-card copies, financial information beyond purchase billing metadata, health data, biometric data, or social-media accounts. Upload fields accept any file you choose, so please do not upload copies of identity documents.

3. Why we process your data

  • Contract performance (Art. 6(1)(b)): to provide the service you purchased or were invited to by your school
  • Consent (Art. 6(1)(a)): product analytics cookies — set only when you accept via the cookie banner; you can withdraw at any time using the Cookie preferences link in the footer
  • Legitimate interest (Art. 6(1)(f)): service improvement, fraud prevention, security monitoring
  • Legal obligation: financial records required by the Bulgarian Accountancy Act

We do not use your data for marketing. The platform sends only transactional emails (deadline reminders, invitations, password reset) — no newsletters, no promotional campaigns.

4. Sub-processors

We use these sub-processors:

  • Anthropic (US) — AI text generation. Receives the profile data and text a feature needs: personal statements, motivation letters, CV content, interview answers, and portfolio PDFs you submit for analysis. Anthropic's Commercial Terms incorporate its Data Processing Addendum (including the EU Standard Contractual Clauses) and prohibit training models on customer content.
  • Voyage AI (US) — vector embeddings. We send (a) static university and programme data, and (b) at query time, short search strings built from your profile: for IB students, the predicted IB total and subjects; for A-level students, that you take A-levels and the names of your A-level subjects, without grades; and for both, your target fields and your career interests as you typed them. No names, contact details, uploaded files or essays are sent. Voyage's Terms incorporate its Data Processing Agreement, including the Standard Contractual Clauses. We have opted out of Voyage using this content to train its models, so it is deleted once processed.
  • Google Cloud Platform (europe-west1, Belgium) — hosting for PostgreSQL, Cloud Run application server, Cloud Storage for files, and server logs (Cloud Logging).
  • Google Firebase Hosting (Google LLC, global network) — delivers the website; receives your IP address and browser details with each page request.
  • Google Fonts (Google LLC) — the website loads its fonts from Google's servers, which receive your IP address.
  • Google Analytics 4 (Google LLC, US — Google Analytics Terms of Service) — page-view and product-event analytics. Cookies are set only after you accept analytics in our cookie banner. Pseudonymous account ID for logged-in users is transmitted on each event when consent is granted. Without consent, Google Analytics runs in Consent Mode and sends cookieless pings; no analytics cookies are set. Data is processed by Google in the EU and US under Standard Contractual Clauses. You can withdraw consent at any time via the Cookie preferences footer link.
  • MongoDB Atlas (on GCP, europe-west1) — document storage (essays, drafts, timelines).
  • Google (Gmail SMTP relay) (Google LLC, US — Data Privacy Framework certified; EU Data Boundary) — transactional email delivery (deadline reminders, invitations, password reset). No marketing email data.
  • Paddle (EU entity — direct-to-student purchases only) — one-time payment processing as Merchant of Record; PCI-compliant, handles VAT.
  • Expo (650 Industries, US) — push notifications for the mobile app, currently in testing: the device push token and the notification text.

Transfers to Anthropic, Voyage AI and Google rely on the Standard Contractual Clauses incorporated in each provider's terms.

5. Retention

  • Active account data: kept while your account is active
  • After a deletion request: student and parent accounts are kept for 30 days, then erased. A parent account is also erased 30 days after its access to the last linked student ends. A counsellor account is not erased automatically; we erase it by hand on request.
  • Uploaded files (Files page, task attachments, analysed portfolio PDFs): deleted from storage in the background after the account is erased; our storage provider keeps a deleted file for 7 more days.
  • Financial records (purchases): retained for periods required by the Bulgarian Accountancy Act — typically 5 years for invoices and 10 years for accounting registers
  • Server logs: up to 90 days
  • Contact-form messages: 2 years, then purged
  • Audit log (a record of actions on accounts): 2 years, also after an account is erased

6. Your rights

Under GDPR (and UK GDPR for UK users) you have the right to:

  • Access — request a copy of your personal data
  • Rectification — correct inaccurate data
  • Erasure — delete your account and data
  • Portability — receive your data in a structured format (JSON)
  • Restriction — suspend processing
  • Objection — object to processing based on legitimate interest
  • Withdrawal of consent — where processing is based on consent (where applicable)
  • Cookie preferences: You can accept or reject analytics cookies at any time using the Cookie preferences link in the footer. Withdrawal of consent is as easy as giving it. Necessary cookies (login session, language) cannot be disabled because they are required for the service to function.

Contact hello@getaccepted.io to exercise any of these rights. You may also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg), the UK Information Commissioner's Office (ico.org.uk), or your own national supervisory authority.

7. Minors

Accepted is designed for IB and A-level students, typically aged 16–19. Users under 16 must have a parent or guardian consent before registering. We do not knowingly collect data from children under 13. In school-licensed deployments, the licensing school is responsible for obtaining any parental consent required under its policies before issuing invitations.

8. Parental access

Students may invite a parent to view a read-only summary of their applications, deadlines, offers, documents, costs, and career report. A school counsellor may request parental access on behalf of a student; in that case, the student must explicitly confirm before the invitation is sent. Students can revoke parental access at any time; revocation takes immediate effect.

Parents do not see: counsellor-only notes, private counsellor-student communications, or data about any student other than the one who invited them.

9. Security

  • TLS encryption in transit for all traffic
  • Encryption at rest provided natively by GCP and MongoDB Atlas for all production data
  • Role-based access control with four roles (student, parent, counsellor, admin), enforced via JWT authentication
  • Audit logging of profile and document access
  • Rate limiting on authentication and AI endpoints
  • Independent third-party security review commissioned before school pilot deployments

10. Cookies

We use browser localStorage to keep you logged in and remember UI preferences (language, filter state). The cookie banner stores your consent choice in a small first-party cookie (cc_cookie). When you accept analytics cookies, Google Analytics 4 sets two cookies (_ga and _ga_<measurement-id>) used to recognise return visits and stitch sessions; without consent, no analytics cookies are set and Google Analytics operates in cookieless ping mode (aggregate data only). For users who are logged in and have accepted analytics cookies, a pseudonymous account identifier is associated with analytics events to support analysis of product usage across visits. We do not use advertising trackers or set advertising cookies.

11. Changes

We will email notice 30 days before any material change to this policy. The version number and "Last updated" date above are authoritative.