Privacy Policy

This policy explains what information AdmitMap collects when you use our website, funnel, account and reports (the "Service"), why we collect it, who else touches it, and what control you have over it. It applies to everyone who uses AdmitMap, wherever you are.

Using the Service is also governed by our Terms of Service.

AdmitMap is operated by Arlan Nurmanov, an individual sole operator based in the Republic of Kazakhstan. For the purposes of data protection law, we are the "data controller" — meaning we decide what is collected and why, and we are the ones you hold accountable.

Contact for any privacy matter, including deletion requests: support@admitmap.app.

Information you give us

Category	Examples
Account	Email address and the date you signed up. You confirm your address with a one-time code we email you; there is no password, so we never store one.
Sign in with Google	If you choose "Continue with Google", Google shares your name and email address with us. We do not receive your Google password or access anything else in your Google account.
Academic profile	Graduation year, unweighted GPA, SAT and ACT scores, AP and other coursework, intended major.
Activities & honors	Extracurricular activities, roles, hours, descriptions, awards and recognition levels.
Financial	An approximate household income band and household size, used solely to estimate net price. We do not ask for and do not want exact income, tax documents, bank details, or a Social Security number.
School list	The colleges you add, and the application round you are considering for each.
Essay	Essay text, only if you choose to submit one for grading. See section 5 — we do not keep it.
Support	Anything you write to us by email, and our replies.

Information collected automatically

• Technical logs. Our hosting provider records standard server information for each request: IP address, browser and device type, pages requested, referring page, and timestamps. This is used for security, abuse prevention, and debugging.
• Local storage. Your progress through the funnel is saved inside your own browser so you do not lose your work. See section 6.
• Your progress through the Service. As you complete each step, we record which steps you reached (for example, which part of the form you finished, whether you saw the prices, and whether you opened your report), with the time and whether you used a phone or a computer. It is linked to a random ID stored in your browser.

Information we deliberately do not collect

• Payment card details. Checkout is handled entirely by Polar. Your card number never reaches our servers and we never see it.
• Exact income, tax records, or financial account information.
• Government identifiers of any kind.
• Precise location. We do not request GPS or device location.

Purpose	Legal basis (GDPR/UK GDPR)
Calculate your acceptance estimates and generate your report	Performance of a contract with you
Estimate net price and financial aid	Performance of a contract with you
Grade an essay you submit	Performance of a contract, at your request
Create and maintain your account, and give you access to what you bought	Performance of a contract with you
Process your purchase, issue receipts and licence keys	Performance of a contract; legal obligation for tax records
Security, fraud prevention, abuse and rate-limit enforcement	Legitimate interests in protecting the Service
See where people stop filling in the form, so we can fix steps that are confusing	Legitimate interests in improving the Service
Improve our models, data quality and interface using aggregated, non-identifying statistics	Legitimate interests in improving the Service
Measure which of our Google ads lead to a purchase (see section 9)	Legitimate interests in knowing whether our advertising works, and consent where the law requires it
Build advertising audiences from hashed email addresses	Legitimate interests in marketing the Service, and consent where the law requires it
Send you deadline reminders, product news and offers	Legitimate interests, and consent where the law requires it — see section 8

We never sell your personal information, and we never share it with colleges, universities, admissions offices, recruiters, scholarship services, lead brokers, or advertisers. Your profile is not a product we sell to anyone.

Your essay is the most personal thing you can give us, so we handle it differently from everything else.

• Essay text is sent to us only when you ask for it to be graded.
• Our server forwards it to Anthropic's API, which scores it against our rubric and returns the result.
• Anthropic does not use API inputs to train its models.
• We do not retain your essay text on our servers after grading. It is processed in the request and discarded. We keep only the resulting numeric scores and written feedback so your report stays intact.
• No human at AdmitMap reads your essay as a matter of course. We do not review essays to improve our rubric.

Because we do not store the essay, we also cannot recover it for you. Keep your own copy.

Automated decision-making

Your estimates and scores are produced automatically by software. They have no legal effect on you and do not determine anything — no college sees them and no admission outcome depends on them. If you want a human to look at how a number was produced, email us and we will explain it.

As you move through the funnel, your answers are saved in your browser's local storage — a storage area on your own device, under keys such as admitmap_profile. This is what stops you losing your work if you refresh or close the tab.

As you complete each step, the answers you have entered are also saved on our servers, together with the steps you reached, so we can produce your report and see where the form is confusing. Essay text is never included — only its word count. Clearing your browser data deletes the copy on your device, but not the copy on our servers; to delete that, see section 14.

Reports you buy. After you buy a report, we email it to you as a PDF at the address you used to pay. We keep the answers your report was built from, and your activity and essay scores, so we can re-send or reopen your report. We do not keep the text of your essay. The email also contains a private link that opens your report on any device; anyone who has that link can open your report, so keep it to yourself.

Creator links. If you open AdmitMap through a creator's link (for example admitmap.app/?ref=name), we remember which creator sent you for 30 days, so we can pay them a commission if you buy a report. The creator only ever sees totals — how many people visited, finished the form and bought — never your name, email, answers or report.

We share only what is necessary, only with the providers that run the Service:

Provider	What it does	What it receives
Vercel	Website hosting and serverless functions	Technical request data, including IP address; any data in transit to the Service
Anthropic	AI essay grading	Essay text at the moment of grading. Not used for model training.
Google	Sign in with Google, only if you choose it	Confirms your identity and shares your name and email address with us. Google's own privacy policy applies to your Google account.
Polar	Payments, as Merchant of Record	Your email, billing details and payment information, handled directly by them
Supabase	Database that stores student profiles	The answers you enter (never essay text), your email if you give it, the steps you reached, and for a report you buy, the answers and scores it was built from. Stored in the United States.
Advertising platforms	Building advertising audiences (see section 8)	Hashed email addresses only. Never your profile, scores, essays or report.
Google (Google Ads tag)	Measuring whether a click on one of our Google ads led to a purchase (see section 9)	An ad-click identifier and the pages you open on our site; for a purchase, the order number, the amount and the currency. Never your name, email, profile, scores, essays or report.
PostHog	Product analytics: how visitors find and use the site (see section 9)	The pages you open and buttons you click, where you came from (for example TikTok, Google or a creator's link), device and browser type, approximate location from your IP address, and recordings of your session with everything you type hidden. Stored in the United States. Never your essay text or payment details.
Resend	Sending verification codes, the report you bought as a PDF, and updates	Your email address and message content, including your report when we email it to you

We may also disclose information where we are legally required to, or where it is necessary to investigate abuse or protect someone's safety or rights. If AdmitMap is ever sold or transferred, your data may transfer with it — we will tell you before that happens and this policy will continue to apply until you are told otherwise.

If you give us your email address — whether you complete a purchase or only go through the funnel — we may send you:

• Transactional email: one-time verification codes, receipts, licence keys, and messages about something you bought. You cannot unsubscribe from these while you have an account, because they are how the Service works.
• Marketing email: application deadline reminders, product news, and offers, including discounts on further reports.

Every marketing email has a one-click unsubscribe link, and we honour it promptly. You can also unsubscribe any time by emailing support@admitmap.app. Unsubscribing from marketing does not affect access to anything you have purchased.

We do not sell or rent your email address, and we never give it to another company to use for that company's own marketing.

Advertising audiences

We advertise AdmitMap on platforms such as Meta (Instagram and Facebook), TikTok and Google. To do that, we may upload a list of email addresses to those platforms so they can:

• match existing users, so we can show you offers or, equally, stop showing you ads for something you already bought; and
• build a "lookalike" audience — the platform finds other people with broadly similar characteristics, and shows our ads to them instead.

What this means in practice:

• Email addresses are sent hashed — scrambled into an irreversible code — so the platform can match them without reading them.
• The platform is contractually permitted to use the list only to build our audience, and for nothing else of its own.
• We never upload your grades, test scores, income band, school list, essays, or report contents to an advertising platform. Only email addresses.
• We do not learn who ends up in a lookalike audience, and those people are strangers to us unless they click an ad and sign up themselves.

To opt out, email support@admitmap.app and ask us to exclude you from advertising audiences, and we will remove you from any list we upload. Unsubscribing from marketing email also removes you. You can additionally limit ad targeting inside each platform's own ad settings.

We keep this deliberately minimal:

• Strictly necessary — a session cookie to keep you signed in, and local storage to hold your funnel progress. These cannot be turned off without breaking the Service.
• Payment — Polar may set its own cookies during checkout, governed by their policy.

Google Ads measurement tag

We advertise AdmitMap on Google Search. To know whether those ads work, our site loads the Google Ads tag (gtag.js) from Google. It is the only advertising technology on the site, and it does one job:

• When you arrive by clicking one of our Google ads, the tag stores an ad-click identifier in a first-party cookie (for example _gcl_aw) for up to 90 days.
• If you then buy a report, the tag tells Google that the click led to a purchase, together with the order number, the amount and the currency. That is all Google receives: never your name, email address, academic profile, scores, essays or report.

We use this only to measure our own ads — which searches and which ads lead to purchases. We do not use it to follow you around the web, to build remarketing lists, or to show you personalised ads elsewhere, and we have switched on Google's restricted data processing so that Google handles this data as our service provider rather than for its own advertising.

If you are in the European Economic Area, the United Kingdom or Switzerland, the tag runs with advertising storage and personalisation turned off by default: it sets no advertising cookies and sends no ad data unless you agree.

You can block or delete these cookies in your browser at any time, and limit ads from Google at myadcenter.google.com. The rest of the Service works the same either way.

PostHog product analytics

To understand how people find AdmitMap and where they get stuck, our site uses PostHog (PostHog, Inc., data stored in the United States). It records the pages you open, the buttons you click, where you came from (for example TikTok, YouTube, Google or a creator's link) and your device and browser type, and stores a random identifier in a first-party cookie and local storage so visits from the same browser can be counted together.

PostHog also makes session recordings — a replay of how a visit moved through the site — so we can find confusing steps. In these recordings everything you type is hidden, and on the report page all text is hidden too. We use PostHog only to improve our own site; it is not used for advertising and the data is not sold.

If you are in the European Economic Area, the United Kingdom or Switzerland, PostHog does not load at all.

Apart from the Google Ads tag and PostHog, we do not use advertising cookies, cross-site tracking pixels, or third-party behavioural advertising networks on this site. If we ever add another analytics or advertising tool, we will update this section before it goes live, name the provider, and ask for your consent where the law requires it.

Do Not Track

Some browsers can send a "Do Not Track" signal. There is no common industry standard for how to respond to one. We do not track you across other websites — the Google Ads tag above only measures what happens on our own site after a click on our own ad — so we do not respond to Do Not Track signals. If that ever changes, we will say so here.

We may combine information across many users to produce aggregated or de-identified statistics — for example, the average profile of students applying to a given school, or how accurate our estimates turn out to be across thousands of applications. Before this is done, anything that identifies you is removed, and we do not attempt to re-identify it afterwards.

Aggregated and de-identified data is not personal information, and we may use and publish it to improve our models, check our data quality, and write about admissions trends. Nothing in it names you, quotes you, or can be traced back to you.

We protect your information with encryption in transit (HTTPS/TLS), sign-in by one-time email code or Google rather than stored passwords, restricted access to production systems, API keys held only on the server and never exposed to the browser, and origin restrictions on our endpoints.

No system is perfectly secure and we cannot guarantee absolute security. If a breach affects your personal data and creates a real risk to you, we will notify you and any regulator we are required to notify, without undue delay.

Wherever you live, you can ask us to:

• Access — get a copy of the personal data we hold about you;
• Correct — fix anything inaccurate;
• Delete — erase your data and close your account;
• Export — receive your data in a portable, machine-readable format;
• Object or restrict — object to processing based on legitimate interests, or ask us to pause processing;
• Withdraw consent — where processing relies on consent, withdraw it at any time, without affecting what happened before;
• Opt out of marketing — at any time, via unsubscribe or email;
• Opt out of advertising audiences — ask us to exclude your email address from any list we upload to an advertising platform.

Email support@admitmap.app. We respond within 30 days and never charge for it. We may need to confirm your identity before acting, to make sure we are not handing your data to someone else.

If you are in the EU, UK, or Switzerland

The rights above are your GDPR / UK GDPR rights. You also have the right to complain to your local data protection authority. We would rather you came to us first, but that right stands either way.

If you are in California or another US state with a privacy law

You have the right to know what personal information we collect and why, to request a copy, to request deletion, to correct inaccuracies, and to not be discriminated against for exercising any of these rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. We do provide hashed email addresses to advertising platforms to build audiences, as described in section 8; some regulators treat that as "sharing", so to be safe we treat it as opt-out-able — email us and we will exclude you. The Google Ads tag described in section 9 runs with Google's restricted data processing switched on, so Google processes that data as our service provider and not for cross-context behavioural advertising. Use the same email address to make any request.

Verification. Before we act on a request to access, correct, or delete data, we have to be reasonably sure the request is really from you — otherwise we would be handing your academic profile to a stranger. We will normally verify by asking you to send the request from the email address on the account. If we cannot verify you, we will tell you why rather than simply refusing.

Authorized agents. You may appoint someone to make a request on your behalf. We will ask for written proof that you authorised them, and we may still ask you to confirm your identity directly.

California "Shine the Light". California residents may ask, once a year and free of charge, what personal information a business disclosed to third parties for those third parties' own direct marketing. We do not disclose personal information to anyone for their own direct marketing, so there is nothing to report — but you are welcome to ask and we will confirm that in writing.

There are two parts to delete:

• Clear your browser data. This permanently removes the copy held on that device. It does not remove the copy on our servers.
• Email support@admitmap.app asking us to delete your account. We erase your account, academic profile, school list, scores and reports from our systems, and confirm when it is done.

The only things that survive a deletion request are purchase records we are legally obliged to keep for tax purposes, and the minimal suppression record that stops us emailing you again. Deleted reports cannot be restored.

We operate from Kazakhstan, and our providers operate primarily in the United States and the European Union. If you use AdmitMap from outside those countries, your information will be transferred to and processed in them, and their data protection laws may differ from your own.

Where we transfer data out of the EEA or the UK, we rely on appropriate safeguards, including Standard Contractual Clauses with our providers where applicable. By using the Service you understand that this transfer is necessary in order to provide it to you.

AdmitMap links out to places we do not control: college websites, admissions offices, each school's own Net Price Calculator, and services that supply things like institution logos. A link is not an endorsement and does not mean we are affiliated with that site.

This Privacy Policy stops at our edge. Anything you give a third-party site is governed by that site's privacy policy, not ours, and we are not responsible for how they handle it. Read their policy before you hand over anything personal — especially on any site that offers to review or rewrite your essay, since many such services do use what you submit to improve their own models.

AdmitMap is available to people aged 13 and over. If you are under 18, a parent or legal guardian must agree to our Terms of Service, must be the one who makes any purchase, and is responsible for the information entered. We treat that parent or guardian as the account holder.

Parents and guardians can ask us at any time to show them what we hold about their child, to correct it, or to delete it and close the account. Email support@admitmap.app from any address and we will verify and act on it.

We do not knowingly collect any information from children under 13. If we discover that we have, we delete it immediately. If you are a parent who believes a child under 13 has given us information, email support@admitmap.app and we will remove it right away.

We will update this policy as AdmitMap develops — in particular when accounts launch and when our database and email providers are finalised. The "Last updated" date at the top always reflects the current version.

If a change materially affects how we handle your data, we will tell you by email where we have your address, or by a notice on the site, before it takes effect.

Any privacy question, access request, or deletion request:

• Email: support@admitmap.app
• Data controller: Arlan Nurmanov, sole operator, Republic of Kazakhstan

A real person reads every message, usually within a few days.