Educationa CertiHomes Company

Privacy Policy

Effective Date: September 1, 2026

1. Introduction

CertiHomes LLC ("CertiHomes," "we," "us," or "our") operates the Education platform at education.certihomes.com (the "Service"). This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the rights you have. It also describes how we handle information about students and minors, which is central to what we do.

We serve users in the United States. We do not sell your personal information, and we do not share it for cross-context behavioral advertising (see Section 5).

2. Information we collect

We collect the following categories of personal information:

  • Identifiers — name, email address, Google profile information (including profile picture) when you sign in with Google, and IP address.
  • Sensitive information — where you choose to provide it while building a student profile: race or ethnicity and citizenship or immigration status (which are "sensitive personal information" under California law), together with date of birth, home address, phone number, gender identity, and legal sex. All of these fields are optional, and we apply extra protections to them (see Sections 5 and 9). We never collect Social Security numbers.
  • Family and household information — when you add household members to a student profile, we collect the names and, where you provide them, the email addresses of parents, guardians, and siblings, sibling ages, and an optional note about household circumstances. Please add another person's information only if you are authorized to do so.
  • Education and athletic information — grade level, GPA, test scores, interests and goals, a target budget and other planning inputs, saved schools and comparisons, essays, and (for recruiting features) sport, position, measurables, transcripts, and highlight media.
  • Commercial information — records of purchases and the plan or tier you bought.
  • Internet and usage activity — pages viewed, searches, features used, referring URLs, device and browser information, and access times.
  • Geolocation — approximate city and state derived from your IP address, used to show locally relevant results.
  • Audio, visual, and uploaded content — screenshots or screen recordings you attach to a bug report; and, for the Social Media Scrubber, the social-media export archives a family uploads for review (see Section 8).
  • Inferences — recommendations we generate from the information above (for example, suggested schools or scholarships).

3. Sources and how we use your information

We collect this information directly from you (account sign-up, the onboarding wizard, purchases, uploads, and support requests), automatically from your device as you use the Service, and — where applicable — from a parent or guardian setting up a student's profile or from a school acting on your behalf. We use it to:

  • Provide the Service, create your account, and authenticate you;
  • Build your student profile and generate personalized school, scholarship, and planning recommendations;
  • Process purchases and provide the paid features you buy;
  • Measure and improve the Service (only with your consent for non-essential analytics — see our Cookie Policy);
  • Send you marketing communications where you have opted in — you can unsubscribe at any time;
  • Provide customer support and respond to your requests; and
  • Comply with law and enforce our terms.

4. Service providers we share information with

We share personal information with vendors that process it on our behalf, under contract, for the purposes above ("service providers" under the CCPA). They are not permitted to use it for their own purposes:

  • Google Analytics and Crazy Egg — usage analytics and, respectively, session replay/heatmaps. Both run only after you consent (see Cookie Policy).
  • CertiHomes Web Analytics — our own first-party analytics.
  • Google OAuth — sign-in with Google.
  • Stripe — payment processing. Card details are entered on Stripe's hosted checkout; we do not receive or store full card numbers.
  • Self-hosted object storage (MinIO) — stores uploaded media (bug-report attachments, recruiting media, and Scrubber archives) on our own infrastructure.
  • LiveKit — powers the real-time voice counselor.
  • AI/LLM processing services — process user-generated content for the essay assistant, the counselor chat, search embeddings, and the Scrubber's content analysis.
  • Resend — sends transactional and, where you have opted in, marketing email.
  • ipwho.is, OpenFreeMap, and YouTube — receive your IP address to provide geolocation, map tiles, and video, each over an encrypted (HTTPS) connection. ipwho.is and OpenFreeMap set no cookies; YouTube sets no cookie until you actually play a video (see Cookie Policy, Section 3).

5. We do not sell or share for advertising

We do not sell your personal information, and we do not share it for cross-context behavioral advertising (as those terms are defined under the CCPA/CPRA). We do not run third-party advertising trackers. We honor the Global Privacy Control signal, and we do not use sensitive personal information, or any information about a minor, to infer characteristics or for targeted advertising. We also do not disclose your personal information to third parties for their own direct-marketing use (California's "Shine the Light" law).

6. How long we keep your information (retention)

We keep personal information only as long as needed for the purpose we collected it, then delete or de-identify it. Our schedule by category:

  • Account and student-profile data — For the life of your account; accounts inactive for 24 months are deleted after an advance-notice email. To protect young athletes, a minor athlete’s saved résumé and date of birth are deleted after 24 months of account inactivity (with an advance-notice email first), even when the account is kept; signing back in cancels it.
  • Product analytics — 14 months.
  • Bug reports — media, 90 days; the report record, 1 year.
  • Recruiting media and profiles — For the life of your account.
  • Social Media Scrubber uploads — The uploaded archive is deleted within 30 days.
  • Social Media Scrubber reports — The scan report is kept up to 2 years.
  • Social Media Scrubber consent record — Kept as an attestation for up to 7 years after it is revoked.
  • Consent records — Kept as proof of your privacy choices for up to 3 years after they are superseded.
  • Payment and tax records — Retained for 7 years to meet tax and accounting obligations, then deleted; de-identified rather than erased if you delete your account within that window.
  • Content preserved for legal reasons — Where the law requires us to preserve material (for example, a report to NCMEC), we keep it for the period the law requires.

7. Your privacy rights

Subject to verification, you have the right to:

  • Know and access the personal information we hold about you, and receive a copy;
  • Delete your personal information and account (subject to the legal exceptions in Section 6, such as tax records and legally-preserved content);
  • Correct inaccurate personal information;
  • Opt out of any sale or sharing (we do not do either, and we honor Global Privacy Control regardless);
  • Limit the use of your sensitive personal information; and
  • Not be discriminated against for exercising these rights.

To exercise a right, email privacy@certihomes.com, or use the in-product controls where available. You can change cookie and analytics choices any time through the cookie-preferences link in the site footer. We acknowledge requests within 10 business days and respond within 45 days (extendable once by another 45 days where permitted). You may use an authorized agent to submit a request. We verify requests against your account or by confirming information we already hold.

8. Children and students

The Service is built around students, so we treat information about minors with particular care.

  • Account holders must be 13 or older. A student under 13 does not create an account; a parent or guardian sets up and manages the profile.
  • Under 13 (COPPA). We do not knowingly collect personal information from a child under 13 without verifiable parental consent. When a parent enters a child's information, we obtain and record that consent, and we collect only what the feature needs.
  • Ages 13–17. We do not sell or share a minor's personal information, we default these accounts to the most privacy-protective settings, and non-essential trackers (including session replay) never run on pages about a minor.
  • Social Media Scrubber. This optional feature reviews a student athlete's own uploaded social-media archives to help families spot issues before recruiting. It requires both parent and athlete consent, is limited to ages 13 and up, and its data is kept in a separate, access-logged, write-once store with strict retention. If the review detects apparent child sexual abuse material, we are legally required to report it to the National Center for Missing & Exploited Children (NCMEC) and to preserve the related material for the period the law requires.

Where we receive student information from or on behalf of a school, we also handle it consistent with applicable student-privacy laws (such as FERPA and state laws like California's SOPIPA). A parent or guardian may exercise the rights in Section 7 on behalf of their child; contact privacy@certihomes.com.

9. How we protect your information

We use technical and organizational measures appropriate to the sensitivity of the data, including access controls and encryption in transit. For the Social Media Scrubber's most sensitive material, we use a write-once, access-logged legal-hold store that is encrypted at rest and separated from the rest of the Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. State privacy rights and where your data is handled

Residents of California and other states with comprehensive privacy laws have the rights described in Section 7; we apply the same high standard to all users rather than gating rights by state. The Service is operated from and hosted on our own infrastructure in the United States; if you access it from outside the U.S., your information is processed in the U.S.

11. Changes to this policy

We may update this Privacy Policy. We will post the updated policy here, change the effective date, and, for material changes, provide at least 30 days' advance notice. Please review it periodically.

12. Contact us

Questions or requests? Contact us at:

CertiHomes LLC (NMLS #1875937)
Email: privacy@certihomes.com