Introduction
This Privacy Policy describes how Blueprint collects, uses, and protects your personal information when you use our platform and services.
Blueprint is designed for high school students, including those under 18. We take the privacy of young users seriously and comply with applicable laws governing student data.
Information We Collect
We collect the following types of information:
Account information
- Name, email address, and password
- School name and graduation year
- Account role (student, parent, or counselor)
- Your age, as you tell it to us. We ask before you start a quiz and we do not accept anyone under 13. We do not ask for your date of birth.
Academic information
- GPA, test scores, and intended major
- Extracurricular activities and achievements
- Essays and application materials you enter
- Transcripts you upload, including the file itself and the course, GPA, and school details we read from it
- Practice interview sessions, including the full transcript and any written answers
What you tell us you are looking for in a college
The College Matchmaker quiz asks about your preferences so it can match you to schools. Every question on these steps is optional, and you can skip any of them.
- Where you want to study: preferred regions, states, distance from home, campus setting, climate, and school size
- Communities you want on campus, which may include historically Black colleges, Hispanic-serving institutions, women’s colleges, Greek life, or a religiously affiliated school
- If, and only if, you say you are looking for a religiously affiliated school, we then ask which affiliation you prefer. This question is not shown otherwise, and if you remove “religious” from your list we delete the answer.
- Whether you have a military connection, so we can surface related aid
- A household income range and how far your parents went in school. We use these to estimate what a college would actually cost you and to flag first-generation opportunities. We ask for a range, never an exact figure.
You can take the quiz without an account. If you do, these answers are stored against an anonymous session rather than against you, until and unless you create an account.
Financial aid information
- Aid offers you choose to enter, including cost of attendance, grants, scholarships, loans, and work study amounts
Information about you from your school
If your school uses Blueprint, your counselor can record information about you in their view:
- Parent or guardian contact details: name, relationship to you, email, phone, and notes
- Counselor notes and recommendation letter drafts
- Your answers to check-ins and brag sheets your counselor assigns
Usage data
- Pages visited and features used
- Device type, browser, and operating system
- IP address and general location (country/region)
AI interaction data
- Prompts sent to AI features (Essay Coach, College Matchmaker, Activity Studio)
- AI-generated responses and suggestions
How We Use Your Information
- Provide and improve the Blueprint platform
- Personalize college recommendations and essay feedback
- Track your application deadlines and progress
- Communicate service updates, tips, and support responses
- Generate aggregated, anonymized analytics to improve our service
AI and Your Data
Blueprint uses AI to power features like Essay Coach, College Matchmaker, and Activity Studio. These features process your academic data and written content to generate personalized recommendations and feedback.
- We do not sell your data to train third-party AI models.
- Your data is processed solely to deliver and improve Blueprint’s features.
- AI-generated suggestions are advisory. They are not guarantees of admission outcomes.
Data Sharing
We do not sell your personal information. We may share data in these limited circumstances:
- Counselors: If your school uses Blueprint, your assigned counselor can view your progress data.
- Parents: If you grant a parent access, they can view your progress dashboard.
- Service providers: We use a small set of vendors (subprocessors) to run Blueprint. Each one operates under a data processing agreement. The full list is below.
- Advertising measurement: When you join our waitlist, we send a scrambled (hashed) version of your email address to Meta so we can measure which advertisements brought people to Blueprint. We also send the time of the signup, a reference number for it, a short label for which part of Blueprint it came from, and, when your browser provides it, the address of the page you signed up on. We never send your quiz answers, essays, college list, or any other work you do in Blueprint. You can turn this off on our Do Not Sell or Share My Personal Information page, which records your choice in the browser you use, so set it on each browser or device you use.
- Legal requirements: We may disclose data if required by law or to protect the safety of our users.
- Business transfers: If Blueprint is acquired, merged, or sells assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
Our subprocessors
These are the third-party vendors that process data on our behalf:
- Vercel: Hosting, AI Gateway routing, cookieless web analytics, and bot protection
- Supabase: Primary database and file storage
- Anthropic: AI text processing
- Google: AI text processing
- PostHog: Product analytics and session replay
- Sentry: Error tracking
- Resend: Transactional email
- Stripe: Payment processing
- Upstash: Rate limiting and abuse prevention
- GeoNames (Unxos GmbH): International city autocomplete in the College Matchmaker quiz (receives only user-typed city search text and a country code via our server; no account identifiers)
- Google Workspace: Business email for our support and contact addresses
- Cal.com: Scheduling calls booked from our contact page
- Linear: Internal follow-up tasks for booked calls
- Meta Platforms: Advertising conversion measurement for account signups, purchases, and completed College Matchmaker quizzes (receives a hashed email address where there is one, event details, and when available an IP address, browser user-agent, page address, and Meta’s own browser and ad-click identifiers; never age, student work, or profile data, never accounts we know were provided by a school, and nothing about anyone under 13). The register below lists exactly what each vendor receives.
The current register is always available at applywithblueprint.com/subprocessors. We give schools at least 30 days’ notice before adding or replacing a subprocessor.
Student content sent to Anthropic or Google for AI features goes through the Vercel AI Gateway with zero data retention and is never used to train models.
FERPA Compliance
When Blueprint is used by schools, student education records are protected under the Family Educational Rights and Privacy Act (FERPA).
- Blueprint acts as a school official with a legitimate educational interest, performing services on behalf of the school under its direct control.
- Schools control access to student education records within Blueprint.
- We use education records only for the authorized purposes specified by the school and do not redisclose student data to third parties without consent.
- Parents and eligible students (18 or older) may request to review or delete education records.
- Schools and districts may request a Data Processing Agreement (DPA) by contacting us at support@applywithblueprint.com. We provide standard DPAs that cover data handling, security measures, and breach notification procedures.
Data Security
Your data is stored and processed in the United States. We take reasonable measures to protect it:
- 256-bit encryption for data in transit (TLS) and at rest
- Role-based access controls and audit logging
- Automated security scanning on every code change
No system is 100% secure. If we discover a data breach that affects your information, we will notify affected schools within 72 hours, notify affected students and parents within 7 business days, and report to applicable authorities as required by law.
Data Retention and Deletion
- Account data is retained while your account is active.
- You can request deletion of your account and data at any time.
- Deleted data is purged within 30 days, except where we are required by law to retain it.
- For school-administered accounts, data retention follows the school’s policies.
Children’s Privacy
Blueprint is designed for high school students, typically ages 14 to 18. We do not knowingly collect personal information from children under 13.
Blueprint accounts, including school-administered accounts, are limited to users 13 and older. We screen age before collecting any personal information and turn away anyone under 13.
If we learn that we have collected personal information from a child under 13, we will delete that information promptly.
Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request deletion of your data
- Export your data in a portable format
- Opt out of marketing communications
To exercise any of these rights, contact us at support@applywithblueprint.com.
California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):
- Right to know: You may request details about the categories and specific pieces of personal information we have collected about you, the sources of that information, and the purposes for which it is used.
- Right to delete: You may request deletion of your personal information, subject to certain legal exceptions.
- Right to correct: You may request that we correct inaccurate personal information we hold about you.
- Right to limit use of sensitive personal information: You may ask us to limit how we use and disclose sensitive personal information. We use it only to provide the services you signed up for.
- Right to opt out of sale or sharing: We do not sell personal information. We do share a hashed version of email addresses with Meta when someone joins the waitlist or creates an account, to measure which advertisements bring people to Blueprint, which California law may treat as “sharing” for cross-context behavioral advertising. We do not share anything about an account provided by a school, and we do not share anything about anyone under 13. You can opt out at any time on our Do Not Sell or Share My Personal Information page, which records your choice in the browser you are using, so set it on each browser or device you use. We also honor the Global Privacy Control (GPC) browser signal automatically, so if your browser sends GPC we treat it as an opt-out without you having to do anything.
- Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.
To submit a verified consumer request, contact us at support@applywithblueprint.com. We will verify your identity before processing your request and respond within 45 days.
State Student Privacy Laws
Blueprint complies with applicable state student privacy laws, including but not limited to:
- SOPIPA (California): For students whose accounts are provided by their school, we do not use student data for non-educational purposes, targeted advertising, or building advertising profiles, and we never share their information for advertising measurement. Student information is used solely to provide and improve the Blueprint platform.
- State-specific requirements: Many states have enacted student privacy laws that impose obligations on educational technology providers. We design our data practices to meet the most protective standards across all jurisdictions we serve.
If your state requires specific data privacy agreements or disclosures, contact us at support@applywithblueprint.com and we will work with your institution to meet those requirements.
International Users
Blueprint is operated from the United States, and your data is processed and stored in the United States. If you use Blueprint from outside the US, including from Brazil, your data is transferred to the US.
If you are in Brazil, you have rights under the LGPD (Brazil’s General Data Protection Law), including the rights to access your data, correct it, delete it, and receive information about who we share it with. To exercise these rights, email us at support@applywithblueprint.com.
Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notice. Continued use of Blueprint after changes take effect constitutes your acceptance of the updated policy.
Contact Us
If you have questions about this Privacy Policy or how we handle your data, reach out to us at support@applywithblueprint.com.
Have questions about how we protect your data? Email us at support@applywithblueprint.com