What we hold, who sees it, how to delete it.

1. Who we are and what this covers

1. 1.1SaharaT20 LLC (“SaharaT20”, “we”) runs saharat20.com. This policy covers information we collect through the website, accounts, requests, sessions and email. It forms part of our Terms of Service.
2. 1.2Effective 27 September 2026. It replaces the interim statement previously published here.
3. 1.3Privacy questions and requests: privacy@saharat20.com. We answer within two business days.

2. Children and teenagers

This section is first because it matters most.

1. 2.1Under 13. We do not knowingly collect personal information from children under 13 and do not create accounts for them. Sign-up asks for a birth month and year purely to route you to the right kind of account; the database rejects an under-13 sign-up and we discard the month and year immediately — we never store a date of birth. If you believe a child under 13 has given us information, email us and we will delete it.
2. 2.213 to 17. A student may hold their own account. We collect from the student directly: an email address, a first name, a grade, and what the request needs. The student must name a parent or legal guardian, and that adult — not the student — approves every Expert and pays for every service. We notify that adult by email when the student sends a request. We do not collect a phone number, home address, photo of the student for anyone else to see, or any social-media handle.
3. 2.3What a parent or guardian can do. From their own account, the linked adult can see everything on the student's file — requests, documents and every version, sessions and recordings, saved items, messages — and can correct it, export it, ask us to stop collecting from the student, or have the whole file deleted (§9). The student is told, inside the Service, that the adult can see this.
4. 2.4Use of a teenager's information. We use it only to match and deliver the service asked for. We do not build advertising or behavioural profiles of any student, we do not sell or share their information for advertising or any other commercial purpose, and we do not use it to target them with anything. Search analytics carry no account identifier, so a student's searches can never be tied back to them.
5. 2.5Recordings. Every live session is recorded so that a parent can review it and so that concerns can be investigated. Recordings are visible to the family and to us, never to other families, and are deleted after 90 days (§8).
6. 2.6Schools. We are a service families choose for themselves, not a school vendor. If a school or district ever contracts with us on behalf of students, that contract and FERPA-style commitments will govern those students' records and we will publish it.

3. What we collect

Listed by where it comes from. Nothing is collected that is not on this list.

1. 3.1Account. Email address; password (stored only as a one-way hash by our authentication provider); account type (parent, student or educator) and an age band (13–17 or 18+) derived at sign-up; first name; optional profile photo, cropped and stripped of embedded location and camera data before storage, visible only to the account holder; the version of the Terms you accepted and when; sign-in device tokens so you are not asked for a code every time.
2. 3.2Family record (parents). Full name, country, optional phone number (used only for payment or urgent contact, never shown to Experts), and the students linked to you.
3. 3.3Student profile. First name; grade or graduation year; school and country (optional); intended field, target schools, tests and goals (optional). For students 13–17, the parent or guardian's email.
4. 3.4Request. Everything the request form asks for the chosen service — for admissions and essay work that includes GPA, test scores, target schools, activities, and what the family is worried about — plus the service requested, the Expert proposed, and the status of the request.
5. 3.5Documents. Essay drafts and other files a student submits for review, every version of them, and the Expert's written feedback. Session recordings, where a service includes live sessions.
6. 3.6Payment. Stripe, Inc. handles payment. We receive and keep the amount, date, currency, a Stripe reference and the last four digits of the card; we never receive or store a full card number.
7. 3.7Saved items. The services and Experts you mark with a heart. For a signed-out visitor these stay on the device only; on sign-in they move to the account.
8. 3.8Search and site use. Search queries with a random per-tab identifier that is not linked to any account, and the result counts. We do not run advertising trackers, session recording of the website, or third-party analytics.
9. 3.9Support. Emails you send us and our replies.
10. 3.10Educators (applicants and Experts). Everything in the application: name, background, institution, areas, bio, an optional link, country and state, hours and hoped-for rate, an optional PDF (for example a CV); and after approval, verified credentials and the date each was checked, identity- and background-check results (the outcome and date only — we do not store the underlying report), tax forms, and payment details for payouts.
11. 3.11From the browser. IP address and standard request logs held briefly by our hosting provider for security; the device-local items listed in §10.

4. How we use it

1. 4.1To run the Service: create and secure accounts, match a request to an Expert, deliver and record the work, take payment, pay Experts, and answer support.
2. 4.2To keep students safe: verify Experts, review reports and held messages, investigate concerns, and enforce our rules.
3. 4.3To communicate about your requests and account: confirmations, proposals, receipts, reminders, and changes to these documents. You can switch off non-essential email in Settings; transactional and safety emails cannot be switched off while you have an account.
4. 4.4To improve the Service in aggregate — for example, which services families look for and cannot find — never by profiling an individual student.
5. 4.5To meet legal obligations: tax and payment records, responding to lawful requests, and defending claims.
6. 4.6We do not sell or rent personal information; share it for advertising; use it for behavioural advertising; use student information to train AI or machine-learning models; or make automated decisions with legal or similarly significant effects about anyone.

5. Who sees it

1. 5.1The founder. SaharaT20 is a small company. The founder matches requests and reviews applications. Every time the founder opens a family's request or an applicant's file, the access is written to a permanent audit log.
2. 5.2The Expert on your request — and only after you approve them. They see the student's first name, grade, the request details and documents needed for that specific job, and the session recordings for that job. They never see a family's email address, phone number, payment details, or other requests. They are bound by a written confidentiality obligation and may not keep copies after the work ends beyond the feedback they wrote.
3. 5.3A parent or guardian sees their student's whole file (§2).
4. 5.4Service providers that store or move data for us, each under a contract limiting them to our instructions: Vercel (website hosting, USA); Supabase on Amazon Web Services (database, file storage and authentication; region US-East, Ohio); Stripe (payments); Resend (transactional email); GitHub (source code, no personal data); and, once live, our identity- and background-check provider and our video-meeting provider. The current list is kept at saharat20.com/privacy and we will update it here before adding a provider that handles personal data.
5. 5.5Legal. We disclose information if the law requires it, to protect a student from serious harm, or to establish or defend legal claims. Where the law allows, we tell the affected family.
6. 5.6A successor. If the business is sold or merged, information transfers with it under this policy, and we tell you first.
7. 5.7Nobody else. There are no data brokers, advertising partners, or “affiliates”.

6. How it is protected

1. 6.1Encryption in transit (TLS everywhere) and at rest. Passwords are hashed; sign-in needs a one-time email code on every new device.
2. 6.2Access rules are enforced inside the database itself, so that one family's records can never be read by another family, an Expert can read only the request they are assigned, and the website has no privileged key that could bypass those rules.
3. 6.3Documents, photos and recordings live in private storage and are served only through short-lived signed links.
4. 6.4Founder access is logged. Experts sign confidentiality terms. We review security settings and dependencies regularly.
5. 6.5No system is perfectly secure. If we discover a breach affecting your information, we tell you without undue delay and within any period the law sets, and we tell the authorities where required.

7. Where it is stored

1. 7.1Information is stored and processed in the United States. If you use the Service from outside the US, your information is transferred to the US, where privacy law may differ from your own.
2. 7.2European Economic Area, United Kingdom and Switzerland. Our legal bases are: performance of the contract with the contracting adult (running the Service); legitimate interests (security, safety of students, improving the Service in aggregate); consent (a teenager's own account, recordings where consent is required, non-essential email); and legal obligation. Transfers to the US rely on Standard Contractual Clauses with our providers. You have the rights in §9 and may complain to your local supervisory authority. We do not currently offer accounts to children under 16 in the EEA without verifiable parental consent, which we obtain through the linked parent's account.
3. 7.3Republic of Korea. For a child under 14 we require the legal representative's consent through the linked parent account, and the representative has the rights in §9 on the child's behalf.
4. 7.4We do not market the Service outside the United States. Some services may be unavailable in some countries.

8. How long we keep it

Retention periods are set so that a later request can build on an earlier one, then end.

1. 8.1Accounts, family and student records, requests, documents and feedback: while the account exists, and 30 days after you ask us to delete it (§9).
2. 8.2Requests from a form that never led to an account or a service: deleted 12 months after submission.
3. 8.3Session recordings: 90 days after the session, then deleted, unless a specific recording is needed for an open complaint, dispute or legal requirement.
4. 8.4Document version history: kept with the account, because it is the record that the work was the student's own; deleted with the account.
5. 8.5Payment records: 7 years, as tax and accounting law requires, in a form that excludes the student's documents.
6. 8.6Search analytics (no account identifier): 13 months.
7. 8.7Founder audit log: 3 years.
8. 8.8Held or reported messages and safety reports: 3 years, so that a pattern can be seen and a later concern investigated.
9. 8.9Educator applications that are declined or abandoned: 12 months. Approved Experts' verification records: for the working relationship plus 3 years.
10. 8.10Backups are kept for up to 30 days and are overwritten on the same schedule.

9. Your rights and how to use them

Email privacy@saharat20.com from the account's address, or use Settings inside your account. We confirm within two business days and act within 30 days. We do not charge for these requests and do not treat you differently for making one.

1. 9.1See and correct. Everything on your file is visible in your account; a parent sees their student's file. Ask us for anything you cannot see.
2. 9.2Export. A copy of your family's records in a readable, machine-portable form (JSON plus the documents).
3. 9.3Delete. “Request account deletion” in Settings, or email us. We confirm by email, then erase the family's accounts, requests, documents, recordings, photos, messages and saved items within 30 days. Payment records the law requires us to keep are retained for that period only, separated from any student document.
4. 9.4Withdraw consent / stop collection. A parent may tell us to stop collecting from their student; we then close the student's account.
5. 9.5Object or restrict processing based on legitimate interests, where applicable law gives you that right.
6. 9.6Opt out of non-essential email in Settings or via the link in any such email.
7. 9.7California (CCPA/CPRA) and other US states with consumer-privacy laws. You have the rights above, including to know what we collect and why, to delete, to correct, and to non-discrimination. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information beyond what is needed to provide the Service, so there is nothing to opt out of; we honour Global Privacy Control signals as an opt-out request anyway. You may use an authorised agent; we will verify the request through the account email. Appeals of a decision go to the same address and are handled by a different reviewer where one exists.
8. 9.8We verify every request against the account's email and, for a student's records, against the linked parent's account.

10. Cookies and on-device storage

1. 10.1Strictly necessary: sign-in session cookies (Supabase auth), a cookie that remembers a trusted device so you are not asked for a code each time, and a 24-hour cookie after a blocked under-13 sign-up.
2. 10.2Preferences, on this device only, never sent to us: your light/dark choice; recent searches; saved items while signed out; a draft request while you are filling it in; a random per-tab identifier for search analytics.
3. 10.3Nothing else. No advertising cookies, no third-party analytics, no cross-site tracking, no fingerprinting. Because we set no optional cookies, there is no cookie banner.

11. Changes to this policy

1. 11.1We will not change how we use a student's information in a way that reduces protection without asking the contracting adult first. For any material change we email account holders at least 14 days before it takes effect, show it inside the account, and ask you to accept the new version.
2. 11.2The date at the top is the version in force. Earlier versions are available on request.

12. Contact

1. 12.1SaharaT20 LLC · privacy@saharat20.com. If you are in the EEA or UK and are not satisfied with our answer, you may contact your data-protection authority.