Legal
Privacy Policy
Effective date: 26 October 2026. This policy describes how ScholarMatch collects, uses, stores and protects your personal data when you use our scholarship discovery and matching platform.
1. Information we collect
When you create a profile or use the matching tool, we may collect your name, email address, degree level, field of study, target country, language test status and academic record. This information is used to score scholarships against your eligibility and to keep your saved shortlist and application tracker synced across devices. If you upload documents to the document centre, the files you choose are stored with your account. We also receive the email you send us if you write to the support address.
2. How we use your data
Your profile data is used solely to power scholarship matching, surface relevant awards, and show deadline reminders you have turned on. We do not sell your personal data to third parties. Search queries and matching preferences are processed to improve recommendation relevance and are retained only for the life of your account unless you request deletion. We do not use your data to make automated decisions with legal effects: a match score is information for you, and every admission or funding decision is made by the provider you apply to.
3. Cookies and local storage
We use essential cookies for authentication and session management. Your theme choice, saved awards, application tracker entries, preparation checklist, notification inbox and — if you enable them — your browser's push subscription are kept in your browser's local storage, so the site works before you sign in. Clearing that storage removes them from your device. None of these ask for permission, because the site cannot do the things you came here to do without them.
Everything else waits for an answer. On a first visit a banner asks whether we may use non-essential cookies. Declining, or not replying at all, changes nothing about what you can read, match or apply for. The answer is kept on this device for twelve months — in local storage, and mirrored in a first-party cookie called scholarmatch_consent_choice so a server-rendered page can honour it too. You can change or delete it whenever you like from Cookie Settings, in the footer of every page.
Two groups are optional. Analytics and measurement covers Google Analytics, Google Tag Manager and Vercel Web Analytics, which count which listings and articles were opened so that the catalogue can be improved. Personalised content covers material selected for you by a third party. A tag in either group is created by your browser once a decision exists and never by the page we send you, so no request to anyone else leaves your device before you have answered.
As published today, no analytics or advertising identifier is configured for this site. The banner still appears and your choice is still recorded, because the mechanism is put in place before any service is turned on. If a measurement or advertising vendor is added later, this section names it first, and our content policy refuses the request that would feed it until consent has been given.
4. Service providers
Three processors handle data on our behalf. Supabase hosts the database, authentication and private file storage for accounts, profiles, saved awards, applications, preparation progress and uploaded documents. The AI assistant's model provider receives the parts of a conversation described in section 5, and only when the assistant is configured with a model. Our email provider stores and delivers mail sent to the support address. Each provider processes data under its own terms, and none is given access to your account password.
5. The AI assistant
The assistant answers questions using the catalog and, when you are signed in, the profile you have built. To generate a reply it sends the following to a third-party model provider: your message, up to the last ten turns of the conversation, the catalog records relevant to the question, and only the profile fields that can affect a score — current degree, GPA, field of study, citizenship, work authorisation, languages and test results, years of work and research experience, leadership experience, preferred degree, countries, funding and study mode, and your fields of interest. Your display name, institution, graduation year and free-text career goal are never forwarded, because no part of the matcher reads them. The conversation is held in the page you are on and is not saved to your account; keeping it means keeping the tab open. If no model provider is configured, the assistant says so instead of guessing.
6. Your rights
You may request access to, correction of, or deletion of your personal data at any time. To exercise these rights, email support@scholarmatch.me from the address on the account. We respond within 30 days in line with GDPR and CCPA requirements. If a scholarship record itself is wrong, use the correction route on the contact page and include the provider page that shows the correct detail.
7. Data security
Account data is stored in our Supabase database, which encrypts data in transit and at rest. Uploaded documents sit in a private storage bucket and are reachable only through short-lived signed URLs issued to your own signed-in session. Access is restricted to authorised platform operators, and we do not share your profile with external scholarship providers unless you explicitly initiate an application through their official portal.