Your story is yours.
We're just renting.

Effective 8 October 2026Last updated 8 October 2026Version 1.3

Table of contents

1. Who we are and what this policy covers
2. Two different roles: direct users and school users
3. Definitions
4. The personal data we collect
5. Where the data comes from
6. Why we process your data, and our legal basis
7. How Capy and our AI systems use your data
8. Automated processing and your right to human review
9. Students under 18, and children
10. School, district and institutional deployments
11. Who we share data with
12. What we never do
13. Subprocessors
14. International data transfers
15. How long we keep data
16. Security
17. Your rights and how to exercise them
18. Cookies and similar technologies
19. Marketing, notifications and WhatsApp
20. Data breach notification
21. Changes to this policy
22. How to contact us

Country annexes

• Annex A: Brazil (LGPD)
• Annex B: United States (federal and state)
• Annex C: India (DPDP Act 2023)
• Annex D: Colombia (Ley 1581 de 2012)
• Annex E: European Economic Area and United Kingdom

1. Who we are and what this policy covers

bcs is a college counseling platform. Our AI counselor, Capy, works with students across the full application workflow: building an applicant profile, researching and shortlisting universities, analyzing extracurricular activities and honors, drafting and revising essays, tracking deadlines and forms, planning recommendation letters, and working through financial aid.

1.1 Who controls your data

bcs – BRIGHT CITIZEN SCHOLARS, INC. is the controller, Data Fiduciary or Responsable del Tratamiento of your personal data, wherever in the world you are, including in Brazil.

bcs – BRIGHT CITIZEN SCHOLARS, INC. A corporation organized under the laws of the State of Delaware, United States of America Delaware File Number 10377748, incorporated 23 October 2025 Employer Identification Number (EIN) 61-2302529 Principal address: 6 Mass Row 2992, Hanover, NH 03755, United States of America Registered office: 131 Continental Dr, Suite 305, Newark, Delaware 19713, County of New Castle Registered agent: Legalinc Corporate Services Inc.

bcs also operates a Brazilian entity:

BCS INC. INOVA SIMPLES (I.S.) Empresa simples de inovação constituída sob o regime do art. 65-A da Lei Complementar nº 123/2006 CNPJ nº 68.475.111/0001-98 Rua Aimorés, nº 162, Bairro Rio Vermelho, Salvador, Bahia, CEP 41940-080, Brasil

This entity carries out operations in Brazil and acts as our local point of contact and representative for data protection matters in Brazil. It processes personal data as an operador on the Delaware entity's instructions.

1.2 How the two entities work together

The two entities are affiliates under common control and together form "bcs".

• They share a single platform, a single set of security controls, and this single Privacy Policy.
• The LGPD applies in full to our processing of Brazilian users' data, under Art. 3, II, because we offer services to individuals located in Brazil. Contracting through a US entity does not reduce your rights under Brazilian law by one word.
• The Brazilian Consumer Code applies in full to Brazilian consumers, for the same reason.
• Personal data of Brazilian users is transferred to and processed on infrastructure outside Brazil. See section 14.
• The Delaware entity is accountable to you for all processing described here. You do not need to work out which entity holds your data. Contact us once, at the address in section 22.
• Where bcs operates through an additional local entity or representative in the future, that entity will be identified in the relevant country annex below.

This policy applies to:

• bcscholars.com and all subdomains, including my.bcscholars.com and waitlist.bcscholars.com
• The bcs web and mobile applications
• Capy and every bcs module, including Dashboard, Roadmap, Essay Lab, EC & Honors, Mapping, School List, Student Profile, Universities Hub and Recommendation Hub
• bcs Pro, bcs Ultra, and school or district licenses
• Our optional WhatsApp check-in service
• Emails, support conversations, demos, and sales interactions

This policy does not apply to: third-party sites and services you reach from bcs, including the Common App, university portals, scholarship providers, or any application platform. Those services have their own privacy policies and we do not control them.

2. Two different roles: direct users and school users

This is the single most important thing to understand about how bcs handles data, so we put it first rather than burying it.

2.1 Direct accounts (bcs Pro, bcs Ultra, waitlist)

When a student or a parent signs up with bcs directly, rather than through a school, bcs is the controller of that personal data. We decide what data is collected and why, within the limits described in this policy. Your relationship is with us.

2.2 School and district accounts

When a student accesses bcs under a licence held by their school, district or educational group, the institution is the controller and bcs acts as processor, operator or service provider on the institution's documented instructions.

In that mode:

• The institution decides what student data enters bcs and for how long it stays there.
• We process that data only to deliver the service to the institution and its students, and for the limited operational purposes described in this policy.
• We do not use school-sourced student data for our own marketing, for advertising, or for any purpose the institution has not authorized in writing.
• Requests to access, correct or delete school-sourced student data are normally directed to the institution first. We will assist the institution in responding.
• In the United States, we handle education records as a school official with a legitimate educational interest under FERPA, 34 CFR § 99.31(a)(1), under the direct control of the institution. We do not redisclose education records except as the institution directs or the law requires.
• Where bcs and an institution have signed a data processing agreement, that agreement governs any conflict with this policy as to school-sourced data.

2.3 Where the roles meet

A student may hold both a school-provided account and a personal bcs account. Where a student later converts a school account into a personal account, or exports their own work, bcs becomes the controller of the data in the personal account from the date of conversion. We will make that transition visible in the product and require an affirmative action from the student, and, where the student is a minor, from a parent or guardian.

3. Definitions

4. The personal data we collect

We collect only what the product actually needs. Fields marked optional can be left blank, and bcs will still function, though some analysis will be less precise.

4.1 Account and identity data

• Full name
• Email address
• Password (stored only as a salted cryptographic hash, never in readable form)
• Phone number, where you enable WhatsApp check-ins or phone-based verification
• Country and state or region
• Preferred language
• Profile photo (optional)
• Third-party sign-in identifiers, where you sign in with Google or with your school's single sign-on

4.2 Student profile and academic data

• An age declaration at signup. You confirm whether you are 18 or over. We use this only to route you to the correct consent flow and to apply the right minor-protection rules. We do not ask for your date of birth
• Current school name, graduation year, grade or year level
• Transcript, grades, GPA, class rank (as provided by you or your institution)
• Standardized test scores: SAT, ACT, AP, IB, TOEFL, IELTS, Duolingo, ENEM, national or state examinations (optional)
• Intended major, academic interests, career goals
• Extracurricular activities, hours, roles, descriptions
• Honors, awards and distinctions
• Competitions, research, portfolios, publications
• Target university list, application status, deadlines, decisions

4.3 Student Content

• Essays, personal statements, supplemental essays, and every draft and revision
• Prompts, questions and messages exchanged with Capy
• Uploaded documents, including transcripts, résumés, activity lists and recommendation drafts
• Notes, tasks, and workspace content

4.4 Financial aid

bcs helps you research and plan financial aid, compare awards and prepare appeals.

We do not collect your household income, family assets, tax returns, expected family contribution or any other family financial information. Financial aid support is delivered from public institutional data, published aid policies and information you choose to describe in your own words, not from a financial intake form.

The only financial data we hold about you is payment data, described in section 4.6.

4.5 Sensitive data

bcs does not require you to provide sensitive data, and we do not ask for it as a condition of using the service.

However, students sometimes write about race, ethnicity, national origin, religion, disability, health, immigration journey, sexual orientation, gender identity, family hardship or personal trauma inside an essay, because these things are often central to the story an application asks for.

Where that happens:

• We treat that content as Student Content, held under the same confidentiality and security controls as any other essay text.
• We do not extract, tag, index, infer, profile or build attributes from sensitive characteristics found in essay text.
• We do not use it for advertising, segmentation or any commercial purpose.
• We do not disclose it to universities, institutions or any third party, except as you explicitly direct.
• In Brazil, processing of dados sensíveis in this context relies on your specific and highlighted consent under LGPD Art. 11, I, or on the exercise of rights in a contract. In Colombia, providing sensitive data is voluntary and you are not obliged to answer questions about it, in accordance with Ley 1581 Art. 6 and Decreto 1377 Art. 6.
• You can delete this content at any time.

We ask you not to upload government identification numbers, passport numbers, CPF, Aadhaar, Social Security numbers, cédula numbers, bank account or card numbers, or medical records. bcs does not need them and they should not enter the product.

4.6 Payment data

Card payments are processed by Stripe, Inc. bcs charges in Brazilian reais (BRL) in Brazil and in US dollars (USD) everywhere else, and Stripe handles the currency and settlement layer. bcs does not receive or store your full card number. We receive the transaction result, the last four digits, the card brand, expiry, billing country, and the subscription status. We also receive the transaction currency and the converted amount. Stripe handles your payment details under its own privacy policy at https://stripe.com/privacy, and acts as an independent controller for some of that processing, including fraud prevention across its network.

If you pay by Pix, the payment is processed in Brazil by Mercado Pago, not by Stripe. bcs sends Mercado Pago your email and the amount, and Mercado Pago uses them to generate and settle the payment. bcs does not ask for your CPF and does not receive it. From Mercado Pago we receive the transaction result, the amount and any refund, and nothing about the paying bank account.

4.7 Device, usage and technical data

• IP address and approximate location derived from it, at city or region level. On every visit, our hosting provider Microsoft Azure (section 13) derives your country from your IP address; we use that country only to show our sites in your language and prices in the currency checkout will charge you
• Device type, operating system, browser type and version, screen resolution, language settings
• Unique device or installation identifiers
• Pages and screens viewed, features used, session duration, navigation paths, timestamps
• Referring URL
• Error logs, crash reports, performance diagnostics
• Cookie and local storage identifiers

4.8 Communications data

• Support tickets, chat conversations with our team, and their contents
• Emails you send us and our replies
• WhatsApp messages exchanged through our check-in service, where you have opted in
• Survey and feedback responses

5. Where the data comes from

We do not buy personal data from data brokers or data licensors, and we do not enrich your profile with data purchased from third parties.

6. Why we process your data, and our legal basis

Where we rely on consent, you may withdraw it at any time, and withdrawal is as easy as giving it. Withdrawing consent does not affect processing already carried out lawfully, and it may mean we can no longer provide part of the service.

7. How Capy and our AI systems use your data

This section is deliberately specific, because vague AI clauses are how student platforms lose the trust of families and schools.

7.1 What Capy actually is

Capy is an AI system built on top of large language models operated by the third-party model provider listed in section 13. Capy is layered on a proprietary knowledge base built from admissions expertise, program and scholarship data, and structured counseling methodology developed by bcs with admissions officers and admitted students.

7.2 What happens to your content when you use Capy

1. Your prompt, together with the relevant portions of your profile and Student Content, is transmitted over an encrypted connection to a model provider.
2. The model generates a response.
3. The response returns to bcs and is displayed to you and stored in your workspace.
4. Both your input and the output are retained in your account so the workflow has continuity across sessions.

7.3 Our commitments on model training

We do not use Student Content to train, fine-tune or improve generative AI models, whether ours or a third party's. This covers essays, drafts, transcripts, activity descriptions, honors, chat messages with Capy and uploaded documents.

We contractually require every model provider we use to process our data on a zero-retention or limited-retention basis and to refrain from training on it.

We will not change this commitment retroactively. If we ever want to train on Student Content, we will ask for separate, specific, opt-in consent, we will make it genuinely optional, and we will never make it a condition of using bcs.

7.4 What "gets smarter with every student" actually means

Our marketing says bcs gets smarter with every student we serve. To be precise about what that does and does not mean:

It does mean:

• We study aggregated and de-identified usage patterns to find where students get stuck, which prompts fail, and which modules save the most time.
• We expand our proprietary admissions knowledge base with institutional facts: program requirements, deadlines, scholarship criteria, competition dates.
• We refine Capy's instructions, retrieval logic, scoring methods and workflow design based on what we learn.
• Our human experts review anonymized examples of Capy's own outputs for quality, under confidentiality obligations, with student identifiers removed.

It does not mean:

• We do not feed your essays into a model to make it better at writing other students' essays.
• We do not train on your transcript, your activities, or your conversations.
• Your work does not become raw material for anyone else's application.

7.5 Human review

A limited number of authorized bcs personnel may access Student Content when it is strictly necessary to: provide support you requested, investigate a security incident or suspected abuse, comply with a legal obligation, or verify the quality and safety of Capy's outputs. Access is logged, role-restricted, and covered by confidentiality obligations. Quality review is conducted on de-identified samples wherever technically feasible.

7.6 Accuracy

AI systems make mistakes. Capy can produce inaccurate deadlines, incorrect requirements, fabricated citations, or advice that does not fit your circumstances. Everything Capy produces is a draft or a suggestion, and you are responsible for verifying it before you rely on it or submit anything. See the Terms of Service for the full allocation of responsibility here.

8. Automated processing and your right to human review

bcs performs automated analysis that produces scores and recommendations, including major-alignment scoring, profile gap analysis, and reach / target / safety classification of universities.

These are advisory. They do not produce legal effects and they do not decide anything about you. bcs does not make admissions decisions, does not communicate scores to universities, and no institution receives a bcs score as an input to any decision about you.

Even so, we give you rights that go beyond what the law strictly requires in some of these countries:

• You can see the reasoning. Capy exposes the basis for its analysis in the product, and you can request a plain-language explanation of the criteria and the general logic behind any score or recommendation you received.
• You can request human review. Contact us at contact@bcscholars.com and a person will review the output and respond.
• You can contest it. You may challenge an automated output and ask us to correct the underlying data or reconsider the result.
• You can opt out of scoring. You can disable profile scoring features and continue using the rest of bcs.

Brazilian users have these rights under LGPD Art. 20. EEA and UK users have related rights under GDPR Art. 22. We extend the same treatment to every user regardless of country.

9. Students under 18, and children

bcs is built for university applicants. Most of our users are in secondary school, and many are minors. We treat that as the central design constraint of the product, not a footnote.

9.1 The global standard we apply

The four countries where we principally operate draw the line in different places. Rather than run four different products, bcs applies the strictest applicable standard to every user, everywhere:

1. No advertising tag runs inside the product. Students are never profiled or retargeted based on anything they do inside bcs.
2. Anyone under 18 must have verifiable parental or guardian consent before creating an account or having data processed by bcs, unless they access bcs through an institutional licence where the institution has obtained the required consent.
3. We never serve behavioral or targeted advertising to any student, of any age, anywhere, inside the product.
4. We never track or monitor the behavior of a minor for advertising, profiling or commercial purposes.
5. We never sell or license student data to anyone. Not to universities, not to advertisers, not to data brokers, not to recruiters.
6. We collect the minimum data the counseling workflow needs, and no more.

9.2 Minimum age

You must be at least 16 years old to hold a bcs account. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we will delete it promptly and terminate the account.

9.3 How parental consent works

• At sign-up you confirm whether you are 18 or over. A user who does not confirm this is treated as a minor and placed in a restricted state. No Student Content processing begins.
• We cross-check the age declaration against the graduation year you provide. Where the two are clearly inconsistent, we treat you as a minor until the inconsistency is resolved.
• We collect a parent or guardian email address and send a consent request that clearly describes what bcs does, what data it processes, why, who it is shared with, and how to withdraw.
• Consent is captured through a signed electronic consent form. We record the date, time, IP address, the scope consented to, and the guardian's confirmation of their relationship to the student.
• Processing begins only after consent is recorded.
• The parent or guardian can withdraw consent at any time from contact@bcscholars.com. Withdrawal stops processing and triggers deletion or return of the student's data.
• We keep a record of the consent given, the method used, the date and the scope, for as long as we process the minor's data and for 5 years afterward as evidence of compliance.

9.4 Country-specific rules for minors

Brazil. LGPD Art. 14 requires that data of children and adolescents be processed in their best interest. For a criança (under 12), Art. 14 § 1 requires specific and highlighted consent from at least one parent or legal guardian. We apply verifiable parental consent to all users under 18, exceeding the statutory minimum. We do not condition a minor's participation in any bcs activity on the disclosure of more personal data than is strictly necessary, as required by Art. 14 § 4. We make information about the data we process for minors public and accessible to guardians, as required by Art. 14 § 6.

United States. Because our minimum age is 16, COPPA, which governs children under 13, does not apply to our processing. For students in school deployments, education records are governed by FERPA and the institution's own consent and notification obligations. We comply with state student privacy laws including California's SOPIPA (Cal. B&P Code § 22584), New York Education Law § 2-d, and equivalent laws in other states. Under those laws we do not: target advertising to students, create a profile of a student for any non-educational purpose, or sell student information.

India. The Digital Personal Data Protection Act, 2023 defines a child as anyone under 18 and, in Section 9, requires verifiable consent from a parent or lawful guardian before processing a child's personal data. Section 9 also prohibits processing that is likely to cause any detrimental effect on the well-being of a child, and prohibits tracking, behavioral monitoring and targeted advertising directed at children. bcs complies with all of these for every Indian user under 18, and applies the advertising and tracking prohibitions to every user globally.

Colombia. Ley 1581 de 2012 Art. 7 establishes that processing the data of children and adolescents is prohibited, except where the data is of a public nature. Decreto 1377 de 2013 Art. 12 permits processing that respects the best interests of the minor and their fundamental rights, provided that the legal representative authorizes it after the minor's opinion has been heard, giving due weight to the minor's maturity, autonomy and capacity to understand. bcs therefore: obtains the legal representative's express authorization, presents the minor with an age-appropriate explanation and records that their view was sought, and processes only what is necessary to deliver a counseling service the minor has asked for.

9.5 A note to parents and guardians

You can review your child's account data, request corrections, request deletion, and withdraw consent at any time by contacting contact@bcscholars.com. We will verify your relationship to the student before acting.

We will tell you plainly what we do not offer: bcs is not a monitoring or surveillance tool. We do not provide parents with a live feed of a student's essays, chats with Capy, or private notes. Students need a workspace where they can draft honestly. Where you hold consent rights over a minor's data, we will honor a lawful access request under section 17, and we will notify the student that the request was made.

10. School, district and institutional deployments

10.1 What administrators can see

School and district administrators see aggregate, cohort-level dashboards: how many students are active, progress against milestones, deadline risk across a cohort, module usage.

Administrators and counselors do not see individual student essays, drafts or Capy conversations unless the student explicitly shares them. Sharing is a deliberate, per-item action taken by the student inside the product, and it is revocable.

This is enforced in the product by role-based permissions, not by policy alone.

10.2 Institutional data flows

• The institution provides roster and enrolment data to create accounts.
• The institution may provide transcripts and academic records.
• On termination of the licence, we return or delete institutional data as agreed with the institution, and we tell students in advance so they can export their own work.
• We do not use institutional data to market to students, parents or other schools.

10.3 Certifications and safeguards

bcs holds a SOC 2 Type II attestation. Single sign-on is supported. Data is encrypted in transit and at rest.

11. Who we share data with

We share personal data only in the situations below.

11.1 Sending your application to a university

bcs helps you prepare applications. bcs does not submit anything to a university on your behalf and does not transmit your data to any institution unless you take a specific action instructing us to, at the moment you want it sent. No standing authorization, no default sharing, no bundled consent.

12. What we never do

These are commitments, not aspirations, and we will keep them in writing so you can hold us to them.

• We never sell your personal data. Not for money, not for anything else of value. We do not transfer student data to universities, colleges, recruiters, lenders, scholarship marketers or data brokers for compensation of any kind.
• We never serve targeted advertising inside bcs. The authenticated product has no ad network, no advertising tags and no advertising business model. Your essays, profile, transcript and Capy conversations are never used for advertising by anyone.
• We never share Student Content, academic data or account data for advertising.
• No advertising tags on our website. Our public marketing website, bcscholars.com, runs no advertising tags today, so no website visitor data goes to ad networks. If we ever add one, we will list it here first and ask for consent where the law requires it.
• We never train generative AI models on Student Content.
• We never use your essays as examples, samples or marketing material without your separate written permission.
• We never share your data with another student, or let another student's Capy session see your content.
• We never make your account or your school's account contingent on providing more data than the service needs.

13. Subprocessors

The subprocessors that may process personal data on our behalf are listed below. We keep this list current and will update it when it changes.

Product analytics and error monitoring run on PostHog, listed above. On the public website bcscholars.com, PostHog keeps no cookie or local-storage identifier. Support conversations are handled on our own infrastructure, with no separate support vendor.

Every subprocessor is bound by a written contract requiring confidentiality, security measures at least as protective as ours, processing limited to our documented instructions, and cooperation with your rights requests.

Changes. We update this list when we add or remove a subprocessor. Institutional customers receive advance notice of any change affecting Student Content.

14. International data transfers

Our production infrastructure is hosted in Brazil. We run on Microsoft Azure in its Brazil South (São Paulo) region, and keep database backups in the United States. Our AI inference provider, OpenAI, and the card payment, analytics and email providers listed in section 13 process in the United States. Pix payments are processed in Brazil by Mercado Pago.

This means that, wherever you are, your personal data is also transferred to and processed in the United States, including your essays, transcript, activity list and conversations with Capy when Capy works on them, and in our backups. We say this plainly because it is the single most important fact about where your data lives.

We use the following safeguards, depending on where you are:

• Brazil. The LGPD applies in full under Art. 3, II, because we offer services to individuals located in Brazil. All processing of Brazilian users' data takes place in the United States, on the infrastructure and with the subprocessors listed in section 13, except a Pix payment, which Mercado Pago processes in Brazil (see section 4.6). These transfers are made under LGPD Art. 33, and we implement the contractual safeguards that provision requires with each subprocessor that receives Brazilian personal data.
• India. Transfers are permitted under DPDP Act Section 16, subject to any restrictions the Central Government may notify. We monitor notified restricted countries and will adjust our hosting if required.
• Colombia. Transfers to countries not deemed adequate by the Superintendencia de Industria y Comercio are made on the basis of your express and informed authorization and contractual clauses that bind the recipient to Colombian standards, in accordance with Ley 1581 Art. 26 and Circular Externa 005 de 2017.
• EEA and UK. Transfers rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with a transfer impact assessment.
• United States. This is where all of our infrastructure sits. The United States has no general federal data protection law. We apply the contractual and technical safeguards described in this policy to every user regardless of where they live, and US law does not reduce the rights this policy gives you.

You may ask us about the safeguards applied to transfers of your data at contact@bcscholars.com.

15. How long we keep data

We will not attempt to re-identify de-identified data, and we contractually prohibit our subprocessors from doing so.

16. Security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of student data.

• Encryption. TLS 1.2 or higher in transit. AES-256 at rest.
• Access control. Role-based access and the principle of least privilege for personnel with production access.
• Secrets and key management. Managed key service, with no credentials stored in source code.
• Isolation. Institutional tenants are separated logically within a shared database. Access to one institution's data from another institution's context is blocked by authorization checks.
• Backups. Encrypted.
• Personnel. Confidentiality obligations, and access revocation on departure.
• Certifications. SOC 2 Type II.

No system is perfectly secure. We cannot guarantee absolute security, and we ask you to help by using a strong unique password and not sharing your account.

17. Your rights and how to exercise them

Whatever country you are in, bcs gives every user the following rights. Where your local law gives you more, your local law wins, and the annexes below set out the additions.

17.1 Export formats

You can obtain a copy of your data in the following formats:

• PDF, a human-readable copy of your essays, profile, activity list and school list.
• A structured, machine-readable copy on request. Statutory portability requires a structured, commonly used, machine-readable format, which a PDF is not. Email contact@bcscholars.com with the subject line PRIVACY and we will provide your data in such a format within the deadline for your country in section 17.

How to make a request

Email contact@bcscholars.com. Access, correction, deletion, portability and every other right in this section are exercised by email. Requests are free and we will not make you jump through steps to submit one.

What we need from you. Enough information to locate your records and verify your identity. We will not ask for more sensitive data than the verification requires. If a parent, guardian or authorized agent makes the request, we will verify their authority.

How fast we respond.

Requests are free. If a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or decline, and we will explain why and tell you how to appeal.

Appeals. If we deny a request, you may appeal by replying to our decision. We will respond to the appeal within 45 days with the reasons for our decision and the contact details of your supervisory authority.

18. Cookies and similar technologies

18.1 What we use

18.2 Your controls

• The public website sets no analytics or advertising cookies, so it shows no consent banner. If that changes, we will ask for consent before setting such a cookie where local law requires it.
• Browser controls let you block or delete cookies, though blocking strictly necessary cookies will break the product.
• We honor Global Privacy Control (GPC) signals as a valid opt-out request where applicable law recognizes them.

Do Not Track. There is no common industry standard for DNT, so we do not respond to DNT headers. We do honor GPC.

19. Marketing, notifications and WhatsApp

19.1 Service messages

We send messages that are part of the service: deadline reminders, security alerts, billing notices, product changes, and Capy nudges you configured. These are not marketing and you cannot fully opt out of the essential ones while you hold an account, though you can adjust nudge frequency in settings.

19.2 Marketing

When you create an individual bcs account, you will receive marketing email from us about bcs: new features, announcements, events we take part in, and content that helps with your applications. These emails are not sales pitches and do not pressure you to buy anything. There is no separate box to tick; you are told about it when you accept the Terms and this Policy at signup. We also email institutional contacts in a business capacity where local law permits.

You can unsubscribe at any time from the link in any marketing email, or by writing to contact@bcscholars.com. Unsubscribing never affects your account or the service messages in section 19.1, and we keep a suppression record so that we do not email you marketing again (section 15).

Students under 18 receive these emails too, on the same terms. The student, or their parent or guardian, can unsubscribe at any time.

19.3 WhatsApp check-ins

The WhatsApp check-in feature is opt-in only and off by default.

• You provide your phone number and confirm you want check-ins.
• Message frequency varies. Standard message and data rates from your carrier may apply.
• Reply STOP at any time to end messages, or turn the feature off in settings.
• Messages travel through WhatsApp, operated by Meta Platforms, under Meta's own terms and privacy policy, which we do not control.
• We do not send WhatsApp messages to a phone number belonging to a user under 18 unless the parent or guardian has separately consented to this specific channel. This consent is distinct from acceptance of our Terms and from general account consent.
• We do not send marketing over WhatsApp. Check-ins are service messages about your application workflow.

20. Data breach notification

If a security incident affects your personal data and is likely to result in risk or harm to you, we will:

• Notify the relevant supervisory authority within the period its law requires. In Brazil, we notify the ANPD and affected data subjects under LGPD Art. 48, within the period set by the applicable ANPD regulation, which is currently three business days from becoming aware of the incident. In India, we notify the Data Protection Board and affected Data Principals under DPDP Section 8(6). In Colombia, we report to the SIC under Ley 1581 Art. 17(n). In the United States, we comply with the applicable state breach notification statutes and, for education records, notify the institution.
• Tell you what happened, what data was involved, what the likely consequences are, what we are doing about it, and what you should do.
• Notify affected institutions within the timelines agreed with them.

21. Changes to this policy

We may update this policy. When we do:

• We update the "last updated" date and the version number.
• For material changes, we give at least 30 days' advance notice by email to registered users and by a prominent in-product notice before the change takes effect.
• Where a change requires your consent under applicable law, we will ask for it rather than assume it from continued use.

We will not apply a materially less protective policy retroactively to data we already collected without a lawful basis for doing so.

22. How to contact us

One mailbox, all requests. bcs operates a single monitored contact address for every request under this policy, including access, correction, deletion, portability, consent withdrawal, human review of automated outputs, appeals, and complaints. You do not need to work out which team or which entity handles your request. Write to contact@bcscholars.com and we will route it internally and answer within the deadline for your country set out in section 17.

Where a request must reach a named officer, mark your email with the subject line indicated below.

Postal addresses:

Brazil: BCS INC. INOVA SIMPLES (I.S.) CNPJ 68.475.111/0001-98 Rua Aimorés, nº 162, Bairro Rio Vermelho Salvador, Bahia, CEP 41940-080, Brasil

United States and rest of world: bcs – BRIGHT CITIZEN SCHOLARS, INC. 6 Mass Row 2992, Hanover, NH 03755, USA

Registered office (service of process): 131 Continental Dr, Suite 305, Newark, Delaware 19713, County of New Castle, USA c/o Legalinc Corporate Services Inc., registered agent

Annex A: Brazil (LGPD)

Legislação aplicável: Lei nº 13.709/2018 (Lei Geral de Proteção de Dados Pessoais), em conjunto com o Marco Civil da Internet (Lei nº 12.965/2014), o Código de Defesa do Consumidor (Lei nº 8.078/1990) e o Estatuto da Criança e do Adolescente (Lei nº 8.069/1990).

Controlador: bcs – BRIGHT CITIZEN SCHOLARS, INC., 6 Mass Row 2992, Hanover, NH 03755, EUA.

Aplicabilidade da LGPD: a LGPD aplica-se integralmente ao tratamento aqui descrito, nos termos do art. 3º, II, por se tratar de oferta de serviços a titulares localizados no território nacional. O fato de o controlador ser estrangeiro não reduz nenhum direito do titular.

Representante e operador no Brasil: BCS INC. INOVA SIMPLES (I.S.), CNPJ 68.475.111/0001-98, Rua Aimorés nº 162, Bairro Rio Vermelho, Salvador, Bahia, CEP 41940-080, empresa simples de inovação constituída sob o art. 65-A da Lei Complementar nº 123/2006. Atua como ponto de contato local e como operadora, mediante instruções do controlador.

Encarregado (DPO): Caio Vitor Urbano Neves, caio@bcscholars.com, indicado nos termos do art. 41 da LGPD. A identidade e o contato do encarregado devem ser divulgados publicamente, de forma clara e objetiva, preferencialmente no sítio eletrônico do controlador.

Transferência internacional: toda a infraestrutura da bcs está localizada nos Estados Unidos. Os dados de usuários no Brasil são, portanto, transferidos e tratados no exterior, nos termos do art. 33 da LGPD. A única exceção é o pagamento via Pix, processado no Brasil pelo Mercado Pago (ver seção 4.6). Ver seção 14.

Idioma: esta Política é publicada em inglês. A exigência legal de informação clara e em português ao consumidor brasileiro não é afastada por esta cláusula.

Idade mínima: 16 anos. Para usuários entre 16 e 18 anos, exige-se consentimento do responsável legal, nos termos do art. 14.

Seus direitos (art. 18 da LGPD): confirmação da existência de tratamento; acesso aos dados; correção de dados incompletos, inexatos ou desatualizados; anonimização, bloqueio ou eliminação de dados desnecessários, excessivos ou tratados em desconformidade com a lei; portabilidade a outro fornecedor; eliminação dos dados tratados com consentimento; informação sobre as entidades públicas e privadas com as quais compartilhamos dados; informação sobre a possibilidade de não fornecer consentimento e as consequências disso; e revogação do consentimento.

Decisões automatizadas (art. 20 da LGPD): você pode solicitar a revisão de decisões tomadas unicamente com base em tratamento automatizado que afetem seus interesses, e pedir informações sobre os critérios e procedimentos utilizados. Ver seção 8.

Crianças e adolescentes: o tratamento observa o art. 14, no melhor interesse do titular, com consentimento específico e em destaque de ao menos um dos pais ou responsável legal. Não condicionamos a participação em qualquer atividade ao fornecimento de mais dados do que o estritamente necessário, conforme o art. 14, § 4º.

Autoridade de controle: Autoridade Nacional de Proteção de Dados (ANPD) https://www.gov.br/anpd

Canal do consumidor: reclamações de consumo também podem ser apresentadas em https://www.consumidor.gov.br or your local PROCON.

Annex B: United States (federal and state)

B.1 FERPA

Where bcs is engaged by an educational institution, we act as a school official with a legitimate educational interest under 34 CFR § 99.31(a)(1)(i)(B). We are under the direct control of the institution with respect to the use and maintenance of education records, we use education records only for the authorized purpose, and we do not redisclose them without the institution's authorization or as FERPA permits.

B.2 COPPA

bcs does not knowingly create accounts for anyone under 16, so COPPA processing of children under 13 does not arise. If we learn that a user under 13 has created an account, we delete the account and the associated data promptly.

B.3 State student privacy laws

We comply with California's Student Online Personal Information Protection Act (SOPIPA, Cal. B&P Code § 22584), New York Education Law § 2-d and its Parents' Bill of Rights, and comparable statutes in other states. Under those laws, we do not:

• target advertising to students on our service or anywhere else based on information acquired through the service;
• amass a profile of a student except in furtherance of school purposes;
• sell or rent student information; or
• disclose student information except as those statutes permit.

B.4 California residents (CCPA / CPRA)

Categories of personal information collected in the last 12 months: identifiers; personal information under Cal. Civ. Code § 1798.80; characteristics of protected classifications, only where a student volunteers them in essay content; commercial information; internet and network activity; approximate geolocation; audio or electronic information; professional or employment-related information; education information as defined by FERPA; and inferences drawn to generate profile analysis. Sensitive personal information may include account log-in credentials and, where volunteered in essay content, racial or ethnic origin, religious belief, health, or sexual orientation.

Sale: bcs does not sell personal information, and has not in the preceding 12 months.

Sharing: bcs runs no advertising tags, so it does not "share" personal information for cross-context behavioral advertising under the CPRA. We do not share any student data, account data or Student Content for advertising, and no advertising tag operates inside the authenticated product.

If that ever changes, you will be able to opt out in our cookie settings or by sending a Global Privacy Control signal, which we honor.

We do not knowingly sell or share the personal information of consumers under 16.

Use of sensitive personal information: limited to performing the service you requested. We do not use it to infer characteristics about you. Because our use falls within the § 1798.121(d) exemptions, no "Limit the Use of My Sensitive Personal Information" link is required, but you may still ask us to restrict it.

Your CCPA/CPRA rights: know, access, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, data portability, and non-discrimination. Submit requests at contact@bcscholars.com. We honor Global Privacy Control signals.

Authorized agents may submit requests with written permission and proof of identity.

B.5 Other US states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states with comprehensive privacy laws have rights of access, correction, deletion, portability, opt-out of targeted advertising, sale and profiling, and the right to appeal a denied request. We honor all of these for every US resident, regardless of whether that state has enacted a law. Appeal instructions are in section 17.

B.6 Other

• Nevada: we do not sell covered information as defined by NRS 603A.
• Washington My Health My Data Act: bcs does not collect consumer health data as defined by that Act.
• Illinois BIPA: bcs does not collect biometric identifiers or biometric information. The Service has no voice input and creates no voiceprints.

Annex C: India (DPDP Act 2023)

Applicable law: the Digital Personal Data Protection Act, 2023, together with the Information Technology Act, 2000, the SPDI Rules, 2011, and the Consumer Protection (E-Commerce) Rules, 2020.

Data Fiduciary: bcs – BRIGHT CITIZEN SCHOLARS, INC.

Data Protection Officer and Grievance Officer: Caio Vitor Urbano Neves, caio@bcscholars.com

Notice and consent. Before we process your personal data, we give you an itemized notice describing the personal data to be processed, the purpose, how to exercise your rights, and how to complain to the Data Protection Board. Consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to what is necessary for the stated purpose.

Children. Under Section 9, a child is anyone under 18. We obtain verifiable consent from a parent or lawful guardian before processing a child's personal data. We do not undertake processing likely to cause a detrimental effect on a child's well-being. We do not track or behaviorally monitor children, and we do not serve targeted advertising to children. These prohibitions are applied to every bcs user globally.

Your rights as a Data Principal: access information about processing; correction, completion, updating and erasure; grievance redressal; and nomination of another individual to exercise your rights in the event of death or incapacity.

Your duties as a Data Principal: the Act requires you to provide authentic information, not impersonate another person, not suppress material information when providing data for a legal document, and not raise false or frivolous grievances.

Grievance redressal. Contact our Grievance Officer, Caio Vitor Urbano Neves, at caio@bcscholars.com. We acknowledge within 48 hours and resolve within one month. If unsatisfied, you may complain to the Data Protection Board of India.

Cross-border transfer: permitted under Section 16, subject to any country restrictions the Central Government notifies.

Annex D: Colombia (Ley 1581 de 2012)

Ley aplicable: Ley 1581 de 2012, Decreto 1074 de 2015 (que compila el Decreto 1377 de 2013), y la Ley 1266 de 2008 en lo pertinente.

Responsable del Tratamiento: bcs – BRIGHT CITIZEN SCHOLARS, INC., 6 Mass Row 2992, Hanover, NH 03755, EUA. Contacto: caio@bcscholars.com

Autorización. El Tratamiento de sus datos personales requiere su autorización previa, expresa e informada, la cual se obtiene mediante una casilla de verificación afirmativa en el registro. Conservamos prueba de la autorización otorgada.

Finalidades. Las descritas en la sección 6 de esta Política.

Datos sensibles. Usted no está obligado a autorizar el Tratamiento de datos sensibles ni a responder preguntas sobre datos sensibles o sobre datos de niños, niñas y adolescentes, conforme al Art. 6 de la Ley 1581 y al Art. 6 del Decreto 1377.

Menores de edad. El Tratamiento de datos de niños, niñas y adolescentes se realiza respondiendo a su interés superior y asegurando sus derechos fundamentales, con la autorización del representante legal y previa opinión del menor, conforme al Art. 12 del Decreto 1377.

Sus derechos (Art. 8, Ley 1581): conocer, actualizar y rectificar sus datos; solicitar prueba de la autorización otorgada; ser informado sobre el uso dado a sus datos; presentar quejas ante la Superintendencia de Industria y Comercio por infracciones; revocar la autorización y solicitar la supresión del dato cuando no exista un deber legal o contractual de conservarlo; y acceder gratuitamente a sus datos.

Procedimiento de consultas y reclamos. Escriba a contact@bcscholars.com. Las consultas se atienden en un término máximo de diez (10) días hábiles, prorrogable por cinco (5) días hábiles. Los reclamos se atienden en un término máximo de quince (15) días hábiles, prorrogable por ocho (8) días hábiles, conforme a los Arts. 14 y 15 de la Ley 1581.

Transferencias internacionales. Se realizan con su autorización expresa e informada y con cláusulas contractuales que obligan al receptor a estándares equivalentes, conforme al Art. 26 de la Ley 1581 y a la Circular Externa 005 de 2017 de la SIC.

Autoridad de control: Superintendencia de Industria y Comercio, https://www.sic.gov.co

Annex E: European Economic Area and United Kingdom

If you are in the EEA, the UK or Switzerland, the GDPR or UK GDPR applies to our processing of your data.

• Legal bases: as set out in the table in section 6.
• Your rights: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects.
• Withdrawal of consent: at any time, without affecting prior lawful processing.
• Transfers: under the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
• EU / UK Representative: not currently appointed. bcs is not established in the EEA or the UK and does not direct its marketing there. If you are in the EEA or the UK and use bcs, the rights above still apply to you.
• Complaints: to your national supervisory authority, or to the UK Information Commissioner's Office.

© 2026 bcs – BRIGHT CITIZEN SCHOLARS, INC. and BCS INC. INOVA SIMPLES (I.S.) All rights reserved.