Privacy Policy

At nrol, we believe trust begins with transparency.

Your educational journey involves highly personal information — your academic history, goals, documents, finances, and aspirations. We take that responsibility seriously.

This Privacy Notice explains what data we collect, why we collect it, which processors may receive it, how long it is retained, and what choices and rights you have. Using essential account services does not automatically grant optional AI, marketing, or third-party messaging consent.

nrol ("nrol," "we," "us," or "our") is an AI-powered educational intelligence platform that helps students discover opportunities, assess eligibility, build application strategies, prepare submissions, navigate application portals, and track outcomes.

Our services may include opportunity discovery, readiness scoring, submission guidance, AI assistance, Concierge support, family visibility tools, and university and scholarship workflow support.

We collect information you provide directly, information generated through platform usage, and information required to deliver requested services.

The Privacy & Compliance Center provides the live purpose-by-purpose inventory, including recipients, retention and withdrawal effects.

We use your data to operate and improve nrol. Primary uses include account operations (create your account, authenticate login, secure platform access, provide customer support), opportunity intelligence (discover opportunities, compute eligibility, generate match scores, rank opportunities, recommend strategic options), readiness and submission support (assess application completeness, detect missing requirements, identify weak areas, improve submission quality), personalized guidance (decide where to apply, determine application timing, prioritize opportunities, build stronger applications), and product improvement (improve recommendation quality, improve user experience, detect friction, improve AI systems, reduce user fatigue).

Optional AI features may use declared processors such as Google Gemini, Anthropic Claude, Groq, OpenAI, or another processor listed in the live processing inventory. Only context required for the requested feature should be sent. AI consent is optional and can be withdrawn in the Privacy & Compliance Center; future optional AI transfers then stop. Deterministic and human-supported features remain available where possible.

AI outputs are assistive and may be incomplete or inaccurate. Final decisions remain with students, institutions, scholarship bodies, and admission committees. nrol must contractually verify processor retention, training restrictions, subprocessors, security and international-transfer safeguards before activating a provider.

nrol's SITE™ (Student Intelligent Transfer Engine) helps users during application submission. SITE™ may monitor authorized workflow signals such as portal step progression, field completion status, document completeness, inactivity duration, submission readiness, workflow interruptions, and fatigue indicators. This allows nrol to provide field guidance, missing-data alerts, mistake prevention, fatigue detection, and progress tracking.

What SITE™ Does NOT Do: Unless explicitly disclosed and consented otherwise, nrol does not record keystrokes, read unrelated browser activity, monitor activity outside authorized workflows, or access unrelated applications or websites.

Users subscribing to Concierge may grant additional permissions. With explicit authorization, nrol may review applications, edit application fields, organize documentation, upload documents, communicate with institutions, and assist in submission. Concierge permissions are governed by separate authorization agreements. No such rights are assumed without explicit consent.

nrol offers optional Family Access. With explicit student consent, approved family members may view selected information such as progress milestones, deadlines, submissions, offers, outcomes, and financial milestones (if enabled). The student controls who gets access, what they can see, and when access is revoked. No family access is granted without student authorization unless legally required.

We may communicate with you through email, SMS, WhatsApp, calls, and in-app notifications regarding deadlines, reminders, alerts, service updates, security events, and account notifications. You may opt out of non-essential marketing communications. Operational and security communications may still be required.

We disclose data only for a declared purpose: to infrastructure and security providers; AI processors when optional AI consent is active; Resend or another declared provider for email; Razorpay for payment processing; an OAuth provider when you choose social sign-in; Meta or Twilio only when third-party messaging is enabled and consented; universities, scholarship bodies or other institutions when specifically authorised; and authorities where legally required.

The live processing inventory identifies the data categories and recipients for each purpose. nrol does not sell personal data to advertisers or data brokers and does not permit a processor to use nrol data for its own advertising or unrelated purposes. A vendor may not be activated until its purpose and processor identity are declared.

We implement reasonable technical and organizational safeguards including encryption in transit, secure storage, access controls, audit logging, role-based permissions, restricted internal access, and infrastructure monitoring. No system can guarantee absolute security, but we continuously work to protect your data.

Lifetime Access Assurance means subscription expiry does not delete your account: while you choose to keep the account, nrol preserves your profile, progress and journey so you can reactivate without starting again. Dormant accounts are not a licence for unrelated marketing, optional AI processing or indefinite hidden collection.

A verified account-deletion request ends Lifetime Access Assurance. nrol erases uploaded files and directly identifying data, anonymises records that must remain structurally linked, revokes sessions and integrations, and requests deletion from applicable processors. Narrow financial, consent, security or legal evidence may be retained only for a documented purpose and period. You receive a deletion receipt stating what was erased, what was retained, why, for how long, and whether processor confirmations remain outstanding.

Current operational limits include: session logs 90 days, notifications 1 year, university messages 2 years, lifecycle evidence 3 years, and legally required financial records up to 7 years. Aggregated data may remain only when it no longer identifies a person.

Subject to applicable law, you may request to access your data, correct inaccurate data, download your data, delete your account, revoke permissions, disable Family Access, and withdraw optional consents. Requests may be subject to verification.

nrol uses essential cookies for authentication, security, language and account preferences. Essential cookies operate because the service cannot function securely without them. Optional analytics, diagnostic replay, advertising or marketing trackers remain disabled until the user receives a plain-language purpose, provider, data and retention explanation and affirmatively chooses them. Rejecting optional tracking does not prevent use of core services.

When separately enabled, diagnostic replay is limited to selected non-sensitive screens and is privacy-masked. nrol does not replay authentication, OTP, profile forms, documents, essays, applications, recommendations, payments, communications, parent access or Admin Universe. Consent can be withdrawn in Privacy & Compliance Center to stop future recording.

nrol is intended only for individuals who are 18 years of age or older. We do not knowingly permit registration by anyone under 18, and registration requires an affirmative confirmation of age. If we learn that an account belongs to someone under 18, we will close the account and delete the associated personal data, subject to any legal retention obligation. If you believe a minor has registered an account, contact support@nrol.me.

We may update this Privacy Policy periodically. Material changes will be communicated through email, platform notices, and service notifications. Continued use of nrol after updates may constitute acceptance of revised terms.

For privacy-related questions or requests, contact:

Privacy Officer — nrol

Email: support@nrol.me

Website: nrol.me