Privacy Policy

Effective September 24, 2026.

ApplySlate, operated by dctsoft, is built to be privacy-first. There is no student account, and we deliberately do not ask for the personal identifiers most college services demand. This policy explains what we collect, why, and how it is handled.

What we do not require

We do not require a student name, date of birth, home address, Social Security number, transcript upload, tax returns or FAFSA documents, or a student account. Your intake asks only for the information that changes the research.

What we collect

Your email: Stripe collects it when you pay for your ApplySlate. It is the main personal identifier we use, to send your private link, to let you recover the link if it is lost, to prepare and deliver your report, and for support.

Your intake answers: the information you enter to guide the research: GPA and rigor bands, test scores, activity summaries, income and asset bands, geographic and program preferences, and the schools you are considering. It is data-minimized and tied to a random case ID rather than a student's name, but it is detailed, so please share only what you are comfortable providing and leave out anything you would not want processed to prepare your report.

Messages you send us: if you use the report "Need help?" panel or the contact form, we keep the message you write, any reply-to email you provide, and the related case ID so we can respond.

Basic technical data: to operate and secure the service we record limited technical information, including the browser user-agent on a support request and whether and when a delivered report was opened or its PDF downloaded.

Site analytics: on our public pages we use Google Analytics to understand how visitors find and use the site, such as the pages viewed, how a visitor arrived, and general device and approximate location information. It sets cookies and loads only after you first scroll, tap or press a key. It never runs on the intake, report or link-recovery pages, and it never receives your intake answers, your email or your private link.

How we use your information

We use your information only to research and prepare your report, to deliver it and let you return to or recover your private link, and to provide support. We do not sell your information, and we do not use it for advertising.

How your case is researched

To prepare your report, the information in your intake is processed by a third-party artificial-intelligence service that conducts the research. Your intake is tied to a random case ID and does not include a student's name, but everything you enter is sent to that service and processed there under its own terms. For that reason, include only information you are willing to have processed this way, and leave out anything you do not want sent anywhere else.

Payment

Payment is processed by Stripe. ApplySlate never receives or stores your card number.

Service providers

We rely on a small set of providers to run the service: Stripe (payments), Resend (transactional email), Google Cloud / Firebase (hosting, database and private file storage), Google Analytics (public-page analytics, described above), and a third-party artificial-intelligence service used to research your case. Cloudflare provides DNS. Our hosting, database and file storage are in the United States; the research provider processes your intake under its own terms.

How your data is protected

Access to your case runs through a private, high-entropy link, and the access tokens are stored only as one-way hashes, never in plain text. Your report files are kept in private storage and served only through your private link. Case data is accessible only server-side, never openly on the web.

Separation of identity

Your research case is keyed to a random case ID, and in our database your email is stored separately from it, in a mapping used to deliver and recover your link. This is data minimization, not anonymization: because that mapping exists, we can connect a case back to the email that bought it, and your intake is detailed even without a name. When you submit your intake, we also send ourselves an internal research email, to our own operator inbox, that brings your email together with your intake answers so a person can prepare and deliver your report. That email is held only by us and is removed when you ask us to delete your data.

Retention

We keep your case data (your intake, your delivered report, and support messages), and the internal research emails described above, for as long as needed to deliver the service and let you return to your report during your application cycle. We do not currently run automated scheduled deletion; you can ask us to delete your data at any time through our contact page, and we will remove the case data we hold and the internal research emails that contain your email and intake. Two things sit outside that deletion: payment records held by Stripe, which we keep as required for tax and accounting, and any copy already processed by the research provider, which is governed by that provider's own retention. Deleting your data also ends your ability to recover your link.

Your choices

You can recover your private link on the recovery page using your checkout email, and you can request access to or deletion of your data through our contact page.

Children

ApplySlate is intended for use by adults (18+) and does not require a student's identity. It is not directed to children under 13.

Changes and contact

We may update this policy; the effective date above reflects the current version. Questions can be sent through our contact page.