At a glance
- Who is it for? College-access advisors at the organizations that use the product. It is a professional tool, not a consumer product, and students do not have accounts on it.
- What does the extension read? A defined set of fields from the student record an advisor has open, and on Mainstay the latest conversation messages. It reads only in the advising apps the advisor has turned on: today Mainstay and our own demonstration app. It never sees other tabs or browsing history.
- When is it sent to us? When the advisor opens a student record, to prepare guidance for that student, and when they ask the assistant a question. Student names are shortened to first name and last initial, and Mainstay messages are redacted first (sections 2 and 4).
- What is it used for? Only to help the advisor guide that student. We do not sell data or use it for advertising, we do not train models on it, and our language model providers do not train on it either.
- Who can see it? Our service and the providers listed in section 6. Access to our production systems is limited to two named members of our team, who open stored question and answer records only for a security investigation or a legal obligation.
- How long do you keep it? Questions, answers and the student context sent with them: 90 days, then automatic expiry. Notes an advisor saves: until they are deleted. Backup copies expire within 35 days.
- What about the demonstration app? It holds no real student data. There, our guide service also keeps a record of advising facts about each student, under a pseudonymous identifier, until 400 days after the record was last viewed (section 2.6).
- How do I get data deleted? Write to privacy@advisor-network.org. We acknowledge requests within five business days and complete them within 30 days. Removing the extension from Chrome removes everything it holds on your device.
- I am a student or a parent. Contact the program that advises you. It holds your record, and we help it respond (section 10).
- Our use of this information follows the Chrome Web Store User Data Policy, including the Limited Use requirements (section 5.1).
1. Who and what this covers
This policy applies to The Advisor Network Chrome extension and to the backend services and administration console that support it. It describes how we handle data belonging to three groups:
- Advisors — the staff of organizations who sign in and use the product.
- Students — the young people whose records an advisor views in their own advising system while using the extension.
- Organizations — the nonprofits, districts, and college-access programs whose staff use the product. Today these are founding partners who are evaluating the product and contributing guidance content. No customer agreement has been signed yet.
It does not cover data held in an organization's own systems, which remain the system of record for student data. The student information we hold ourselves is limited to what this policy describes. When an organization becomes a customer, we will handle its student data on its instructions under a written agreement.
2. What the extension collects
2.1 Advisor account data
Name, work email address, role, and organization, provided when the advisor's account is set up. To sign in, the advisor's email address, password, and any multi-factor code are sent to our service, which passes them to our identity provider (Amazon Cognito) to check; we do not store passwords. Sign-in events are recorded with their timestamp, IP address, and browser user agent for security auditing.
2.2 Page context from the advising system
The extension reads pages only in the advising apps an advisor has turned on — currently Mainstay, plus a demonstration app run by us that holds no real student data. The apps it can be turned on for are a fixed list of web addresses built into the extension (section 3), and Chrome asks the advisor to allow each one when they turn it on. It cannot read any other website, it never sees the advisor's other tabs or browsing history, and it never changes anything on the pages it reads. For Mainstay, the organization's workspace must also be approved by The Advisor Network before any student information is read. To check approval, the extension reads the Mainstay workspace identifier from the page and sends it to our service.
On a recognized advising system, the extension reads a defined set of advising-relevant fields, not the page as a whole:
- First name and last initial only.
- Grade level, high school, expected graduation year, enrollment stage, and current or target colleges.
- FAFSA status, milestone status, and application deadlines.
- Academic measures: GPA, SAT/ACT scores, credits completed, and enrollment status, where the record shows them.
- Intended major and college preferences (such as the type and location of college), academic path, whether the student is in their final semester, preferred language, and home location as entered (for example city or state), where the record shows them.
- Student population indicators: first-generation or low-income status, where the advising system records them.
- Contact history (the date and type of each contact, not what was said) and the program's tier for the student, where the record shows them.
- Advisor-recorded notes about barriers, where the record shows them (up to 200 characters each, at most 5). They are sent as written.
- On Mainstay, the most recent messages of the conversation between the program and the student (at most the latest 40 messages and about 4,000 characters), redacted as described in section 4.
On a page of a turned-on app that is not a student record, the extension takes only the page title, the page address, and college-related terms found in the main body text. It does not extract personal fields from such pages, and it does not read form inputs, passwords, or payment fields anywhere.
When a student record is open, the side panel requests that student's preparation guidance and saved summary from us automatically, which sends the student fields listed above (with the name shortened and Mainstay messages redacted, as described in section 4) and the record's address. On our demonstration app, the fields read from the record are also sent to our guide service each time a student record is opened (section 2.6). Other page context is held in the browser's session storage and is attached to a request only when the advisor sends a question to the assistant.
If the advisor selects text on a page of an app they have turned on, the extension may keep up to 500 characters of that selection in the browser's session storage. It is never sent to our servers, and Chrome clears it when the browser closes.
2.3 Questions, answers, and feedback
The question an advisor types, the answer returned, the redacted context that accompanied it, and any rating or comment the advisor submits on that answer. We keep these for 90 days (section 8). We use them to run and secure the service, and to produce automated, aggregated measures of reliability, cost, and gaps in our guidance library. People on our team do not read individual records except as section 5.1 allows.
2.4 Advisor-authored records
Notes, student profiles, action items, and session summaries that an advisor creates in the side panel, which saves them as the advisor works, so their own work carries between sessions. A student profile holds the student's first name and last initial, the record's address, and schools of interest.
2.5 What we never collect
Social Security numbers, government identifiers, financial account or payment data, health data, immigration documents, disciplinary records, transcripts, test score reports (we read only the scores listed in section 2.2), home addresses (the home location field in section 2.2 is read as entered, for example a city or state), and passwords or other credentials entered on the pages the extension reads. (An advisor's own password for The Advisor Network is sent to us only to sign in, as described in section 2.1.) We never extract these as fields. Free text we read (advisor-recorded barrier notes and Mainstay messages) can mention them if someone wrote them there. In Mainstay messages, redaction removes the patterns listed in section 4, such as Social Security, phone, and card numbers; barrier notes are sent as written. Redaction cannot recognize every sensitive topic, such as a mention of health or immigration status. We also do not collect cookies, downloads, clipboard contents, network traffic, or browsing history beyond the address and title of pages on the apps an advisor has turned on, and the extension requests no permission that would let it do so.
The extension and service do not track users across third-party websites, so they do not respond differently to browser Do Not Track signals.
2.6 The guide service and guided mode
On our demonstration app, which holds no real student data, the side panel sends the fields described in section 2.2, without the student's name, to our guide service each time a student record is opened, whether or not guided mode is on. It does so when the advisor's account belongs to a partner organization, or, for our own staff, when they have selected one. The guide service is not used on Mainstay. The guide service keeps a record of advising facts about that student (for example grade level and application and financial-aid milestones) so that guidance stays current between visits. That record excludes direct identifiers such as the student's name and contact details, is kept under a pseudonymous identifier (explained in section 9), and expires automatically 400 days after the student's record was last viewed. Guidance suggestions it prepares expire 400 days after they are prepared. Guided mode is an optional view of that guidance in the side panel, off by default. A guided-mode conversation is kept for 4 hours. The guide service uses language and search models provided through Amazon Bedrock.
3. Permissions the extension requests, and why
The extension has no access to any website when it is installed: every site in the table marked optional is granted separately by the advisor, and access can be removed at any time in Chrome's extension settings. The extension does not request Chrome's tabs or activeTab permissions, so it cannot see the address or title of a tab on any site the advisor has not turned on, and Chrome's install prompt shows no warning about browsing history. It loads no code from outside the extension, and it never changes the pages it reads.
4. Minimization and redaction
Three controls limit what can leave the browser, applied in this order:
- Bounded field extraction. On a recognized advising system the extension reads a defined list of advising-relevant fields, not the whole page.
- Client-side redaction. Before the Mainstay conversation excerpt and any conversation summary leave the browser, a redaction pass removes Social Security numbers, phone numbers, email addresses, credit card numbers, common street-address formats, labelled dates of birth, and labelled passwords, and removes every part of the student's name except the first name. The other fields in section 2.2, such as barrier notes and home location, are sent as the record shows them, except that the student's name is reduced to first name and last initial.
- Server-side redaction. A further pass runs before any question record is written, stripping known student identifiers from the stored question, answer, and context.
Pattern-based redaction is a defense-in-depth measure, not a guarantee of de-identification, and we say so rather than overclaim. The controlling protection is the bounded field set.
5. How we use data, and what we will not do with it
We use the data described above only to provide and improve the product's single purpose, helping advisors guide students through college access: to authenticate advisors, to answer their questions in the context of the student in front of them, to keep their saved notes available, to secure the service, and to measure its reliability and cost and find gaps in our guidance library through automated, aggregated reports.
We do not:
- sell, rent, or trade advisor, organization, or student data;
- transfer it to third parties for any purpose other than the operation of the service described here, or where the law compels us;
- use it for advertising, profiling, or any purpose unrelated to the product's single stated function;
- use it to determine creditworthiness or for any lending purpose;
- use it to train machine learning models. Our language model providers do not train on data submitted through their commercial interfaces.
5.1 Chrome Web Store Limited Use
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
In particular, for data the extension collects:
- we use it only to provide or improve the extension's single purpose described above;
- we transfer it to third parties only as listed in section 6 and as necessary to provide or improve that purpose, to comply with applicable laws, or to protect against malware, spam, phishing, or other fraud or abuse, or as part of a merger, acquisition, or sale of assets with the advisor's explicit prior consent;
- we do not use, transfer, or sell it for personalized advertising, we do not transfer or sell it to advertising platforms, data brokers, or other information resellers, and we do not use, transfer, or sell it to determine creditworthiness or for lending purposes;
- people on our team do not read it unless the advisor has explicitly agreed to that for specific data, it has been aggregated and anonymized for our internal operations, it is needed for security purposes such as investigating abuse, or it is needed to comply with applicable laws. Access to our production systems is limited to two named members of our team, who open stored question and answer records only for a security investigation or a legal obligation.
6. Who else processes the data
We will update this list before any new provider receives student or advisor data, and we will tell the organizations whose staff use the product.
7. Where data is stored, and how it is protected
All platform data is stored in Amazon Web Services in the US East (Ohio) region, in an AWS account dedicated to that environment. Development, staging, and production are separate accounts with no shared credentials.
- In transit: TLS 1.2 or higher on every connection, browser to service and service to service.
- At rest: server-side encryption on every database table and storage bucket, with point-in-time recovery enabled in production.
- Authentication: Amazon Cognito, with a separate user pool for each partner organization. Multi-factor authentication is supported and can be required at the organization level.
- Isolation: every request carries a signed token identifying the user and their organization, and every read and write is scoped to that organization on the server. Users at one organization have no path to another organization's data. Only our own platform administrators can act across organizations, to support the product and keep it secure.
- Staff access: production access is limited to two named members of our team, through single sign-on with multi-factor authentication. Deployments use short-lived credentials; no long-lived access keys exist in the deployment path.
- Secrets are held in managed secret storage, never in source control.
8. How long we keep it
Automatic expiry is enforced by the storage layer itself rather than by application code, so it continues to apply whether or not our services are running. Expired records are deleted automatically shortly after their expiry date.
9. Access, correction, deletion, export, and other requests
You can ask for a copy of, or a correction to, the personal data we hold about you. We may need to verify your identity, or confirm the request with your organization, before acting on it. Requests go to privacy@advisor-network.org and are acknowledged within five business days. Each request is completed within 30 days of the day we receive it.
A pseudonymous identifier is a code we derive with a secret key we hold. It does not contain a name or email address, but it is not anonymous: we can confirm a match if we are given the identity it stands for, which we do only to answer a security or legal question.
Content an organization adds to our guidance library, which may name its staff, is managed by that organization. We remove it when the organization asks or when it leaves.
After removal, data may remain in backup copies, which expire automatically within 35 days and are never restored to undo a deletion. Logs, other than security audit logs, expire after 90 days and are deleted automatically shortly after. Security audit logs of account administration record an internal account identifier, not your name or email address, and are kept longer to protect the service.
We keep a record of each request so that we can show it was completed. It holds the identifiers in the request only as keyed one-way fingerprints, which cannot be turned back into a name or email address, and it is kept after the request is completed.
Data covered by an automatic expiry in section 8 requires no request. On the advisor's device, the extension's caches are cleared when the advisor signs out, and so is the email address it remembers to fill in the sign-in form. Removing the extension from Chrome removes everything it holds locally.
10. Students, families, and FERPA
Students do not have accounts on the platform, and we do not market to students or families. We handle student information on behalf of the organizations whose advisors use the product, some of which are themselves subject to the Family Educational Rights and Privacy Act (FERPA). Our founding partners are evaluating the product, and no customer agreement has been signed yet. Because we keep student information only as this policy describes, redact it before it leaves the browser, and expire question records on a 90-day schedule, we are positioned to operate within an organization's FERPA obligations. On request, we will sign a data processing agreement that lets an organization treat us as a school official under FERPA. It places our use of student records under the organization's direct control and bars any further disclosure except as the agreement allows. Requests from a student or family about their own data should go to the organization that advises them, which holds the record; we support that organization in responding. If you cannot reach the organization, write to privacy@advisor-network.org and we will work with it to respond.
The product is for adult professional staff and is not directed to children. We do not knowingly collect personal information directly from a child under 13. Student information reaches us through the advisor and their organization, not from the student.
We have not completed a SOC 2 audit, and we state that directly rather than imply an attestation we do not hold.
11. If something goes wrong
If we become aware of an incident affecting organization or student data, we contain it and preserve evidence, notify the affected organization's designated contact within 72 hours of confirming the incident with what we know at that point, provide a written account of scope, cause, affected data, and remediation once the investigation concludes, and support the organization in any notification obligation it carries.
12. Changes to this policy
Material changes are posted here and communicated to the contacts at organizations using the product before they take effect. The version and effective date at the top of this page identify the current revision.
Version history: version 2.0, effective 11 October 2026, replaces version 1.0.
The Advisor Network
Privacy inquiries and data requests: privacy@advisor-network.org
Policy owner: Toby Jackson