Your documents are not an advertising product.

ScholarAuto is operated by Ermaz LLC, a Wyoming limited liability company, which is the controller of the personal data described here. Questions about this notice, or any request about your own data, go to support@scholarauto.com. A request about your own data is answered within 30 days.

Your dossier: identity details, education, tests, experience, the documents you upload, stories you write, referee contacts you add, and the applications you prepare. Each is collected for one reason — to check your eligibility against a provider’s published rules and to prepare what that provider permits.

Some of it is sensitive by nature. Identity documents establish who you are; transcripts establish what you have studied; questions about disability, financial circumstances or refugee status exist only because providers write eligibility rules about them. Every one of those optional attributes can be left unanswered, and each is used only for a specific published criterion — never for profiling, scoring or advertising.

The legal basis is your agreement to use the service and the necessity of processing to do what you have asked. Where a sensitive attribute is involved, the basis is your explicit consent, given by choosing to answer, and you may withdraw it by removing the answer.

• All traffic is encrypted in transit.
• Documents are held in private storage and are never served from a public URL. Every request for a file is checked against the signed-in owner before a single byte is returned.
• Sessions use secure, HTTP-only cookies. You can list every active session and revoke any of them from Settings.
• Sensitive actions — enabling autopilot, deleting your account — require a fresh confirmation by email code or passkey, valid for ten minutes.
• No advertising trackers run anywhere on this site.

Sign-in codes sent by email

10 minutes, then they stop working

Confirmation for a sensitive action

10 minutes, after which it is asked for again

A signed-in session

30 days, or until you revoke it

A link you share with someone you trust

The period you choose when creating it (14 days by default), or until you revoke it

Documents you delete

Removed from storage when you empty the trash; the file itself is deleted, not hidden

Your dossier, documents, facts and drafts

Until you delete them or delete your account

Receipts for applications actually submitted on your behalf

Kept after account deletion, because they are the evidence of what was sent and when; they are listed for you before you confirm deletion

ScholarAuto uses the services below to operate. Each is bound to process data only on instruction, and none is permitted to use your documents for its own purposes.

Railway

Hosting and the database. Everything stored in your account, at rest in a managed database and file volume.

OpenAI

Reading and translating documents you upload. The page images and text of documents you upload, at the moment they are read.

Resend

Sending sign-in codes and notification emails. Your email address and the contents of those messages.

Google

Signing in with Google, if you choose it. Your email address and Google account identifier — only if you use that option.

Beyond these, your dossier goes to a scholarship provider only as part of an application you authorised, and only the parts that application asks for.

These services operate outside your country, so using ScholarAuto involves transferring your data internationally — including to the United States and the European Union. Transfers rely on the standard contractual protections those providers offer. If that is not acceptable to you, do not upload documents.

You can see, correct, export and delete what is held about you. Export produces everything in your account as JSON, from Settings. Deletion removes your dossier, facts and uploaded files; what is retained afterwards is listed for you before you confirm.

Depending on where you live, you may also have the right to object to processing, to restrict it, to withdraw consent, and to complain to your data protection authority. Exercise any of these by writing to support@scholarauto.com. You will not be charged, and you will not be asked why.

Applying through a provider’s own portal means leaving ScholarAuto and entering a system this notice does not govern. What that provider does with your application is covered by their privacy notice, not this one.

Referees you name are contacted by email. They are told who asked and what for, and they see only what the reference requires — never your dossier. When you share a document with someone you trust, they see that one document and nothing else, for as long as the link lasts.

ScholarAuto is not intended for children under 16, and an account should not be created for one. Where an applicant is under 18 and a provider requires a parent’s or guardian’s involvement, that consent is a matter between the applicant and the provider. If you believe a child has created an account, write to the address above and it will be removed.

• Applicant data is not sold, and never will be.
• Your documents are not used to train models.
• Your dossier is not shared with providers beyond the applications you authorise.
• No decision about you is made by automation alone without a way to ask for review.

When this notice changes materially, the effective date at the top changes and you are told before the change applies to you. Continuing to use ScholarAuto after that means accepting the new version; if you would rather not, export your data and delete your account.

See also the terms and what ScholarAuto will and will not do on your behalf.