Identity
Scholiad is operated by Scholiad Inc., a corporation incorporated under the Business Corporations Act (Ontario), Canada (corporation #1001606253), located in Hamilton, Ontario. Our operating jurisdiction is Ontario, Canada. For any privacy-related question, contact us at [email protected]. All references to "we", "us", "our", or "Scholiad" in this Policy refer to Scholiad Inc.
Data we collect
We collect the following categories of information when you use Scholiad:
Minimum age: Scholiad is intended for individuals who are at least 18 years of age, or who have reached the age of majority in their jurisdiction. By creating an account you confirm you meet this threshold.
- Account data: email address (required for authentication), display name (optional), institutional affiliation (optional, free text). - Profile data: research interests, academic discipline, career stage, search preferences. You author this content; we store it scoped to your account. - Behavioral data: which opportunities you view, save, or dismiss within Scholiad. We use this only to improve your own match results. It is not shared with other users or third parties, and is not used to train AI models. - Payment metadata: subscription tier, billing status, and a payment-processor customer ID. Card numbers and CVV are never stored on Scholiad servers; payment processing is handled exclusively by our third-party payment processor, which acts as merchant of record.
Data we do NOT collect
We deliberately do not collect:
- Cross-site browsing history outside Scholiad - Third-party advertising or marketing tracker data - Social-graph data (your contacts, network, or relationships) - Browser fingerprinting data beyond what is required for session authentication and CSRF protection
Data retention
User-authored content (profile, saved opportunities, search history) is retained while your account is active. When you initiate account deletion (a GDPR right of erasure or CCPA right to delete), your data enters a 90-day soft-delete window. During this window you may restore your account by signing in. After 90 days, your data is hard- purged from production systems, with the exception of legally-required billing records (retained for the period required by tax authorities in the operating jurisdiction).
Backup snapshots may retain deleted data for up to 90 days as part of disaster recovery; backups are encrypted at rest and access-controlled.
Encryption
Data at rest is encrypted at the infrastructure level by our hosting provider, with access controls. Data in transit between your device and Scholiad servers is protected by transport encryption (HTTPS/TLS). Authentication tokens are stored as opaque session identifiers managed server-side. They cannot be decoded or used outside your browser session.
No-sale commitment
Scholiad does not sell, lease, rent, or otherwise transfer your personal data, profile information, or aggregated search behavior to any third party for monetary or other valuable consideration. We have no advertising network integration, no data broker relationships, and no marketing-data syndication.
Scholiad does not use your authored content (profile data, search queries, free-text inputs) to train AI models, and our AI providers are contractually bound not to train on your content. They process it only to compute responses for your own session, never to improve models that benefit other users or third parties. If a provider's data-use commitment changes materially, we will notify you and update this Policy before the change takes effect.
GDPR rights (EU + UK users)
If you are in the European Union, the United Kingdom, or another jurisdiction with comparable data protection law, you have the following rights under the General Data Protection Regulation:
- Access: request a copy of personal data we hold about you - Rectification: correct inaccurate personal data - Erasure (right to be forgotten): delete your account and data - Portability: receive your data in a structured, machine-readable format - Restriction: limit how we process your data - Objection: object to processing for legitimate-interest grounds
To exercise these rights, contact [email protected]. We will respond within 30 days.
CCPA rights (California users)
California residents have the following rights under the California Consumer Privacy Act:
- Right to know: what personal information we collect, use, and disclose - Right to delete: request deletion of personal information - Right to opt-out of sale: not applicable — we do not sell data (see §VI) - Right to non-discrimination: we will not discriminate against you for exercising CCPA rights
To exercise CCPA rights, contact [email protected].
Subprocessors
Scholiad uses the following third-party processors to deliver service. Each subprocessor is bound by contract to protect your data consistent with this Policy:
- Anthropic — AI matching and advisor (feedback) features. Anthropic receives the opportunity text and the draft you submit for the feature (for example your CV or document text). Before it is sent, your surname and contact details (email, phone, postal code, links) are removed; your first name is kept so the feedback can address you. Your stored document is unchanged — it keeps your full name. Anthropic does not retain or train on this content under its API data-use terms. - Google — AI provider (used as a fallback or per administrator configuration). When active, it receives the same content as Anthropic, redacted the same way (surname and contact details removed; first name kept; your stored document unchanged). Data handling is governed by Google Cloud AI terms, which do not permit training on your content. - Payment processor (merchant of record) — payment processing. Our third-party payment processor receives card data directly from your browser; Scholiad never sees raw card data. It acts as reseller, handling tax and payment compliance. - Postmark — transactional email delivery (magic-link auth, welcome email, saved-search alerts). Postmark receives your email address and the message content; it does not use this data for advertising or profiling. - Railway — hosting and infrastructure. Railway hosts the Scholiad application servers; all data at rest is encrypted per Railway's infrastructure terms.
Subprocessor list will be updated when material changes occur.
Updates to this Policy
For material changes (e.g., new categories of data collection, new subprocessors, new retention periods), we will provide 30 days' notice via email and in-app notification before the changes take effect. For minor clarifications and editorial updates, we will update the "Last updated" date and post the revised Policy. An archive of prior versions is maintained for transparency.
## Cross-references
- Terms of Service (/terms)
- Cookie Policy (/cookies)
Version 1.0 · 2026