Privacy Policy

Who we are

MeritPlaybook is operated by Paul Takisaki as a sole proprietorship based in the United States. You can reach us any time through the contact page. This policy explains what information we collect when you visit the site or purchase a playbook, how we use and protect that information, and what rights you have over it.

By using the site or purchasing a playbook, you agree to this policy and our Terms of Service.

The short version

We collect the information you give us so we can build your playbook. We never sell or rent your data and never share it with data brokers. Your intake answers are used only to build your playbook, never for advertising. Like most sites, we do use analytics and ad-measurement tools (Google Analytics and the Meta Pixel) that collect data about your visit; the Cookies, analytics, and advertising section below explains what they collect and how to opt out. We share data only with the providers needed to run the business (listed below). You can ask us to export, correct, or delete your data at any time.

Information we collect

From you, when you purchase. Your first name, last name, and email address. Payment details (including card number, billing address, and the last four digits of your card) are collected and processed by Stripe; we never see or store your card number.

From you, when you complete the intake. Academic information (GPA, test scores, class rank, honors, coursework), educational background (school, grade level, graduation year, target colleges, school preferences), geographic information (home state, county, city, area type), intended field of study, extracurriculars, leadership roles, community service hours, and awards. You may also optionally share information about identity and demographics, faith background, athletics, music and the arts, military or service connections, family background, financial situation, heritage and cultural background, affiliations and memberships, and life circumstances. Every optional field is genuinely optional and exists to help match the student to scholarships with matching eligibility criteria.

Automatically, when you visit the site. Your IP address, browser type, device type, pages visited, timestamps, and cookie identifiers, collected through our hosting provider, Google Analytics, and the Meta Pixel (described under Cookies, analytics, and advertising below). This is used to keep the site running, prevent abuse, understand which pages are useful, and measure the performance of our own advertising.

From your browser.We save your intake draft in your browser’s local storage so you don’t lose work if you close the tab. This data stays on your device until you clear it.

From the contact form or a waitlist. The name, email, and message you send, or the email address you provide to join a waitlist (for example, the School Snapshot waitlist).

From you, when you run a free Merit Check. Your email address, the school you checked, your student’s unweighted GPA range and test score range (ranges only, never exact values), your state, your student’s high school graduation year, and the result we showed you. We deliberately do not ask for or store the student’s name with a Merit Check. We use this to save your result to your email and to send you school-specific deadline and rule updates, which you can unsubscribe from at any time.

Sensitive information

Some intake fields ask for information that is considered “sensitive personal information” under California and other state privacy laws. This includes race or ethnicity, religious or faith beliefs, sexual orientation, disability or health status, information about minor students, and precise details about family income or government benefits (FAFSA, Pell Grant, free or reduced lunch). We collect these fields only because scholarship eligibility often depends on them (for example, scholarships for first-generation students, students of a specific faith, students with a chronic illness, or students from a particular heritage).

All sensitive fields are optional. We use them only to match the student to scholarships. We do not use them to infer additional traits about you, sell them, share them for advertising, or train general-purpose AI models. If you prefer not to share a sensitive attribute, leave the field blank. You can also ask us to delete any sensitive field later.

How we use your information

We use your information only to:

• Process your purchase through Stripe.
• Build and deliver your playbook.
• Send order confirmations, intake links, delivery emails, and (if you request them) revisions or refunds.
• Respond to messages you send through the contact form.
• Save your free Merit Check result to your email and send school-specific deadline and rule updates you can unsubscribe from at any time.
• Detect and prevent fraud, abuse, and spam.
• Understand site traffic and measure the performance of our own advertising (see Cookies, analytics, and advertising below).
• Keep an internal audit log of playbook generation runs for quality assurance and debugging.
• Comply with our legal, tax, and accounting obligations.

We never use your intake answers, sensitive information, or playbook contents for advertising, profiling, or training general-purpose AI models, and we never share them with advertisers. The analytics and ad measurement described below uses data about your site visit, not your intake.

Service providers we share with

We share the minimum information necessary with the following service providers so the business can operate. Except for Google Analytics and Meta, whose roles are described separately below, each is contractually required to protect your information and use it only to provide services to us, and none is permitted to use your data for their own marketing or to train general-purpose AI models.

• Stripe handles payment processing. It receives your name, email, and payment details.
• Supabase provides our database and file storage (hosted on Amazon Web Services). It holds your account record and intake data.
• Vercel hosts the website and provides first-party analytics. It receives the technical request data needed to serve the site.
• Google provides Google Analytics (GA4), which we use to understand site traffic. It receives usage data about your visit (pages viewed, approximate location derived from IP address, browser and device information) tied to analytics cookies.
• Meta (Facebook and Instagram) provides the Meta Pixel and Conversions API, which we use to measure whether our own ads lead to visits and purchases. It receives event data about your visit (page views, checkout and purchase events), cookie identifiers, IP address, browser information, and, when you give us your email address (starting a checkout, completing a purchase, signing up for an offer, or sending the contact form), a hashed version of that email address. Meta processes this data under its own privacy policy and may use it for its own purposes, including ad personalization on its platforms. See Cookies, analytics, and advertising below for how to opt out.
• Resend sends transactional email. It receives your email address and the content of messages we send you (order confirmations, intake links, playbook delivery).
• AI research providers.We use a set of third-party AI providers to surface scholarship candidates and check findings against current school policies. The portion of your intake relevant to each research task is sent to the provider through a developer API. The current list of providers includes OpenAI, Anthropic, Google, Perplexity, and Exa, and may change from time to time. Under current API terms, these providers do not use your inputs to train their general-purpose models. None of them receive payment details; Stripe handles payments separately. You can review each provider’s privacy terms on its website.

Selling and “sharing” of personal information

We do not sell your personal information for money, and we never sell or share your intake answers, sensitive information, or playbook contents with anyone for advertising.

Our use of the Meta Pixel and Conversions API to measure our own ads sends identifiers and internet-activity data about your visit to Meta. Under the California Consumer Privacy Act and similar state laws, this may be considered “sharing” personal information for cross-context behavioral advertising. You have the right to opt out of this sharing at any time; see Cookies, analytics, and advertising below for how.

Cookies, analytics, and advertising

Functional cookies and local storage. We use a short-lived first-party cookie (mp_pixel_ic) during checkout to prevent double-counting when you return from payment, and local storage to autosave your intake draft and remember whether you have dismissed a popup. These stay on your device and are not used to track you across other sites.

Analytics and advertising measurement. We use two third-party measurement tools:

• Google Analytics (GA4) helps us understand site traffic: which pages are visited, where visitors roughly come from, and which content is useful. It sets first-party analytics cookies (_ga and related identifiers).
• Meta Pixel and Conversions API measure whether our own ads on Facebook and Instagram lead to visits and purchases. The pixel sets the _fbp cookie (and _fbc if you arrive from a Meta ad) and sends page views, checkout events, and purchase events to Meta along with your IP address and browser information; when you give us your email address, a hashed version of it is included. We also relay the same events to Meta from our server with a shared event ID so they are not double-counted.

We also run Vercel Analytics, which records aggregate traffic patterns without cookies and does not identify individual visitors.

Your opt-out choices.You can opt out of this measurement in several ways: block or delete cookies in your browser settings; use a content or tracker blocker (the site works fine with one); install Google’s Analytics opt-out browser add-on; adjust the ad preferences in your Facebook or Instagram account settings; or send us a request through the contact form and we will honor it. None of these cookies is required for the site to function.

Do Not Track and Global Privacy Control. The site does not currently respond automatically to DNT or Global Privacy Control (GPC) browser signals. You can opt out of the “sharing” described in this policy using the choices above, including by contacting us directly.

Data retention

We keep your information for as long as needed to operate the business and meet our legal obligations:

• Purchase records (name, email, transaction metadata): up to seven years for tax and accounting purposes.
• Intake form data: kept so we can provide free revisions and updates you may request later. You can ask us to delete it at any time.
• Delivered playbook: kept until you ask us to delete it. You always keep your own copy.
• Contact form and waitlist emails: up to two years, or until you unsubscribe or ask us to delete them.
• Web server logs: up to 90 days. Data held by our analytics and advertising providers is retained on their own published schedules.

Security

We protect your information by transmitting it over HTTPS, storing it in a database with row-level security enabled and no public read or write policies, and restricting access to a server-side credential that only our application can use. Payment details are handled entirely by Stripe, a PCI-DSS Level 1 certified payment processor. We never see or store your card number.

No method of transmission or storage is perfectly secure. If we become aware of a data incident that affects your personal information, we will notify you without unreasonable delay and in any event within the timelines required by applicable state and federal breach notification laws.

Your privacy rights

You have the following rights over the information we hold about you:

• Access. Ask us for a copy of the information we hold about you.
• Correction. Ask us to fix information that is wrong.
• Deletion. Ask us to delete information we hold about you, subject to legal retention requirements.
• Portability. Ask us to send you your information in a common, machine-readable format.
• Limit use of sensitive information. Ask us to use sensitive fields only to match the student to scholarships, which is the purpose they were collected for.
• Opt-out of sales or cross-context advertising.We do not sell your data for money. You can opt out of the ad-measurement “sharing” described above at any time (see Cookies, analytics, and advertising).
• No retaliation. We will not charge you more or give you a worse product because you exercised a privacy right.

To exercise any of these rights, send a request through our contact form from the email address on your account. We will respond within 45 days. We may ask for reasonable verification that you are the person you say you are before acting on a request that involves copies, corrections, or deletions.

California residents

California residents have the rights listed above under the California Consumer Privacy Act (CCPA) and related laws. For the twelve months preceding this policy:

• The categories of personal information we collected are: identifiers (name, email), commercial information (purchase history), internet or network activity (browsing on our site), approximate geolocation (state, county, and city only), sensitive information that you chose to provide, inferences drawn to match you to scholarships, and education information.
• The sources were: you directly, your browser, and our service providers.
• The purposes were: delivering the playbook you purchased, operating the business, preventing fraud, and complying with law.
• The categories disclosed to service providers are listed under “Service providers we share with” above.
• We did not sell personal information for money. As described above, our use of the Meta Pixel may be considered “sharing” identifiers and internet-activity data for cross-context behavioral advertising; you can opt out as described under Cookies, analytics, and advertising. We did not knowingly sell or share the personal information of anyone under 16.

You may designate an authorized agent to make a request on your behalf. We may ask for a signed letter of permission.

California also has a “Shine the Light” law (Civil Code Section 1798.83) that lets California residents ask about our disclosures of personal information to third parties for their own direct marketing. We do not make such disclosures.

Other state privacy rights

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have substantially similar rights under their state privacy laws. To exercise any of them, contact us the same way described for California residents.

Children and student data

MeritPlaybook is intended for parents, legal guardians, and adults age 18 or older who are planning for college scholarships. We do not knowingly collect personal information from children under 13. If you are under 13, please do not submit any information; ask a parent or guardian to do so on your behalf.

If the student you are planning for is under 18, the purchasing adult represents that they are the student’s parent or legal guardian and consents, on the student’s behalf, to the collection and use of the information in the intake form as described in this policy. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly.

International users

MeritPlaybook is operated from the United States and is intended for US residents. If you access the site from outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from those of your country. By using the site, you consent to this transfer.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated to active customers by email. The “Last updated” date above always reflects the current version. If you do not agree with an update, your remedy is to stop using the service; you can also request deletion of your data.