Privacy Policy

Who we are

MeritPlaybook is operated by Paul Takisaki as a sole proprietorship based in the United States. You can reach us any time through the contact page. This policy explains what information we collect when you visit the site or purchase a playbook, how we use and protect that information, and what rights you have over it.

By using the site or purchasing a playbook, you agree to this policy and our Terms of Service.

The short version

We collect the information you give us so we can build your playbook. We never sell or rent your data, never use it for advertising, and never share it with data brokers. We share data only with the service providers needed to run the business (listed below). You can ask us to export, correct, or delete your data at any time.

Information we collect

From you, when you purchase. Your first name, last name, and email address. Payment details (including card number, billing address, and the last four digits of your card) are collected and processed by Stripe; we never see or store your card number.

From you, when you complete the intake. Academic information (GPA, test scores, class rank, honors, coursework), educational background (school, grade level, graduation year, target colleges, school preferences), geographic information (home state, county, city, area type), intended field of study, extracurriculars, leadership roles, community service hours, and awards. You may also optionally share information about identity and demographics, faith background, athletics, music and the arts, military or service connections, family background, financial situation, heritage and cultural background, affiliations and memberships, and life circumstances. Every optional field is genuinely optional and exists to help match the student to scholarships with matching eligibility criteria.

Automatically, when you visit the site. Your IP address, browser type, device type, pages visited, and timestamps, collected through our hosting provider and first-party analytics. This is used to keep the site running, prevent abuse, and understand which pages are useful.

From your browser.We save your intake draft in your browser’s local storage so you don’t lose work if you close the tab. This data stays on your device until you clear it.

From the contact form or a waitlist. The name, email, and message you send, or the email address you provide to join a waitlist (for example, the School Snapshot waitlist).

Sensitive information

Some intake fields ask for information that is considered “sensitive personal information” under California and other state privacy laws. This includes race or ethnicity, religious or faith beliefs, sexual orientation, disability or health status, information about minor students, and precise details about family income or government benefits (FAFSA, Pell Grant, free or reduced lunch). We collect these fields only because scholarship eligibility often depends on them (for example, scholarships for first-generation students, students of a specific faith, students with a chronic illness, or students from a particular heritage).

All sensitive fields are optional. We use them only to match the student to scholarships. We do not use them to infer additional traits about you, sell them, share them for advertising, or train general-purpose AI models. If you prefer not to share a sensitive attribute, leave the field blank. You can also ask us to delete any sensitive field later.

How we use your information

We use your information only to:

• Process your purchase through Stripe.
• Build and deliver your playbook.
• Send order confirmations, intake links, delivery emails, and (if you request them) revisions or refunds.
• Respond to messages you send through the contact form.
• Detect and prevent fraud, abuse, and spam.
• Keep an internal audit log of playbook generation runs for quality assurance and debugging.
• Comply with our legal, tax, and accounting obligations.

We do not use your information for advertising, profiling, third-party sharing (other than the service providers listed below), or training general-purpose AI models.

Service providers we share with

We share the minimum information necessary with the following service providers so the business can operate. Each is contractually required to protect your information and use it only to provide services to us. None is permitted to use your data for their own marketing or to train general-purpose AI models.

• Stripe handles payment processing. It receives your name, email, and payment details.
• Supabase provides our database and file storage (hosted on Amazon Web Services). It holds your account record and intake data.
• Vercel hosts the website and provides first-party analytics. It receives the technical request data needed to serve the site.
• Resend sends transactional email. It receives your email address and the content of messages we send you (order confirmations, intake links, playbook delivery).
• AI research providers.We use a set of third-party AI providers to surface scholarship candidates and check findings against current school policies. The portion of your intake relevant to each research task is sent to the provider through a developer API. The current list of providers includes OpenAI, Anthropic, Google, Perplexity, and Exa, and may change from time to time. Under current API terms, these providers do not use your inputs to train their general-purpose models. None of them receive payment details; Stripe handles payments separately. You can review each provider’s privacy terms on its website.

We don’t sell or share for advertising

We do not sell your personal information. We do not “share” it for cross-context behavioral advertising as that term is defined under the California Consumer Privacy Act and similar state laws. We do not set third-party advertising cookies and do not participate in ad networks.

Cookies and local storage

We use a small number of first-party cookies and local storage entries to keep the site working: session cookies for checkout and intake, and local storage to autosave your intake draft. We also run Vercel Analytics, which records aggregate traffic patterns using first-party storage and does not identify individual visitors.

We do not use Google Analytics, Facebook Pixel, TikTok Pixel, LinkedIn Insight, or any other cross-site advertising or profiling technology.

Do Not Track and Global Privacy Control. Because we do not sell or share personal information for cross-context behavioral advertising and do not run third-party advertising on the site, there is nothing to opt out of from a DNT or Global Privacy Control (GPC) signal. We honor those signals by default by not engaging in the practices they cover.

Data retention

We keep your information for as long as needed to operate the business and meet our legal obligations:

• Purchase records (name, email, transaction metadata): up to seven years for tax and accounting purposes.
• Intake form data: kept so we can provide free revisions and updates you may request later. You can ask us to delete it at any time.
• Delivered playbook: kept until you ask us to delete it. You always keep your own copy.
• Contact form and waitlist emails: up to two years, or until you unsubscribe or ask us to delete them.
• Web server and analytics logs: up to 90 days.

Security

We protect your information by transmitting it over HTTPS, storing it in a database with row-level security enabled and no public read or write policies, and restricting access to a server-side credential that only our application can use. Payment details are handled entirely by Stripe, a PCI-DSS Level 1 certified payment processor. We never see or store your card number.

No method of transmission or storage is perfectly secure. If we become aware of a data incident that affects your personal information, we will notify you without unreasonable delay and in any event within the timelines required by applicable state and federal breach notification laws.

Your privacy rights

You have the following rights over the information we hold about you:

• Access. Ask us for a copy of the information we hold about you.
• Correction. Ask us to fix information that is wrong.
• Deletion. Ask us to delete information we hold about you, subject to legal retention requirements.
• Portability. Ask us to send you your information in a common, machine-readable format.
• Limit use of sensitive information. Ask us to use sensitive fields only to match the student to scholarships, which is the purpose they were collected for.
• Opt-out of sales or cross-context advertising. We do not engage in either, but you are always free to tell us not to.
• No retaliation. We will not charge you more or give you a worse product because you exercised a privacy right.

To exercise any of these rights, send a request through our contact form from the email address on your account. We will respond within 45 days. We may ask for reasonable verification that you are the person you say you are before acting on a request that involves copies, corrections, or deletions.

California residents

California residents have the rights listed above under the California Consumer Privacy Act (CCPA) and related laws. For the twelve months preceding this policy:

• The categories of personal information we collected are: identifiers (name, email), commercial information (purchase history), internet or network activity (browsing on our site), approximate geolocation (state, county, and city only), sensitive information that you chose to provide, inferences drawn to match you to scholarships, and education information.
• The sources were: you directly, your browser, and our service providers.
• The purposes were: delivering the playbook you purchased, operating the business, preventing fraud, and complying with law.
• The categories disclosed to service providers are listed under “Service providers we share with” above.
• We did not sell or share personal information for cross-context behavioral advertising, and we did not knowingly sell or share the personal information of anyone under 16.

You may designate an authorized agent to make a request on your behalf. We may ask for a signed letter of permission.

California also has a “Shine the Light” law (Civil Code Section 1798.83) that lets California residents ask about our disclosures of personal information to third parties for their own direct marketing. We do not make such disclosures.

Other state privacy rights

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have substantially similar rights under their state privacy laws. To exercise any of them, contact us the same way described for California residents.

Children and student data

MeritPlaybook is intended for parents, legal guardians, and adults age 18 or older who are planning for college scholarships. We do not knowingly collect personal information from children under 13. If you are under 13, please do not submit any information; ask a parent or guardian to do so on your behalf.

If the student you are planning for is under 18, the purchasing adult represents that they are the student’s parent or legal guardian and consents, on the student’s behalf, to the collection and use of the information in the intake form as described in this policy. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly.

International users

MeritPlaybook is operated from the United States and is intended for US residents. If you access the site from outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from those of your country. By using the site, you consent to this transfer.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated to active customers by email. The “Last updated” date above always reflects the current version. If you do not agree with an update, your remedy is to stop using the service; you can also request deletion of your data.