We at AdmitHub PBC, d.b.a. Mainstay and our affiliates (“Mainstay”, “we”, “us”, or “our”) have created this privacy policy (“Chatbot Privacy Policy”) to describe how we collect and use Personal Information (defined below) from and about the students and end users (“Users”, “you”, “your”) who use our Service (as defined below) to interface with and communicate with the universities, colleges and organizations that use the Mainstay platform (our “Partners”) and the choices that you have with regard to how we use your information.

This Privacy Policy applies to Users’ use of mobile features, applications and any other interactive features or services owned or controlled by Mainstay (each, a “Service” and collectively, the “Services”). Certain features discussed in this Privacy Policy may not be offered on each Service at any particular time.  This Chatbot Privacy Policy does not apply to our general privacy practices, such as information collected through our web site or our Partners’ use of the Services; these activities are governed by our general Privacy Policy, available at mainstay.com/legal/privacypolicy.

This Chatbot Privacy Policy explains what Personal Information (defined below) we collect from or about Users, how we use and share that information, and your choices concerning our data practices. Additional information for California residents may be found here. This Chatbot Privacy Policy is incorporated into and forms part of our Chatbot Terms of Use.

Before using the Service or submitting any Personal Information to us, please review this Chatbot Privacy Policy carefully and contact us if you have any questions. By using the Service, you agree to the practices described in this Chatbot Privacy Policy. If you do not agree to this Chatbot Privacy Policy, please do not use the Service.

1.         PERSONAL INFORMATION COLLECTION.

Through providing the Services, we may collect information that, alone or in combination with other reasonably available information, can reasonably identify or relate to a specific individual or household (“Personal Information”) as follows:

1.1       Information You Provide: We collect Personal Information you provide when you interact with Services to communicate with a Partner, such as by chatting with a bot provided on a Partner’s website or sending text messages to a Partner using our Services. This Personal Information includes information you provide during these interactions, such as your name, email address, phone number, physical address or zip code, demographic information (such as your school, gender, age or birthdate), and information about your interests and preferences.

Note that our Chatbot will only ever ask for your name, email address and phone number; any other Personal Information you provide is at your own discretion and not required for your use of the Services. We may combine the information we collect from you through Services with other Personal Information we have about you as described in this Chatbot Privacy Policy. Any information combined with Personal Information will be treated as Personal Information.

1.2       Information Provided By Our Partners: Our Partners enter your Personal Information into the Services so that they may communicate with you via the Services. This Personal Information includes, but is not limited to, your name, email address, phone number, and any other Personal Information our Partners may choose to provide.

1.3       Third Party Services: Our Services may be made available on the web sites of our Partners or other third parties, such as Facebook. Our Services may also include links to web sites or services hosted by third parties, such as chat rooms or group counseling sessions, through which you may communicate directly with third parties and/or other Users. We only collect information regarding your interaction with the Services and do not gather information from the third party sites regarding your interactions with the third parties or other Users on those services.

The information we collect is subject to this Chatbot Privacy Policy. The information collected and stored by the third party remains subject to the third party’s privacy practices, including whether the third party shares information with us, the types of information shared, and your choices with regard to what is visible to others on that third party web site and service. For more information about third-party content and services, click here.

1.4       Information Third Parties May Provide About You:  To the extent permissible by law, we also may supplement the information we collect with outside records from third parties, such as schools, universities, organizations, services, and institutions that are not our Partners, in order to provide you with information, services or goods you have requested, to enhance our ability to serve you, to tailor our content to you and to offer you opportunities that we believe may be of interest to you. We may combine the information we receive from those other sources with information we collect through the Services. In those cases, we will apply this Chatbot Privacy Policy to the combined information.

1.5       Information Collected Automatically: Depending on the Service used, we and certain service providers may automatically collect “Usage Information” when you access and use the Services online. To do so, we automatically assign and collect a unique identifier (“Device Identifier”) for any computer, mobile phone or other device (any, a “Device”) you may use to access the Services online so that our servers can recognize your Device. The Usage Information we automatically collect based on your Device Identifier include details of your online interaction with the Services, such as when and what messages you send and receive via the Services online. Usage Information is generally non-identifying, but if we associate it with you as a specific and identifiable person, we treat it as Personal Information.

Usage Information is automatically collected via tracking technologies, including:

Cookies: Cookies are small text files stored on your Device that allow us to recognize your Device and personalize the content of our Services. For more details on cookies please visit All About Cookies. Our Services may utilize Cookies to store your Device Identifier to improve your current and future experience by allowing us to understand your usage of our Services and recognize you if you return to our Services. Cookies can be turned off via your browser settings if you so choose. However, if you turn your cookies off, some features of our Services may not function properly.

An Embedded Script: We and service providers may use an embedded script, which is programming code that is designed to collect information about your interactions with the Services, such as the links you click on. The code is temporarily downloaded onto your Device from our server or that of a service provider, and is deactivated or deleted when you disconnect from the Services.

HTML5: We use Local Storage Objects (“LSOs”) such as HTML5 to store content, information and preferences, such as the messages you exchanged with the Services, to optimize the performance of the Services and provide certain features. Various browsers may offer their own management tools for removing HTML5 LSOs.

2 OUR USE OF YOUR INFORMATION.

We may use information about you, including Personal Information, to: (1) allow you to participate in the Services, including, without limitation, to respond to your questions, complaints or comments; (2) tailor content, recommendations and offers we display to you on the Services; (3) provide you with information, products, services, or suggestions you request; (4) improve the Services and our products, and for internal business purposes, including the improvement of our AI chat algorithms; (5) contact you with regard to your use of the Services and, in our discretion, changes to our policies; and (6) as described in the Chatbot Privacy Policy or as disclosed at the time you provide your information.

Unless you have explicitly agreed to interact directly with us, such as to receive additional information or services that may be of interest to you, we only use the Personal Information collected via the Services as described above to provide the Services to our Partners.

We may aggregate Personal Information and use the aggregated information to analyze the effectiveness of our Service, to improve and add features to our Service, and for other similar purposes. In addition, from time to time, we may analyze the general behavior and characteristics of users of our Services and share aggregated information like general user statistics with prospective business partners. We may collect aggregated information through the Service, through cookies, and through other means described in this Chatbot Privacy Policy.

3.         INFORMATION SHARING.

We may share your Personal Information, without further notice to you unless required by applicable law, as described below or otherwise in this Chatbot Privacy Policy:

• When You Request That We Share Your Personal Information: Certain Services may include opportunities and features brought to you by a third party or that otherwise involve sharing your information with a third party. If you request or agree at that time to have your information shared, or use an interactive feature, widget, or third-party application, your information will be disclosed to that third party (or parties).  Please note that the third party’s handling of that information will be subject to the privacy policy and practices of that third party.
• Our Partners: Because we provide the Services on behalf of our Partners, we may share your Personal Information with the Partners with whom you are communicating through the Services.
• Service Providers: We will share your Personal Information with unaffiliated entities that provide services to us or our Partners in connection with the Services, such as companies that provide hosting and other IT services, send messages through the Services, or offer customer service.  These service providers are subject to confidentiality obligations which limit their use and disclosure of such information.

• Administrative and Legal Reasons: We may also disclose your information, including Personal Information, in response to a subpoena, court order, or when otherwise required by law; in response to bankruptcy proceedings; to defend our rights; in response to a request from law enforcement; to provide information to a claimed owner of intellectual property who claims that content you have provided to us infringes on their rights; upon request of an academic institution connected to an investigation into academic integrity; to protect and/or defend any applicable Terms of Use or other policies applicable to the Services; or to protect the personal safety, rights, property or security of any organization or individual.
• Business Transitions: Mainstay may share Personal Information with its parent, subsidiaries and affiliates, and investors primarily for business and operational purposes so long as any recipient agrees to comply with this Privacy Policy and applicable law with regard to such Personal Information. In the event that Mainstay goes through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, bankruptcy, or other corporate change, including, without limitation, during the course of any due diligence process, your information, including Personal Information, will likely be among the assets transferred.
• With Your Consent: We may share your Personal Information with third parties with your consent (if permissible under applicable law) provided at the time you provide us with information.

Mainstay does not share your Personal Information with third parties for their marketing purposes without your consent and in compliance with all applicable laws. Mainstay may share non-Personal Information, such as aggregate or de-identified user statistics, demographic information, Usage Information, and related insights with our Partners and third parties, such as other schools and universities, for our marketing purposes.

4. THIRD PARTY ANALYTICS.

Depending on the Service used, we may use Google Analytics, a web analytics service provided by Google, Inc. (“Google”), to provide us with information regarding traffic on the Services, including the pages viewed and the actions Users take when visiting the Services. For more information on how Google uses this data, go to www.google.com/policies/privacy/partners/.

Please note that your browser setting may allow you to automatically transmit a “Do Not Track” (DNT) signal to websites and online service you visit. DNT is a privacy preference that users can set in certain web browsers to inform websites and services that they do not want certain information about their webpage visits collected over time and across websites or online services. However, we do not recognize or respond to browser-initiated DNT signals, as the internet industry is still working to determine what DNT means, how to comply with DNT, and how to create a common approach to responding to DNT. To find out more about “Do Not Track”, please visit http://www.allaboutdnt.com.

5.         MOBILE USE.

If you interact with the Services through a mobile device, it may be possible for you to transmit your mobile Device Identifier, your mobile carrier, or your physical location to Mainstay; however, Mainstay will not track such information in the background. If you transmit such information to Mainstay, we may store or use that information in compliance with this Chatbot Privacy Policy. You may be able to opt-in to receiving text messages sent using the Services. You may always opt-out by replying “#pause” or “STOP” to one of the text messages received. You also acknowledge and agree that use of the Services through a mobile device may cause data to be displayed on and through your mobile device which may be viewed by your mobile carrier or other access providers.

6.         YOUR RIGHTS.

Depending on where you live and the law governing your Personal Information, you may have certain rights, as described throughout this Chatbot Privacy Policy.  For example, you can opt-out of receiving text messages through the Services by replying “#pause” or “STOP” to one of the messages.  Where we are providing the Services on behalf of our Partners, you must contact the Partner with whom you are communicating if you wish to request access, deletion, or rectification of your information.

For additional information applicable to California residents, please see here.

7.         THIRD PARTY CONTENT AND SERVICES.

Certain content provided through the Services may be hosted and served by third parties, including our Partners. In addition, the Services may link to third party web sites or content over which Mainstay has no control and which are governed by the privacy policies and business practices of those third parties. Please also note that Mainstay content and widgets may be included on web pages and web sites that are not associated with us and over which we have no control. These third parties may independently collect data. Mainstay is not responsible or liable for the privacy practices or business practices of any third party.

8.         SECURITY.

Mainstay take data security very seriously. Mainstay takes commercially reasonable technical, physical, and administrative security measures to protect the Personal Information submitted to us, both during transmission and once we receive it. Such measures vary depending on the sensitivity of the information at issue. Please note that no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially reasonable means to protect your Personal Information, we cannot guarantee its absolute security. In the event that Mainstay becomes aware of a data breach impacting your Personal Information, we will provide notification in compliance with all applicable laws. If you have any questions about security on our Services, you can email us by clicking here.

9.         INTERNATIONAL USERS.

The Services are operated in the United States and intended only for Users located in the United States. However, if you access the Site or the Services from outside of the United States, please be aware that information we collect will be transferred to and processed in the United States. By using the Services, submitting any information on the Site, or otherwise providing us with any information, you fully understand and acknowledge this transfer, processing and storage of your information in the United States. We rely on our EU-U.S. Data Privacy Framework (DPF) certification to transfer Personal Information that we receive from the EU and the United Kingdom (UK) to Mainstay in the U.S. (for more information, please read the “EU-U.S. Data Privacy Framework (DPF)” section below). For information on our Data Privacy Framework certification, please see our general Privacy Policy.

10.       EU-U.S. Data Privacy Framework

Data Privacy Framework (DPF) Compliance. Mainstay complies with the EU-U.S. DPF as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Information transferred from the EU and the UK to the United States. We have certified to the Department of Commerce that we adhere to the Data Privacy Framework Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability (“Data Privacy Framework Principles”). If there is any conflict between the terms in this Privacy Policy, our Terms of Use and the Data Privacy Framework Principles, the Data Privacy Framework Principles shall take precedence. To learn more about the Data Privacy Framework program, the Data Privacy Framework Principles and to view our certification, please visit www.dataprivacyframework.gov.

Mainstay’s Accountability for Data Processing. As described in the Data Privacy Framework Principles, Mainstay is accountable for Personal Information that it receives and subsequently transfers to third parties. If third parties that process Personal Information on our behalf do so in a manner that does not comply with the Data Privacy Framework Principles, we are accountable, unless we prove that we are not responsible for the event giving rise to the damage.

Choice. You may opt out of (i) the disclosure of your Personal Information to third parties that do not provide services to us and/or (ii) uses of your Personal Information for purposes that are materially different from the purposes for which the Personal Information was collected unless you have authorized such different purposes. To exercise these rights, please contact us at [email protected] as described below.

Access. Users in the EU and the UK have certain rights to access, correct, amend, or delete Personal Information where it is inaccurate, or has been processed in violation of the Data Privacy Framework Principles.

Complaints by EU/UK Individuals. In compliance with the Data Privacy Framework Principles, Mainstay commits to resolve complaints about our collection or use of your Personal Information. EU/UK individuals with inquiries or complaints regarding this Privacy Policy should first contact us via email [email protected] or by writing to us at the following mailing address: 1 Washington Mall #1349, Boston, MA 02108.

Independent Recourse Mechanism. Mainstay has further committed to refer unresolved Data Privacy Framework complaints to BBB EU Data Privacy Framework, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not resolved your complaint, please contact or visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information or to file a complaint. The services of BBB EU Data Privacy Framework are provided at no cost to you.

Arbitration and FTC powers. As further explained in the Data Privacy Framework Principles, binding arbitration before a Data Privacy Framework Panel will also be made available to you in order to address residual complaints not resolved by any other means. Mainstay is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. As described in the “Information Sharing” section of this Privacy Policy, we may share Personal Information to comply with legal and regulatory requirements, which includes the requirement to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

11.       ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS

In accordance with the California Consumer Privacy Act (“CCPA”), this section is intended to inform California residents of (1) the Personal Information that we collect and how we disclose that information, and (2) the privacy rights California residents may have relating to their Personal Information and how those rights can be exercised.

Personal Information Collection and Disclosure

The following disclosures are intended to provide additional information about (1) the categories of Personal Information we collect, and (2) how and to whom we disclose that Personal Information. Nothing in this section limits our ability to use or disclose information as described elsewhere in this Chatbot Privacy Policy.

• Categories of Personal Information Collected: In the past 12 months, we have collected the following categories of Personal Information, as described in greater detail in the “Personal Information Collection” section above:
  • Identification Information, such as your name, email address, phone number, physical address or zip code, and Device Identifier.
  • Demographic Information, such as school, gender, age, or birthdate, as well as information about your interests, activities, and preferences.
  • Communication Information, such as the content of your communications with us and our Partners.
  • Professional and Educational Information, such as the school you attend, or the schools you are considering attending, and information about your academic and work history that you or our Partners provide.
  • Online Activity Information, such as the Device used to access a Service online and the Usage Information regarding that Device’s interaction with the Service, including when and what messages are sent and received via the Service.
• Sources of Personal Information: We collect the above categories of Personal Information from you, our Partners, and as otherwise described in the “Personal Information Collection” section above.
• Purposes of Collection and Disclosure: We collect and disclose the above categories of Personal Information for the business and commercial purposes described in the “Our Use Of Your Information” and “Information Sharing” sections above.
• Categories of Personal Information Disclosed for a Business Purpose: In the past 12 months, we have disclosed for a business purpose all of the above categories of Personal Information to service providers and as described in the “Information Sharing” section above.
• Categories of Personal Information Sold: In the past 12 months, we have not sold your Personal Information.

California Privacy Rights

To the extent provided for by the CCPA and subject to applicable exceptions and exclusions, California residents have the following privacy rights in relation to the Personal Information we collect:

• The right to know what Personal Information we have collected and how we have used and disclosed that Personal Information.
• The right to request deletion of your Personal Information.
• The right to opt out of the sale of your Personal Information. 
• The right to be free from discrimination for the exercise of any of your privacy rights.

Exercising Your Rights: California residents can exercise the above privacy rights by filling out the form here, calling 1 855-955-1920, or emailing us at privacy@@mainstay.com.

Verification: In order to protect your Personal Information from unauthorized access or deletion, we may ask you to provide additional Personal Information for verification.  If we cannot verify your identity, we will not provide or delete your Personal Information.

Authorized Agents: You may submit a request to know or a request to delete your Personal Information through an authorized agent. If you do so, we may require the agent to present signed written permission to act on your behalf and you may also be required to independently verify your identity with us and confirm that you have provided the agent permission to submit the request.

11.       CHANGES TO THIS CHATBOT PRIVACY POLICY.

Mainstay may update this Chatbot Privacy Policy at any time and any changes will be effective upon posting. Upon any update the “Last Updated” date at the top of this policy will be updated. In the event that there are material changes to the way we treat your Personal Information, you are responsible for regularly reviewing this Chatbot Privacy Policy and your Mainstay account for notice of such modifications. Your continued use of the Services following an update to this Chatbot Privacy Policy will constitute your acceptance of the updated Chatbot Privacy Policy. We will notify you of material changes to the Chatbot Privacy Policy on our website and/or by email, and, if required by law, make additional efforts to notify customers of material changes that impact the treatment of data collected through our Services.

12.       QUESTIONS OR COMMENTS.

If you have questions or comments about this Chatbot Privacy Policy, or would like to access it in an alternative format, please contact us via email at [email protected] or mail at: 38 Chauncy Street, 11th Floor, Boston, MA 02111.

Our Chatbot Privacy Policy was last updated and is effective as of April 15, 2020.