ScholarEngine privacy notice

Version 2026-10-07. Published on NextGen Consulting Inc.'s authority, with management approval reported in principle; this notice has not been reviewed by legal counsel and may change.

ScholarEngine is operated by NextGen Consulting Inc. Contact scholarengine@ngciglobal.com for privacy requests.

Information and purposes

We collect account details and a salted password hash; education, interests, activities, experiences and other profile information you provide; uploaded documents, writing samples, application drafts and replies; scholarship selections, approvals, revision records, notifications and family links. Technical records support authentication, security, background processing and audit. We use this information to match scholarships, explain missing evidence, propose extracted profile changes, prepare and revise answers, track requirements and operate supported original-form filling. Providers make their own award decisions; a match guarantees no outcome.

Optional sensitive information may be needed for a particular scholarship. Provide only what is necessary. Do not upload passwords, banking credentials, government identification numbers or others' private documents without authority. Extracted facts and AI drafts can be wrong; extraction is not human verification. You review proposed changes and answers.

AI

The current free Gemini Developer API configuration processes isolated fictional test accounts only. Real-student generation through it is blocked. Google may use free-tier test inputs and outputs for improvement and human review. The production AI provider for real students remains on hold; its data practices must be disclosed before activation.

Structured context is scoped to the question, with explicit grants for sensitive structured facts. Essays, writing samples and free-text replies can themselves contain sensitive information. An acknowledgement does not guarantee that all sensitive free text is detected or removed. AI may ask focused questions, save your replies and rewrite drafts. Generated answers require review; provider AI-use restrictions still apply.

Documents and security

Production uploads use malware scanning. Files are stored in private AWS storage with application-level encryption and encrypted S3 storage. Authorized administrator document access is access-controlled and audited. Connections use HTTPS. AWS reported the RDS database volume unencrypted on 2026-10-07; encrypted files do not encrypt every database record. A migration is being prepared. Security measures do not guarantee protection against every incident.

Recipients and transfers

AWS supplies hosting, database and storage, with production infrastructure in us-east-1 in the United States. Resend delivers email addresses and message content. Google processes fictional AI test material as described above. Processing may occur outside your country.

Approved answers and individually approved documents can be transferred to supported provider forms by the browser extension. Providers may receive information when a field is filled or a file selected, BEFORE Submit, through autosave or immediate upload. Approval precedes supported transfer. Withdrawal stops future ScholarEngine transfer but cannot recall a provider's existing copy. Provider copies follow the provider's policies; deleting ScholarEngine data does not delete those copies. Unsupported forms require manual completion. We never submit, sign, accept declarations or pay fees for you.

ScholarEngine does not sell your information. No advertising or analytics scripts were found in the reviewed application; external provider websites have their own scripts and cookies. Operational providers may maintain their own security logs.

Family access and young people

Minor/guardian and parent-managed features provide the permissions available in their interfaces. Applicable consent gates restrict sensitive features. A stated relationship or account link does not independently verify legal guardianship. The current implementation does not establish a complete minimum-age or verifiable-parental-consent policy. These features alone do not authorize an under-13 public launch. Child collection and parental access/deletion procedures must be resolved before that pathway handles real children's information. Adult students can revoke supported guardian access; contact us for requests not supported by the interface.

Retention and choices

Account data, accepted documents and drafts are generally kept until you delete them or the account. Rejected documents are scheduled for deletion after the configured period, defaulting to 30 days; processing is not guaranteed at an exact minute. Sessions currently expire after 30 days for students/parents and 12 hours for staff. Job, audit and application-log records do not yet have uniformly enforced expiry limits; no 90-day limit is promised. RDS backups currently last one day, with seven days proposed. Deleted information may remain in backups until expiry; restores must account for prior deletions.

Your data at /account provides export and account-deletion controls. You can correct your profile, review/reject proposals, delete documents and manage supported permissions. Contact us for requests the interface cannot handle; we may verify authority before disclosing or changing another person's data. Optional notifications differ from transactional verification and recovery messages.

Session cookies support sign-in. Browser storage keeps preferences, acknowledgements and, where supported, in-progress replies. Sign out and clear saved browser data on shared devices.

Changes

Published notices will identify a version and effective date. Material changes to AI recipients, sensitive-data use or provider transfers require updated disclosures and any necessary consent. Existing approval is not blanket permission for unrelated new uses.