Privacy Policy

1. Who We Are

fez (“we,” “us,” or “the Platform”) provides a secure, web-based platform at onfez.com that enables authorized education counselors to manage student admissions guidance. This Privacy Policy explains what data we collect, why we collect it, how we protect it, and what rights you have.

2. Our Commitment to Student Privacy

Student data protection is the foundation of everything we build. We follow a privacy-by-design approach: we collect only what is necessary, retain it only as long as needed, encrypt it in transit and at rest, and never sell, rent, or trade personal information to third parties for marketing or advertising purposes.

3. Information We Collect

We collect information in three categories:

4. How We Use Your Information

We use collected information strictly for the following purposes:

• Providing and maintaining platform access for authorized users
• Enabling counselors to manage student admissions guidance
• Authenticating users and securing accounts
• Generating documents requested by the counselor (e.g., reports, summaries)
• Sending service-related communications (password resets, security alerts)
• Complying with legal obligations

We do not use student data for advertising, profiling, or any purpose unrelated to the counseling services provided through the platform.

5. FERPA Compliance

We treat all student information entered into fez as education recordsunder the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g.

• Legitimate Educational Interest: Student data is accessible only to the assigned counselor and team members with explicit, role-based permissions granted by the counselor.
• Minimum Necessary Standard: We collect only the data necessary to provide admissions counseling services. We do not require or request data beyond what the counselor chooses to enter.
• No Re-Disclosure: We do not disclose student education records to any third party except as required by law or with written consent.
• Counselor Responsibility: Counselors using fez are responsible for obtaining appropriate consent from students and/or parents before entering personally identifiable information.
• Annual Notification: We support counselors in meeting their FERPA notification obligations by providing clear documentation of our data practices.

6. Data Security

We implement multiple layers of security to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest.
• Authentication: Passwords are cryptographically hashed using bcrypt. We support secure session management with automatic expiration.
• Access Controls: Role-based permissions ensure team members can only access data explicitly authorized by the counselor. All permission changes are logged.
• Audit Logging: Critical actions (data changes, access events) are logged for accountability and incident response.
• Infrastructure: Hosted on secure, SOC 2-compliant cloud infrastructure with regular security updates and monitoring.

7. Data Sharing

We do not sell, rent, or share personal information with third parties for their own marketing purposes. We may share data only in these limited circumstances:

• Service Providers: We use a limited number of trusted service providers for hosting, data storage, and platform operations. These providers are contractually bound to protect data and use it only for the services we engage them for.
• Legal Requirements: We may disclose information if required by law, court order, or government regulation.
• With Consent: We may share data with the explicit, written consent of the data subject or their authorized representative.

8. Data Retention & Deletion

We retain personal data only as long as necessary to provide our services or as required by law. When an account is closed or data deletion is requested, we remove personal information from our active systems within 30 days. Backups containing personal data are purged within 90 days. Counselors may delete individual student records at any time through the platform.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access and review personal data we hold about you
• Request correction of inaccurate information
• Request deletion of your data (“right to be forgotten”)
• Receive a copy of your data in a portable format
• Object to or restrict certain processing of your data
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

10. International Users

fez is operated from the United States. If you access the platform from outside the U.S., please be aware that your data may be transferred to and processed in the United States. By using fez, you consent to this transfer. We take appropriate measures to ensure your data receives an adequate level of protection regardless of where it is processed.

11. Children's Privacy

fez is designed for use by education counselors and students aged 13 and older. We do not knowingly collect personal information from children under 13 without verified parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA). If we learn that we have collected data from a child under 13 without proper consent, we will delete it promptly.

12. Cookies

We use only essential cookies required for authentication and session management. We do not use tracking cookies, analytics cookies, or advertising cookies. We do not participate in cross-site tracking or sell browsing data.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated to registered users via email at least 30 days before they take effect. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

14. Contact

For questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern:

We will acknowledge receipt of your inquiry within 48 hours and provide a substantive response within 30 days.