Privacy Policy

Effective Date: February 23, 2026

Proveground ("we," "us," or "our") operates the Proveground platform (the "Service"), a workforce readiness and talent-matching platform connecting students, educational institutions, and corporate partners. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our Service.

If you are accessing the Service through an educational institution, references to your educational institution refer to your institution. For questions specific to your institution's data practices, contact your institution's privacy officer. For Proveground-specific inquiries, contact us at privacy@proveground.com.

1. Information We Collect

1.1 Information You Provide

Account Information: Name, email address, password (stored as a salted hash), role (student, corporate partner, educational administrator, or platform admin).
Profile Information: University, major, graduation year, GPA, bio, phone number, avatar image, sports played, and extracurricular activities.
Academic Information: Coursework details, skills and competencies, project applications, cover letters, and portfolio content.
Corporate Information: Company name, job title, department, company description, website, industry, company size, and stock ticker (if publicly traded).
Project & Application Data: Project listings, applications, messages between students and corporate partners, ratings, and feedback.
AI Interaction Data: Conversations with our AI coaching features, career guidance queries, resume reviews, and interview preparation content.
Communications: Direct messages, application messages, education messages, and notification preferences.

1.2 Information Collected Automatically

Usage Data: Pages visited, features used, time spent on the platform, and interaction patterns.
Device Information: Browser type, operating system, IP address, and device identifiers.
Cookies & Similar Technologies: We use essential cookies (for authentication and security), analytics cookies (to understand usage patterns), and marketing cookies (for relevant advertising). See Section 8 for details.

1.3 Information from Third Parties

Educational Institutions: Enrollment verification, academic standing, and institutional domain information provided through SSO or administrative data sharing.
Single Sign-On (SSO): If you authenticate via your institution's SSO provider, we receive basic profile information as configured by your institution.

2. How We Use Your Information

Talent Matching: Our proprietary ProveGround Match Engine uses your skills, availability, academic profile, and preferences to match you with relevant project opportunities and corporate partners.
AI Coaching & Career Services: We use your profile data and interaction history to provide personalized AI-powered career coaching, resume review, interview preparation, and portfolio intelligence reports through our integration with Anthropic's Claude AI.
Analytics & Reporting: Aggregated and anonymized data is used to generate institutional analytics, skills-gap analysis, and outcome reports for educational partners.
Platform Operations: Account management, authentication, security monitoring, fraud prevention, and customer support.
Communications: Transactional emails (application updates, new messages, project completions), and platform notifications.
Improvement: To improve our Service, develop new features, and fix bugs.

3. How We Share Your Information

3.1 With Corporate Partners

When you apply to a project, your application information (name, email, skills, cover letter, relevant coursework, and GPA) is shared with the corporate partner posting the project. Corporate partners may rate your performance, which is visible to you and your educational administrators.

3.2 With Educational Institutions

If you are associated with an educational institution through the platform, your institution's administrators may access aggregated and individual student data including application activity, project outcomes, skills progression, and performance ratings to fulfill their educational mission.

3.3 With AI Service Providers

We use Anthropic's Claude AI to power our coaching and intelligence features. When you use AI features, relevant context (such as your profile, skills, and conversation history) is sent to Anthropic for processing. Anthropic processes this data under our data processing agreement and does not use your data to train their models. You can opt out of AI model training in your privacy settings.

3.4 With Service Providers

We use third-party service providers for email delivery (Mailgun), file storage (Cloudinary), hosting (Heroku), and database services (PostgreSQL). These providers process data on our behalf under data processing agreements.

3.5 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Proveground, our users, or the public.

4. FERPA Rights (Student Users)

If you are a student user, certain information you provide may constitute "education records" under the Family Educational Rights and Privacy Act (FERPA). Your educational institution (your educational institution) is the custodian of your education records, and Proveground acts as a "school official" with a legitimate educational interest under FERPA.

As a student, you have the right to:

Inspect and review your education records held by the platform.
Request correction of records you believe are inaccurate or misleading.
Consent to disclosure of personally identifiable information from your education records, except to the extent that FERPA authorizes disclosure without consent.
File a complaint with the U.S. Department of Education if you believe your FERPA rights have been violated.

Your institution's privacy officer can provide additional information about your FERPA rights. Contact your institution directly or reach out to us at privacy@proveground.com.

5. CCPA Rights (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

Right to Know: You can request details about the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it.
Right to Delete: You can request deletion of your personal information, subject to certain exceptions. Use the account deletion feature in Settings or contact us at privacy@proveground.com.
Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
Right to Correct: You can request correction of inaccurate personal information through your profile settings or by contacting us.

To exercise your CCPA rights, email privacy@proveground.com with the subject line "CCPA Request." We will verify your identity before processing your request.

6. Data Retention

Account Data: Retained for the duration of your account. Upon account deletion, your personal data is removed or anonymized within 30 days, except where retention is required by law or for legitimate business purposes (e.g., audit logs, anonymized analytics).
AI Conversation Data: AI coaching conversations are retained for the duration of your account to provide continuity. They are deleted when your account is deleted.
Audit Logs: Security-related audit logs (login attempts, account changes) are retained for a minimum of 2 years for compliance and security purposes.
Anonymized Data: Aggregated, de-identified data may be retained indefinitely for research, analytics, and platform improvement.

7. Data Security

We implement industry-standard security measures to protect your information, including:

Passwords hashed with bcrypt (salted, high cost factor).
CSRF protection on all state-changing API endpoints.
Rate limiting on authentication and sensitive endpoints.
Session management with idle timeouts and absolute TTLs.
Encrypted data in transit (TLS/HTTPS) and at rest.
Row-level security (RLS) for multi-tenant data isolation.
Comprehensive audit logging of security events.

8. Cookies

We use the following categories of cookies:

Essential Cookies: Required for core functionality including authentication sessions, CSRF tokens, and cookie consent preferences. These cannot be disabled.
Analytics Cookies: Help us understand how visitors use the platform so we can improve the user experience. You can opt in or out via our cookie consent banner.
Marketing Cookies: Used to deliver relevant advertisements and measure campaign effectiveness. You can opt in or out via our cookie consent banner.

You can manage your cookie preferences at any time by clearing your browser's cookies, which will trigger the consent banner to appear again on your next visit.

9. Data Portability & Export

You can export a copy of all your personal data at any time through the Settings page. The export includes your profile information, applications, ratings, messages, portfolio data, and AI conversation history in a machine-readable JSON format.

10. Account Deletion

You can permanently delete your account through Settings > Delete Account. Account deletion:

Removes all personal data including profile, messages, applications, and AI conversations.
Anonymizes any denormalized references to your name and email in shared records.
Invalidates all active sessions immediately.
Sends a confirmation email to your registered email address.
Cannot be undone.

11. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will promptly delete it.

12. International Users

Our Service is primarily operated in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located. By using the Service, you consent to such transfer and processing.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Effective Date" at the top. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy, your data, or your rights, please contact us:

Email: privacy@proveground.com
Institution Privacy Officer: Contact your educational institution (your educational institution) directly for FERPA-related inquiries.