Privacy Policy

Last updated: August 20, 2026

This Privacy Policy explains how CAA Readiness Index LLC, a Mississippi limited liability company (“CRI,” “we,” “us,” or “our”), handles personal information when you visit criscore.org, create an account, use the CRI calculator and planning tools, participate in community features, contact us, or purchase CRI Plus (collectively, the “Service”).

CRI operates the Service and is the entity responsible for the personal information described in this policy.

This policy is a notice about our practices; it is not a request for consent where consent is not the appropriate legal basis. Our Data Usage Policy gives additional product-level detail, and our Terms of Service govern use of the Service.

1. Information We Collect

In short: Here is everything we collect: your account details, whatever you type into the tools (GPAs, test scores, programs, notes), what you contribute to the community application dashboard, your subscription info if you pay, and the usual technical data your browser sends. If you tell us you were accepted to a CAA program, we also collect the two documents that prove it and the name printed on them, and we delete all of that as soon as someone has checked it. Stripe holds your card number, not us.

Account and profile information. Your email address, account identifier, authentication records, display name, optional avatar, account preferences, marketing-email preference, signup source or survey responses, and the date and source of your acceptance of our terms.

Academic, application, and planning information. Information you enter into CRI tools, such as GPA values, MCAT or GRE type and score, prerequisites, programs of interest, saved programs and results, application milestones, response dates, experience-hour entries and goals, matcher inputs, and notes.

Uploaded transcripts. If you use the transcript upload on the CASAA GPA Calculator, the PDF you choose is stored privately for the seconds it takes to read it and is deleted once it has been read. While it is being read, a copy is sent to Anthropic, whose retention is described in their privacy notice linked in section 6. We keep a record that a read happened, how many files it covered, and its size in tokens, so we can meter the feature and answer billing questions. That record contains no course, grade, or school information.

Acceptance documents. If you fill in the Accepted Applicant Survey, you upload two files at the end: your acceptance letter and your deposit receipt. They go into private storage that no other account can read, and they exist for one reason, so a person can check that you were accepted before your cycle is added to the dataset. This is the same check the CAA Discord does. Both files are deleted the moment your submission is approved or rejected, and automatically after 30 days if nobody has reviewed it by then. What we keep afterwards is the decision, the date it was made, and any note the reviewer wrote. We do not keep the documents, and we never publish them.

Your name on the acceptance letter. The Accepted Applicant Survey also asks you to type your name as it appears on that letter. It is used for one thing, so the reviewer can see that the two files belong to each other and to you, and it is held to the same clock as the files: deleted when your submission is approved or rejected, and automatically after 30 days if nobody has reviewed it. It is never added to the dataset, never exported, and never published.

Survey answers saved in your browser.The Accepted Applicant Survey can be filled in before you sign in, so while you are working on it your answers are held in your own browser's local storage on that device. Nothing is sent to us until you press submit. That saved copy is discarded after 14 days, when you press Start Over, or when a different account signs in on the same device. Your uploaded files are never part of it.

Community and support content. Application-response contributions, feedback, reviews, ratings, support messages, and related timestamps.

Subscription and transaction information. If you purchase CRI Plus, we receive Stripe customer and subscription identifiers, plan, billing status, renewal and cancellation information, invoice or dispute status, and limited payment metadata. Stripe processes payment-card details; CRI does not receive or store your full card number.

Cancellation feedback. If you cancel CRI Plus, we store the reason you select, either the one Stripe collects in its billing portal or the optional question shown in Account Settings. Answering is optional, and your answer does not affect your access or any refund.

Device, log, and usage information. IP address, browser and device type, operating system, referral source, pages or features used, approximate location derived from IP, timestamps, error and security logs, and cookie or similar identifiers. Google Analytics receives data only if you enable Analytics in our consent controls. Vercel Web Analytics operates without third-party cookies and reports aggregated traffic information.

2. How We Collect Information

In short: Some of it you type in yourself. Some comes from your browser automatically. The rest comes from the companies we use to run the site.

Directly from you when you create an account, use a tool, contribute content, make a purchase, or contact us
Automatically from your browser or device when you use the Service
From service providers such as Supabase, Stripe, Vercel, Google, and Resend
From public program sources and community-contributed admissions information

3. How We Use Information

In short: We use it to run the site, work out your score, save your stuff, handle payments, email you, spot abuse, and follow the law.

Provide, personalize, maintain, and troubleshoot the Service
Calculate CRI scores, percentiles, comparisons, and program matches
Save your scenarios, trackers, prerequisites, programs, goals, and preferences
Operate community activity, response tracking, and aggregate analytics
Process subscriptions, renewals, cancellations, refunds, and payment disputes
Send authentication, security, billing, service, support, and marketing messages when enabled
Measure performance, understand feature use, and improve our models and tools
Detect fraud, scraping, abuse, security incidents, and violations of our Terms
Comply with law and establish, exercise, or defend legal claims

4. Community and Public Information

In short: Some parts of the site are meant to be seen by other members. Those show your score and ranges but never your email or account ID. Do not put anything private in a community field. If you choose to appear in Supporters, only signed-in members see it, it never shows how much you gave, and you can remove yourself instantly.

Some features are designed to share information with the CRI community. The Recent Calculations Made feed and Community Score Distribution may show a calculation's CRI score, GPA range, test type, and test-score range without showing the account's email, user ID, or display name.

The community application dashboard may show school, application cycle, submission and response month, status, response method, fee, and submission timestamp. Account IDs and private notes are excluded from the public community view. Do not submit information you want to keep confidential.

Supporters panel. If you opt in to the licensure advocacy contribution, you may separately choose to be listed in Supporters. Listing is off by default and is a distinct choice from contributing, so you can contribute without being listed. When you enable it, the panel shows the display name from your profile, together with the month you opted in. It is visible only to signed-in CRI members, is not accessible to the public, and is excluded from search engine indexing. Your email, account ID, and the amount you contributed are never shown, and the order of the list does not reflect how much anyone has contributed. Your name appears only while your CRI Plus subscription is active and is removed when that subscription ends. Turning listing off removes your name immediately.

We may use aggregated or de-identified information for product analytics, community benchmarks, reports, and research. We do not publish your email or account ID as part of those materials.

5. How We Disclose Information

In short: We pass data to the companies that run parts of the site, like Supabase, Stripe, and Vercel. We may also hand it over if the law requires it or if the company is sold. We never sell your personal information, and we never use your grades to target ads at you.

We may disclose information to the following recipients for the purposes described in this policy:

Supabase: database hosting, authentication, and file storage
Vercel: website hosting, delivery, logs, and web analytics
Render: hosting for the CRI analysis backend that calculates scores
Cloudflare: DNS, content delivery, and network protection for the CRI analysis backend
Google Analytics: consent-based website analytics
Anthropic: reading transcripts you upload to the CASAA GPA Calculator
Stripe: checkout, subscriptions, invoices, refunds, and payment disputes
Resend: transactional, service, and marketing email delivery
Mailgun: receiving email you send to our support and privacy addresses
Mapbox: map tiles and interactive program-map functionality
Google/YouTube: playlist data and video playback when those features are used
The CRI community: information you submit to public or community features as described above

We may also disclose information if required by law; to protect rights, safety, and security; to professional advisers; or as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards.

We do not sell personal information or share it for cross-context behavioral advertising. We also do not use your academic profile to target third-party advertising.

6. Service Provider Privacy Notices

In short: Links to the privacy policies of every company we use. They handle your data under their own rules.

These providers process information under their own terms and privacy notices.

7. Cookies and Similar Technologies

In short: Some cookies are required to keep you logged in and secure. Google Analytics only runs if you turn it on, and you can change your mind any time from Cookie Preferences in the footer.

We use necessary cookies and browser storage to authenticate accounts, protect sessions, remember trusted-device and consent choices, preserve interface preferences, and provide requested functionality. Disabling these technologies may prevent account or security features from working.

Google Analytics is loaded only after you choose to enable Analytics. Its standard web implementation uses a first-party identifier to distinguish users and sessions. Vercel Web Analytics does not use third-party cookies and provides CRI with aggregated traffic data.

You can revisit your choice at any time using Cookie Preferencesin the site footer. You may also clear or block cookies and site data in your browser. We do not respond to Do Not Track signals because there is no consistent industry standard for them; we honor legally required opt-out preference signals where applicable.

8. Data Retention

In short: We keep your data while your account is open, and keep some records longer for legal, security, and accounting reasons. Contributions that feed community stats may stay. Acceptance letters, deposit receipts, and the name given with them are the exception and go the other way: they are deleted as soon as they have been checked, and after 30 days regardless. Deleting something does not wipe it from backups right away.

We keep personal information only as long as reasonably necessary for the purposes described here, including providing the Service, maintaining community datasets, resolving disputes, enforcing agreements, meeting legal obligations, and protecting the Service. Retention depends on the type of information:

Account and private planning data are generally retained while your account is active
Calculation and community contributions may be retained to maintain longitudinal, aggregate, and community features
Support, security, and transaction records may be retained as needed for fraud prevention, accounting, disputes, and legal compliance
Acceptance letters and deposit receipts uploaded to the Accepted Applicant Survey are deleted when the submission is approved or rejected, and no later than 30 days after it is made; only the decision, its date, and any reviewer note are kept
The name given with those documents is deleted on the same schedule, in the same operation, and is never added to the dataset or published
Analytics and infrastructure providers retain data under their settings and policies
Deletion may not immediately remove information from encrypted backups, provider records, or information we must retain by law

9. Your Choices and Rights

In short: You can view, edit, or delete almost everything yourself in Account Settings. Email us if you want a copy of your data or need something removed that you cannot remove on your own.

Review and update profile information in Account Settings
Delete saved results and other user-managed entries in the relevant tool
Turn marketing email on or off in Account Settings
Change consent-based analytics through Cookie Preferences
Delete your account from Account Settings
Request access, correction, deletion, or a portable copy by emailing us

Account deletion removes the authentication account and account-linked data subject to technical, legal, security, and payment-record exceptions. It does not necessarily cancel an active subscription with Stripe. Cancel CRI Plus in Account Settings > Billing before deleting your account.

We may need to verify your identity before completing a request. Rights and exceptions vary by location, and we will respond within the period required by applicable law. Authorized agents may submit a request where permitted by law, subject to verification of their authority.

10. U.S. State Privacy Disclosures

In short: If you live in a U.S. state with a privacy law, you have extra rights, like asking what we hold on you and having it deleted. We will not treat you worse for asking. If we turn a request down, you can ask us to look again, and if we still say no we will point you to your state attorney general.

Depending on where you live and whether the applicable law covers CRI, you may have rights to know or access, correct, delete, or obtain a copy of personal information; opt out of certain sales, sharing, targeted advertising, or profiling; limit certain uses of sensitive information; appeal a decision; and receive equal service without discrimination.

In the preceding 12 months, CRI has collected the categories described in Section 1: identifiers; customer records; commercial information; internet or electronic activity; educational and professional information; user-provided content; approximate geolocation; and inferences generated by CRI tools. We have disclosed these categories for the business purposes in Sections 3 and 5. We have not sold them or shared them for cross-context behavioral advertising.

Appealing a decision. If we decline a privacy request, you may appeal. Reply to our decision, or email team@criscore.orgwith “Appeal” in the subject line and a brief explanation of why you disagree. We will review it and respond in writing within 45 days, with the reasons for our conclusion. If we deny the appeal, that response will also tell you how to complain to the attorney general or supervisory authority where you live.

11. EEA, UK, and Swiss Users

In short: If you are in Europe or the UK, GDPR-style rights apply to you, including the right to object, to get your data moved, and to complain to your local regulator.

Where applicable, our legal bases include performance of a contract (providing your account, requested tools, and subscription), legitimate interests (operating, securing, preventing abuse of, and improving the Service), consent (Google Analytics and marketing where required), and compliance with legal obligations. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

You may have rights to access, rectify, erase, restrict, port, and object to processing, as well as the right to complain to your local supervisory authority. CRI and its providers may process information in the United States and other countries that may have different data-protection laws. Where required, transfers are made using recognized safeguards.

12. Automated Outputs

In short: Our scores and matches are worked out by a formula, not a person. Nothing here decides anything legally binding about you, and it is not a prediction of getting in.

CRI scores, percentiles, comparisons, and Program Matcher results are generated automatically from the data you enter and our statistical models. They are informational planning tools. CRI does not make admissions decisions, and these outputs do not produce legal or similarly significant effects.

13. Security

In short: We use encryption, access controls, and managed logins to protect your data. No website is perfectly safe, so keep your own login secure too.

We use safeguards designed to protect information, including HTTPS, access controls, server-side authorization, and database row-level security. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Protect your credentials and contact us if you believe your account has been compromised.

14. Age Requirement

In short: You must be 18 or older. We do not knowingly collect data from children, and we delete it if we find it.

The Service is intended for adults applying to graduate-level professional programs. You must be at least 18 to create an account or purchase CRI Plus. We do not knowingly collect personal information from children. Contact us if you believe a child has provided personal information.

15. Changes to This Policy

In short: If we change this policy, we post the new version with a new date, and tell you directly when the change is a big one.

We may update this policy as the Service or law changes. We will post the revised policy with a new “Last updated” date and provide additional notice when a change is material and applicable law requires it.

16. Contact and Privacy Requests

Email questions or privacy requests to team@criscore.org. Please use the email associated with your account when possible and describe the request clearly.

Written requests may be sent to CAA Readiness Index LLC at PO Box 15352, Hattiesburg, MS 39404.