Privacy policy

MBA Copilot (“we”, “us”) is an AI platform that helps you plan and prepare business school applications. This policy explains what we collect when you use our website and app, how we use it, and the choices you have. If anything is unclear, email support@mbacopilot.com.

Your account. Your name, email address and login details when you create an account.

Early access and blog sign-ups. If you sign up for early access or subscribe on the blog, we keep your email address and the page you signed up on, and use them to email you about early access, the launch and new posts.

Your profile. Details you choose to share so MBA Copilot can guide you, such as your education, test scores, work experience, target schools, funding plans and any background details you choose to give.

Your documents and messages. Files you upload (like your resume), the essays and stories you write, and your chats with MBA Copilot. If you use spoken mock interviews, your voice is processed live to run the conversation, and we keep a transcript in your account. We never store the audio itself.

How you use MBA Copilot. A short list of product events, like signing up or accepting a suggestion, plus device and browser details. This works without cookies; see “Cookies and analytics” below.

• To run MBA Copilot: school strategy, essay and story coaching, deadline planning and the rest of your application workspace.
• To produce MBA Copilot’s guidance. Your profile, documents and messages are sent to AI providers (such as OpenAI) under terms that stop them from using your data to train their models.
• To run, fix and improve MBA Copilot, including aggregated analytics.
• To email you about your account and product updates.

We never sell your personal information.

We use a small set of providers to run MBA Copilot. This is the full list, and what each one receives:

• Supabase. Database, sign-in and file storage. Your account and everything in it lives here.
• Vercel. Hosting for the website and the app.
• OpenAI. AI processing, as described above, under terms that stop it from training on your data. For spoken mock interviews, your live microphone audio also streams to OpenAI to run the conversation. We keep the transcript, never the audio.
• Langfuse. AI quality monitoring. It holds records of what the AI was asked and what it answered, tied to your account id, so we can find and fix bad answers.
• Stripe. Payments. Your card details go straight to Stripe and never touch our servers.
• Google. Sign-in with Google, if you choose it, and the optional calendar connection described below.
• PostHog. Product analytics. See “Cookies and analytics”.
• Tavily and Brave. Web search. When MBA Copilot looks something up for you, such as a school’s current deadlines, the search words go to one of these two. Your documents, essays and chats never do.
• Resend. Email delivery: the emails we send you, like early-access invites and launch news, and any request you send a recommender. For a recommender request, Resend receives their name, their email address and the note you wrote. Nothing goes to a recommender until you press send.
• Sanity. Content for our public pages. No personal data.

These providers use your data only to provide their service to us. If we add a provider that will process your personal data, we’ll name it here before it starts. We may also share information if the law requires it.

Mock interviews are optional and spoken out loud. When you start one, your live microphone audio streams to OpenAI and the interviewer’s voice streams back, under the same terms that stop OpenAI from training on your data.

We don’t record or store the audio. What stays in your account is the transcript and the written debrief built from it. Both are included when you download your data and removed when you delete your account.

Connecting Google Calendar is optional. If you connect it, we ask Google for one narrow permission: to create our own calendar and manage the events on it. It doesn’t let us see, read or change any of your other calendars.

We create a calendar called “MBA Copilot” and keep it in step with your application plan: your schools’ deadlines, your submit-by dates and, if you leave the option on, your work time. Nothing else is written, and nothing is read back. You can hide or delete that calendar in Google at any time.

Google’s access key is encrypted before we store it, never reaches your browser, and is used only by our servers to keep the calendar up to date. Disconnecting revokes it with Google and deletes it from our records. You can also revoke it yourself in your Google Account, and deleting your MBA Copilot account removes it too.

MBA Copilot’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can also subscribe any calendar app to a private link we create for you. That link shows your plan’s dates and needs no sign-in, so anyone you share it with can see them. Treat it like a password, and disconnect it if it’s ever exposed.

We use essential cookies to keep you signed in and to remember, for an hour, that you’ve finished onboarding. With your permission, we also set one cookie that remembers how you found us, so we know which links and campaigns work. You choose on the cookie banner, and you can change your mind anytime from Cookie settings at the bottom of any page, or in Settings → Privacy & data. We set no advertising cookies.

Product analytics is a short list of events tied to your account id. It never includes the text of your documents or chats, and session recording is off across MBA Copilot. Unless you accept the cookie, analytics stores nothing on your device. You can turn analytics off entirely in Settings → Privacy & data, and we respect your browser’s privacy signals (Global Privacy Control and Do Not Track).

• Encryption. Every connection to MBA Copilot is encrypted, and your data is encrypted where it’s stored, by our providers Vercel and Supabase.
• Your data stays yours. The database itself makes sure a request signed in as you can only read and change your own records.
• Limited admin access. A few server-side jobs need admin-level database access: updates that run after you save changes, calendar sync, billing, recommender emails and account deletion. That access never reaches your browser, and each job is written to touch only the records it needs.
• Our team. Our team only looks at your account when you ask for help, when we need to keep the service secure, or when the law requires it.
• Payments. Card details go straight to Stripe and never touch our servers.
• What we don’t claim. We’re an early-stage team. We haven’t completed a SOC 2 or ISO 27001 certification or an independent penetration test, and we’ll update this page when we do.
• Found a security problem? Email support@mbacopilot.com with enough detail to reproduce it, and give us reasonable time to fix it before sharing it publicly. We’ll confirm we got it and follow up once it’s fixed. We don’t run a bug bounty.

We keep your information until you delete it. We don’t run any automatic expiry or anonymization, so an essay draft or a chat stays in your account for as long as the account exists.

You can delete your account anytime from Settings → Privacy & data. Your account closes right away, and everything in it is permanently deleted 30 days later. Until then, you can sign in and click Restore. Routine encrypted backups may hold a copy until they expire on our provider’s schedule, and we never restore a deleted account from one.

One record survives deletion. If a recommender asked us to stop emailing them, we keep their email address and that request, so the opt-out keeps working.

We may also keep de-identified, aggregated insights from application materials, such as what works at each school. These contain nothing that identifies you and aren’t part of your account, so they’re kept after deletion. We won’t try to re-identify anyone from them, and we require the same of anyone we share them with.

Depending on where you live, you may have rights to see, correct, download or delete your personal information. You can do most of this yourself:

• See and download. Settings → Privacy & data downloads everything in your account. The file downloads directly to your browser.
• Correct. Every detail on your profile can be edited, and your documents are yours to rewrite anytime.
• Delete. Settings → Privacy & data closes your account right away and deletes it 30 days later.

For anything else, including objecting to how we use your information, email support@mbacopilot.com and we’ll act on it within 30 days. We honor these requests for everyone, wherever they live.

Our providers may process data in other countries, including the United States. Where they do, they commit to safeguards consistent with this policy.

MBA Copilot is for adults. You must be 18 or older to use it.

We’ll post any changes here and update the date at the top. For significant changes, we’ll also tell you by email or in MBA Copilot.

Questions about privacy? Email support@mbacopilot.com.