Privacy Policy

1. Who we are

USAnaru™ (usanaru.com) is operated by an individual (sole proprietor) in the United States under the brand USAnaru™ (“we”, “us”). We are the controller of the personal data described in this policy — we decide why and how it is processed.

Privacy contact (data protection contact; in Korea, the person responsible for personal information protection): USAnaru™ privacy contact (the operator) — aiswingx.com@gmail.com · privacy request form.

2. Summary

• You can read the whole site without an account. We publish information about schools — institutions, not people.
• If you create an account or write to us, we keep only what we need to run the service and answer you.
• We do not sell personal data, we do not show advertising, and we do not share data for targeted advertising.
• Optional analytics and YouTube previews run only as described in the cookie policy below. Visitors from the EU/EEA, the UK and Switzerland see none of them until they opt in, and we honor Global Privacy Control.
• You can download or delete your data yourself in your account under “Privacy & data”, or write to us. We answer requests within 30 days.

3. What we collect, why, and on what legal basis

The legal bases in the last column are those of the EU and UK General Data Protection Regulation (GDPR). Where other laws apply, we rely on the equivalent grounds they provide, or on your consent where they require it.

We do not ask for passport details, visa documents, student records, payment card numbers, government ID numbers, or sensitive data such as health, religion or ethnicity. Please do not send them to us. We do not buy personal data, we do not use it for automated decisions with legal or similarly significant effects, and we do not build advertising profiles.

4. Legitimate interests

Where we rely on legitimate interests — running and securing the site, understanding which pages help readers, and answering messages — we have weighed those interests against your rights. We keep the data small (IP addresses in our statistics are hashed with a key that changes daily; precise location is never collected), we do not combine it with data from other companies or use it for advertising, we limit access to the operator, and we delete or strip it on the schedule in section 8. You can object at any time (section 9).

5. Roles, links and organization accounts

An account can have roles: student, parent or guardian, school staff, study-abroad agent or guardian service, and J-1 exchange sponsor. When you add a role we collect what that role needs:

• Student — year of birth (to confirm you meet the minimum age in section 10 and whether a parent must agree to links), grade, country, preferred language, optional phone number and interests (regions, visa type, notes).
• Parent or guardian — country, preferred language, optional phone number, and the email address of a child you invite.
• School staff, agent, sponsor — your job title, the organization you act for, and verification evidence: your sign-in email domain, the company details or designation number you enter, and the result of checking a J-1 sponsor against the U.S. Department of State’s public list of designated sponsors.

If a year of birth shows a student is under the minimum age, we store nothing. When you invite someone, we email them a single-use link that expires after 14 days. Personal profiles and links are never public and are kept separate from the public school information, API and MCP. A link between a student and a parent, agent or guardian service starts only when both sides accept, and a student under 18 needs a linked parent’s agreement before linking with a helper. Linked people see only what the link is for. Organization data is isolated: each organization (for example each J-1 sponsor) sees only its own placements, quotas and records; anything we publish across organizations is anonymous and aggregated. The operator and USAnaru™ managers see role data only as far as needed to verify roles and handle disputes. Organization profiles (name, website, programs) can be public; information a school submits about itself is published on its school page and through our API, marked as provided by the school.

Student and parent tools: the schools you save (with an optional note), the tests and visa type you choose for your timeline, checklist ticks, due dates and notes, and a private calendar link. Linked parents can read their child’s saved schools, timeline and checklist.

Help requests: the kind of help needed, grade, country, language, visa type, school types, U.S. states, saved schools you choose, budget range and notes, and the time you agreed to share the request. We use a request to suggest verified helpers and send it only to the helpers your family selects (up to 3); the staff accounts of those organizations can then read it and reply in a conversation on USAnaru™. Your name, email and phone number are shared with a helper only after it replies and the parent (or a student aged 18 or older who made the request) accepts. A linked parent or student can see the request, and USAnaru™ staff can see it to suggest helpers when no match is found.

Agency progress boards: when a student links with an agency, the agency records the schools applied to, stages, deadlines, document status and notes; the student and linked parents can read the board and comment. Messages you send to a school’s admissions office through USAnaru™ are read by that school’s verified staff.

When you link with or contact an organization, that organization receives the information you choose to share and uses it under its own privacy policy and its own legal duties. It is not our processor, and we do not sell or rent your data to it.

6. Who receives your data

We use these service providers. They process data for us or, for some Google services, as independent controllers under Google’s own terms:

Google’s privacy policy: policies.google.com/privacy. Location lookups use the DB-IP database stored on our own server, so no data is sent to DB-IP. Our fonts are served from our own server.

We may also disclose data when the law requires it (for example a valid court order), to protect the rights, safety or property of users or others, or to a successor if USAnaru™ is transferred — in that case we will tell you before your data becomes subject to a different privacy policy. We do not sell personal data and do not share it for cross-context behavioral advertising.

7. International transfers

We are located in the United States and our servers are in the United States. When you use USAnaru™ from another country, the data you give us is processed in the United States, whose laws may not protect personal data in the same way as the laws where you live. Our providers may also process data in other countries. Google LLC is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions; for other providers we rely on the Standard Contractual Clauses or other safeguards in their terms where they offer them. You can ask us for more information about these safeguards.

We do not currently offer our service specifically to people in the EU, the EEA or the UK and have not appointed a representative there (Article 27 GDPR). If that changes, we will appoint one and name it here.

8. How long we keep data

When you delete your account we delete your saved items, plans and checklists, messages (including help-request conversations), help requests, progress-board entries about you and comments you wrote, messages you sent to schools, API keys, contact-form messages sent from your email, roles, profile and links, remove your email from our logs, and replace the account record with an anonymous placeholder. Security-log entries keep the IP address until their 12 months end, and consent records are kept as stated above, without your email. Deleted data disappears from backups within about 24 hours. Electronic data is deleted so that it cannot be restored; we keep no paper records. We may keep data longer only where the law requires it or to establish or defend a legal claim.

9. Your rights and how to use them

Wherever you live, you can ask us to:

• confirm whether we hold data about you and give you a copy (access and portability) — or download it yourself in your account under “Privacy & data”;
• correct inaccurate or incomplete data — most of it you can edit yourself in your profile;
• delete your data — you can delete your account yourself in your profile;
• restrict or stop a use of your data, or object to processing based on legitimate interests;
• withdraw consent at any time (emails, cookies) — this does not affect processing before the withdrawal;
• not be treated differently for using these rights.

Use the privacy request form or email us. We answer within 30 days, free of charge. If a request is complex, we may extend this as the law allows and tell you why. To protect you, we may ask you to confirm the request from the email address on your account; we do not ask for more data than we need for this. An authorized agent may act for you with your signed permission. If we decline a request, we will explain why and you can appeal by replying; we decide appeals within 60 days. Email: aiswingx.com@gmail.com.

EEA, UK and Switzerland — You also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to resolve your concern first.

Other countries — People in China, Vietnam, Latin America and elsewhere have similar rights under their own laws (for example China’s Personal Information Protection Law, Vietnam’s personal data protection law, Brazil’s LGPD and Mexico’s data protection law). Use the same form; we will apply the rights your law gives you.

10. Children and students

USAnaru™ is not directed to children under 13. You must be 13 or older to create an account, and we do not knowingly collect personal data from children under 13. If we learn that we have, we delete it. Parents who believe their child gave us data can contact us.

Where local law sets a higher age, we apply it at sign-up (based on the country of your IP address) and when a student role is added (based on the country in the profile, or otherwise the IP address): people in Korea or China must be 14 or older, and in Vietnam 16 or older. All students under 18 should use USAnaru™ with a parent or guardian’s knowledge, and cannot link with an agent or other helper without a linked parent’s agreement. We never publish information about individual students.

11. Security and breaches

We protect data with encrypted connections (HTTPS with HSTS), hashed passwords and API keys, single-use sign-in links that expire after 15 minutes, protection against cross-site request forgery, rate limits, separation of personal data from the public school data and API, access to the server and admin area limited to the operator, and access-restricted hourly backups. No system is perfectly secure.

If a breach of personal data occurs, we will contain it, assess the risk, and notify the affected people and the authorities as the law requires — for example, the competent supervisory authority within 72 hours where GDPR applies and without undue delay where Korea’s PIPA applies, and affected people without undue delay when the risk to them is high.

12. Cookie policy

Cookies are small files your browser stores for a website; local storage is similar. By default we use only strictly necessary ones. Optional ones are used only as described here, and you can change your choice at any time with “Cookie settings” at the bottom of every page. Cookie settings

• EU/EEA, UK and Switzerland: nothing optional is loaded — not even the Google Analytics script or YouTube preview images — until you opt in.
• Elsewhere: until you choose, Google Analytics runs in Consent Mode without analytics or advertising cookies, and school pages show YouTube preview images. You can accept or reject optional cookies in the banner.
• If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out: Google Analytics is not loaded. We do not respond to “Do Not Track” signals, which have no agreed standard.

You can also block or delete cookies in your browser settings. If you block the session cookie, signing in and forms will not work.

13. Additional information for users in Korea

This section supplements the policy for users protected by Korea’s Personal Information Protection Act (PIPA).

• Processing outsourcing and overseas transfer — Your data is stored and processed in the United States from the moment you send it over the internet to our servers, for the purposes and periods in sections 3 and 8. The recipients, countries and purposes are listed in section 6 (our hosting provider and Google LLC; contact: through our privacy contact). You can refuse by not creating an account or not sending data; you can then still read the public site, but cannot use account features.
• Provision to third parties — We do not provide your personal information to third parties, except to people or organizations you choose to link with or contact, or where the law requires it.
• Destruction — When the retention period ends or the purpose is achieved, we delete electronic files so that they cannot be restored. We keep no paper records.
• Your rights — You (or your legal representative) may request access, correction, deletion or suspension of processing, and withdraw consent, as described in section 9. Under PIPA, processing the data of children under 14 needs a legal representative’s consent, so people signing up from Korea must confirm they are 14 or older, and we do not knowingly keep accounts of younger children.
• Person responsible for personal information protection — USAnaru™ privacy contact (the operator), aiswingx.com@gmail.com. We have not designated a domestic representative in Korea because we do not meet the legal thresholds that require one.
• Remedies — Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr); Personal Information Infringement Report Center, KISA (118, privacy.kisa.or.kr); Supreme Prosecutors’ Office cybercrime unit (1301); Korean National Police Agency cyber bureau (182, ecrm.police.go.kr).

14. Additional information for U.S. residents

In the past 12 months we collected these categories of personal information, for the purposes in section 3: identifiers (email address, name, IP address, account number); internet activity (pages viewed, searches, interactions); approximate geolocation (from IP address); account and profile information you provide (including year of birth and, for helpers, professional information); and inferences limited to whether a visitor is a person or a bot. Sources: you, your browser, and Google if you use Google Sign-In.

We do not sell personal information, we do not “share” it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information for purposes that require a right to limit. We honor Global Privacy Control as a request to opt out. California residents and residents of other states with privacy laws can use the rights in section 9, including through an authorized agent, and we will not discriminate against you for using them.

Children’s privacy (COPPA): see section 10.

15. Changes and contact

We will post any change here with a new date and version. If a change is material, we will email account holders before it takes effect, and account holders will be asked to agree again the next time they use their account. Earlier versions are available on request.

Privacy request form · aiswingx.com@gmail.com