Privacy Policy

1. Scope and roles

Consularly is a software product operated by The Continuum Designs. The Continuum Designs is responsible for the Consularly website and platform operations described in this policy.

Consularly provides software for education consultancies, study-abroad agencies, and test-preparation providers. This policy applies to Consularly's website and hosted platform.

A consultancy using Consularly generally decides why and how its student, applicant, staff, and communications data is processed. In that situation, the consultancy is the data controller or equivalent business, and Consularly processes the data on its behalf. Consularly is responsible for data it collects for its own account administration, security, support, and website operations.

2. Information we process

• Account data, such as name, email address, role, organization, and sign-in records.
• Student and applicant data entered by customers, including contact details, educational history, applications, documents, appointments, payments, test results, and visa-workflow information.
• Communications and integration data from connected services, such as email, Facebook, Instagram, WhatsApp, calendars, and web forms, subject to the customer's configuration.
• Technical and security data, including IP address, browser and device information, request logs, audit events, error diagnostics, and cookie identifiers.
• Support requests, feedback, demo enquiries and other information sent to us. Website demo enquiries are delivered to Consularly’s corporate mailbox, with contact details, consultancy name where supplied, plan interest and any consented campaign attribution. They are not inserted into a customer consultancy’s inbox.

Customers determine which information they place in the platform. They should only collect and use information for which they have an appropriate legal basis and should not upload information they are not authorized to process.

3. How we use information

• Provide, secure, maintain, and support the Consularly platform.
• Authenticate users and enforce organization roles and permissions.
• Deliver customer-configured communications and integrations.
• Process transactions, generate records, and operate requested workflows.
• Detect abuse, investigate incidents, troubleshoot errors, and maintain audit trails.
• Comply with applicable law and enforce our agreements.
• Improve the platform using aggregated or de-identified information that is not Google user data, where appropriate.

4. Google-connected services

When an authorized organization administrator connects a Google account, Consularly receives the account identity needed to associate the connection with the correct user and workspace, such as the Google account email address and basic profile information.

Depending on the feature the administrator chooses, Consularly may use Google Calendar access to create, update, or delete consultation appointments and generate Google Meet links; Google Business Profile access to display and manage business reviews and replies; and Gmail access to send B2B messages and read or synchronize tracked B2B communication threads connected to a Consularly record. Each connection is tenant-scoped and uses only the feature requested by the administrator.

Consularly does not synchronize unrelated mailbox messages or permanently delete Gmail messages. The Calendar/Meet appointment connection does not request Google Drive access, and Google Drive is not required to create appointments or Meet links.

Consularly does not sell Google user data, use it for advertising, or use it for unrelated purposes. Google data is processed only to provide the connected feature and for the limited security, support, and legal operations necessary to provide that feature. Google Workspace data is not used to train or improve generalized artificial intelligence or machine-learning models and is not transferred to third-party AI providers for their own training or secondary purposes.

The use of raw or derived user data received from Google Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements.

Disconnecting a Google account or revoking access stops future Google API access. Data already copied into the customer's workspace is handled according to this policy, the customer's retention configuration, and applicable legal obligations. To request deletion of stored integration data, follow our Data Deletion Instructions.

5. Legal bases

Where a legal basis is required, processing may be necessary to perform a contract, comply with law, protect legitimate interests such as platform security and reliability, or act on consent. A Consularly customer is responsible for identifying the appropriate basis for personal data it controls.

6. Service providers and disclosures

We use infrastructure and service providers to operate Consularly. Depending on enabled features, these may include Supabase for database and authentication services, Cloudflare for storage and network services, our application-hosting infrastructure, email and SMS providers, AI or speech providers such as CometAPI, Groq, AssemblyAI, MiniMax, and Azure Speech, and customer-connected services such as Meta or Google. These providers process customer-provided content only to deliver the enabled feature under our instructions. Google Workspace data is not provided to third-party AI providers for generalized model training or other secondary purposes.

We do not sell personal data. We may disclose information to service providers acting on our instructions, to a customer that controls the relevant workspace, during a lawful corporate transaction, or where required to comply with law or protect rights and safety.

7. International processing

Consularly and its service providers may process information in countries other than the country where it was collected. Where required, we use contractual or other safeguards intended to protect transferred personal data.

8. Retention and deletion

We retain information for as long as needed to provide the service, satisfy a customer's configured retention requirements, maintain security and audit records, resolve disputes, and meet legal obligations. Retention differs by data type and feature. Backups may retain deleted information for a limited period before routine expiry.

To request deletion, first contact the consultancy that collected your information or follow our Data Deletion Instructions. You may also email info@consularly.com.

9. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted transport, access controls, tenant-aware authorization, audit logging, and restricted administrative access. No system can guarantee absolute security, and customers remain responsible for protecting their accounts and configuring access appropriately.

10. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, or export personal data, object to certain processing, or withdraw consent. Requests relating to data controlled by a consultancy should be directed to that consultancy. We assist our customers with verified requests when required.

11. Children

Consularly is a business platform and is not directed to children for independent use. Customers that process information about minors are responsible for obtaining any required authorization and providing appropriate notices.

12. Changes to this policy

We may update this policy as the platform, providers, or legal requirements change. We will update the date above and provide additional notice where required.