Privacy Policy

1. Scope and roles

Consularly provides software for education consultancies, study-abroad agencies, and test-preparation providers. This policy applies to Consularly's website and hosted platform.

A consultancy using Consularly generally decides why and how its student, applicant, staff, and communications data is processed. In that situation, the consultancy is the data controller or equivalent business, and Consularly processes the data on its behalf. Consularly is responsible for data it collects for its own account administration, security, support, and website operations.

2. Information we process

• Account data, such as name, email address, role, organization, and sign-in records.
• Student and applicant data entered by customers, including contact details, educational history, applications, documents, appointments, payments, test results, and visa-workflow information.
• Communications and integration data from connected services, such as email, Facebook, Instagram, WhatsApp, calendars, and web forms, subject to the customer's configuration.
• Technical and security data, including IP address, browser and device information, request logs, audit events, error diagnostics, and cookie identifiers.
• Support requests, feedback, demo requests, and other information sent to us.

Customers determine which information they place in the platform. They should only collect and use information for which they have an appropriate legal basis and should not upload information they are not authorized to process.

3. How we use information

• Provide, secure, maintain, and support the Consularly platform.
• Authenticate users and enforce organization roles and permissions.
• Deliver customer-configured communications and integrations.
• Process transactions, generate records, and operate requested workflows.
• Detect abuse, investigate incidents, troubleshoot errors, and maintain audit trails.
• Comply with applicable law and enforce our agreements.
• Improve the platform using aggregated or de-identified information where appropriate.

4. Legal bases

Where a legal basis is required, processing may be necessary to perform a contract, comply with law, protect legitimate interests such as platform security and reliability, or act on consent. A Consularly customer is responsible for identifying the appropriate basis for personal data it controls.

5. Service providers and disclosures

We use infrastructure and service providers to operate Consularly. Depending on enabled features, these may include Supabase for database and authentication services, Cloudflare for storage and network services, our application-hosting infrastructure, email and SMS providers, and customer-connected services such as Meta or Google.

We do not sell personal data. We may disclose information to service providers acting on our instructions, to a customer that controls the relevant workspace, during a lawful corporate transaction, or where required to comply with law or protect rights and safety.

6. International processing

Consularly and its service providers may process information in countries other than the country where it was collected. Where required, we use contractual or other safeguards intended to protect transferred personal data.

7. Retention and deletion

We retain information for as long as needed to provide the service, satisfy a customer's configured retention requirements, maintain security and audit records, resolve disputes, and meet legal obligations. Retention differs by data type and feature. Backups may retain deleted information for a limited period before routine expiry.

To request deletion, first contact the consultancy that collected your information or follow our Data Deletion Instructions. You may also email info@consularly.com.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted transport, access controls, tenant-aware authorization, audit logging, and restricted administrative access. No system can guarantee absolute security, and customers remain responsible for protecting their accounts and configuring access appropriately.

9. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, or export personal data, object to certain processing, or withdraw consent. Requests relating to data controlled by a consultancy should be directed to that consultancy. We assist our customers with verified requests when required.

10. Children

Consularly is a business platform and is not directed to children for independent use. Customers that process information about minors are responsible for obtaining any required authorization and providing appropriate notices.

11. Changes to this policy

We may update this policy as the platform, providers, or legal requirements change. We will update the date above and provide additional notice where required.