Privacy Policy

Atlas & Ivy ("we," "us," or "our") is committed to protecting the privacy of families, students, and agents who use our website and services. This policy explains what personal data we collect, why we collect it, and your rights regarding that data.

1. Who We Are (Data Controller)

Atlas & Ivy is the data controller for personal information collected through this website.

• Company: Atlas & Ivy
• Contact: [email protected]
• Website: globallinkadvisors.org

For any data-related requests or questions, please contact us at the email address above.

2. What Personal Data We Collect

We collect personal data in the following ways:

Through the School Match Quiz

• First name, last name, email address
• Phone number (optional)
• Role (student, parent, or agent)
• Quiz answers: budget band, program preferences, regional preferences, interests, start timeline

Through the Contact Form

• First name, last name, email address
• Phone number (optional)
• Your message

Automatically

• UTM parameters (traffic source, campaign, medium) — captured from the URL when you first arrive at our site
• Analytics data via Google Analytics 4 (GA4), including pages visited, approximate location, device type, and session behavior — collected only with your consent
• Cookie preference data (stored in a browser cookie named gla_consent)
• Session data via sessionStorage (quiz state, UTM parameters — stored in your browser only, not transmitted to our servers until you submit)

3. Why We Collect Your Data

To Provide Our Services

When you complete the school match quiz, we use your information to run the matching algorithm, display your results, send you a copy of your matched schools by email, and connect your inquiry with an advisor through ExLink (our workflow platform) so a real human can follow up.

To Communicate With You

We use your email address to send you your quiz results, respond to contact form inquiries, and provide follow-up guidance from our team. We do not send unsolicited marketing emails.

To Improve Our Website

With your consent, we use Google Analytics to understand how visitors use our site — which pages perform well, where people get stuck, and what's working. This helps us improve the experience for everyone.

To Prevent Abuse

We use Cloudflare Turnstile on all forms to prevent automated bot submissions. This is an invisible verification tool — most users never notice it.

4. Legal Basis for Processing

Under GDPR and applicable data protection law, we rely on the following legal bases:

5. Who We Share Your Data With

We share your personal data only with the service providers necessary to operate our platform:

Resend

We use Resend to send email. When you complete the quiz or contact form, your name, email, and relevant details are sent to Resend's servers to deliver your message. Resend acts as a data processor on our behalf. Privacy policy: resend.com/legal/privacy-policy

Zapier

We use Zapier to route lead data to ExLink. When you submit the quiz or contact form, your information is passed through Zapier to ExLink. Zapier acts as a data processor. Privacy policy: zapier.com/privacy

ExLink

ExLink is a workflow platform for international student exchange operations. Your lead data (name, email, quiz answers, match results) is stored in ExLink so our advisors can follow up effectively. ExLink is a data processor operating under our instructions.

Google Analytics

If you consent to analytics cookies, your usage data (pages visited, session behavior, device type) is sent to Google Analytics. Google may process this data on servers globally. Privacy policy: policies.google.com/privacy

Cloudflare

Our website is hosted on Cloudflare Pages. Cloudflare processes requests made to our site and provides security services including DDoS protection and bot mitigation via Turnstile. Privacy policy: cloudflare.com/privacypolicy

We do not sell your personal data to third parties. We do not share it for advertising purposes.

6. Data Retention

• Lead data in ExLink: Retained for as long as the business relationship is active or relevant. Typically 3 years from last contact, after which inactive leads are reviewed for deletion.
• Email records: Resend retains email logs for up to 90 days by default. We do not independently archive these.
• Analytics data: Google Analytics retains data for 14 months by default (our configured retention period).
• Cookie consent preference: Stored in your browser for 365 days (the gla_consent cookie).
• Session data (sessionStorage): Cleared automatically when you close your browser tab.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data. EU/EEA residents have these rights under GDPR. We honor these rights for all users regardless of location.

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that inaccurate data be corrected.
• Deletion: Request that your personal data be deleted ("right to be forgotten").
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: If we rely on consent (e.g., analytics cookies), you may withdraw at any time via our Cookie Settings link in the footer.
• Complaint: You have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

8. Cookies

We use cookies and browser storage on this site. For full details — including what each cookie does, how long it lasts, and how to manage your preferences — see our Cookie Policy.

You can update your cookie preferences at any time using the "Cookie Settings" link in the footer.

9. International Data Transfers

Atlas & Ivy serves families in 42+ countries. Some of our service providers (Google, Cloudflare, Resend, Zapier) may process data outside the EU/EEA. Where this is the case, transfers are governed by Standard Contractual Clauses or equivalent safeguards recognized under GDPR.

10. Children's Privacy

Our services involve placing minors in schools. However, we collect personal data only from parents, guardians, and adult agents — not directly from students under 16. If you believe a minor has submitted data directly to us, please contact us at [email protected] and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of our website after changes are posted constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or to exercise your rights:

• Email: [email protected]
• Subject line: "Privacy Request — [Your Name]"

We will acknowledge your request within 5 business days and respond fully within 30 days.