Privacy policy

Last updated: 11 November 2026

Who we are

Higher Ed Apply is a Global School Partners company that guides students and graduates through university choice and applications. This policy explains what we do with the information you send us through this website. The person responsible for your data (the data controller) is Cris Ferreira, who you can reach at [email protected].

What we collect

When you book a free consultation, we collect what you type into the form: whether you’re asking about undergraduate or postgraduate study; for undergraduate study, the parent’s and student’s names, the student’s school year and curriculum; for postgraduate study, your name, current degree and year of graduation, years of work experience and the program type; and for both, the countries you’re interested in, your email address, mobile or WhatsApp number and preferred language. We also record the date and time you sent the form and that you agreed to this policy.

We don’t use cookies, analytics or advertising trackers on this website, and we don’t collect anything else about your visit. To stop the form being misused, our server keeps a scrambled code made from your connection’s address, with the times you sent the form, for one hour; it can’t be turned back into the address, and codes older than an hour are deleted the next time anyone uses the form.

Why we use it

Only to contact you about the consultation, arrange it and reply to your questions. We don’t sell your information or use it for advertising.

Our legal basis

Your consent, which you give by ticking the box on the form. You can withdraw it at any time by emailing us.

Who can see it

The Higher Ed Apply team. Your form is sent by email through our web host, HostGator, and our email provider, Titan, whose servers are in the United States, so your information is transferred outside Brazil and the European Union. We share it with no one else unless the law requires us to.

How long we keep it

For 24 months after our last contact with you, then we delete it.

Your rights

Under Brazil’s LGPD and, where it applies, the EU and UK GDPR, you can ask us to:

• confirm whether we hold your information and give you a copy
• correct it
• delete it
• send it to you or to another provider in a common format
• stop using it, by withdrawing your consent

Email [email protected] and we’ll reply within 15 days. You can also complain to Brazil’s data protection authority (ANPD) or to the data protection authority where you live.

The student portal

Families who work with us can sign in to the student portal at portal.higheredapply.com (opens in a new tab) to see a student’s portfolio and the report of each meeting. Only our team creates accounts. This section explains what the portal keeps and why.

What the portal keeps

• About each person who signs in (parent, student or adult student): name, email address, mobile number if given, a scrambled copy of the password (we can’t read it), and the date of the last sign-in.
• About each student: full name, date of birth, school year and school, and the portfolio our team adds: university plan, academic record, activities, applications and documents.
• Meeting reports: the report of each meeting with our founder, with the goals agreed until the next meeting, where each goal stands, the notes the student or a parent writes about it, and the comments parents and our team add.
• Which parents are linked to which student.
• An activity record: when someone signs in (with the type of device, for example “iPhone”), changes a password, is given a sign-in or updates a goal, when a parent gives consent for a child’s sign-in, and what our team adds, changes or views. It lets us answer if you ask who has seen or changed your information.
• For security: short-lived codes sent by email, and records of failed sign-in attempts. We keep internet addresses only in a scrambled form that can’t be turned back into the address.

The portal uses one cookie, which keeps you signed in. It is needed for the portal to work, ends when you sign out or after 30 minutes without activity, and is never used for tracking or advertising. The main website still uses no cookies.

Why we use it

To give each family a private view of their student’s plan and progress, to follow up the goals agreed in each meeting, to protect the account, and to keep parents informed. We don’t sell this information or use it for advertising.

Our legal basis

• To provide the guidance service your family asked us for (LGPD art. 7, V).
• For children aged 13 or younger, the child’s own sign-in is created only by a parent, who gives specific consent on the portal (LGPD art. 14, § 1). We record that consent.
• Parent notices (below) protect students under 18 and keep their parents informed, in the student’s best interest (LGPD art. 14).

Who can see it

• A parent sees only their own children.
• A student sees only their own portfolio and meeting reports.
• Our team sees all portfolios and reports, signs in with a password and a second code from an authenticator app, and every view and change is recorded.

The portal runs on our web host, HostGator, and sends email through Titan, whose servers are in the United States, so your information is transferred outside Brazil and the European Union. We share it with no one else unless the law requires us to.

Emails the portal sends

• A 6-digit code each time someone chooses a new password.
• An email when a password is changed.
• Every time a student under 18 signs in, each linked parent receives an email with the date, time and type of device.
• When a parent gives a child a sign-in, the child’s other linked parents receive an email.
• When a new meeting report is ready, the student and each linked parent receive an email with the meeting date only; the report itself stays in the portal.
• Our team receives one email a day, only on days when families updated goals, with the students’ names.

Children and teenagers

• Aged 13 or younger: only a parent can give the child their own sign-in, after confirming they are the parent, ticking a consent box and re-entering their own password. Until then, a parent can update the child’s goals.
• Aged 14 to 17: our team gives the sign-in, and parents receive an email every time the student signs in.
• 18 and over: the student’s account is their own; no parent emails are sent.

How long we keep it

• Accounts, portfolios and meeting reports with their goals, notes and comments: for as long as the student works with us, then for 24 months after our last contact, unless you ask us to delete them sooner.
• The activity record: 24 months. A parent’s consent to a child’s sign-in is kept for as long as the child’s record exists, as proof of that consent.
• Email codes: 1 day. Failed sign-in records: 30 days. Sign-in sessions: 12 hours at most.
• When we delete a family, we remove their accounts, portfolios, meeting reports and consent records, and remove names from the activity record.

Your rights

The rights listed above apply to the portal too. A parent can exercise them for their child. Email [email protected] to ask for a copy, a correction or deletion.

Changes to this policy

If we change this policy, we’ll update the date at the top of this page.