Privacy Policy
Last updated: 2026-05-26
What we collect
When you create an account we collect your name, email, date of birth, country of citizenship, target destination, profession and (optionally) financial runway figures. If you add family members to a Linked Sanctuary, we collect the same minimal fields for each of them. Where required for USMCA fast-track processing, we collect your Mexican CĂ©dula Profesional and encrypt it with AES-256-GCM at the field level before storage.
How we use it
Your data is used to generate your Aptitude Identity, recommend careers and courses, calculate visa eligibility, and (for adults in a Linked Sanctuary) verify three-way handshake consent on high-stakes actions. We do not sell or rent personal data.
Your controls
You can request export or deletion of your account data at any time by emailing privacy@aptitude.global. Audit logs of access events are retained for 365 days for integrity verification.
Security
Passwords are hashed with bcrypt. Sensitive fields use AES-256-GCM envelope encryption. All transport is TLS with HSTS preloaded. Detailed security documentation is available on request to enterprise customers.