Privacy Policy

The privacy policy you agree to when creating an InternFirst account. Also see the Terms & Conditions.

Student Privacy Policy

Pilot Version 1.3 · Effective August 3, 2026

This Student Privacy Policy explains how InternFirst Inc. collects, uses, discloses, secures, and retains personal information in connection with Student Accounts and student-facing Platform features.

1. Company Information and Contact

InternFirst Inc., a Delaware corporation foreign-qualified to do business in North Carolina Business and correspondence address: 131 Continental Drive, Suite 305, Newark, DE 19713, New Castle County Email: lukebaltzell@intern-first.com Privacy, security, trust and safety, and privacy appeals: lukebaltzell@intern-first.com Telephone: InternFirst does not currently offer telephone support or a telephone privacy-request line. Requests may be submitted through the account controls described below or by email. Where applicable law requires another request method, InternFirst will provide it.

2. Scope and Key Commitments

This Policy applies to Students and prospective Students using the Platform. It does not govern an Employer’s independent systems after an Employer lawfully downloads a resume or otherwise receives information outside InternFirst’s control. InternFirst does not sell Student personal information and does not include identifiable Student personal information in Employer or university reports. Authorized Employers may receive identifiable information after a Student applies, may communicate with the Student, and may download the Student’s resume. Supabase, Stripe, and other service providers also process information to provide Platform services. InternFirst’s Employer verification process may compare an Employer representative’s work-email domain with the domain associated with the company website submitted during signup. If the domains do not match or the available information is inconclusive, the Employer Account is flagged for manual review and remains pending until the review is complete. This process is intended to reduce impersonation and false-affiliation risk but does not guarantee the identity, conduct, legitimacy, or legal compliance of an Employer or its users.

3. Information We Collect

Account and Verification Information

Full name
.edu email address
Optional phone number
Password or authentication credentials handled through Supabase Auth
Google or other social-login identifier if enabled
Email-verification status
Account role
Creation and update timestamps
Support and verification communications

Academic and Profile Information

College or university
Major or field of study
Graduation year
Biography
Profile image or avatar
Skills
Experience history
Projects and portfolios
Organizations, clubs, and campus involvement
Career interests, goals, preferred industries, work environment, duration, and skills of interest
Location and work preferences
External links and other information you add

Resume and Application Information

Resume file, display name, file reference, and upload time
Application answers and attachments
Listing applied to and submission date
Application status and pipeline stage
Match score
Withdrawal, interview, offer, and disposition information

Voluntary Self-Identification Information

Ethnicity and race
Gender and optional self-description
Veteran status
Disability status
U.S. work authorization
Present or future sponsorship needs
A declined response for each question

Self-identification is optional, is visible only to you through the ordinary interface, and is not available to Employers. It is not used in matching, ranking, or current reports. InternFirst will not begin demographic reporting without updated Terms and Privacy disclosures, appropriate safeguards, and any required consent. Messages, Interviews, and Activity

Messages, sender and recipient, read status, attachments, and timestamps
Interview dates, times, participants, status, duration, reminders, cancellation details, and meeting

links

Listings viewed, searches, filters, clicks, applications, status changes, messages, events,

RSVPs, notifications, and feature interactions

Employer-created internal notes and feedback, which are not ordinarily visible to you

Technical, Security, and Support Information

IP address
Browser, device, and operating-system information
Session or device identifiers
Approximate location derived from IP address
Authentication, access, error, security, and fraud-prevention logs
Cookie and local-storage identifiers
Support requests, complaints, appeals, privacy requests, and integrity reports

Payment Information

Paid service or subscription purchased
Amount and date
Billing contact information
Stripe customer and payment-method reference
Charge, invoice, receipt, payment status, refund, and dispute records

InternFirst does not store full payment-card numbers or card-security codes. Stripe and Link process payment credentials.

4. Sources of Information

Directly from you
From your device and use of the Platform
From Employers when they update applications, schedule interviews, send messages, or report

concerns

From Supabase, Stripe, and other service providers
From public educational-domain or verification sources
From other users reporting suspected fraud or abuse
From lawful legal or governmental sources

5. How We Use Information

Create, authenticate, verify, maintain, and secure your Student Account.
Confirm .edu eligibility and periodically re-verify access.
Provide profiles, applications, messaging, interviews, calendars, events, notifications, and career

resources.

Provide your application and authorized profile information to an Employer when you apply.
Generate recommendations, match scores, and job ranking or personalization.
Process paid services, subscriptions, refunds, and accounting records.
Provide support and communicate security, application, billing, policy, and service updates.
Prevent impersonation, fraud, scraping, harassment, discrimination, and security incidents.
Investigate complaints, enforce Terms, and establish or defend legal claims.
Maintain, test, analyze, and improve the Platform.
Create aggregate or de-identified analytics and reports concerning internship opportunity and

recruiting activity.

Comply with law and complete a financing, merger, acquisition, or asset transfer subject to

appropriate safeguards.

6. Matching, Ranking, and Explanations

InternFirst may analyze profile and listing information to estimate relevance or compatibility. Inputs may include skills, major, experience, education, location, availability, and listing requirements. Selfidentification data is not used. Detailed formulas, exact weights, source code, integrity controls, and proprietary methodology are accessible only to authorized InternFirst personnel. You may request a high-level explanation of principal factors affecting a match score or correction of inaccurate profile information by emailing lukebaltzell@intern-first.com. An explanation may omit trade secrets and security-sensitive details. Listings may be ranked using relevance, engagement, quality, pricing or promotion tier, freshness, performance, and integrity or operational factors. Paid placement may affect visibility.

7. Who Can See or Receive Student Information

You You can view and edit information available in your account, subject to technical and legal limitations. Employers Before You Apply Under the current design, an Employer cannot view your full Student profile merely because you created it. Employers After You Apply After you apply, authorized users associated with that Employer may view your identity, contact information, academic profile, skills, experience, organizations, resume, application materials, match score, messages, and interview information. Employers may download and retain your resume in their own systems. Employers cannot view your voluntary self-identification record through the Platform. Universities Verified universities may receive institution-level dashboards and purchased reports containing aggregate or de-identified internship-opportunity information, such as counts of registered or active students, number of applications, time to interview, time to offer, application and outcome trends, and similar recruiting metrics. Universities do not receive individual profiles, resumes, messages, applications, self-identification responses, or other identifiable Student information through these reports. Current reports do not segment or report based on race, ethnicity, gender, veteran status, disability status, work authorization, or other self-identification data. InternFirst will update this Policy and obtain any consent required before introducing demographic reporting. InternFirst Personnel and Service Providers Authorized InternFirst personnel may access information on a need-to-know basis for operations, support, verification, matching review, security, trust and safety, billing, legal compliance, and policy enforcement.

Supabase, for authentication, PostgreSQL database infrastructure, file storage, and related

services

Stripe and Link, for payment processing, payment-method storage, authentication, fraud

prevention, and transactions

Resend, for transactional and notification email delivery
Vercel, for application hosting and deployment
LiveKit, for interview video, audio, and real-time communication
Professional advisers, auditors, insurers, and security providers

Legal, Safety, and Business Transfers InternFirst may disclose information to comply with valid legal process; investigate fraud, security incidents, threats, or Terms violations; protect users or the public; obtain professional advice; or complete a merger, financing, reorganization, bankruptcy, acquisition, or asset transfer. InternFirst may also disclose information at your direction or consent.

8. No Sale, No Cross-Context Behavioral Advertising, and Aggregate Reporting

InternFirst does not currently sell Student personal information for monetary or other valuable consideration and does not currently share Student personal information for cross-context behavioral advertising. InternFirst does not include identifiable Student personal information in Employer or university reports. Authorized disclosure of an application to the Employer you selected, processing by service providers, or an Employer’s permitted resume download is not an external aggregate report and is separately described in this Policy. InternFirst may retain and use aggregate or de-identified information that is not reasonably linkable to an individual. InternFirst will take reasonable measures designed to prevent reidentification and may contractually prohibit recipients from reidentifying such information.

9. Uploaded File Storage and Access Controls

InternFirst stores resumes, profile avatars, company logos, and other uploaded files using private, access-controlled storage, currently through Supabase Storage. Files are not maintained in a publicly accessible storage bucket. InternFirst limits access according to account permissions and may deliver files through authenticated requests or private, short-lived URLs that expire after a limited period. You should avoid placing unnecessary sensitive information in a resume or uploaded file. After you apply, authorized Employer users may access your resume through the Platform and may download and retain copies in Employer-controlled systems outside InternFirst’s access controls.

10. Cookies and Similar Technologies

InternFirst and its providers may use cookies, local storage, session identifiers, and similar technologies to authenticate users, remember preferences, secure accounts, prevent fraud, process payments, diagnose errors, measure performance, and understand feature use. Stripe and Link may use cookies and device or interaction information for payment, authentication, fraud prevention, and Link functionality.

11. Retention

InternFirst retains personal information only as long as reasonably necessary for the purposes described in this Policy, subject to legal, security, fraud-prevention, accounting, dispute, and backup needs.

Active account and profile information: while the account is active.
After use of the “Delete Account” button: profile information may be retained in restricted form for

up to six months to permit restoration if you re-enroll or regain eligibility, unless earlier deletion is requested and no exception applies.

Applications, status history, interview records, and recruiting communications: generally up to

three years after the last relevant activity, subject to confirmation by counsel and engineering.

Voluntary self-identification information: while the account is active or until consent is withdrawn,

then deleted or de-identified from active systems within a reasonable period.

Security and access logs: generally up to twenty-four months.
Payment, tax, and accounting records: generally seven years.
Support, complaint, fraud, and enforcement records: for the period reasonably necessary to

address the matter and protect users.

Backups: deleted or overwritten on a rolling schedule.
Aggregate or de-identified information: may be retained without a fixed period where it no longer

reasonably identifies you.

12. Account Deletion

You may initiate deletion through the “Delete Account” button. This deactivates the account and removes it from active use. InternFirst may retain profile information in restricted form for up to six months for restoration. You may request earlier permanent deletion by emailing lukebaltzell@intern-first.com, subject to legal and operational exceptions. Deletion may not remove Employer-held resume copies, lawful recruiting records, transaction records, security or fraud records, records needed for disputes or legal obligations, temporary backups, or aggregate and de-identified information.

13. Security

InternFirst uses administrative, technical, and physical safeguards intended to protect information, including Supabase authentication, password hashing, database Row-Level Security, access controls, and logging. No system can guarantee absolute security. Report suspected compromise to lukebaltzell@intern-first.com. InternFirst will investigate suspected incidents and provide notices required by applicable law.

14. Your Privacy Choices and Rights

Access or confirm processing
Correct inaccurate information
Delete information
Obtain a portable copy where technically feasible
Withdraw consent for voluntary self-identification processing
Opt out of sale, targeted advertising, or certain profiling if such processing begins and the right

applies

Appeal a denied request where applicable
Receive non-discriminatory treatment for exercising a legal right

Submit a request or appeal to lukebaltzell@intern-first.com. InternFirst may verify identity, request proof of authorization for an agent, and deny or limit a request where required to protect another person, preserve security, comply with law, retain transaction or legal records, defend claims, or protect trade secrets. InternFirst will explain denials and appeal options where required. California Privacy Rights This section applies to California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), applies to InternFirst and the information at issue. California privacy rights may extend to students, job applicants, employees, independent contractors, and business contacts when the statutory requirements are met. Categories of Personal Information

Identifiers, such as name, .edu email address, optional phone number, account identifiers, IP

address, and profile image.

Customer-record information, such as contact details and payment transaction references.
Protected-classification and sensitive personal information that you voluntarily provide through

self-identification, including race, ethnicity, gender, veteran status, disability status, citizenship or immigration-related work-authorization information, and sponsorship needs.

Commercial information, such as paid-service purchases, subscription status, and transaction

history.

Internet or electronic-network activity, such as logins, listing views, searches, clicks, applications,

messages, and feature use.

Professional, employment, and education information, such as school, major, graduation year,

skills, experience, projects, organizations, resume, and application history.

Audio, electronic, visual, or similar information, such as profile images, uploaded files, or an

elevator-pitch video if that feature is enabled.

Approximate geolocation derived from IP address and location preferences supplied for job

matching.

Inferences, such as career interests, recommendations, match scores, and engagement or job-

relevance indicators. InternFirst collects and uses these categories for the business and commercial purposes described in this Policy, including providing accounts and recruiting services; verification; security and fraud prevention; analytics; communications; payments; customer support; legal compliance; and aggregate or de-identified reporting. Categories of recipients may include authorized users, Supabase, Stripe and Link, other service providers listed in this Policy, professional advisers, and government authorities when legally required. InternFirst has not sold personal information for monetary or other valuable consideration during the preceding twelve months and has not shared personal information for cross-context behavioral advertising during the preceding twelve months, based on the current pilot configuration. InternFirst does not knowingly sell or share the personal information of consumers under 16. California Rights

Right to know the categories and specific pieces of personal information collected, sources,

purposes, and recipient categories.

Right to delete personal information, subject to legal exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing for cross-context behavioral advertising.
Right to limit certain uses or disclosures of sensitive personal information when that right applies.
Right to non-discrimination for exercising CCPA rights.

Requests may be submitted by email to lukebaltzell@intern-first.com. Because InternFirst operates exclusively online and has a direct relationship with account holders, InternFirst currently designates email and in-account controls as its request methods. InternFirst may verify identity and authority before acting on a request. InternFirst will honor a legally recognized opt-out preference signal, including Global Privacy Control, for processing to which the signal applies. InternFirst does not currently display a “Do Not Sell or Share My Personal Information” link because it does not currently sell or share personal information as those terms are defined by the CCPA. Other U.S. State Privacy Rights Depending on your state of residence and whether a particular law applies to InternFirst and the information involved, you may have rights to confirm processing; access; correct; delete; obtain a portable copy; opt out of targeted advertising, sale, or certain profiling; withdraw consent to sensitive-data processing; designate an authorized agent; appeal a denied request; and receive non-discriminatory treatment. InternFirst intends this request process to accommodate applicable rights under laws such as the Texas Data Privacy and Security Act, Virginia Consumer Data Protection Act, Colorado Privacy Act, Florida Digital Bill of Rights, Delaware Personal Data Privacy Act, and similar comprehensive state privacy laws, subject to each law’s scope, thresholds, exemptions, and exceptions. Submit a request or appeal to lukebaltzell@intern-first.com. InternFirst generally aims to respond within 45 days and may extend the response period when permitted. If a request is denied, InternFirst will explain the reason and provide appeal or regulator-complaint information when applicable law requires it. Children and Minors The Student Services are intended for users at least 18 years old. InternFirst does not knowingly permit a person under 18 to create a Student Account. Contact lukebaltzell@intern-first.com if you believe a minor has created an account. International Users The pilot is intended for users located in the United States. International users should not create an account unless InternFirst expressly authorizes access and provides any required supplemental notice. Changes to This Policy InternFirst may update this Policy prospectively. For material changes, InternFirst will provide reasonable notice by email, in-product notice, or another conspicuous method. If a change materially expands use of sensitive information or introduces an incompatible purpose, InternFirst will obtain consent where required. Prior versions will be retained internally. Contact and Complaints InternFirst Inc., a Delaware corporation foreign-qualified to do business in North Carolina Business and correspondence address: 131 Continental Drive, Suite 305, Newark, DE 19713, New Castle County Email: lukebaltzell@intern-first.com Privacy, security, trust and safety, and privacy appeals: lukebaltzell@intern-first.com Telephone: InternFirst does not currently offer telephone support or a telephone privacy-request line. Requests may be submitted through the account controls described below or by email. Where applicable law requires another request method, InternFirst will provide it.