Skip to main content

Step 1 Online Privacy Statement

Revision date: September 30, 2025

Step 1 Scholarship SearchSM (the "Service") is a free online search tool provided by Iowa Student Loan Liquidity Corporation, an Iowa nonprofit doing business as ISL Education Lending (referred to as "Step 1" or "ISL"), in an unaffiliated collaboration with ICAN (collectively referred to as "we", "our", or "us"), located at www.Step1Scholarships.org ("Website"). Use of this Service is governed by our applicable Terms of Use and this Online Privacy Statement, along with other potentially applicable agreements, terms and conditions as described below.

We understand that you are concerned about the privacy and security of your Personal Information (as defined below). This Online Privacy Statement ("Privacy Statement") applies to the information we collect from you online when you access our Service through this Website; additional privacy statements and terms apply when you visit other websites that we own and control. The amount, type and use of the information we receive depends on how you use this Website, other websites and the kinds of products or services you receive.

By using this Website, you accept this Privacy Statement and consent to its terms. If you don't agree to the terms contained in this Privacy Statement, you must immediately exit this Website.

Collecting and Using Your Personal Information

  • Information we collect from you. We collect Personal Information (defined below) that you provide to us directly through our Website(s); electronic mail; electronic website forms; and other electronic means. "Personal Information" means information that can specifically identify you and includes, without limitation, your name; phone number; mailing address; email address; the account/profile details you submit like a high school, college or university you attend or that your student or dependent attends, your course of study and other academic details (e.g., groups or memberships), your planned year of graduation, etc.; and/or web-based identifiers like cookies, IP addresses and log files (as described below). We collect and use this information when you register and/or set up an account/profile to access, visit and/or use certain portions of this Website or any of the other websites in our control.
  • Information that we collect from third parties. We may collect from third parties certain limited information that pertains to your use of this Service, this Website and other websites, products and services we offer that are within our control. This information may include de-personalized or aggregated data to make this Service, our Website and other related items functional and operational.
  • Information that we collect automatically. We may automatically collect information about you related to your use of this Website or our other websites using cookies, web beacons and log information. We use the information gathered from cookies, web beacons, logs and similar tools to monitor website performance; improve website design, functionality, and security; assemble web analytics and activity trends; and to measure, improve and customize our products and services. We may use cookies, web beacons and other technologies from third-party service providers to satisfy these functions. The information we may collect includes, without limitation, the make, model, settings, specifications (e.g., CPU speed, connection speed, browser type, operating system, device identifier) and geographic location of you and/or your computer, mobile or other device, as well as date/time stamp, IP address, pages visited, time of visits, content viewed, ads viewed, the website(s), application(s), destination(s) and/or service(s) you arrived from, and other clickstream data.
  • Google Analytics is a tool we use to collect information about use of this Website. Google Analytics collects information such as how often users visit this Website, what pages they visit when they do so, what other sites they used prior to coming to this Website and an anonymous IP address not exactly matching the IP address of the device used to connect to our site. We use some of the information we get from Google Analytics to improve this Website and provide information regarding our products to you. We do not combine the information collected from Google Analytics with any of your Personal Information. Although Google Analytics plants a permanent cookie on your device's web browser to identify you as a unique user the next time you visit this Website using that same device, the cookie cannot be used by anyone but Google. You can read Google's Privacy Policy to learn how Google uses the data gathered by Google Analytics.

Users can opt out of Google Analytics tracking; to learn more visit Google's site: https://tools.google.com/dlpage/gaoptout.

Cookies and other browser-related items are explained further in this Privacy Statement.

We may use the Personal Information that we collect from you or third parties to:

  • Register you with this Website and to create an online account/profile.
  • Communicate with you.
  • Provide you with products or services that you request.
  • Provide you with troubleshooting or related details.
  • Provide you with updates.
  • Provide you with marketing and surveys.
  • Provide you with information you request regarding our products or services or in response to your questions.
  • Verify your identity.
  • Detect and prevent identity fraud with respect to your account/profile, violations of our legal agreements, and illegal activity.
  • Comply with legal or regulatory requirements.
  • Make business decisions.
  • Fulfill other technical, logistical, financial, tax, legal, compliance, administrative or back-office functions.

Remarketing

This Website uses third-party remarketing services, such as Google or Microsoft Ads, to advertise our products and services on other websites to previous visitors of our website. Third-party remarketing services including Google will use cookies and pixel tags (action tags) on your web browser to collect non-identifiable information about your visits and interaction with our website—including button clicks and page visits—and display advertisements based on these past visits. The advertisements could be in the form of an advertisement on a Google or Bing search results page, a site in the Google Display Network, a banner or link. These advertisements on third-party websites allow us to track responses to our ads.

  • Google Ads. You can set preferences for how Google advertises to you using the Google Ad Settings page.
  • Microsoft Ads. We use certain services from Microsoft related to our websites and online ads, following their contracts and terms. Because of this, Microsoft may receive or collect some of your Personal Information. Please review the Microsoft Privacy Statement for more information.

If you want, you can opt out of interest-based advertising entirely by changing your cookie settings, permanently using a browser plugin or opting out of a third-party vendor's use of cookies by visiting the Network Advertising Initiative opt-out page.

Cookies are small files containing strings of text stored on your computer, mobile or other device. We use cookies to authenticate you as a user when you log in, to track your session, to deliver content specific to your preferences and interests, and to provide other functions.

We may use session cookies or persistent cookies.

  • Session cookies are temporary and are deleted after you close your web browser. Session cookies do not collect personal information from your computer, mobile or other device. Among other uses, session cookies allow us to deliver content specific to your interests and to improve website navigation.
  • Persistent cookies assist in verifying the identity of a customer who is attempting to log in to an online account, like accessing Step 1 via this Website. We use persistent cookies for customer protection, as part of our authentication technology.

Web beacons are objects embedded into web pages that allow a website to count users and determine how long users view web pages. We use web beacons for website traffic reporting, unique visitor counts, auditing and reporting, personalization, and other functions.

A web beacon embeds a small transparent gif image in a web page or email used to track when the web page or email has been viewed. A similar device may be used where a product, service or functionality sends data to a server when a set of user-initiated events occur, such as clicking a button on the website or in an email. This is similar to a cookie—it tracks your visit, and the data is only read by the server that receives the data. However, it differs because it is not browser-based, may not function as an ID card and doesn't store any data on your computer.

Log file information is automatically reported by your browser each time you access this Website. When you access this Website, our servers may automatically record certain log file information. These server logs may include Personal Information such as your web request, Internet Protocol ("IP") address, browser type, browser language, operating system, platform type, the state or country from which you accessed the website, software and hardware attributes (including Device ID), referring/exit pages and URLs, number of clicks and how you interact with links on the website, domain names, landing pages, pages viewed and the order of those pages, the date and time you visited the website and uploaded or posted content, error logs, files you downloaded, and other such information. We use this information to enhance the functionality of this Website and to make your access more convenient, secure and efficient. We may also use this information to develop group profiles of website visitors, to assist with systems administration, to resolve problems and to prevent fraud.

Location information is general location information (e.g., IP address, city/state and or ZIP code associated with an IP address) that we automatically collect from your computer or mobile device. We use this information to enhance your experience of using this Website.

Most internet browsers are set up to accept cookies automatically. You may stop your browser from accepting cookies or web beacons or providing location information. The Help portion of your browser should explain how to configure your browser's settings. Your browser may have add-ons that may help you block web beacons. You may have limited functionality if you block cookies or web beacons set by this Website. Please note that if you disable such features, you may not be able to access or receive some or all of the services, content, features and/or products made available via this Website.

If you do disable such features, please note that we are unable to respond to Do Not Track signals or similar tools and settings at this time due to the limits of current internet technology, standards and solutions.

Updating Your Personal Information

Keeping your Personal Information up to date is important. You may review or update your Personal Information by logging in to your account/profile via this Website or a link we send to you. If you encounter information that cannot be changed online or if you prefer to request changes offline, you may email Contact@step1scholarships.org and/or Privacy@studentloan.org.

Disclosure and Sharing of Personal Information

We may disclose or share your Personal Information to our affiliated companies, employees and individuals who have a need to know; and to certain unaffiliated entities and parties that perform services and functions on our behalf under various legal agreements that have confidentiality requirements. These entities include, but are not limited to, external auditors; marketing service providers; vendors that facilitate parts of this Website and/or your interactions with us; database managers; and others who perform technical, logistical, financial, tax, legal, compliance or administrative functions on our behalf. They may perform functions including, but not limited to, providing products and services; analyzing data; supplying marketing assistance; providing search results and links; sending postal mail and email; providing limited customer service about your account/profile issues or use of this Website; and providing other financial, technical, logistical, tax, legal, compliance or administrative functions. All parties who receive your Personal Information are required to maintain reasonable safeguards to protect the privacy of your Personal Information.

In addition, we may disclose Personal Information where:

  • Required by law, by court rules concerning the production of records or by an order or requirement of a court, administrative agency, law enforcement authority or other government entity.
  • We have reasonable grounds to believe that use or disclosure is necessary to protect the rights, privacy, property or safety of our users, employees or others.
  • We have reasonable grounds to believe that the information relates to the breach of an agreement or violation of the law that has been, is being or is about to be committed.
  • It is necessary for fraud protection, risk reduction or the establishment or collection of funds owed to us, if applicable.
  • It is necessary to enforce or to apply our legal agreements, to pursue remedies or to limit damages to us.
  • The information is public.
  • You have provided consent or with your direction.
  • Other reasons allow it or other laws require it.

We may share de-personalized, aggregated or statistical data with certain unaffiliated parties for community reinvestments, public relations or other purposes, including to support our mission.

Storing and Protecting Your Personal Information

Your Personal Information that we collect through this Website and other websites that we control may be stored and processed in the United States or any other country in which we or our subsidiaries, affiliates or service providers maintain facilities. We may transfer information that we collect about you, including Personal Information, to affiliated entities or to other third parties across borders and from your country or jurisdiction to other countries or jurisdictions around the world.

We care about the security of your Personal Information and take reasonable technical and organizational measures to protect your data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access. These measures vary depending on the sensitivity of the information we have collected from you. However, no method of transmission over the internet or via mobile device or method of electronic storage is absolutely secure. Therefore, while we strive to use commercially reasonable means to protect your information, we cannot guarantee its absolute security. We are not responsible for the functionality or security measures of any third party.

To protect your privacy and security, we take steps (such as requesting a unique password) to verify your identity before granting you access to your account through use of this Website. You are responsible for maintaining the secrecy of your unique password and account information, and for controlling access to your email communications from us, at all times. Do not share your password with anyone and do limit access to your computer or other devices by signing off after you have finished accessing your account.

For information about how to protect yourself against identity theft, please refer to the Federal Trade Commission's website at www.ftc.gov and search for the latest identity theft and data security resources.

Retaining Your Personal Information

Following termination or deactivation of your account or any other actions we may take, we may retain your profile information for an additional period for backup, archival or audit purposes. In certain circumstances, we are required by federal and state regulations to store various information. In order to comply with those requirements, we may be unable to delete your Personal Information from our systems until the expiration of the applicable period. This is known as retaining information. Afterward, your Personal Information will be deleted or destroyed in accordance with our policies for information security and privacy that comply with applicable law.

Opting Out of Future Product, Service, or Event Notifications

We may contact you or send you information about new products or services or upcoming events. If you do not want to receive information about products, services or events, you may send an email to Privacy@studentloan.org or use the information in the Contact Information section below to contact us. If possible, please provide your exact name and address or email address as it appears on any mailings you have received from us. Your election not to receive information does not change our ability to send you information about your account with us.

Protecting Your Personal Information: Security Measures

We protect your Personal Information by maintaining administrative and technical safeguards. We use encryption technology to secure your information when being transmitted. Because no data transmission is completely secure, you understand there is some risk when you send us your information.

We also train our employees in the proper handling of Personal Information. When we use other companies to provide services, we require them to protect the confidentiality of any Personal Information they may receive. We combine these technical safeguards with physical safeguards and employee policies to protect your information.

Maintaining Children’s and Teens’ Privacy

We do not knowingly collect, maintain or use Personal Information from this Website or any of our websites about children under age 13. If you are under age 13, do not share Personal Information with us.

We may collect, maintain or use limited Personal Information of teenagers, defined in certain applicable laws as minors (individuals aged 13 to 17 years old) in order to provide the requested Service and for the purposes outlined in this Privacy Statement. We do not process or use Personal Information for targeted advertising or profiling (as such terms are defined in applicable laws).

Managing Linked Sites

This Website may display links to websites of other companies. If you link to a site that is not a website we own and control, the privacy policy of that site applies to you. We are not responsible for the way that site may collect, use, disclose or secure the personal information that you provide to them. Please read their privacy policy to learn how they use your personal information.

Changing this Privacy Statement

We may change this Privacy Statement on one or more occasions by posting a revised Privacy Statement on this Website or a website replacing this Website; in some cases, we may notify you about changes via email. Any changes to this Privacy Statement will become effective when posted unless indicated otherwise. Your continued use of our websites shall constitute your agreement to any revised Privacy Statement. Please save and print a copy of this Privacy Statement for your records.

California Privacy Rights

Under California Civil Code Section 1798.83 (known as the "Shine the Light Law"), if you are a resident of California, you may request certain information about our disclosure of personal information about you during the prior calendar year to third parties for their direct marketing purposes. To make such a request, please write to us at the following address:

Privacy Department
Iowa Student Loan
P.O. Box 659704
West Des Moines, IA 50265-0970

Alternatively, you may send us an email at Privacy@StudentLoan.org.

Privacy Rights for Residents of Certain States

If you are a resident of certain states, you may have certain rights and choices regarding how we process your "personal data" and/or "sensitive data", as defined under such laws, and how you can exercise those rights.

We do not sell "personal data" or "sensitive data", nor have we sold it, in the last 12 months. We do not share, use or disclose "sensitive data" for purposes other than those provided by applicable law to facilitate our legitimate business purposes, such as providing you with this Service.

Exceptions

Certain information and data that we collect may be exempt from a state privacy law because it is considered public information or it is covered by financial privacy laws, such as the Gramm-Leach Bliley Act, the California Financial Information Privacy Act, the Health Insurance Portability and Accountability Act, or the Fair Credit Reporting Act, or because it may be exempt for other legitimate business purposes.

To the extent that we collect "personal information", "personal data", "sensitive personal information" or "sensitive personal data" subject to an applicable state privacy, that information/data, our practices, and your rights are described below, and otherwise throughout this Online Privacy Statement (also known as a privacy notice or privacy policy).

We collect the following categories of "personal data" or "sensitive data" for providing this Service and the purposes outlined in this Privacy Statement, also in accordance with our written contracts and pursuant to applicable laws:

  • Unique personal identifiers that include, but are not limited to:
    • Name
    • Email address
    • Internet Protocol (IP) address
    • Postal address
  • Profile information that includes education information (grade, school of attendance, type of school, etc.); preferences, hobbies and interests relating to scholarships; and other data that can be used to identify or reasonably link to you as a unique person or to your device by which you access this Website.

Your privacy rights may include:

  • The right to access your personal data or sensitive data that we may collect from or about you.
  • The right to know what personal data or sensitive data that we may collect about you by requesting that we disclose to you, or your authorized agent, free of charge, the following:
    • The categories of personal data that we have collected about you or the person for whom you are the authorized agent, or have shared with third parties, if any.
    • The business or commercial purpose for collecting or selling personal data.
    • The categories of third parties with whom we share personal data.
    • The specific pieces of personal data we have collected about you or the person for whom you are the agent.
  • The right to delete any personal data, subject to exceptions.
  • The right to correct any inaccurate personal data that we maintain.
  • The right to obtain a copy of your personal data in a portable, accessible, readily usable format.
  • The right to be free from discriminatory treatment, including retaliation, for the exercise of your privacy rights as conferred by applicable law.

You may submit a request to exercise any of your privacy rights listed above by providing your first name, last name, email address, telephone number, postal address and ZIP code (personal identifiers) via email to Privacy@Studentloan.org.

We authenticate or verify you based on your personal identifiers that you provide to process your privacy request(s), or requests made on your behalf, if applicable.

We may deny requests pursuant to the exceptions provided under applicable laws; our responses to your requests will include detailed explanations to such effect. You may appeal a denial of your request by contacting us via email or mail, as provided in this Privacy Statement. We respond timely to all requests but in no event will any response be later than 45 days from when your request was received.

You may also designate an authorized agent to make such requests on your behalf by mailing a signed Power of Attorney to:

Compliance Department
Iowa Student Loan
P.O. Box 659704
West Des Moines, IA 50265-0970

We will not discriminate against you because you exercise any of your rights under applicable law. You will not be retaliated against for the exercise of your rights under applicable law.

Nevada Residents Disclaimer

Nevada residents have the right to opt out of the sale of certain pieces of their information. We do not sell "personal information" of Nevada residents, but, if you are a Nevada resident who has questions or who wants to make this type of request, please send your email to Privacy@StudentLoan.org.

Contact Information

If you have questions about this Privacy Statement, please contact:

Privacy Department
Iowa Student Loan
P.O. Box 659704
West Des Moines, IA 50265-0970
(800) 507-3814

Alternatively, you may send us an email at Privacy@StudentLoan.org.