🎁 Give the gift of Extern 🎁
Effective date and last updated: September 18, 2026.
This notice (our "Privacy Policy") tells you how we look after your personal data when you visit our websites at https://www.extern.com/ or any of our sub-domains (collectively referred to as the "Website"), when you are involved in our externship program ("Program"), where you are considering being involved in a Program, or where you are another type of business contact, such as a supplier or service provider to our business.
In this notice we sometimes need to tell two parts of the Website apart. The "marketing site" means www.extern.com. The "application" means app.extern.com, where you create an account, sign in and take part in a Program.
This notice sets out what information we collect about you, what we use it for and who we share it with. It also explains your rights and what to do if you have any concerns about your personal data. Our Cookie Policy is at the end of this notice and forms part of it.
We may sometimes need to update this notice, to reflect changes to the way the Program is provided or to comply with new business practices or legal requirements. When we do, we will post the updated notice on this page and change the date at the top. You should check this notice to see whether any changes have occurred.
Our legal name is Extern, Inc. and we do business as "Extern". Extern, Inc. is the legal entity responsible for your personal data (referred to as "Extern", "we", "us" or "our").
Depending on where you are located, you may be subject to jurisdiction-specific laws and regulations. This privacy notice is intended to provide you with the information that we are required to provide you with, wherever you are located. We will look after your personal data carefully wherever you are located, but you may not be able to exercise all of the rights set out below if you are resident in a jurisdiction where such rights do not exist.
If you are a resident of California, please also see Section 12 (California Privacy Notice). Where Section 12 conflicts with the rest of this notice, Section 12 controls for California residents. Residents of other US states should see Section 13.
Personal data means any information which does (or could be used to) identify a living person.
We have set out the types of personal data that we collect below.
We do not collect or store your full payment card number. You provide your payment details directly to our third-party payment processor, which processes payments on our behalf. We receive limited information about your payment, such as its timing, amount and status.
Sensitive information (also known as "special category" data) includes information about your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, sex life or sexual orientation.
We collect and process information about you and your interactions with us, for example:
We use personal data to:
In some jurisdictions we are required to identify a legal justification (also known as a lawful basis) for collecting and using your personal data. The most relevant lawful bases to us are set out below. If we intend to use your personal data for a new reason that is not listed, we will update our privacy notice.
Contract. Where we have a contract with you as an individual (for example in connection with your application to a Program), and the processing is carried out:
Legitimate Interests. Where using your information is necessary to pursue our legitimate business interests, but only if those interests are not outweighed by your other rights and freedoms (for example your right to privacy). We rely on this basis to:
Legal Obligation. Where we are under a legal obligation to conduct the processing, including:
Consent. Where you have provided your consent to the use or sharing of your information, including:
We may anonymize the personal data we collect (so it can no longer identify you) and then combine it with other anonymous information so it becomes aggregated data. Aggregated data helps us identify trends (for example what percentage of users responded to a specific survey). Data protection law does not govern the use of aggregated data and the rights described below do not apply to it.
Where we need to collect your personal data (for example, in order to fulfill a contract we have with you), failure to provide us with your personal data may mean that we are not able to provide you with the services.
5.1 Artificial intelligence
Some features of our services use third-party artificial intelligence service providers, which process personal data on our behalf. We do not use the work you submit to train artificial intelligence models. If you have questions about this, contact us at support@extern.com.
We may send you marketing messages where you have consented, or where we are otherwise not legally prohibited from doing so.
You can opt out of receiving marketing messages from us at any time. Use the unsubscribe link in any marketing email or let us know at support@extern.com. Opting out of marketing will not affect our processing of your personal data in relation to any contract you have with us, where we are required to use your personal data to fulfil that contract or provide you with certain information.
We share (or may share) your personal data with:
A current list of the service providers and partners in these categories is available on request from support@extern.com.
If we were asked to provide personal data in response to a court order or legal request (for example from the police), we would carefully consider the request and the impact on your rights before responding.
7.1 Advertising, and the "sale" and "sharing" of personal information
We advertise the Program on third-party platforms and we measure how that advertising performs. To do this we disclose personal information to advertising and measurement partners. These partners include search, social media and other online advertising platforms and the measurement and analytics services connected to them.
The personal information we disclose to these partners is:
This information can reach our partners in more than one way: through cookies, pixels and similar technologies that run in your browser, and directly from our systems (see Section 3 of the Cookie Policy).
We do not sell your personal information for money. However, the disclosures described in this section are "sharing" for cross-context behavioral advertising, and may also be considered "sales", as those terms are defined by the California Consumer Privacy Act. Our partners may use this information for their own purposes, as described in their own privacy notices, including to show advertising to you on other sites and services.
You have the right to opt out of the sale and sharing of your personal information. Your right applies to these disclosures themselves, however the information is transmitted, and not only to cookies. Section 12.6 explains how to exercise it.
7.2 Children and minors
Our services are intended for people aged 18 and over and are not directed to children. We do not knowingly collect personal information from children under 13. If you believe someone under 18 has provided us with personal information, please contact us at support@extern.com and we will review the account and the information.
We are based in the USA. When you provide your personal data to us, it will be transferred to and processed in the USA.
We may also disclose personal information across borders to host companies who take part in our Programs, and to third parties so that they may perform services for us, on our behalf, or in the context of the provision of our services to you.
We may also disclose your personal information across borders to others where:
We have implemented security measures designed to prevent your personal data from being accidentally or illegally lost, used or accessed by those who do not have permission. These measures include:
If there is an incident which has affected your personal data and we are the controller, we will notify the regulator and keep you informed (where required under data protection law). Where we act as the processor for the affected personal data, we notify the controller and support them with investigating and responding to the incident.
If you notice any unusual activity on the Website, please contact us at support@extern.com
We keep your personal data for as long as necessary to fulfill the purposes we collected it for.
To decide how long to keep personal data (also known as its retention period), we consider the volume, nature, and sensitivity of the personal data, the potential risk of harm to you if an incident were to happen, whether we require the personal data to achieve the purposes we have identified or whether we can achieve those purposes through other means (e.g. by using aggregated data instead), and any applicable legal requirements (e.g. minimum periods for keeping accounting and tax records).
We may keep Identity Data, Contact Data, information about payments received from you and certain other data (specifically, any exchanges between us by email or any other means) for up to seven years after the end of our contractual relationship with you.
If you browse our website, we keep personal data collected through our analytics tools for as long as necessary to fulfill the purposes we collected it for.
If you have registered an interest in our Program or services, or you have subscribed to our mailing list, we keep your details until you ask us to stop contacting you.
We may keep personal data for longer where we are required to do so by law, or where we need it to establish, exercise or defend legal claims.
You have specific legal rights in relation to your personal data, which may vary by jurisdiction. The following list sets out your legal rights if you are resident in the European Economic Area or in the UK. Where these rights do not apply to you by law, we will consider your request. If you wish to exercise any of the rights listed below, please contact support@extern.com.
If you are a resident of California, your rights are set out in Section 12. If you are a resident of another US state, see Section 13.
We can decide not to take any action in relation to a request where we have been unable to confirm your identity (this is one of our security processes to make sure we keep information safe) or if we feel the request is manifestly unfounded or excessive. We may charge a fee where we decide to proceed with a request that we believe is unfounded or excessive. If this happens, we will always inform you in writing.
This Section 12 supplements the rest of this notice and applies only to consumers who reside in the State of California. It is provided under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (together, the "CCPA"). Terms defined in the CCPA have the same meaning when used in this Section.
12.1 Categories of personal information we collect
We collect, and in the preceding 12 months have collected, the following categories of personal information:
12.2 Sources
We collect personal information from the sources described in Section 4: from you directly; automatically from your browser or device when you use our Website; and from third parties, such as referral sources, educational institutions and other organizations that arrange your participation, host companies, advertising and analytics partners, and publicly available or third-party vendor sources.
12.3 Purposes
We collect and use each category of personal information for the business and commercial purposes described in Section 5. These include providing the Program, communicating with you, analytics and product improvement, advertising and marketing (including cross-context behavioral advertising), security and fraud prevention, and legal compliance.
12.4 Disclosing, selling and sharing
Categories disclosed for a business purpose. In the preceding 12 months we have disclosed each category of personal information listed in Section 12.1 to the service providers described in Section 7, to the extent they need it to provide their services to us. We have disclosed identifiers, personal records, professional and education information, and audio or visual content to prospective host companies and to organizations that arrange your participation. Any category may be disclosed to our professional advisers, to regulatory or government authorities, and to a buyer or successor in a business transfer, where required or permitted by law.
Categories sold or shared. We do not sell personal information for money. In the preceding 12 months we have shared the following categories of personal information with advertising and measurement partners for cross-context behavioral advertising, and under California law these disclosures may also be considered "sales":
The categories of third parties who received this information are advertising and measurement partners, as described in Section 7.1.
We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.
12.5 Retention
We keep each category of personal information for as long as is necessary for the purposes described in Section 5, applying the criteria and periods set out in Section 10.
12.6 Your California privacy rights and how to exercise them
If you are a California resident, you have the following rights, subject to certain exceptions:
Requests to know, delete or correct. Email support@extern.com with the subject line "California Privacy Request" and tell us which right you wish to exercise. You may ask for information we collected before the 12 months preceding your request. You can also write to us at the address in Section 14.
Opting out of sale and sharing. Your right is to opt out of the disclosures described in Section 7.1 themselves, however the information is transmitted. You can exercise it in the following ways:
A banner choice applies to the site where you make it (the marketing site or the application), in the browser you are using.
Global Privacy Control. On the marketing site and the public pages of the application, we do not sell or share your personal information through technologies in your browser unless you choose to allow Marketing technologies. This default applies to every browser, including browsers that send a Global Privacy Control (GPC) signal.
Sensitive personal information. We collect race or ethnicity and citizenship or immigration status as described in Section 3, where you provide them, and this information is processed on our behalf by service providers, including our customer data infrastructure provider. We may use or disclose sensitive personal information for purposes other than those the CCPA regulations permit without a right to limit, which is why you have the right described here. You have the right to direct us to limit our use of your sensitive personal information to the purposes permitted by the CCPA, such as providing our services, security and legal compliance. To exercise this right, email support@extern.com with the subject line "Limit the Use of My Sensitive Personal Information". You can also ask us to delete this information.
Verification. To protect your information, we will take steps to verify your identity before responding to a request to know, delete or correct, typically by matching information you provide against information we hold. We cannot respond to these requests if we cannot verify your identity. We do not require verification for a request to opt out of sale and sharing or to limit the use of sensitive personal information, but we may ask for the information we need to find your records.
Authorized agents. You may use an authorized agent to submit a request. We may require the agent to provide proof of your signed permission, and we may require you to verify your own identity directly with us or confirm that you gave the agent permission.
Timing. We will respond to your request within the time periods required by the CCPA. If we need more time to respond to a request to know, delete or correct, we will tell you the reason and the extension period in writing.
12.7 California "Shine the Light"
California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. You may make one request per year by emailing support@extern.com.
Depending on the state you live in, you may have rights similar to those described in Section 12, such as the right to access, correct or delete your personal data, to obtain a copy of it, and to opt out of targeted advertising, the sale of your personal data, and certain profiling. To exercise these rights, email support@extern.com and tell us the state you live in and the right you wish to exercise. You can opt out of targeted advertising and sale using the methods described under "Opting out of sale and sharing" in Section 12.6.
If we decline to act on your request, you may appeal by replying to our decision or by emailing support@extern.com with the subject line "Privacy Appeal". We will respond to your appeal in writing. If your appeal is denied, you may contact the attorney general of your state.
If you have questions about this notice or our privacy practices, or wish to exercise any of your rights, contact us at:
This Cookie Policy explains how we use cookies and similar technologies on the Website. "Similar technologies" include pixels, tags, software development kits and storage in your browser (such as local storage).
Cookies are small files placed on your computer or internet-enabled device when you visit a site. They allow the site to remember your computer or device and serve a number of purposes.
Session and persistent cookies: cookies which only last a short time or end when you close your browser are called session cookies. Cookies which remain on your device for longer are called persistent cookies (these are the type of cookies that allow websites to remember your details when you come back).
First party and third party cookies: cookies placed on your device by the website owner are called first party cookies. When the website owner uses other businesses' technology, the cookies added by the other business are called third party cookies.
Our cookie banner groups cookies and similar technologies into four categories:
When you first visit the marketing site (www.extern.com) or the public pages of the application (app.extern.com), such as the sign-up and sign-in pages, a banner asks for your choice. You can allow all categories, choose "Do not sell or share my personal information" (which declines all categories other than Necessary), or open "Show details" to choose by category. After you have made a choice, you can reopen the banner at any time using the consent widget shown on the page. The marketing site and the application each remember your choice separately.
Until you allow them, and if you decline or do not respond to the banner:
If you allow all categories, advertising and measurement, analytics, product-experience and session replay technologies will run, including a session replay tool supplied by one of our advertising and measurement partners. Session replay records how you interact with a page, such as your clicks, mouse movements, scrolling and the pages you view.
Some technologies are not controlled by the banner. These are Necessary cookies and similar technologies; first-party storage that we set ourselves to operate and measure the Website (for example a visitor identifier, the version of a page you were shown, the Attribution Data described in Section 3 of the Privacy Policy, and the record of your choice); and service providers that help us deliver, operate and measure the Website on our behalf. Whatever choice you make in the banner, these service providers receive information such as the pages you view, your IP address, the visitor identifier and the Attribution Data.
The signed-in application
Once you are signed in, the application uses Necessary technologies, and analytics, product-experience, session replay and error-monitoring tools operated by our service providers, to run and improve the product. Session replay records how you interact with the application, which can include information displayed on a page and information entered into it. These service providers process this information on our behalf.
The record of your choice
We keep a record of the choices you make in the banner, including when and where you made them and technical information about your browser, so that we can demonstrate and honor your choices. Our consent management provider also keeps a record of your choice.
Not all advertising measurement happens in your browser. We also send information about events, such as a sign-up or a purchase, directly from our systems to our advertising and measurement partners, as described in Section 7.1 of the Privacy Policy. These events are sent from our systems, so your browser settings alone do not control them. You can opt out at any time using the methods described in Section 12.6 of the Privacy Policy.
You can change your choice at any time using the consent widget shown on the page.
You can also manage or delete cookies through your browser settings or device settings (your browser's help pages contain more information). If you block Necessary cookies, some pages and functions on our Website may not work properly. Clearing cookies or using a different browser or device means your earlier banner choice will no longer be remembered, and you may be asked again.
Many of our advertising and measurement partners offer their own opt-out tools. For example, Google offers a browser add-on to opt out of Google Analytics.
Do Not Track: some browsers offer a "Do Not Track" setting. There is no common industry standard for this signal, and our Website does not respond to it.
If you have any questions about our cookies, or how we otherwise use your personal data, please contact us at support@extern.com.
