COPPA Policy

Our commitment: We do not collect personal information directly from children. We do not use children's data for advertising. We do not sell children's data. Ever.

1. What Is COPPA?

The Children's Online Privacy Protection Act ("COPPA") is a United States federal law that imposes requirements on operators of websites and online services directed at children under 13, and on operators who have actual knowledge that they are collecting personal information online from children under 13.

COPPA requires that covered operators: (1) post a clear and comprehensive privacy policy, (2) provide direct notice to parents before collecting personal information from their children, (3) obtain verifiable parental consent before such collection, and (4) give parents the ability to review, correct, and delete their children's information.

COPPA is enforced by the Federal Trade Commission (FTC). Violations can result in civil penalties of up to $51,744 per violation. We take our COPPA obligations seriously.

2. How COPPA Applies to Bright After School

Bright After School is not directed at children. Children do not create accounts, download the app, or interact with our Service directly. However, program operators (schools and after-school programs) create and maintain student records within the platform — records that contain information about children, including children under 13.

In the relationship between Bright After School and program operators, we act as a service provider processing student data on behalf of the program. The program operator — as the entity with a direct relationship with families — is responsible for:

• Obtaining appropriate parental consent before enrolling children in the platform
• Notifying parents about how their child's information is used
• Responding to parental requests to access, correct, or delete their child's data

BrightGrades Inc. processes children's information only as directed by and on behalf of the program operator, and only for the purposes described in this policy.

3. What Information We Collect About Children

The following information about children is stored in Bright After School. All of it is provided by program operators or parents — never collected directly from children.

We do not collect: photos of children, social security numbers, medical or health information, home addresses, financial information, or any biometric data from children.

4. How We Use Children's Information

Children's information is used exclusively to:

• Display the student in the program's dashboard so staff can manage attendance
• Match the child with their authorized pickup persons when a pickup is initiated
• Record check-in and check-out events for the attendance log
• Send notifications to parents when their child is checked in or out

We do not use children's information for:

• Advertising or marketing of any kind
• Building behavioral profiles or tracking children across other services
• Training machine learning models
• Any purpose beyond operating the Service for the program that enrolled the child

5. How Children's Information Is Shared

Children's information is shared only in the following circumstances:

• Within the program: Authorized staff members of the program can view the student roster and attendance records for their program only.
• With the child's parent/guardian: Parents can view their own child's check-in status and attendance history.
• Infrastructure providers: Our database and cloud hosting providers process data on our behalf under strict data processing agreements. They do not have independent access to or rights over student data.
• Legal requirements: We may be required to disclose information in response to a lawful court order, subpoena, or government request.

We never sell, rent, or trade children's information. We never share it with advertisers, data brokers, or analytics companies.

6. How We Protect Children's Data

Student data receives the same — and in some cases, heightened — security protections as all data on our platform:

• Encryption at rest: All student data is encrypted using AES-256 encryption
• Encryption in transit: All data transfers use TLS 1.2 or higher
• Access controls: Staff can only access data for students in their own program. No cross-program access is permitted.
• Audit logging: All access to student records is logged with timestamps and user identifiers
• Minimal collection: We only collect the student information necessary to operate the pickup verification system — nothing more

7. Parental Rights

Parents and legal guardians have the following rights with respect to their child's information in Bright After School:

• Right to review: You may request a copy of the personal information we have collected about your child by contacting us or your child's program administrator.
• Right to correct: You may request that inaccurate information about your child be corrected.
• Right to delete: You may request that your child's information be deleted. Note that deleting a child's record from the platform will remove their enrollment from the program.
• Right to refuse further collection: You may opt your child out of the platform by contacting your program administrator to remove your child's enrollment.

To exercise these rights, contact your child's program administrator directly, or contact us at privacy@brightgrades.com. We will respond within 5 business days.

Please note: we may need to verify your identity before fulfilling a parental rights request to ensure we are disclosing or deleting information to the correct parent or guardian.

8. Data Retention for Children

Student data is retained for as long as the child is actively enrolled in a program using Bright After School, and for up to 90 days after the program account is closed or the student is removed from enrollment. After this period:

• All personally identifiable student records are permanently deleted
• Attendance event logs (check-in/check-out) are deleted along with the student record
• No student data is retained in backups after 90 days of account closure

Program operators may request earlier deletion of specific student records at any time. Parents may also request deletion through their program administrator or directly with us.

9. Contact Us

If you are a parent or guardian with questions or concerns about your child's privacy, or if you would like to exercise any of the parental rights described above, please contact us:

You may also file a complaint with the Federal Trade Commission at ftc.gov or by calling 1-877-FTC-HELP.