Children's Privacy Policy

1. Introduction

BOWER ("we," "us," or "our") operates educateprivately.com, a two-sided marketplace that connects parents with fingerprint-vetted educators for children's learning pods. We take children's privacy seriously and are committed to complying with the Children's Online Privacy Protection Act ("COPPA"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the California Age-Appropriate Design Code Act ("AADC").

This Children's Privacy Policy explains how we collect, use, and protect personal information from children under the age of 18 who use BOWER through accounts created by their parents or legal guardians.

2. Scope

This policy applies to any user of BOWER who is under 18 years of age. Parents or legal guardians create and manage all BOWER accounts on behalf of their children. Children do not create accounts directly.

For purposes of this policy: "Child" or "children" refers to individuals under the age of 18, consistent with the California AADC. "Young child" refers to individuals under the age of 13, who receive the highest level of protection under COPPA. "Teen" refers to individuals aged 13 through 17.

3. Information We Collect from Children

BOWER collects personal information from children solely through the Compass Quiz, an onboarding questionnaire completed by the parent on behalf of the child. We do not collect personal information directly from children.

3A. Information Collected Through the Compass Quiz

Age information: Date of birth (converted to age bracket; full date not retained). Used to determine applicable privacy tier and match with age-appropriate educators and pods.

Interests: Subject interests (e.g., science, art, music), hobby preferences, and favorite topics. Used to personalize educator and pod recommendations.

Learning needs: Learning style (e.g., visual, auditory, kinesthetic), any accommodations or special needs the parent chooses to share, and grade level or academic level. Used to help educators prepare and match with appropriate pods.

Preferences: Group size preference, scheduling preferences, in-person vs. remote preference, and geographic area. Used to match with compatible learning pods.

3B. Information We Do NOT Collect from Children

We do not collect precise geolocation data from children. We do not collect persistent identifiers (such as device IDs or IP addresses) from children for purposes other than supporting the internal operations of our site. We do not collect Social Security numbers, financial information, or government identification from children.

3C. Sensitive Personal Information (CCPA/CPRA)

Under the CCPA as amended (effective January 1, 2026), all personal information of consumers under the age of 16 is classified as sensitive personal information ("SPI"). BOWER treats all child data accordingly: processing is limited to the purposes disclosed in this policy (educational matching), we honor requests to limit the use and disclosure of SPI, and we conduct privacy risk assessments for processing of children's SPI.

4. How We Use Children's Information

We use children's personal information solely for the following purposes:

Educational matching. We use Compass Quiz responses to match children with vetted educators and compatible learning pods based on the child's interests, needs, and preferences.

Student Profile creation. We create a Student Profile from Compass Quiz data that educators can view when a parent initiates a connection. The Student Profile contains the child's first name, age bracket, interests, learning needs, and preferences.

Service improvement. We may use aggregated, de-identified data (from which no individual child can be identified) to improve our matching algorithms and service quality.

We do not use children's personal information for advertising or marketing to children, behavioral profiling or tracking, sale to any third party, or any purpose unrelated to the educational matching service.

5. Disclosure of Children's Information

5A. Educators. When a parent chooses to connect with an educator, the educator will be able to view the child's Student Profile. All educators on BOWER must pass a fingerprint-based background check before they can access any student information. Educators are contractually prohibited from using student information for any purpose other than providing educational services through BOWER.

5B. Service Providers. We may share children's information with service providers who help us operate BOWER (such as cloud hosting providers and database services), but only to the extent necessary for them to perform services on our behalf. These providers are contractually bound to use children's data only for the purposes we specify and to maintain appropriate security.

5C. We Do Not Sell or Share Children's Data. We do not sell children's personal information. We do not share children's personal information for cross-context behavioral advertising. We do not disclose children's personal information to any third party for that party's own commercial purposes.

5D. Legal Requirements. We may disclose children's information if required by law, court order, or governmental regulation, or if disclosure is necessary to protect the safety of a child.

6. Parental Consent

6A. Children Under 13 (COPPA). Before sharing any personal information about a child under 13 with an educator, we obtain verifiable parental consent ("VPC") from the child's parent or legal guardian. BOWER does not collect information directly from children — all child data is provided by parents through their own accounts. Because enrolling a child in a class discloses the child's profile information to the educator (a third-party disclosure under COPPA), we require higher-assurance consent at the point of enrollment. Our primary method is credit or debit card verification: when a parent completes a paid enrollment through Stripe Checkout, the financial transaction itself serves as verifiable parental consent. Before payment, the parent is shown a clear notice describing exactly what data the educator will see (name, age, allergies, emergency contacts, and any notes provided) and what data the educator may create (session journals, photos, attendance records). The parent must affirmatively acknowledge this disclosure before proceeding to payment. A timestamped consent record is stored in our system and a confirmation is sent to the parent by email.

6B. Teens 13–15 (CCPA/CPRA). For teens aged 13 to 15, we obtain parental acknowledgment and opt-in before disclosing the teen's personal information to educators. The teen's personal information is treated as sensitive personal information under CCPA/CPRA.

6C. Teens 16–17 (AADC). For teens aged 16 to 17, we provide clear privacy notices and set all privacy defaults to the highest level, consistent with the California AADC. These users may consent to data collection themselves, but privacy defaults cannot be lowered without an affirmative action.

7. Parental Rights

Parents and legal guardians have the following rights regarding their child's personal information:

7A. Right to Review. You may request to review the personal information we have collected from your child. We will provide this information within 45 days of a verifiable request.

7B. Right to Deletion. You may request that we delete your child's personal information. Upon receiving a verified deletion request, we will immediately remove the child's Student Profile from visibility to educators, delete the child's personal information from active databases within 30 days, purge backup copies within 90 days, and send you a confirmation when deletion is complete.

7C. Right to Revoke Consent. You may revoke your consent for us to collect and use your child's personal information at any time. Revoking consent will stop all further collection of your child's data, trigger deletion of existing data (per the deletion process above), disable the Compass Quiz and educator matching features for your child's profile, and not affect your parent account or any other child profiles on your account.

7D. Right to Refuse Without Penalty. You may refuse to consent to our collection of your child's personal information. If you refuse, your BOWER account will remain active, but the Compass Quiz and educator matching features will be unavailable for that child.

7E. Right to Limit (CCPA/CPRA). For California residents, you have the right to limit our use and disclosure of your child's sensitive personal information to only the uses necessary to perform the educational matching services.

7F. Right to Non-Discrimination. We will not discriminate against you or your child for exercising any privacy rights.

8. Data Retention

We retain children's personal information only for as long as necessary to provide the educational matching service.

Active accounts: Child data is retained for the duration of the active account.

Inactive accounts: If an account is inactive for 12 consecutive months, we will notify the parent and, absent a response within 30 days, automatically delete all child data.

Post-deletion: After account deletion or consent revocation, child data is removed from active databases within 30 days and from backups within 90 days.

Consent records: Records of parental consent are retained for 3 years after consent or account deletion (whichever is later) as required by COPPA.

Verification data: Identity verification documents (government IDs, credit card data) are deleted within 24 hours of verification and are never associated with the child's profile.

9. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect children's personal information.

Encryption at Rest: AES-256 encryption protects all stored data, including full database backups and archive copies.

Encryption in Transit: TLS 1.2+ encryption is enforced for all API endpoints and HTTPS is mandatory for all web communications.

Database-Level Access Control: Row Level Security (RLS) policies are enabled on all database tables and enforce granular access control, ensuring parents can only access their own children's data and educators can only access data for children they are actively enrolled to teach.

Consent-Gated Visibility: Child photos and learning records are only visible to parents when active parental consent is on file. Consent records track the specific consent type, timestamp, and version of the privacy policy agreed to.

Infrastructure Certification: BOWER's hosting infrastructure (Supabase) is SOC 2 Type 2 certified, with annual independent audits confirming security controls are operating effectively.

Password Security: All database credentials use SCRAM-SHA-256 encryption, resistant to rainbow table and brute-force attacks.

Additional administrative and physical security measures include access controls limiting employee access to children's data on a need-to-know basis, background checks for all employees who may access children's data, regular security assessments and vulnerability testing, and incident response procedures with notification to affected parents within 30 days of discovery.

10. Default Privacy Settings (California AADC Compliance)

Consistent with the California Age-Appropriate Design Code Act, BOWER configures all default privacy settings to offer a high level of privacy for users under 18:

Student Profiles are not visible to educators by default; a parent must initiate a connection. No personal information is used for advertising, profiling, or recommendation algorithms beyond the educational matching service. Location-based features default to off. No notifications or engagement techniques are used to encourage children to weaken their privacy settings. Privacy information is presented in clear, age-appropriate language.

11. Age-Appropriate Notices

BOWER provides privacy notices that are appropriate to the age of the child. For children under 13, all notices are directed to the parent and language is written for an adult audience. For teens 13–15, notices are provided to both parent and teen, and teen-facing language is written at approximately an 8th-grade reading level. For teens 16–17, notices are provided directly to the teen with a copy to the parent, and language is clear and jargon-free.

12. Privacy Risk Assessment

BOWER conducts Data Protection Impact Assessments ("DPIAs") for all processing of children's personal information. These assessments evaluate the necessity and proportionality of data collection, risks to children's privacy and wellbeing, measures to mitigate identified risks, and whether default settings are configured to the highest privacy level.

DPIAs are reviewed annually and updated when processing activities change.

13. Changes to This Policy

If we make material changes to how we collect, use, or disclose children's personal information, we will notify parents by email at least 30 days before the changes take effect, obtain new verifiable parental consent (for children under 13) before applying changes to existing accounts, and post the updated policy on our website with a revised "Last Updated" date.

14. Contact Us

If you have questions about this Children's Privacy Policy or wish to exercise any rights described herein, please contact us:

BOWER Privacy Team
Email: frontdesk@educateprivately.com
Phone: 1-310-740-7871
Mail: BOWER Privacy Team, 954 Old Topanga Canyon Rd, Topanga, CA 90290

For complaints or concerns about our compliance with COPPA, you may also contact the Federal Trade Commission at ftc.gov/complaint.