1. Introduction

At Cyber Jack Academy, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our educational platform. We are committed to protecting the privacy of families, especially children, as we teach them about internet safety.

2. Children's Privacy (COPPA Compliance)

Cyber Jack Academy is designed for use by parents and guardians with their children. We comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13 without verified parental consent.

• Parent/guardian creates the account (must be 18+)
• Parent provides child information (name and age only)
• We collect minimal information necessary for the educational experience
• Parents have full control over their child's information and can delete it at any time

2.5 FERPA Compliance for Schools

When Cyber Jack Academy is licensed by a school, district, or other educational institution, we operate as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g; 34 CFR Part 99). In that capacity:

• The school remains the owner and controller of all student education records
• We process student data only under the school's direction and only for the educational purposes the school authorizes
• We do not disclose personally identifiable information (PII) from education records to third parties without the school's written consent, except as permitted by FERPA
• We do not use student data for advertising, marketing, or profiling, and we do not sell student data — ever
• Schools can request access, correction, or deletion of student records at any time by emailing support@cyberjackacademy.com
• A signed Data Processing Addendum (DPA) is available at /dpa, and our full federal & state compliance posture (FERPA, COPPA, SOC 2 controls, 7-state coverage) is published at /compliance.

3. Information We Collect

3.1 Parent/Guardian Information

• Email address (for account creation and communication)
• Full name
• Password (encrypted and securely stored)
• Payment information (processed securely through Stripe; we do not store credit card details)
• Purchase history and product access entitlements (Cyber Jack Academy sells one-time purchases only — there are no auto-renewing subscriptions)

3.2 Child Information (Minimal Collection)

With parental consent, we collect only the minimum information necessary:

• Child's first name (for personalization)
• Child's age (to tailor content appropriately)
• Progress tracking data (completed challenges, earned certificates)
• No photographs, location data, or contact information is collected from children

3.3 Usage Information

• Pages visited and features used
• Time spent on the platform
• Browser type and device information
• IP address (for security purposes only)

4. How We Use Your Information

We use the information we collect to:

• Provide and maintain the educational service
• Track progress and issue certificates of achievement
• Process one-time purchases and grant ongoing access to the products you've purchased
• Send important updates, newsletters (optional), and weekly progress reports
• Improve our educational content and user experience
• Respond to customer service inquiries
• Protect against fraud and unauthorized access
• Comply with legal obligations

5. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information or your child's information to third parties.We may share information only in the following limited circumstances:

• Service Providers: Stripe (payment processing) and Resend (transactional email delivery) — these sub-processors are contractually obligated to protect your data and to process it only on our documented instructions
• Legal Requirements: When required by law, court order, or government regulation
• Safety: To protect the rights, property, or safety of Cyber Jack Academy, our users, or others
• Business Transfer: In the event of a merger, sale, or transfer of assets

6. Data Security

We implement industry-standard security measures to protect your information:

• Encrypted data transmission (HTTPS/SSL)
• Secure password storage with encryption
• Regular security audits and updates
• Limited access to personal information by authorized personnel only
• Secure payment processing through Stripe (PCI DSS compliant)

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for authentication and basic functionality
• Preference Cookies: Remember your settings and preferences
• Analytics: Help us understand how users interact with our platform (anonymized data)

You can control cookies through your browser settings, but disabling certain cookies may limit functionality.

8. Parental Rights and Controls

As a parent or guardian, you have the right to:

• Review your child's personal information
• Request deletion of your child's information
• Refuse to allow further collection or use of your child's information
• Access and update your account information at any time
• Export your data (upon request)
• Delete your entire account and all associated data

To exercise these rights, contact us at support@cyberjackacademy.com

9. Email Communications

We may send you:

• Transactional Emails: Account confirmations, password resets, payment receipts (cannot opt-out)
• Weekly Progress Reports: Optional updates on your child's learning progress (can opt-out in settings)
• Newsletter: Optional cybersafety tips and updates (can unsubscribe anytime)

10. Data Retention

We retain your information for as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymize your information within 30 days, except where we are required to retain it for legal, accounting, or security purposes.

11. Third-Party Links

Our platform may contain links to third-party websites for educational purposes. We are not responsible for the privacy practices of these external sites. We encourage parents to review the privacy policies of any site their children visit.

12. International Users

Cyber Jack Academy is operated in the United States. If you are accessing our service from outside the U.S., please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through a prominent notice on our website. The "Last Updated" date at the top of this policy indicates when it was last revised.

14. Your California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell personal information.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: