Privacy Policy

At Impacter Education Corporation ("IMPACTER," "we," "us," or "our"), we recognize that student privacy is important. This policy ("Privacy Policy") outlines the types of personal information we receive and collect when you use:

• IMPACTER's informational website at https://impacterpathway.com/ (the "Website")
• Our education products and services, including logged-in areas of our website and the IMPACTER application available at http://students.impacterpathway.com/ (collectively "Education Services")

Together, these are referred to as our "Services."

IMPACTER Services are provided exclusively to K-12 school districts and educational institutions and their authorized users (students, teachers, administrators, and staff). Authentication to our Education Services occurs through district-managed accounts, including Google Workspace for Education and Clever. IMPACTER does not offer accounts to individual consumers or general-audience users.

This Privacy Policy explains:

• What information we collect (and why we collect it)
• How we use and share that information
• The choices and rights you have, including how to access, update, and delete your information
• How we protect children's privacy under COPPA

We hope this will help you make an informed decision about sharing personal information with us.

Protecting your privacy is incredibly important to us. This Privacy Policy is here to help you understand how we treat any personal information that you share with us when you visit IMPACTER's Website or use our Education Services.

1. YOUR CONSENT TO THIS PRIVACY POLICY

By using our Services, you agree to the terms of this Privacy Policy as they may be amended from time to time. This Privacy Policy is incorporated into our Website Terms of Use and our Education Services Terms, of which this Privacy Policy is a part. This Privacy Policy applies to all users of the Services.

For our Education Services, school districts typically provide consent on behalf of students and manage parental consent requirements as educational stewards. By providing personal information to IMPACTER, you understand and consent to the collection, maintenance, processing and transfer of such information in and to the United States and other countries and territories, in accordance with United States law.

IMPACTER reserves the right to modify or revise its Terms of Use and/or Privacy Policy, in its sole discretion, at any time. Your continued use of the Services indicates your agreement to be bound by any and all subsequent modifications or revisions. IMPACTER will attempt to notify users whenever it modifies or revises the Terms of Use and/or Privacy Policy, however, we reserve the right to make such modifications or revisions without prior notice to you. IMPACTER recommends that users review the most up-to-date version of the Terms of Use and Privacy Policy periodically at www.impacterpathway.com.

When you utilize our Services, you may be able to visit or link to other sites not operated by us. We do not control such sites and we are not responsible for the information practices of these sites. This Privacy Policy does not address the information practices of those other websites, and we encourage you to read the posted privacy policies of such sites.

2. INFORMATION WE COLLECT

We collect information in three ways: 1) information that you or your school district voluntarily provides to us while using our Services (described below under "Information You Provide to Us"), 2) information collected automatically as a result of your use of our Services (described below under "Information Collected Automatically"), and 3) information we may receive about you from third-party sources as described below under "Information Received from Third Party Sources."

2.1 THE INFORMATION YOU PROVIDE TO US

From Website Visitors: You may choose to voluntarily provide certain personal information to us — such as name, telephone number, or email address in order to access certain features of our Website or to request information from us.

We will collect personal information that you provide to us, including if you contact us with questions, sign up for a newsletter, or otherwise submit data to us. For example, the Website allows you to request information about IMPACTER or contact customer service. To support these activities, IMPACTER asks for information to communicate with you, that may include contact information, such as your name and email address.

From Education Services Users: For our Education Services, we collect information about students from school districts that contract with us, as these districts act as educational stewards under FERPA. This includes:

• Student information provided by school districts (names, email addresses, grade levels, school affiliation)
• Student responses to educational prompts and assessments (text, audio, and video recordings)
• Account information and login credentials (managed through school systems via Clever integration)
• Educational progress and performance data

Audio and Video Recordings: When students submit spoken or video responses through our Education Services, we collect and store these recordings in order to transcribe and score the educational content of the response and provide feedback to teachers and students. These recordings may include a student's voice or image and are treated as sensitive educational records and protected accordingly. We do not create or store separate biometric templates (such as face geometry maps or voiceprints), and we do not use recordings for facial recognition, voiceprint matching, or any biometric authentication or identification.

2.2 INFORMATION COLLECTED AUTOMATICALLY

We may collect certain information from your computers and devices as you use or engage with our Services.

To provide a personalized and high-quality experience for our users, we (or our service providers) may use various technologies that automatically record or collect certain information, including personal information, from your browser or your device about the services you use and how you use them. This information is necessary for the adequate performance of our Services, to enable us to comply with legal obligations and given our legitimate interest in being able to provide and improve the Services. For example, this could include the frequency and duration of your visits to IMPACTER's website and education platform (similar to TV ratings that indicate how many people watched a particular show). If you use IMPACTER on different devices, we may link the information we collect from those different devices to help us provide a consistent service across your different devices. If we do combine any automatically-collected information with personal information, we will treat the combined information as personal information, and it will be protected as per this Privacy Policy.

2.2.1 DEVICE AND NETWORK INFORMATION

When you visit our Services, we may collect information about networks (such as language, Internet protocol (IP) addresses, internet service provider, and connection speed) and other identifiers that are automatically assigned to your computer or device (such as browser type and operating system).

We also collect the date and time of your use of the Services, and information about the links clicked and pages viewed within the Services, including educational content engagement and assessment completion data.

We collect and may share this information with third parties to help diagnose problems with our servers, for security purposes, to manage the Services, to enhance the Services based on usage pattern data, for analytics, and to improve educational outcomes.

2.2.2 WEBSITE AND EDUCATION SERVICES TRACKING TECHNOLOGIES

We also use technologies such as cookies, pixel tags, local storage, and similar technologies to automatically collect this information to provide you with information, or to help us understand your interests and educational progress. We do not use or disclose information collected through these technologies for third-party advertising purposes (including behaviorally targeting advertising to students or children) on our Education Services.

Cookies. Cookies are small text files placed on your device consisting of a string of numbers and letters that uniquely identifies your device. This helps us do things such as gauge engagement on content on our Services; personalize educational content users receive in the future based on what they have previously engaged with; maintain login sessions for educational continuity; and send out communications to users that have consented to receive them. You may be able to have your browser block or delete cookies, but some parts of the Services may not work properly as a result.

Google Analytics. Google Analytics is a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses cookies; the information generated by the cookie about your use of our Services (including your IP address) will be transmitted to and stored by Google on its servers. Google will use this information for the purpose of evaluating your use of our Services, compiling reports on website and platform activity for us and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.

By using the Services, you consent to our use of cookies, Google Analytics, and similar technologies to collect information as you engage with the Services. Most browsers allow you to block or delete cookies through settings they provide. However, refusing a cookie may, in some cases, preclude you from using, or negatively impact the display or function of the Services. We currently do not support "do not track" signals or related opt-outs.

Pixels. Pixels (a/k/a "Clear GIFs," "web beacons," or "pixel tags") are a type of technology placed on a website or within the body of an email for the purpose of tracking certain activity, such as views of a website or when an email is opened. Pixels are often used in combination with cookies. We may use pixels or similar technologies, in connection with the Services and/or in our communications (e.g., in our HTML-based e-mails) which enable us to know whether you have visited a web page or received or opened an e-mail. This allows us to know the effectiveness of our communications and educational content delivery.

2.3 INFORMATION RECEIVED FROM THIRD-PARTY SOURCES

We may also obtain information, including personal information, from third-party sources to update or supplement the information you provided or we collected automatically. This may include aggregated anonymous information or certain personal information that may be provided to us by school districts or educational institutions. If we receive personal information from third parties we will handle it in accordance with this Privacy Policy. If we directly combine information we receive from other third parties with personal information that we collect through our Services, we will treat the combined information as personal information and handle it in accordance with this Privacy Policy.

Additionally, we may use any aggregated anonymous information received from third parties as set forth below under the heading "Aggregated Information and Non-Identifying Information." Local law may require you to authorize the third-party to share your information with us before we can acquire it. We do not control, supervise, or respond to how third parties providing your information process your personal information, and any information request regarding the disclosure of your personal information to us should be directed to such third parties.

3. HOW WE USE YOUR INFORMATION

We use the personal information covered by this Privacy Policy to:

• Provide the Services: Deliver our website functionality and educational platform, including personalized learning experiences and progress tracking
• Respond to your requests and inquiries: Manage your account and provide customer service
• Educational Purposes: Analyze student responses and learning patterns to improve educational outcomes and provide meaningful feedback to teachers and students
• Send communications: Send you e-mail notices and offers and otherwise correspond with you about products, services, and events that we think might interest you (subject to your election to opt-in to receive such notices and offers). Examples of these messages include: (1) notices about changes to our Services and policies or about security alerts; and (2) promotional messages about us or our partners that we think you might find interesting
• Personalize the Services: Customize content and experiences for you based on your usage patterns and educational needs
• Offer relevant products and services: Suggest products and services that may be of interest to you or your educational institution
• Research and development: Perform research and analysis about your use of our Services or interest in IMPACTER Services and to develop new educational tools and features
• Provide promotional communications: Provide promotional electronic mailings, such as newsletters and other updates, to our users. Users may opt out of receiving such promotional electronic mailings by following the unsubscribe feature contained within the mailing or contacting us at privacy@impacterpathway.com
• Safety and security: For safety and security reasons, such as detecting, investigating and preventing activities that may violate our policies or be illegal
• Legal compliance: Perform functions as otherwise described to you at the time of collection or as required by law

Please note that we may anonymize and/or de-identify information collected through our Services or via other means so that the data cannot reasonably be used to identify or contact an individual. We use de-identified information for other purposes, including educational research, product improvement, and academic studies.

• Provide a safe, reliable, and secure educational experience
• Respond to your requests for information
• Deliver personalized educational content and track learning progress
• Tell you about Service changes
• Offer information about IMPACTER services and news, and other products, services, or events we think might interest you (but you can opt-out)

4. HOW WE SHARE YOUR INFORMATION

IMPACTER only shares personal information with other companies or individuals outside of IMPACTER in the following limited circumstances:

Consent. We have your consent or the consent of the educational institution acting on behalf of students.

Affiliated Organizations and Trusted Businesses. We provide such information to our affiliated organizations or other trusted businesses or persons for the purpose of supporting the operation of our Services and processing personal information on our behalf. We require that these parties agree to process such information based on our instructions and in compliance with this Privacy Policy and any other appropriate confidentiality and security measures. Our current trusted service providers include:

• Amazon Web Services (AWS): Cloud hosting and infrastructure services
• Google (Firebase): User authentication, database management, and application development services
• LearnWorlds: Learning management system platform features
• Typeform: Survey and assessment creation tools
• Databricks: Data analytics and processing platform

Analytics Providers. We may collect analytics data, or use third-party analytics tools such as Google Analytics, to help us measure website traffic and usage trends for our Services and to understand more about the demographics of our users and educational effectiveness. You can learn more about Google's practices and view its currently available opt-out options.

These third parties use the type of technologies described in the "Information Collected Automatically" section above. These services may collect, store and use information in order to help us understand things like how often you use our Services, the educational events that occur within our platform, usage and performance data, learning outcomes, and technical performance metrics. The information collected by this technology will be disclosed to or collected directly by these service providers.

Good Faith Belief. We have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to: (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, including FERPA, COPPA, and state privacy laws; (b) enforce applicable Terms of Use, including investigation of potential violations thereof; (c) detect, prevent, or otherwise address fraud, security or technical issues; or (d) protect against imminent harm to the rights, property or safety of IMPACTER, its users or the public as required or permitted by law.

Educational Institutions. We share student educational data, progress reports, and learning analytics with the school districts and educational institutions that have contracted with us for educational services on behalf of their students.

Affiliates and Partners. Over time, IMPACTER may grow and reorganize. We may share your information, including personal information with affiliates such as a parent company, subsidiaries, joint venture partners or other companies that we control or that are under common control with us, provided they agree to honor this Privacy Policy.

Change of Control. If IMPACTER becomes involved in a merger, acquisition, or any form of sale of some or all of its assets, your personal information may be transferred as a business asset. In such cases, we will provide notice before personal information is transferred and becomes subject to a different privacy policy.

Aggregated and Non-Personal Information. We may share aggregated, non-personal information with third parties, including business advisors and educational researchers, for the purpose of conducting general business analysis and educational research that benefits the broader educational community.

• Third-party service providers and subcontractors that help us operate the Services
• Educational institutions that have contracted with us for student services
• Third-party analytics providers that help us learn about educational effectiveness and user experience
• Other third parties if required by law
• Any new owners of IMPACTER

5. GOOGLE USER DATA (GOOGLE WORKSPACE FOR EDUCATION)

IMPACTER Services are delivered exclusively to K-12 school districts and educational institutions. When students, teachers, or school staff sign in to IMPACTER using Google Sign-In, they do so through Google Workspace for Education accounts issued and administered by their school district. IMPACTER does not offer accounts to individual consumers or general-audience Google users. All authentication, data access, and data flow described in this section occur within the school district's Google Workspace for Education environment, under the district's administrative control.

5.1 GOOGLE USER DATA WE ACCESS

When a teacher, administrator, or student signs in to IMPACTER through their district-issued Google Workspace for Education account, we access, collect, and store the following Google user data:

• Basic profile information (first and last name, and Google account identifier)
• School-issued email address
• The user's affiliation with the school district's Workspace for Education domain

We do not access, collect, or store the contents of Gmail, Google Drive, Google Calendar, Google Classroom, or any other Google Workspace application unless a specific integration is separately enabled by the school district's Workspace administrator and disclosed in writing.

5.2 HOW WE USE GOOGLE USER DATA

We use Google user data solely to provide and improve the user-facing educational features of IMPACTER, including authenticating users through their school-issued account, creating or linking an IMPACTER account tied to the district's roster, personalizing the educational experience within the Services, generating educational progress reports for teachers and school administrators, and communicating with users about their account and service-related notices. All use is consistent with the educational purposes for which the school district has engaged IMPACTER, and with the district's role as an educational steward under FERPA.

5.3 HOW WE SHARE GOOGLE USER DATA

We do not sell Google user data. We share Google user data only (i) with the school district and authorized school personnel that have engaged IMPACTER on behalf of their users; (ii) with the trusted service providers identified elsewhere in this Privacy Policy (including Amazon Web Services, Google Firebase, LearnWorlds, Typeform, and Databricks), who process it on our behalf under contractual obligations to protect student and educator privacy and to use it only for the purposes we specify; or (iii) where disclosure is required by law or reasonably necessary to protect the rights, property, or safety of IMPACTER, our users, or the public.

5.4 PROHIBITED USES OF GOOGLE USER DATA

Consistent with the Google API Services User Data Policy, including its Limited Use requirements, and with the heightened protections that apply to Google Workspace for Education users (including users under 18), IMPACTER does not use or transfer Google user data for any of the following purposes:

• Serving advertisements of any kind, including targeted, personalized, retargeted, or interest-based advertising, and specifically no advertising directed to students or minors
• Selling or transferring Google user data to third parties, data brokers, or information resellers
• Determining credit-worthiness or for lending purposes
• Building profiles of students or educators for purposes unrelated to authorized educational services
• Training, developing, or improving generalized or non-personalized machine learning or artificial intelligence models
• Any purpose unrelated to providing or improving the user-facing educational features of our Services

5.5 RETENTION AND DELETION OF GOOGLE USER DATA

We retain Google user data only as long as necessary to provide the educational Services or as required by applicable education-records laws and our agreements with the contracting school district. School district Workspace administrators may revoke IMPACTER's access to their domain at any time through the Google Admin console, and individual users may revoke access through https://myaccount.google.com/permissions Deletion requests may be submitted by the school district or by parents/eligible students in accordance with the "Accessing and Updating Personal Information" and "Children's Privacy and COPPA Compliance" sections of this Privacy Policy, or by contacting privacy@impacterpathway.com. We will delete the requested Google user data promptly, subject to legal and educational-record retention obligations.

6. CHILDREN'S PRIVACY AND COPPA COMPLIANCE

IMPACTER is committed to protecting children's privacy in accordance with the Children's Online Privacy Protection Act (COPPA) and its 2025 amendments. We work exclusively with educational institutions that act as educational stewards under FERPA and manage parental consent requirements.

6.1 INFORMATION WE COLLECT ABOUT CHILDREN

We collect personal information about children under 13 from school districts that have contracted with us for educational services. This includes:

• Identifiers: First and last names, school email addresses
• Contact Information: School-provided email addresses and institutional identifiers
• Audio/Visual Information: Audio and video recordings of classroom activities and student responses, which may include a child's voice or image, as well as photographs and other visual content used for educational purposes. We use these recordings to transcribe and score responses, support feedback to teachers and students, and improve instructional experiences. We do not perform facial recognition, voiceprint matching, or other biometric authentication using these recordings, and we do not create separate biometric templates.
• Educational Records: Written responses, assessment results, learning progress data
• Technical Information: IP addresses, device identifiers, and other persistent identifiers
• Geolocation Data: General location information derived from IP addresses
• Usage Data: Platform interaction data, time spent on activities, and learning analytics

6.2 HOW WE COLLECT CHILDREN'S INFORMATION

We do not collect personal information directly from children. Instead, we collect information about children through:

• School District Partnerships: Educational institutions provide student information and manage all consent requirements
• Clever Integration: Secure single sign-on through school district systems
• Educational Platform Usage: Automated collection of learning data as students engage with educational content

School districts are responsible for:

• Obtaining verifiable parental consent before students use our Services
• Providing parents with proper notice about our data collection practices
• Managing student access to our platform
• Ensuring compliance with all applicable privacy laws

6.3 HOW WE USE CHILDREN'S INFORMATION

We use children's personal information exclusively for educational purposes:

• Personalized Learning: Providing customized educational experiences based on individual learning patterns
• Progress Tracking: Generating reports for teachers, parents, and students about educational progress
• Content Improvement: Analyzing learning effectiveness to improve our educational content (using de-identified data)
• Platform Functionality: Ensuring proper operation of our educational platform
• Safety and Security: Protecting the integrity and security of our Services

We do NOT:

• Use children's information for advertising or marketing to children
• Share children's information for commercial purposes unrelated to education
• Use children's data to train artificial intelligence models for non-educational purposes
• Sell children's personal information to third parties
• Contact children directly for marketing purposes

6.4 SHARING CHILDREN'S INFORMATION

We share children's information only with:

• Educational Institutions: The child's school district, teachers, and authorized school personnel
• Parents/Guardians: Upon request through the school district or directly to us
• Essential Service Providers: Our trusted subprocessors (AWS, LearnWorlds, Typeform, Databricks) under strict contractual obligations to protect student privacy
• Legal Requirements: When required by law, such as in response to a valid court order or to protect safety

All service providers must:

• Maintain strict confidentiality of student information
• Use information only for specified educational purposes
• Implement appropriate security measures
• Delete information when no longer needed for educational purposes

6.5 DATA RETENTION AND DELETION

We retain children's personal information for no longer than reasonably necessary for educational purposes:

• Standard Retention: Up to 12 months after last educational use
• Extended Retention: Only when required by applicable education records laws or at the written request of the school district
• Secure Deletion: Information is securely deleted using industry-standard methods when retention period expires

Parents and eligible students may request to:

• Review their child's personal information
• Correct inaccuracies in their child's information
• Request deletion of their child's personal information (subject to educational record retention requirements)

6.6 ENHANCED SECURITY FOR CHILDREN'S DATA

We implement additional security measures for children's information:

• Written Information Security Program: Comprehensive policies and procedures specifically designed to protect student data
• Regular Security Assessments: Annual third-party penetration testing and quarterly vulnerability assessments
• Encryption: Strong encryption for data in transit and at rest
• Access Controls: Strict limitations on who can access student information
• Employee Training: Regular privacy and security training for all personnel
• Incident Response: Rapid response procedures for any security incidents involving student data

6.7 COPPA COMPLIANCE OFFICER

All COPPA-related questions, parental requests, or concerns should be directed to:

• Ashley Michelson, COPPA Compliance Officer
• Email: coppa@impacterpathway.com
• Phone: 949-656-3673
• Address: IMPACTER Education Corporation, 780 Roosevelt, Suite 214, Irvine, CA, 92620.

The COPPA Compliance Officer will respond to parental requests within ten (10) business days of receipt.

A Note for Parents:

What Information We Collect About Your Child: IMPACTER collects educational information about your child from your school district, including your child's name, school email, educational responses (text, audio, and video recordings), and learning progress data. Some of these responses may include your child's voice or image. We use these recordings only for educational purposes such as transcribing and scoring responses and providing feedback to teachers and students. We do not use them for facial recognition, voiceprint matching, or any biometric identification.

Why We Collect This Information: We use this information solely for educational purposes: delivering personalized learning experiences, tracking educational progress, and generating reports for teachers and parents about your child's learning.

Who We Share Information With: We share your child's educational progress and data with your child's school district and teachers. We also work with trusted service providers (Amazon Web Services, LearnWorlds, Typeform, and Databricks) who help us operate our educational platform securely and are contractually required to protect student privacy.

How Long We Keep Information: We keep your child's information for up to 12 months after last educational use, then securely delete it, unless longer retention is required by education records laws.

Your Rights as a Parent: You have the right to:

• Review your child's personal information we have collected
• Request correction of any inaccuracies
• Request deletion of your child's personal information (subject to educational record requirements)
• Refuse to allow further collection of your child's information
• Contact us with questions about our privacy practices

How to Exercise Your Rights: Contact your child's school district or our COPPA Compliance Officer at coppa@impacterpathway.com.

Our Commitment: We do not use your child's information for advertising, marketing, or any commercial purposes unrelated to education. We do not sell your child's information to third parties.

7. ACCESSING AND UPDATING PERSONAL INFORMATION

When you use IMPACTER services, we make good faith efforts to provide you with access to your personal information and either to correct this data if it is inaccurate or to delete such data at your request if it is not otherwise required to be retained by law or for legitimate educational purposes.

For student information, we work with school districts to facilitate parental access to their children's educational records. Parents may request access to their child's information through their school district or by contacting our COPPA Compliance Officer directly.

We ask individual users to identify themselves and the information requested to be accessed, corrected or removed before processing such requests, and we may decline to process requests that are unreasonably repetitive or systematic, require disproportionate technical effort, jeopardize the privacy of others, would violate our legal obligations to maintain educational records, or would be extremely impractical (for instance, requests concerning information residing on backup systems), or for which access is not otherwise required. In any case where we provide information access and correction, we perform this service free of charge, except if doing so would require a disproportionate effort.

8. DATA RETENTION

We will retain your personal information for the length of time needed to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law.

For student information, we follow these retention guidelines:

• Children's Personal Information: Up to 12 months after last educational use
• Educational Records: As required by applicable federal and state education record retention laws
• Website Contact Information: Until you request deletion or unsubscribe from communications
• De-identified Educational Data: May be retained indefinitely for research and product improvement

9. DATA SECURITY

IMPACTER processes personal information only for the purposes for which it was collected and in accordance with this Privacy Policy or any applicable service-specific privacy notice. We review our data collection, storage and processing practices to ensure that we only collect, store and process the personal information needed to provide or improve our Services. We take reasonable steps to ensure that the personal information we process is accurate, complete and current, but we depend on our users and partner school districts to update or correct personal information whenever necessary.

We take appropriate security measures to protect against unauthorized access to, or unauthorized alteration, disclosure or destruction of, data. These include internal reviews of our data collection, storage and processing practices and security measures, as well as physical security measures to guard against unauthorized access to systems where we store personal data. Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations of the Internet which are beyond our control; (b) the security, integrity and privacy of any and all information and data exchanged between you and us through our Services cannot be guaranteed; and (c) any such information and data may be viewed or tampered with in transit by a third party.

The security of your information is important to us, and we work hard to protect it from unauthorized access and use. In an effort to prevent unauthorized access, disclosure, or improper use of your information, and to maintain data accuracy, we have established physical, technical, and administrative safeguards designed to protect the personal information we collect.

9.1 WRITTEN INFORMATION SECURITY PROGRAM

We maintain a comprehensive, written information security program that includes:

Administrative Safeguards: Designated security personnel responsible for information security, regular security training for all employees, background checks for personnel with access to personal information, and incident response procedures for security breaches.

Technical Safeguards: Strong encryption technology (AES-256 for data at rest, TLS 1.2+ for data in transit), multi-factor authentication for system access, network security measures including firewalls and intrusion detection, regular software updates and security patches, and secure backup and recovery capabilities.

Physical Safeguards: Restricted access to facilities where personal information is stored, secure disposal of physical media containing personal information, and environmental controls for data centers.

9.2 REGULAR SECURITY ASSESSMENTS

We conduct regular security assessments to identify and address potential vulnerabilities:

• Annual Penetration Testing: Third-party security experts conduct comprehensive penetration tests of our systems
• Quarterly Vulnerability Assessments: Regular scans to identify and remediate security vulnerabilities
• Continuous Monitoring: 24/7 monitoring of our systems for suspicious activity
• Security Audits: Regular reviews of our security policies and procedures

We're constantly evolving our security procedures as technology changes, but our security procedures at a minimum include the following:

• Using strong authentication methods
• Limiting who has access to personal data on a need-to-know basis
• Destroying or deleting personal information as needed according to our retention policies
• Using strong encryption technology for all data transmission and storage
• Using secured data backup and recovery capability
• Maintaining industry standard software development lifecycle practices
• Requiring service and analytics providers to follow similar security terms

We restrict access to personal information to IMPACTER employees, agents, service providers, or independent contractors who reasonably need to know that information in order to process it for us in order to operate, develop or improve our Services. These individuals are bound by confidentiality obligations and may be subject to discipline, potentially including termination and criminal prosecution, if they fail to meet these obligations.

9.3 SECURITY INCIDENT RESPONSE

If we learn of a security breach involving personal information, we will:

• Immediate Response: Contain the incident and assess the scope of the breach
• Notification: Notify affected users, school districts, and authorities as required by law, typically within 48 hours of discovery
• Investigation: Conduct a thorough investigation to determine the cause and extent of the breach
• Remediation: Take steps to prevent similar incidents in the future
• Communication: Provide regular updates to affected parties about our response efforts

We may notify you electronically (subject to any applicable laws) so that you can take appropriate protective steps; for example, we may post a notice on our homepage https://impacterpathway.com or elsewhere on our Services and may send email to you at the email address you have provided to us. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.

Should you discover any security bugs or vulnerabilities in our Services or have any questions regarding our data practices, please contact our team at info@impacterpathway.com.

10. CHANGES TO THIS PRIVACY POLICY

We may occasionally update this Privacy Policy as our business practices and legal requirements evolve or to further protect our users. You can see when the last update was by looking at the "Last Updated" date at the top of this page. We recommend that you periodically review this Privacy Policy for any updates and/or changes. If we make any changes to this Privacy Policy or relevant Terms of Service, you can request a copy of the prior versions by contacting us at privacy@impacterpathway.com.

If we make any significant changes, we'll post a prominent notice on our Services and notify school district partners who use our Education Services, so you can review and make sure you know about them. Your continued use of our Services after we publish or send a notice about our changes to these terms means that you are consenting to the updated terms following their "effective date." If you object to any changes, you must stop using our Services.

For changes that materially affect how we collect, use, or share children's personal information, we will provide direct notice to school districts and may require updated parental consent before implementing such changes.

11. MARKETING COMMUNICATIONS

If you have provided an email or phone number to us, or your school district has provided contact information, or you have otherwise opted-in to receive communications from us, we may send you messages and updates regarding your account or your child's educational progress, including privacy and security notices, updates regarding our Services, and information regarding products, features or services from IMPACTER (or third-parties we believe you may be interested in). We may also use your email address to contact you for customer service purposes, educational support, or for any legal matters that arise in the course of business.

You can always unsubscribe from receiving any of our marketing emails or other marketing communications whenever you'd like by clicking the "Unsubscribe" link at the bottom of the email. You can also always send us an email at privacy@impacterpathway.com.

Please note that opting out of marketing communications does not affect your receipt of important communications related to your interaction with IMPACTER or your child's education, such as:

• Educational progress reports and notifications
• Support/service communications
• Security updates or privacy notices
• Account management communications
• Legal notices

You may not opt-out of receiving these essential communications.

12. CALIFORNIA PRIVACY RIGHTS

This section applies only to California residents as the State of California has very specific privacy rights. It describes how we collect, use, and share California consumers' Personal Information in our role as a business, and the rights applicable to such residents. If you are unable to access this Privacy Policy due to a disability or any physical or mental impairment, please contact us and we will arrange to supply you with the information you need in an alternative format that you can access. For purposes of this section "Personal Information" has the meaning given in the California Consumer Privacy Act ("CCPA"). We might collect the following statutory categories of Personal Information:

Personal Information: Your personal information includes all the data you provide us when you sign up for an account or enroll in our services, including your name, email address, telephone number. For students, this includes educational information provided by school districts. If you make a payment for services, your card information is not held by us, it is collected by our third-party payment processors, who specialize in the secure online capture and processing of card transactions.

Audio / Visual Information: Audio recordings of lessons and student responses and video clips submitted through the platform, which may capture a person's voice or image. Some California privacy laws may classify certain recordings as "biometric" or "sensitive" identifiers. We treat all such recordings as sensitive educational records and protect them accordingly. We do not create or store separate biometric templates (such as face geometry maps or voiceprints), and we do not use these recordings for biometric authentication or identification.

Geolocation data: Such as IP address. We collect this information from your device.

Audio/Visual Information: Recordings, photographs, and other audio or visual information submitted through our educational platform.

Education Information: Student educational records, assessment results, and learning progress data.

Inferences: Conclusions drawn from personal information to create profiles about learning preferences, educational needs, or other characteristics.

Other personal information: In instances when you interact with us online, by phone or mail in the context of receiving help through our help desks or other support channels; participation in customer surveys or contests; or in providing the Services.

As a California Resident, you have certain rights regarding the Personal Information we collect or maintain about you. Please note these rights are not absolute, and there may be cases when we decline your request as permitted by law.

The right of access means that you have the right to request that we disclose what Personal Information we have collected, used and disclosed about you in the past 12 months.

The right of deletion means that you have the right to request that we delete Personal Information collected or maintained by us, subject to certain exceptions (such as legal requirements to maintain educational records).

The right to non-discrimination means that you will not receive any discriminatory treatment when you exercise one of your privacy rights.

The right to correct means that you have the right to request that we correct inaccurate personal information about you.

The right to limit use and disclosure means that you have the right to request that we limit our use or disclosure of sensitive personal information.

As a California Resident, you can exercise your rights yourself or you can alternatively designate an authorized agent to exercise these rights on your behalf. Please note that to protect your Personal Information, we will verify your identity by a method appropriate to the type of request you are making. We may also request that your authorized agent have written permission from you to make requests on your behalf, and we may also need to verify your authorized agent's identity to protect your Personal Information.

For student information, parents may exercise these rights on behalf of their minor children by contacting us at privacy@impacterpathway.com or through their child's school district.

Please use the contact details above if you would like to:

• Access this policy in an alternative format
• Exercise your rights
• Learn more about your rights or our privacy practices
• Designate an authorized agent to make a request on your behalf

13. INTERNATIONAL DATA TRANSFERS

Our Services are hosted and operated in the United States. If you use our Services from the European Union or the United Kingdom, or any other region with laws governing data collection, protection and use that may differ from United States law, please note that you may be transferring your personal information outside of those jurisdictions to the United States.

By using our Services, you consent to the transfer of your personal information outside your home jurisdiction, including to the United States, and to the storage of your personal information in the United States, for the purpose of hosting, using and processing the personal information in accordance with this Privacy Policy. You further acknowledge that these countries may not have the same data protection laws as the country from which you provided your personal information, and that IMPACTER may be compelled to disclose your personal information to U.S. authorities. You have the right to withdraw your consent at any time by contacting us as described in the "Contacting IMPACTER" section below.

For users in the European Union, we provide additional protections under the General Data Protection Regulation (GDPR) where applicable.

14. CONTACTING IMPACTER

If you have any questions about this Privacy Policy or our practices, please contact us:

General Privacy Questions:

• Email: privacy@impacterpathway.com
• Phone: 949-656-3673

COPPA-Related Questions:

• Ashley Michelson, COPPA Compliance Officer
• Email: coppa@impacterpathway.com
• Phone: 949-656-3673

Mailing Address: IMPACTER Education Corporation, 780 Roosevelt, Suite 214, Irvine, CA, 92620.

We will respond to your inquiry within a reasonable time frame, typically within 10 business days for general inquiries and within 10 business days for COPPA-related requests.

This Privacy Policy is effective as of November 1, 2025 and replaces all previous versions.