Culangex Children's & Student Data Protection Notice

We knowingly allow children under 13 to use the Services because language learning benefits young learners. With that comes responsibility: we collect the minimum information necessary, we obtain verifiable parental consent before collecting personal information from a child, and we give you control over your child's information at all times.

For a child under 13, we may collect:

• A username and limited account information (we avoid collecting a child's real name where possible).
• Voice recordings (“Voice Data”) when the child uses pronunciation features. This is the most sensitive data we collect from children, and we treat it accordingly.
• Learning and gameplay progress (quests completed, assessment results, pronunciation scores).
• Limited device and technical data needed to operate the Services.

We do not collect more than is reasonably necessary for the child to participate, and we do not require a child to disclose more information than is needed as a condition of participation.

We use children's information only to:

• Operate the Services and provide pronunciation feedback and adaptive learning.
• Measure and report learning progress.
• Maintain security and support.

We do not:

• Use children's information for targeted or behavioral advertising.
• Build advertising profiles of children.
• Sell or rent children's personal information.
• Disclose children's information except to service providers who help us operate the Services (under contracts that restrict their use), or as required by law.

Before we collect personal information from your child (including Voice Data), we will:

• Provide you direct notice of what we collect, how we use it, and that we need your consent.
• Obtain your verifiable consent using a method reasonably designed to ensure you are the parent, such as a payment-card verification, a signed consent form returned to us, a government-ID check that we match and then promptly delete, or another method approved under COPPA.

If we make a material change to our data practices, we will notify you and obtain renewed consent where required.

Limited exception: We may collect a parent's or child's online contact information solely to obtain consent or provide required notice, consistent with COPPA.

When your child uses the Services through a school or district, the school may provide consent on your behalf for the collection and use of your child's information strictly for the educational purpose authorized by the school, as permitted under COPPA's school-consent framework and FERPA. In that case, the school directs how the data is used, and our Institutional Data Protection Addendum applies. You may direct questions to your child's school or to us.

At any time, you may:

• Review the personal information we have collected from your child.
• Request deletion of your child's personal information.
• Refuse further collection or use of your child's information (note: this may mean your child can no longer use some or all of the Services).
• Revoke consent, including consent to collect Voice Data.

To exercise any of these rights, contact us at privacy@culangex.com with enough information for us to identify the child's account. We will verify your identity as the parent before acting, to protect the child.

Because Voice Data may be biometric and is especially sensitive for children:

• We collect it only to provide pronunciation feedback and measure progress.
• We retain raw recordings for no more than 30 days and then delete them, keeping only non-identifying progress metrics.
• We never use children's Voice Data for advertising, profiling, or sale.
• You may request deletion of your child's Voice Data at any time.

We keep a child's personal information only as long as reasonably necessary to provide the Services, then delete it. If you close the account or request deletion, we delete the child's personal information promptly, except where law requires retention.

We apply heightened safeguards to children's information, including access restrictions, encryption in transit, and limits on internal access.

If you have questions, or to exercise any parental right:

If you believe a child has provided us information without your consent, contact us immediately and we will delete it.

For student data processed through the Services on the Institution's behalf, Culangex acts as a “school official” with a legitimate educational interest under FERPA, and as a service provider / processor acting under the Institution's direction. The Institution remains responsible for its obligations to students and parents under applicable law.

“Student Data” means personal information about a student that Culangex receives or generates through the Services on behalf of the Institution, including account identifiers, learning and assessment data, and Voice Data used for pronunciation features.

Culangex will:

• Use Student Data only to provide and support the Services for the Institution's educational purposes.
• Not sell Student Data.
• Not use Student Data for targeted advertising or to build advertising or non-educational profiles.
• Not use Student Data to train models for unrelated commercial products without the Institution's written authorization (de-identified or aggregated data may be used to operate and improve the Services).
• Disclose Student Data only to sub-processors bound by equivalent obligations, or as required by law.

Where permitted by COPPA's school-consent framework and FERPA, the Institution may consent on behalf of parents to the collection and use of Student Data solely for authorized educational purposes. The Institution represents it has authority and has provided any notices required under FERPA and applicable state student-privacy laws.

Culangex will support the Institution in responding to requests from parents or eligible students to access, correct, or delete Student Data. Culangex will not respond to such requests directly except as directed by the Institution or required by law.

Student Voice Data is collected only to provide pronunciation feedback and measure progress, retained for no more than 30 days as raw recordings, then deleted (retaining only non-identifying progress metrics). It is never sold or used for advertising. Where state biometric laws apply, Culangex will support the Institution's compliance.

Culangex will maintain reasonable administrative, technical, and physical safeguards for Student Data. In the event of a confirmed breach of Student Data, Culangex will notify the Institution without undue delay and cooperate in the Institution's response and any legally required notifications.

Upon termination of the Services or at the Institution's written request, Culangex will return or securely delete Student Data within a commercially reasonable period, except where retention is required by law.

Culangex uses third-party providers (hosting, speech/AI processing, analytics) to deliver the Services and will require them to protect Student Data under terms consistent with this Addendum. A current list of sub-processors is available upon request at privacy@culangex.com.

Culangex will comply with applicable state student-data-privacy laws (for example, California's SOPIPA and similar laws in other states) with respect to Student Data processed for the Institution.

If the Institution and Culangex sign a separate negotiated data agreement (such as a state-standard student data privacy agreement / NDPA), that signed agreement controls over this Addendum to the extent of any conflict.