Privacy Policy

At Impacter Education Corporation ("IMPACTER," "we," "us," or "our"), we recognize that student privacy is important. This policy ("Privacy Policy") outlines the types of personal information we receive and collect when you use:

• IMPACTER's informational website at https://impacterpathway.com/ (the "Website")
• Our education products and services, including logged-in areas of our website and the IMPACTER application available at http://students.impacterpathway.com/ (collectively "Education Services")

Together, these are referred to as our "Services."

IMPACTER Services are provided to K–12 school districts, charter schools, county offices of education, and other educational institutions, and, under separate agreements, to higher-education and research partners. Student information from K–12 users is protected under Cal. Bus. & Prof. Code §22584; student information from higher-education users will be protected under §22587 when it becomes operative on July 1, 2027, and IMPACTER applies the same practices to both today. Authentication to our Education Services occurs through district-managed accounts, including Google Workspace for Education and Clever. IMPACTER does not offer accounts to individual consumers or general-audience users.

This Privacy Policy explains:

• What information we collect (and why we collect it)
• How we use and share that information
• The choices and rights you have, including how to access, update, and delete your information
• How we protect children's privacy under COPPA

We hope this will help you make an informed decision about sharing personal information with us.

Protecting your privacy is incredibly important to us. This Privacy Policy is here to help you understand how we treat any personal information that you share with us when you visit IMPACTER's Website or use our Education Services.

1. YOUR CONSENT TO THIS PRIVACY POLICY

By using our Services, you agree to the terms of this Privacy Policy as they may be amended from time to time. This Privacy Policy is incorporated into our Website Terms of Use and our Education Services Terms, of which this Privacy Policy is a part. This Privacy Policy applies to all users of the Services.

For our Education Services, school districts typically provide consent on behalf of students and manage parental consent requirements as educational stewards. By providing personal information to IMPACTER, you understand and consent to the collection, maintenance, processing and transfer of such information in and to the United States and other countries and territories, in accordance with United States law.

IMPACTER reserves the right to modify or revise its Terms of Use and/or Privacy Policy, in its sole discretion, at any time. Your continued use of the Services indicates your agreement to be bound by any and all subsequent modifications or revisions. IMPACTER will attempt to notify users whenever it modifies or revises the Terms of Use and/or Privacy Policy, however, we reserve the right to make such modifications or revisions without prior notice to you. IMPACTER recommends that users review the most up-to-date version of the Terms of Use and Privacy Policy periodically at www.impacterpathway.com.

When you utilize our Services, you may be able to visit or link to other sites not operated by us. We do not control such sites and we are not responsible for the information practices of these sites. This Privacy Policy does not address the information practices of those other websites, and we encourage you to read the posted privacy policies of such sites.

2. INFORMATION WE COLLECT

We collect information in three ways: 1) information that you or your school district voluntarily provides to us while using our Services (described below under "Information You Provide to Us"), 2) information collected automatically as a result of your use of our Services (described below under "Information Collected Automatically"), and 3) information we may receive about you from third-party sources as described below under "Information Received from Third Party Sources."

2.1 THE INFORMATION YOU PROVIDE TO US

From Website Visitors: You may choose to voluntarily provide certain personal information to us — such as name, telephone number, or email address in order to access certain features of our Website or to request information from us.

We will collect personal information that you provide to us, including if you contact us with questions, sign up for a newsletter, or otherwise submit data to us. For example, the Website allows you to request information about IMPACTER or contact customer service. To support these activities, IMPACTER asks for information to communicate with you, that may include contact information, such as your name and email address.

From Education Services Users: For our Education Services, we collect information about students from school districts that contract with us, as these districts act as educational stewards under FERPA. This includes:

• Student information provided by school districts (names, email addresses, grade levels, school affiliation)
• Student responses to educational prompts and assessments (text, audio, and video recordings)
• Account information and login credentials (managed through school systems via Clever integration)
• Educational progress and performance data

Audio and Video Recordings: When students submit spoken or video responses through our Education Services, we collect and store these recordings in order to transcribe and score the educational content of the response and provide feedback to teachers and students. These recordings may include a student's voice or image and are treated as sensitive educational records and protected accordingly. We do not create or store separate biometric templates (such as face geometry maps or voiceprints), and we do not use recordings for facial recognition, voiceprint matching, or any biometric authentication or identification.

2.2 INFORMATION COLLECTED AUTOMATICALLY

We may collect certain information from your computers and devices as you use or engage with our Services.

To provide a personalized and high-quality experience for our users, we (or our service providers) may use various technologies that automatically record or collect certain information, including personal information, from your browser or your device about the services you use and how you use them. This information is necessary for the adequate performance of our Services, to enable us to comply with legal obligations and given our legitimate interest in being able to provide and improve the Services. For example, this could include the frequency and duration of your visits to IMPACTER's website and education platform (similar to TV ratings that indicate how many people watched a particular show). If you use IMPACTER on different devices, we may link the information we collect from those different devices to help us provide a consistent service across your different devices. If we do combine any automatically-collected information with personal information, we will treat the combined information as personal information, and it will be protected as per this Privacy Policy.

2.2.1 DEVICE AND NETWORK INFORMATION

When you visit our Services, we may collect information about networks (such as language, Internet protocol (IP) addresses, internet service provider, and connection speed) and other identifiers that are automatically assigned to your computer or device (such as browser type and operating system).

We also collect the date and time of your use of the Services, and information about the links clicked and pages viewed within the Services, including educational content engagement and assessment completion data.

For visitors to our public website, we may share this information with our service providers to help diagnose problems with our servers, for security purposes, to manage the website, and for analytics. Information about students is never shared for analytics or marketing. It is used only to operate and secure the Education Services for the contracting school, as described in Sections 3 and 6 and in that school’s student data privacy agreement.

2.2.2 WEBSITE AND EDUCATION SERVICES TRACKING TECHNOLOGIES

We also use technologies such as cookies, pixel tags, local storage, and similar technologies to automatically collect this information to provide you with information, or to help us understand your interests and educational progress. We do not use or disclose information collected through these technologies for third-party advertising purposes (including behaviorally targeting advertising to students or children) on our Education Services.

Cookies. Cookies are small text files placed on your device consisting of a string of numbers and letters that uniquely identifies your device. This helps us do things such as gauge engagement on content on our Services; personalize educational content users receive in the future based on what they have previously engaged with; maintain login sessions for educational continuity; and send out communications to users that have consented to receive them. You may be able to have your browser block or delete cookies, but some parts of the Services may not work properly as a result.

Google Analytics. On the informational Website, we use Google Analytics to measure traffic and usage. Google Analytics is not deployed on the Education Services. Usage measurement within the Education Services is performed by IMPACTER on its own infrastructure and is used only to operate, support, and improve the Services for the contracting school.

By using the Services, you consent to our use of cookies, Google Analytics, and similar technologies to collect information as you engage with the Services. Most browsers allow you to block or delete cookies through settings they provide. However, refusing a cookie may, in some cases, preclude you from using, or negatively impact the display or function of the Services. We currently do not support "do not track" signals or related opt-outs.

Pixels. Pixels (a/k/a "Clear GIFs," "web beacons," or "pixel tags") are a type of technology placed on a website or within the body of an email for the purpose of tracking certain activity, such as views of a website or when an email is opened. Pixels are often used in combination with cookies. We may use pixels or similar technologies, in connection with the Services and/or in our communications (e.g., in our HTML-based e-mails) which enable us to know whether you have visited a web page or received or opened an e-mail. This allows us to know the effectiveness of our communications and educational content delivery.

2.3 INFORMATION RECEIVED FROM THIRD-PARTY SOURCES

We may also obtain information, including personal information, from third-party sources to update or supplement the information you provided or we collected automatically. This may include aggregated anonymous information or certain personal information that may be provided to us by school districts or educational institutions. If we receive personal information from third parties we will handle it in accordance with this Privacy Policy. If we directly combine information we receive from other third parties with personal information that we collect through our Services, we will treat the combined information as personal information and handle it in accordance with this Privacy Policy.

Additionally, we may use any aggregated anonymous information received from third parties as set forth below under the heading "Aggregated Information and Non-Identifying Information." Local law may require you to authorize the third-party to share your information with us before we can acquire it. We do not control, supervise, or respond to how third parties providing your information process your personal information, and any information request regarding the disclosure of your personal information to us should be directed to such third parties.

3. HOW WE USE YOUR INFORMATION

IMPACTER does not train on identified student data. It never has and it never will.

We use the personal information covered by this Privacy Policy to:

• Provide the Services: Deliver our website functionality and educational platform, including personalized learning experiences and progress tracking
• Respond to your requests and inquiries: Manage your account and provide customer service
• Educational Purposes: Analyze student responses and learning patterns to improve educational outcomes and provide meaningful feedback to teachers and students
• Send communications: Send you e-mail notices and offers and otherwise correspond with you about products, services, and events that we think might interest you (subject to your election to opt-in to receive such notices and offers). Examples of these messages include: (1) notices about changes to our Services and policies or about security alerts; and (2) promotional messages about us or our partners that we think you might find interesting
• Personalize the Services: Customize content and experiences for you based on your usage patterns and educational needs
• Offer relevant products and services: Suggest products and services that may be of interest to you or your educational institution
• Research and development: Maintain, support, improve, and diagnose the Services (§22584(c)). Research involving student information is conducted only on de-identified information under Section 3 above, or at the direction of a school or local educational agency under §22584(e)(2)(B), and never trains a model on identified student information.
• Provide promotional communications: Provide promotional electronic mailings, such as newsletters and other updates, to our users. Users may opt out of receiving such promotional electronic mailings by following the unsubscribe feature contained within the mailing or contacting us at privacy@impacterpathway.com
• Safety and security: For safety and security reasons, such as detecting, investigating and preventing activities that may violate our policies or be illegal
• Legal compliance: Perform functions as otherwise described to you at the time of collection or as required by law

The communications, personalization, and product-offer purposes above apply to Website visitors and to School Personnel acting for their institution. They do not apply to students or to student information. IMPACTER does not use student information, including persistent identifiers, for targeted advertising anywhere, to amass a profile of a student except in furtherance of K–12 school purposes for the school's use, or to market to students or their families (§22584(b)(1), (b)(2), (l)).

We de-identify student information before any use beyond delivering the Education Services to the contracting school. IMPACTER never uses identified or pseudonymized student information to train, fine-tune, test, validate, benchmark, or develop any machine-learning model. De-identified student information means information that cannot reasonably be linked to a particular student, household, or school, produced through the process published at impacterpathway.com/ab1159 and meeting each condition of Cal. Bus. & Prof. Code §22584(a)(4). That process is available to a school or local educational agency for review before any use of its students' de-identified information, and a school that determines the process insufficient may prohibit the use. We use de-identified student information only to improve the Education Services and to demonstrate their effectiveness, as §22584(f) permits, and never for advertising or to build a profile of any student.

Public commitment. IMPACTER will maintain and use de-identified information only in de-identified form and will not attempt to re-identify it, except to test whether our own de-identification process holds, as §22584(a)(4)(B) allows.

• Provide a safe, reliable, and secure educational experience
• Respond to your requests for information
• Deliver personalized educational content and track learning progress
• Tell you about Service changes
• Offer information about IMPACTER services and news, and other products, services, or events we think might interest you (but you can opt-out)

4. HOW WE SHARE YOUR INFORMATION

IMPACTER only shares personal information with other companies or individuals outside of IMPACTER in the following limited circumstances:

Consent. We have your consent or the consent of the educational institution acting on behalf of students.

Affiliated Organizations and Trusted Businesses. We provide such information to our affiliated organizations or other trusted businesses or persons for the purpose of supporting the operation of our Services and processing personal information on our behalf. We require that these parties agree to process such information based on our instructions and in compliance with this Privacy Policy and any other appropriate confidentiality and security measures.

Our current service providers with access to student information, and what each receives, are published and kept current at impacterpathway.com/ab1159. As of this policy's effective date they are: Amazon Web Services (hosting, storage, compute, and Amazon Transcribe for speech-to-text, US-West-2, Oregon); Google (Firebase Authentication for sign-in); LearnWorlds (delivery of learning activities); Typeform (capture of written and recorded responses in some deployments); Databricks (data analytics and processing); and the school's single sign-on and roster provider, such as Clever, under the school's own agreement. Each is contractually prohibited from using student information for any purpose other than providing the contracted service to IMPACTER, from disclosing it to any other party, and from using it to train or improve any model, and each is required to maintain reasonable security practices (§22584(b)(4)(E)). Schools receive 30 days' notice and a right to object before any new service provider receives student information.

Analytics Providers. We use third-party analytics tools such as Google Analytics on our public website to measure traffic and usage trends among website visitors. These tools are not used to profile students, and student information is never provided to analytics providers. You can learn more about Google's practices and view its currently available opt-out options.

These third parties use the type of technologies described in the "Information Collected Automatically" section above. These services may collect, store and use information in order to help us understand how often visitors use our website and how it performs. The information collected by this technology will be disclosed to or collected directly by these service providers.

Good Faith Belief. We have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to: (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, including FERPA, COPPA, and state privacy laws; (b) enforce applicable Terms of Use, including investigation of potential violations thereof; (c) detect, prevent, or otherwise address fraud, security or technical issues; or (d) protect against imminent harm to the rights, property or safety of IMPACTER, its users or the public as required or permitted by law.

Educational Institutions. We share student educational data, progress reports, and learning analytics with the school districts and educational institutions that have contracted with us for educational services on behalf of their students.

Affiliates. Over time, IMPACTER may grow and reorganize. We may share website visitor and school personnel information with companies that we control or that are under common control with us, provided they agree to honor this Privacy Policy. Student information is never shared with affiliates, joint venture partners, or investors. It is handled only under the contracting school’s student data privacy agreement.

Change of Control. Investors do not receive student information. If IMPACTER is involved in a merger, acquisition, or sale of all or substantially all of its assets, any successor is bound by every obligation in each school’s student data privacy agreement. The school receives written notice within 60 days of closing, with a signed assurance that the successor assumes those obligations, and may terminate its agreement if it does not approve of the successor. Student information is never sold and never transferred free of those obligations.

Aggregated and Non-Personal Information. We may share aggregated de-identified student information, produced through the process in Section 3, for the development and improvement of educational services as §22584(g) permits. Every recipient is bound by contract to maintain the information in de-identified form and not to attempt re-identification (§22584(a)(4)(C)). No figure is reported for a group smaller than ten students.

• Third-party service providers and subcontractors that help us operate the Services
• Educational institutions that have contracted with us for student services
• Third-party analytics providers that help us learn about educational effectiveness and user experience
• Other third parties if required by law
• Any new owners of IMPACTER

5. GOOGLE USER DATA (GOOGLE WORKSPACE FOR EDUCATION)

IMPACTER Services are delivered to K–12 school districts and educational institutions. When students, teachers, or school staff sign in to IMPACTER using Google Sign-In, they do so through Google Workspace for Education accounts issued and administered by their school district. IMPACTER does not offer accounts to individual consumers or general-audience Google users. All authentication, data access, and data flow described in this section occur within the school district's Google Workspace for Education environment, under the district's administrative control.

5.1 GOOGLE USER DATA WE ACCESS

When a teacher, administrator, or student signs in to IMPACTER through their district-issued Google Workspace for Education account, we access, collect, and store the following Google user data:

• Basic profile information (first and last name, and Google account identifier)
• School-issued email address
• The user's affiliation with the school district's Workspace for Education domain

We do not access, collect, or store the contents of Gmail, Google Drive, Google Calendar, Google Classroom, or any other Google Workspace application unless a specific integration is separately enabled by the school district's Workspace administrator and disclosed in writing.

5.2 HOW WE USE GOOGLE USER DATA

We use Google user data solely to provide and improve the user-facing educational features of IMPACTER, including authenticating users through their school-issued account, creating or linking an IMPACTER account tied to the district's roster, personalizing the educational experience within the Services, generating educational progress reports for teachers and school administrators, and communicating with users about their account and service-related notices. All use is consistent with the educational purposes for which the school district has engaged IMPACTER, and with the district's role as an educational steward under FERPA.

5.3 HOW WE SHARE GOOGLE USER DATA

We do not sell Google user data. We share Google user data only (i) with the school district and authorized school personnel that have engaged IMPACTER on behalf of their users; (ii) with the trusted service providers identified elsewhere in this Privacy Policy (Amazon Web Services, Google Firebase Authentication, LearnWorlds, Typeform, Databricks, and the school's single sign-on and roster provider, such as Clever, as listed in Section 4), who process it on our behalf under contractual obligations to protect student and educator privacy and to use it only for the purposes we specify; or (iii) where disclosure is required by law or reasonably necessary to protect the rights, property, or safety of IMPACTER, our users, or the public.

5.4 PROHIBITED USES OF GOOGLE USER DATA

Consistent with the Google API Services User Data Policy, including its Limited Use requirements, and with the heightened protections that apply to Google Workspace for Education users (including users under 18), IMPACTER does not use or transfer Google user data for any of the following purposes:

• Serving advertisements of any kind, including targeted, personalized, retargeted, or interest-based advertising, and specifically no advertising directed to students or minors
• Selling or transferring Google user data to third parties, data brokers, or information resellers
• Determining credit-worthiness or for lending purposes
• Building profiles of students or educators for purposes unrelated to authorized educational services
• Training, fine-tuning, testing, validating, benchmarking, developing, or improving any machine-learning or artificial-intelligence model
• Any purpose unrelated to providing or improving the user-facing educational features of our Services

5.5 RETENTION AND DELETION OF GOOGLE USER DATA

We retain Google user data only as long as necessary to provide the educational Services or as required by applicable education-records laws and our agreements with the contracting school district. School district Workspace administrators may revoke IMPACTER's access to their domain at any time through the Google Admin console, and individual users may revoke access through https://myaccount.google.com/permissions Deletion requests may be submitted by the school district or by parents/eligible students in accordance with the "Accessing and Updating Personal Information" and "Children's Privacy and COPPA Compliance" sections of this Privacy Policy, or by contacting privacy@impacterpathway.com. We will delete the requested Google user data promptly, subject to legal and educational-record retention obligations.

6. CHILDREN'S PRIVACY AND COPPA COMPLIANCE

IMPACTER is committed to protecting children's privacy in accordance with the Children's Online Privacy Protection Act (COPPA) and its 2025 amendments. We work exclusively with educational institutions that act as educational stewards under FERPA and manage parental consent requirements.

6.1 INFORMATION WE COLLECT ABOUT CHILDREN

We collect personal information about children under 13 from school districts that have contracted with us for educational services. This includes:

• Identifiers: First and last names, school email addresses
• Contact Information: School-provided email addresses and institutional identifiers
• Audio/Visual Information: Audio and video recordings of classroom activities and student responses, which may include a child's voice or image, as well as photographs and other visual content used for educational purposes. We use these recordings to transcribe and score responses, support feedback to teachers and students, and improve instructional experiences. We do not perform facial recognition, voiceprint matching, or other biometric authentication using these recordings, and we do not create separate biometric templates.
• Educational Records: Written responses, assessment results, learning progress data
• Technical Information: IP addresses, device identifiers, and other persistent identifiers
• Geolocation Data: General location information derived from IP addresses
• Usage Data: Platform interaction data, time spent on activities, and learning analytics

6.2 HOW WE COLLECT CHILDREN'S INFORMATION

We do not collect personal information directly from children. Instead, we collect information about children through:

• School District Partnerships: Educational institutions provide student information and manage all consent requirements
• Clever Integration: Secure single sign-on through school district systems
• Educational Platform Usage: Automated collection of learning data as students engage with educational content

School districts are responsible for:

• Obtaining verifiable parental consent before students use our Services
• Providing parents with proper notice about our data collection practices
• Managing student access to our platform
• Ensuring compliance with all applicable privacy laws

6.3 HOW WE USE CHILDREN'S INFORMATION

We use children's personal information exclusively for educational purposes:

• Personalized Learning: Providing customized educational experiences based on individual learning patterns
• Progress Tracking: Generating reports for teachers, parents, and students about educational progress
• Content Improvement: Analyzing learning effectiveness to improve our educational content (using de-identified information only, under Section 3)
• Platform Functionality: Ensuring proper operation of our educational platform
• Safety and Security: Protecting the integrity and security of our Services

We do NOT:

• Use children's information for advertising or marketing to children
• Share children's information for commercial purposes unrelated to education
• Use children's identified or pseudonymized information to train, fine-tune, test, validate, benchmark, or develop any machine-learning model, for any purpose. De-identified information is used only as described in Section 3, after the school has been offered review of the de-identification process, and never where a school has prohibited it.
• Sell children's personal information to third parties
• Contact children directly for marketing purposes

6.4 SHARING CHILDREN'S INFORMATION

We share children's information only with:

• Educational Institutions: The child's school district, teachers, and authorized school personnel
• Parents/Guardians: Upon request through the school district or directly to us
• Essential Service Providers: Our trusted subprocessors (AWS, Google Firebase Authentication, LearnWorlds, Typeform, Databricks, and the school's single sign-on and roster provider, such as Clever, as listed in Section 4) under strict contractual obligations to protect student privacy
• Legal Requirements: When required by law, such as in response to a valid court order or to protect safety

All service providers must:

• Maintain strict confidentiality of student information
• Use information only for specified educational purposes
• Implement appropriate security measures
• Delete information when no longer needed for educational purposes

6.5 DATA RETENTION AND DELETION

We retain children's personal information for no longer than reasonably necessary for educational purposes:

• Standard Retention: As set out in Section 8 (Data Retention): no longer than the contracting school retains the same category of record, and never longer than 12 months after last educational use
• Extended Retention: Only when required by applicable education records laws or at the written request of the school district
• Secure Deletion: Information is securely deleted using industry-standard methods when retention period expires

Parents and eligible students may request to:

• Review their child's personal information
• Correct inaccuracies in their child's information
• Request deletion of their child's personal information (subject to educational record retention requirements)

6.6 ENHANCED SECURITY FOR CHILDREN'S DATA

We implement additional security measures for children's information:

• Written Information Security Program: Comprehensive policies and procedures specifically designed to protect student data
• Regular Security Assessments: Annual third-party penetration testing and quarterly vulnerability assessments
• Encryption: Strong encryption for data in transit and at rest
• Access Controls: Strict limitations on who can access student information
• Employee Training: Regular privacy and security training for all personnel
• Incident Response: Rapid response procedures for any security incidents involving student data

6.7 COPPA COMPLIANCE OFFICER

All COPPA-related questions, parental requests, or concerns should be directed to:

• Ashley Michelson, COPPA Compliance Officer
• Email: coppa@impacterpathway.com
• Phone: 949-656-3673
• Address: IMPACTER Education Corporation, 780 Roosevelt, Suite 214, Irvine, CA, 92620.

The COPPA Compliance Officer will respond to parental requests within ten (10) business days of receipt.

A Note for Parents:

What Information We Collect About Your Child: IMPACTER collects educational information about your child from your school district, including your child's name, school email, educational responses (text, audio, and video recordings), and learning progress data. Some of these responses may include your child's voice or image. We use these recordings only for educational purposes such as transcribing and scoring responses and providing feedback to teachers and students. We do not use them for facial recognition, voiceprint matching, or any biometric identification.

Why We Collect This Information: We use this information solely for educational purposes: delivering personalized learning experiences, tracking educational progress, and generating reports for teachers and parents about your child's learning.

Who We Share Information With: We share your child's educational progress and data with your child's school district and teachers. We also work with trusted service providers (Amazon Web Services, Google Firebase Authentication, LearnWorlds, Typeform, Databricks, and your school's single sign-on and roster provider, such as Clever) who help us operate our educational platform securely and are contractually required to protect student privacy.

How Long We Keep Information: We keep your child's information no longer than your school keeps the same kind of record, and never longer than 12 months after last educational use. Your school may set a shorter period. You may ask your school, or us, to delete it.

Your Rights as a Parent: You have the right to:

• Review your child's personal information we have collected
• Request correction of any inaccuracies
• Request deletion of your child's personal information (subject to educational record requirements)
• Refuse to allow further collection of your child's information
• Contact us with questions about our privacy practices

How to Exercise Your Rights: Contact your child's school district or our COPPA Compliance Officer at coppa@impacterpathway.com.

Our Commitment: We do not use your child's information for advertising, marketing, or any commercial purposes unrelated to education. We do not sell your child's information to third parties.

6.8 INFORMATION WE DO NOT COLLECT

IMPACTER's prompts ask students about durable skills: persistence, perspective-taking, self-control, repair after conflict, and similar. They do not ask about a student's health, symptoms, immigration status, or sexual orientation or gender identity, and IMPACTER does not collect, use, retain, or disclose student information relating to reproductive or sexual health, immigration status, or sexual orientation or gender identity (§22584(b)(6)). Where a student volunteers such content in a response, it is not scored, does not appear in any report, and is removed from stored transcripts upon identification.

7. ACCESSING AND UPDATING PERSONAL INFORMATION

When you use IMPACTER services, we make good faith efforts to provide you with access to your personal information and either to correct this data if it is inaccurate or to delete such data at your request if it is not otherwise required to be retained by law or for legitimate educational purposes.

For student information, we work with school districts to facilitate parental access to their children's educational records. Parents may request access to their child's information through their school district or by contacting our COPPA Compliance Officer directly.

We ask individual users to identify themselves and the information requested to be accessed, corrected or removed before processing such requests, and we may decline to process requests that are unreasonably repetitive or systematic, require disproportionate technical effort, jeopardize the privacy of others, would violate our legal obligations to maintain educational records, or would be extremely impractical (for instance, requests concerning information residing on backup systems), or for which access is not otherwise required. In any case where we provide information access and correction, we perform this service free of charge, except if doing so would require a disproportionate effort.

8. DATA RETENTION

This section is IMPACTER's written data retention policy for student information under Cal. Bus. & Prof. Code §22584(d)(5). It is available on request to any student, parent, guardian, education rights holder, or school personnel.

Purpose of collection. Student information is collected to deliver the Education Services the contracting school has engaged: eliciting a student's spoken or written reflection, transcribing and scoring it against a published rubric, reporting results to the school, and measuring growth over time.

Purpose of retention. Student responses and results are retained so that students and school staff can review a response beside its result, so that growth can be measured across administrations, and so that the school can meet its own documentation needs (counseling and MTSS follow-up, IEP and Section 504 records, and program records such as CYBHI). These are student work product and evaluative results, the category §22584(d)(4)(B) recognizes.

Timeframes.

• Student responses, transcripts, scores, and indicators: retained no longer than the contracting school retains the same category of record under its own schedule, and in no event longer than twelve (12) months after last educational use. Where the school's period is shorter, the school's period controls (§22584(d)(5)(B)). A school may elect a shorter period, end-of-school-year deletion, or deletion of audio and video recordings once transcribed and scored, in its agreement with IMPACTER.
• Audio and video recordings: same schedule as their transcripts unless the school elects earlier deletion or text-only administration.
• Account and roster information: for the duration of the school's agreement, then deleted with the school's data.
• Database backups: 35 days, then automatically purged.
• Website contact information: until you request deletion or unsubscribe.
• De-identified student information: retained only as long as it is used for the purposes in Section 3, and never re-identified.

Deletion on request. IMPACTER deletes a student's information within 60 days of a request from the contracting school or local educational agency (§22584(d)(2)), with written verification. A parent, guardian, education rights holder, or former student aged 18 or older may request deletion of the student's information once the student has been unenrolled from the school for at least 60 days (§22584(d)(3)); IMPACTER will require documentation of unenrollment and will honor the request except as to records the school directs us to maintain. Deletion is performed using methods that protect the information from unauthorized access during disposal.

9. DATA SECURITY

IMPACTER processes personal information only for the purposes for which it was collected and in accordance with this Privacy Policy or any applicable service-specific privacy notice. We review our data collection, storage and processing practices to ensure that we only collect, store and process the personal information needed to provide or improve our Services. We take reasonable steps to ensure that the personal information we process is accurate, complete and current, but we depend on our users and partner school districts to update or correct personal information whenever necessary.

We take appropriate security measures to protect against unauthorized access to, or unauthorized alteration, disclosure or destruction of, data. These include internal reviews of our data collection, storage and processing practices and security measures, as well as physical security measures to guard against unauthorized access to systems where we store personal data. Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations of the Internet which are beyond our control; (b) the security, integrity and privacy of any and all information and data exchanged between you and us through our Services cannot be guaranteed; and (c) any such information and data may be viewed or tampered with in transit by a third party.

The security of your information is important to us, and we work hard to protect it from unauthorized access and use. In an effort to prevent unauthorized access, disclosure, or improper use of your information, and to maintain data accuracy, we have established physical, technical, and administrative safeguards designed to protect the personal information we collect.

9.1 WRITTEN INFORMATION SECURITY PROGRAM

We maintain a comprehensive, written information security program that includes:

Administrative Safeguards: Designated security personnel responsible for information security, regular security training for all employees, background checks for personnel with access to personal information, and incident response procedures for security breaches.

Technical Safeguards: Strong encryption technology (AES-256 for data at rest, TLS 1.2+ for data in transit), multi-factor authentication for system access, network security measures including firewalls and intrusion detection, regular software updates and security patches, and secure backup and recovery capabilities.

Physical Safeguards: Restricted access to facilities where personal information is stored, secure disposal of physical media containing personal information, and environmental controls for data centers.

9.2 REGULAR SECURITY ASSESSMENTS

We conduct regular security assessments to identify and address potential vulnerabilities:

• Annual Penetration Testing: Third-party security experts conduct comprehensive penetration tests of our systems
• Quarterly Vulnerability Assessments: Regular scans to identify and remediate security vulnerabilities
• Continuous Monitoring: 24/7 monitoring of our systems for suspicious activity
• Security Audits: Regular reviews of our security policies and procedures

We're constantly evolving our security procedures as technology changes, but our security procedures at a minimum include the following:

• Using strong authentication methods
• Limiting who has access to personal data on a need-to-know basis
• Destroying or deleting personal information as needed according to our retention policies
• Using strong encryption technology for all data transmission and storage
• Using secured data backup and recovery capability
• Maintaining industry standard software development lifecycle practices
• Requiring service and analytics providers to follow similar security terms

We restrict access to personal information to IMPACTER employees, agents, service providers, or independent contractors who reasonably need to know that information in order to process it for us in order to operate, develop or improve our Services. These individuals are bound by confidentiality obligations and may be subject to discipline, potentially including termination and criminal prosecution, if they fail to meet these obligations.

9.3 SECURITY INCIDENT RESPONSE

If we learn of a security breach involving personal information, we will:

• Immediate Response: Contain the incident and assess the scope of the breach
• Notification: Notify affected users, school districts, and authorities as required by law, typically within 48 hours of discovery
• Investigation: Conduct a thorough investigation to determine the cause and extent of the breach
• Remediation: Take steps to prevent similar incidents in the future
• Communication: Provide regular updates to affected parties about our response efforts

We may notify you electronically (subject to any applicable laws) so that you can take appropriate protective steps; for example, we may post a notice on our homepage https://impacterpathway.com or elsewhere on our Services and may send email to you at the email address you have provided to us. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.

Should you discover any security bugs or vulnerabilities in our Services or have any questions regarding our data practices, please contact our team at info@impacterpathway.com.

10. CHANGES TO THIS PRIVACY POLICY

We may occasionally update this Privacy Policy as our business practices and legal requirements evolve or to further protect our users. You can see when the last update was by looking at the "Last Updated" date at the top of this page. We recommend that you periodically review this Privacy Policy for any updates and/or changes. If we make any changes to this Privacy Policy or relevant Terms of Service, you can request a copy of the prior versions by contacting us at privacy@impacterpathway.com.

If we make any significant changes, we'll post a prominent notice on our Services and notify school district partners who use our Education Services, so you can review and make sure you know about them. Your continued use of our Services after we publish or send a notice about our changes to these terms means that you are consenting to the updated terms following their "effective date." If you object to any changes, you must stop using our Services.

For changes that materially affect how we collect, use, or share children's personal information, we will provide direct notice to school districts and may require updated parental consent before implementing such changes.

11. MARKETING COMMUNICATIONS

If you have provided an email or phone number to us, or your school district has provided contact information, or you have otherwise opted-in to receive communications from us, we may send you messages and updates regarding your account or your child's educational progress, including privacy and security notices, updates regarding our Services, and information regarding products, features or services from IMPACTER (or third-parties we believe you may be interested in). We may also use your email address to contact you for customer service purposes, educational support, or for any legal matters that arise in the course of business.

You can always unsubscribe from receiving any of our marketing emails or other marketing communications whenever you'd like by clicking the "Unsubscribe" link at the bottom of the email. You can also always send us an email at privacy@impacterpathway.com.

Please note that opting out of marketing communications does not affect your receipt of important communications related to your interaction with IMPACTER or your child's education, such as:

• Educational progress reports and notifications
• Support/service communications
• Security updates or privacy notices
• Account management communications
• Legal notices

You may not opt-out of receiving these essential communications.

12. CALIFORNIA PRIVACY RIGHTS

This section applies only to California residents as the State of California has very specific privacy rights. It describes how we collect, use, and share California consumers' Personal Information in our role as a business, and the rights applicable to such residents. If you are unable to access this Privacy Policy due to a disability or any physical or mental impairment, please contact us and we will arrange to supply you with the information you need in an alternative format that you can access. For purposes of this section "Personal Information" has the meaning given in the California Consumer Privacy Act ("CCPA"). We might collect the following statutory categories of Personal Information:

Personal Information: Your personal information includes all the data you provide us when you sign up for an account or enroll in our services, including your name, email address, telephone number. For students, this includes educational information provided by school districts. If you make a payment for services, your card information is not held by us, it is collected by our third-party payment processors, who specialize in the secure online capture and processing of card transactions.

Audio / Visual Information: Audio recordings of lessons and student responses and video clips submitted through the platform, which may capture a person's voice or image. Some California privacy laws may classify certain recordings as "biometric" or "sensitive" identifiers. We treat all such recordings as sensitive educational records and protect them accordingly. We do not create or store separate biometric templates (such as face geometry maps or voiceprints), and we do not use these recordings for biometric authentication or identification.

Geolocation data: Such as IP address. We collect this information from your device.

Education Information: Student educational records, assessment results, and learning progress data.

Rubric-level results: Levels on a published skills rubric assigned to a student's responses, reported to the student's school for K–12 school purposes. IMPACTER does not build profiles of students for any other purpose (§22584(b)(2)).

Other personal information: In instances when you interact with us online, by phone or mail in the context of receiving help through our help desks or other support channels; participation in customer surveys or contests; or in providing the Services.

As a California Resident, you have certain rights regarding the Personal Information we collect or maintain about you. Please note these rights are not absolute, and there may be cases when we decline your request as permitted by law.

The right of access means that you have the right to request that we disclose what Personal Information we have collected, used and disclosed about you in the past 12 months.

The right of deletion means that you have the right to request that we delete Personal Information collected or maintained by us, subject to certain exceptions (such as legal requirements to maintain educational records).

The right to non-discrimination means that you will not receive any discriminatory treatment when you exercise one of your privacy rights.

The right to correct means that you have the right to request that we correct inaccurate personal information about you.

The right to limit use and disclosure means that you have the right to request that we limit our use or disclosure of sensitive personal information.

As a California Resident, you can exercise your rights yourself or you can alternatively designate an authorized agent to exercise these rights on your behalf. Please note that to protect your Personal Information, we will verify your identity by a method appropriate to the type of request you are making. We may also request that your authorized agent have written permission from you to make requests on your behalf, and we may also need to verify your authorized agent's identity to protect your Personal Information.

For student information, parents may exercise these rights on behalf of their minor children by contacting us at privacy@impacterpathway.com or through their child's school district.

Please use the contact details above if you would like to:

• Access this policy in an alternative format
• Exercise your rights
• Learn more about your rights or our privacy practices
• Designate an authorized agent to make a request on your behalf

13. INTERNATIONAL DATA TRANSFERS

Our Services are hosted and operated in the United States. If you use our Services from the European Union or the United Kingdom, or any other region with laws governing data collection, protection and use that may differ from United States law, please note that you may be transferring your personal information outside of those jurisdictions to the United States.

By using our Services, you consent to the transfer of your personal information outside your home jurisdiction, including to the United States, and to the storage of your personal information in the United States, for the purpose of hosting, using and processing the personal information in accordance with this Privacy Policy. You further acknowledge that these countries may not have the same data protection laws as the country from which you provided your personal information, and that IMPACTER may be compelled to disclose your personal information to U.S. authorities. You have the right to withdraw your consent at any time by contacting us as described in the "Contacting IMPACTER" section below.

For users in the European Union, we provide additional protections under the General Data Protection Regulation (GDPR) where applicable.

14. CONTACTING IMPACTER

If you have any questions about this Privacy Policy or our practices, please contact us:

General Privacy Questions:

• Email: privacy@impacterpathway.com
• Phone: 949-656-3673

COPPA-Related Questions:

• Ashley Michelson, COPPA Compliance Officer
• Email: coppa@impacterpathway.com
• Phone: 949-656-3673

Mailing Address: IMPACTER Education Corporation, 780 Roosevelt, Suite 214, Irvine, CA, 92620.

We will respond to your inquiry within a reasonable time frame, typically within 10 business days for general inquiries and within 10 business days for COPPA-related requests.

This Privacy Policy is effective as of October 8, 2026 and replaces all previous versions.

This revision reflects Assembly Bill 1159 (Chapter 182, Statutes of 2026), operative January 1, 2027. IMPACTER applies its provisions as of the date above.