Privacy Policy

Introduction

This Privacy Policy describes how Enlightapp, Inc. ("Enlightapp," "we," "our," or "us") collects, uses, maintains, and discloses information obtained from users ("you" or "Users") of the Guess2KnowU platform and related services (collectively, the "Service"). Guess2KnowU is a classroom engagement tool designed to help educators and students build belonging, connection, and understanding through interactive game-based experiences.

We are committed to protecting the privacy of all Users, including students, educators, school administrators, and parents/guardians. This policy applies to information collected through our website, applications, and any related services we provide.

Definitions

"Personal Information" means information that identifies, relates to, describes, or can be reasonably linked to a particular individual, such as name, email address, or school affiliation.

"Personal Student Information" means Personal Information that is directly related to an identifiable current or former student and is maintained by or on behalf of a school, school district, or related educational institution, or collected and maintained by us in the course of providing the Service to a school.

"School" means a school, school district, or educational institution that has authorized the use of the Service for its educators and students.

"De-Identified Data" means data that has been stripped of all personally identifiable information such that the data cannot reasonably be linked back to a specific individual or student.

Information We Collect

3.1 Information Collected from Educators

When educators create an account or use the Service, we may collect:

• Name and email address
• School name, grade level, and subject area (optional)
• Custom prompts and game configurations created within the Service
• Usage data, such as features accessed and frequency of use

3.2 Information Collected from Students

Guess2KnowU is designed so that students can participate without providing personally identifiable information. By default, student participation is anonymous. We may collect:

• Game responses submitted during a round (anonymous by default)
• A student-chosen display name or avatar (where applicable, not verified against real identity)
• Device and browser type for technical functionality

We do not require students to create accounts to participate in game rounds. We do not knowingly collect, use, or disclose Personal Student Information without verifiable consent from the School or, where applicable, from parents or guardians, as required by law.

3.3 Information Collected Automatically

When you access the Service, we may automatically collect certain technical information, including:

• IP address (anonymized where technically feasible)
• Browser type and version
• Device type and operating system
• Pages viewed, features used, and time spent on the Service
• Referring URL and general geographic location (city-level)

We use privacy-respecting analytics tools and do not use third-party advertising trackers or cross-site tracking technologies.

How We Use Information

We use the information we collect for the following purposes:

• To provide and operate the Service: Running game rounds, generating class-level insights, and delivering features to educators and students.
• To improve the Service: Analyzing aggregated, de-identified usage patterns to understand how the Service is used and to improve functionality, user experience, and educational outcomes.
• To communicate with educators: Sending service-related communications, responding to inquiries, and providing product updates to educators who have opted in.
• To ensure security and integrity: Detecting and preventing fraud, abuse, and unauthorized access.
• To comply with legal obligations: Meeting applicable regulatory, legal, and contractual requirements.

We do not use Personal Student Information for any purpose other than providing and improving the Service as directed by the School. We do not use Personal Student Information to market or advertise to students, parents, or guardians.

Student Data and Privacy Protections

5.1 FERPA Compliance

To the extent that we receive or process student education records subject to the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232g, we do so as a "school official" with a legitimate educational interest, as authorized by the School. We use such information solely for the purposes set forth in our agreement with the School and in accordance with FERPA and its implementing regulations.

5.2 COPPA Compliance

We comply with the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. §§ 6501–6506. To the extent COPPA applies, the School provides consent on behalf of parents or guardians to permit the collection of student information in connection with the educational use of the Service, consistent with COPPA's exception for school-authorized educational purposes. We do not knowingly collect personal information from children under 13 outside of this context.

5.3 State Student Privacy Laws

We comply with applicable state student privacy laws, including but not limited to the Student Online Personal Information Protection Act (SOPIPA) and state-specific student data privacy statutes. Where required, we will enter into student data privacy agreements with Schools and districts.

5.4 Our Student Data Commitments

• We do not sell Personal Student Information under any circumstances.
• We do not use Personal Student Information to market or advertise to students, parents, or guardians.
• We do not serve behaviorally targeted advertising on our platform.
• We do not build personal profiles of students except in furtherance of authorized educational purposes.
• We do not use Personal Student Information to train artificial intelligence or machine learning models. Any AI-assisted features within the Service operate on aggregated, de-identified data only and do not process, store, or learn from individually identifiable student information.
• We do not retain Personal Student Information beyond the period necessary to provide the Service, unless authorized by the School or required by law.
• We do not disclose Personal Student Information to third parties except as described in this Policy or as directed by the School.
• We implement reasonable administrative, technical, and physical safeguards to protect Personal Student Information against unauthorized access, disclosure, or use.

Artificial Intelligence and Machine Learning

The Service may use artificial intelligence ("AI") and machine learning ("ML") technologies to generate class-level insights, suggest prompts, or enhance the educational experience. We are committed to transparency about how these technologies interact with your data:

• No student data in model training: We do not use Personal Student Information, student responses, or any individually identifiable data to train, fine-tune, or improve AI or ML models — whether our own or those of third-party providers.
• Aggregated and de-identified data only: Where AI or ML features process data, they operate exclusively on aggregated, de-identified, or anonymized datasets that cannot be linked back to any individual student.
• Third-party AI services: If we use third-party AI service providers (e.g., for natural language processing or data analysis), we ensure through contractual agreements that no Personal Student Information is retained, used for training, or shared by those providers. We select providers who offer zero-data-retention policies for education customers.
• Human oversight: AI-generated insights and recommendations are designed to support — not replace — educator judgment. Educators retain full control over how they use any information provided by the Service.

How We Share Information

We do not sell, trade, or rent Users' Personal Information to third parties. We may share information in the following limited circumstances:

• Service Providers: We may share information with trusted third-party service providers who assist us in operating the Service (e.g., hosting, analytics, email delivery). These providers are contractually obligated to use such information solely for the purposes of providing services to us and in accordance with this Policy.
• Schools and Educators: Class-level, aggregated game results and insights are shared with the educator who initiated the game round. Individual student responses are not linked to identified students unless the School has configured the Service to do so.
• Legal Requirements: We may disclose information if required to do so by law, regulation, subpoena, court order, or other governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, Users' information may be transferred as part of that transaction. We will notify affected Users of any change in ownership or control of their Personal Information.

Cookies and Similar Technologies

We use essential cookies and similar technologies that are strictly necessary for the operation of the Service, including maintaining session state during game rounds. We do not use cookies for advertising purposes. We do not use third-party tracking cookies.

We may use privacy-respecting analytics services that do not track individuals across websites and do not collect personally identifiable information.

Data Retention and Deletion

We retain Personal Information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

• Student game responses: Anonymous game responses are retained for the purpose of generating class-level insights. Where responses are linked to identifiable students, they are retained only for as long as the educator's account is active or as directed by the School.
• Educator account data: Retained for as long as the account is active. Educators may request deletion of their account and associated data at any time.

Upon termination of a School's use of the Service, or upon request from a School, we will delete or de-identify Personal Student Information within a commercially reasonable timeframe, except where retention is required by applicable law.

Data Security

We implement commercially reasonable administrative, technical, and physical security measures designed to protect Personal Information from unauthorized access, disclosure, alteration, and destruction. These measures include, but are not limited to, encryption of data in transit (TLS/SSL), access controls, and regular security assessments.

While we strive to protect your information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

Your Rights and Choices

10.1 Educators and Parents/Guardians

You have the right to:

• Access, correct, or delete your Personal Information by contacting us
• Opt out of non-essential communications at any time
• Request a copy of your Personal Information in a commonly used electronic format
• Withdraw consent for data processing where consent is the legal basis

10.2 Schools

Schools may:

• Request access to, correction of, or deletion of Personal Student Information
• Direct us to cease collection or use of Personal Student Information
• Request a data privacy agreement consistent with their district's requirements

10.3 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete personal information, and the right to opt out of the sale of personal information. As stated above, we do not sell personal information.

International Users

The Service is primarily intended for use within the United States. If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes to how we treat Personal Information or Personal Student Information, we will notify affected Users by posting the updated Policy on our website with a revised effective date, and, where required, by providing notice via email or through the Service.

Your continued use of the Service following the posting of changes constitutes your acceptance of such changes. We encourage you to review this Policy periodically.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, our data practices, or your Personal Information, please contact us:

Enlightapp, Inc.
Email: info@enlightapp.co
Address: 150 Court St, Brooklyn, NY 11201

If a School or district requires a Student Data Privacy Agreement or has questions about our compliance with FERPA, COPPA, or other applicable laws, please contact us at info@enlightapp.co.