Privacy Policy

Who We Are & Scope

ClassroomSponsors, LLC (Virginia LLC or successor — “we,” “us,” “our”). We operate the Platform. We are not a 501(c)(3). When we partner with a qualified 501(c)(3) fiscal sponsor, certain donation processing and tax receipt functions will be handled under their umbrella under a Data Processing Agreement (DPA).

This Policy covers our website(s), apps, and services. It does not cover third parties (Stripe, school sites, logistics) — their policies govern.

Children's Privacy (COPPA & K-12 Focus — Critical)

We enrich only publicly available NCES (National Center for Education Statistics) CCD/PSS school data for search and discovery. We do not collect, store, or process individual student names, grades, assessments, or other education records on behalf of schools. We are not a school, district, or “school official” under FERPA.

If you believe we have inadvertently collected information from a child under 13, contact us immediately at privacy@classroomsponsors.com so we can delete it. Teachers remain responsible for any FERPA or student privacy obligations on their side (e.g., consents for photos/stories they share). Future school integrations involving student data require separate agreements and full compliance review.

1. Information We Collect

Directly from you:

• Teachers: Preferred display name + legal name (legal never public), school affiliation/grades/role, short bio (optional), profile photo (optional/public if chosen), school or personal email for verification, Tier 0 school email or Tier 1 redacted gov ID + selfie (you redact sensitive data), W-9 and payout details via Stripe (we do not store full bank details in plaintext), voluntary impact updates/photos/stories you control.
• Donors/Parents/Supporters: Name, email (receipts, updates), optional avatar/preferences, donation history + optional public note + visibility choice for leaderboards, tip preference/history, payment info tokenized exclusively by Stripe.

Automatically:

Device/browser, IP, usage (pages, features, donation flows for analytics/fraud/product improvement), cookies/local storage (session, prefs, analytics; we support DNT/GPC where feasible).

From third parties/public:

Public NCES school data (name, address, district, grades, enrollment ranges — attributed). Payment processor confirmations (Stripe). Fiscal sponsor reporting data (when live). No purchased marketing lists.

2. How We Use + 3. How We Share

Core service delivery, teacher verification & trust/safety (human review only, audit logs), payments & compliance (1099 tracking, sponsor reporting), personalization & “Fun Layer” strictly opt-in only (leaderboards, visualizations, badges, streaks — no use without affirmative choice), transactional communications, analytics (aggregated/de-identified preferred), legal/safety/compliance (fraud, subpoenas, sponsor requirements, 7+ year financial records).

Sharing only as described: Stripe & processors (under contract), hosting/infra/analytics (minimized, privacy-respecting), fiscal sponsor only for tax receipts, compliance, audits, and reporting (formal DPA governs; receipts name sponsor). Limited to teachers when you opt in to visibility (they do not receive your contact unless you share it). Legal/safety as required. Never sold. No targeted advertising.

4. Data Retention & Security

• Active accounts: while active + reasonable wind-down (e.g. 90–180 days post-deletion for pending items).
• Transaction/financial records: 7+ years (tax, IRS 1099, sponsor audit, state statutes).
• Verification documents (ID/selfies): Human-reviewed, target delete raw images after successful verification + 90 days unless legal hold or sponsor requirement. We log only verification fact/method + immutable audit trail (timestamps, reviewer notes).
• Impact content: user-controlled until removed (subject to legal archival).

Security: TLS in transit, encryption at rest where feasible, least-privilege access with audit logging for verification/payouts, immutable audit trails for decisions, regular reviews, incident response. We notify on breaches per law (VCDPA etc.). No system is perfect but we invest seriously.

Counsel flag: Exact verification retention SOP to be confirmed with sponsor DPA, IRS, and state law — balancing deletion rights with 7-year needs.

5. Your Rights & Choices

You have meaningful control. Exercise easily:

• Access/know, correct, delete (“right to be forgotten” — subject to legal/tax retention we will explain), export/portability.
• Opt-out of leaderboards/fun layer instantly (at donation or in settings; retroactive where possible). “Hide me” works.
• Marketing unsubscribe in every email + prefs center.
• Cookie management via browser + banner (when implemented) + GPC signals.

Virginia/DMV residents: Additional VCDPA rights (subject, sensitive data, etc.). Contact with “Virginia Privacy Request”. We do not process sensitive data for purposes requiring extra consent under current law.

How: Email privacy@classroomsponsors.com or in-app tools (when live). Identity verification required. Respond per legal timelines (typically 30–45 days). No fee for reasonable requests.

Account deletion removes you from public features promptly. Transactional records tied to donations/payouts retained for tax/legal/sponsor compliance (see Retention).

Additional Sections

Third-party links/services (Stripe etc. have own policies). International transfers (U.S.-based now; safeguards if expanded). Changes to Policy (notice for material; continued use = acceptance). Contact: privacy@classroomsponsors.com (requests), support@classroomsponsors.com (general). Mailing address once confirmed.