Privacy Policy

This privacy notice for StevensED LLC ("we," "us," or "our") describes how and why we collect, store, use, and share ("process") your information when you use our services ("Services"), such as when you:

• Visit stevensed.org, music.stevensed.org, or another StevensED website that links to this notice
• Sign in to a StevensED account at auth.stevensed.org, or use Canvas, our online classroom at canvas.stevensed.org
• Use the StevensED app or the StevensED LMS app (see Our apps)
• Use a StevensED email address, take an online lesson, or sign one of our family forms
• Book a session, place an order, pay an invoice, sign up for our newsletter, or otherwise contact us

Our websites are for parents and guardians, payers, and adult students. Some of our online services for enrolled students are used by children under 13, with a parent's consent (for accounts opened before November 1, 2026, see "Parental consent" in Section 4). Section 4, Children's privacy, summarizes how we handle children's information.

This notice works together with our institutional policies in the StevensED Policy Library, especially the Student Records and Privacy Policy (STU-006), the Records Retention Policy (INF-002), the Data Protection and Security Policy (INF-006), and the Service Providers List (INF-008). If this notice and one of those policies differ, the policy controls.

Questions or requests? For privacy questions and requests to see, correct, or delete information, email our Office of Legal Operations and Institutional Compliance at [email protected]. For anything else, email [email protected]. See Your privacy rights and how to make a request.

Summary of Key Points

This summary gives the key points of our privacy notice. You can find more detail about each topic in the section it links to, or by using the table of contents below.

What personal information do we process? Information you give us (such as your name, contact details, your student's name and grade, and your messages), information about enrolled students and their work in our online classroom, billing records, and limited technical information such as IP addresses. See What information do we collect?

Do we process information about children? Yes. Enrolled students, including children under 13, use our sign-in service, Canvas, our apps, and StevensED email, with a parent's consent (see Section 4 for accounts opened before November 1, 2026). See Children's privacy.

Do we sell your information or use it for advertising? No. We do not sell personal information, share it for targeted advertising, use advertising or analytics trackers, or use students' information to train artificial intelligence.

Who do we share it with? The service providers that run our services for us, including software services that assist our staff; a few outside services that receive limited technical information: YouTube videos in some Canvas lessons, Gravatar profile pictures (only for people 13 or older), and the web font and code-library services that some of our pages and apps load; all named in Section 3; and others only where the law requires or allows it.

How long do we keep it? For set periods in our Records Retention Policy, then we delete it. See How long do we keep your information?

How do you exercise your rights? Email [email protected]. We respond within 30 days. See Section 10.

Table of Contents

1. What information do we collect?
2. How do we use your information?
3. Who do we share your information with?
4. Children's privacy (students under 13)
5. Our apps
6. Payments
7. Do we use cookies and other tracking technologies?
8. How long do we keep your information?
9. How do we keep your information safe?
10. Your privacy rights and how to make a request
11. Controls for do-not-track features
12. Do United States residents have specific privacy rights?
13. What is our stance on third-party websites?
14. Do we make updates to this notice?
15. How can you contact us about this notice?

1. What information do we collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you give us when you contact us, book a session, place an order, sign up for our newsletter, enroll a student, sign a family form, pay an invoice, or use your StevensED account. What we collect depends on what you do:

• Contact and account details: names, email addresses, phone numbers, mailing and billing addresses, and the sign-in details for your StevensED account. Passwords are stored only in a protected (hashed) form.
• Student details from a parent or guardian: your student's name, grade, date of birth, the courses or lessons you choose, and the emergency contact, health, and other information on our enrollment forms.
• Billing records: invoices, payments, balances, and payment plans. We do not collect or store full payment card numbers (see Payments).
• Messages and requests: what you write to us, and the bookings, cancellations, absence reports, and orders you send us.

Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

• information about students, including children under 13 (see Children's privacy)
• health and emergency information a parent or adult student gives us on our forms, and the reason category for an absence (illness, emergency, or other)
• financial account information about your StevensED account, such as invoices and payments

We do not ask for Social Security numbers or other government identification numbers unless the law requires it. When we verify a parent's consent for a child under 13 by an identity check, the parent gives the parent's ID and photo, or ID information, to our identity verification service, not to us, and the service and StevensED delete them after the check (Section 4).

Messages to Our Front Desk. When you send us a message through the "Ask us" front-desk widget or the form on our Contact page, we collect your name, your email address and/or phone number, the topic you choose, your message, and the address of the page you sent it from. The front-desk widget also lets you give your student's name and grade if you choose to. We email your message to our front-desk inbox, which is hosted by Google Workspace, so that our staff can reply to you. Our staff may also record your contact details and inquiry in our customer relationship management system (Zoho CRM) to keep track of our conversation with you. Please don't include payment details or other sensitive information in these messages.

Booking a Session. When you book a session on our website or in the StevensED app, we collect your name, email address, optional phone number, your student's name and grade, any notes you add, and, if you tell us, how you heard about us. We put the session on our Google Calendar, send you a calendar invitation, and keep a record of the booking in a Google Sheet.

Store Orders. When you place an order in our store, we collect your name, email address, optional phone number and ZIP code, the items, and any notes. We keep a record of the order in a Google Sheet and email you an invoice to pay. Nothing is charged on our website.

Absence Reports. When a parent reports an absence or asks to switch a lesson online in the StevensED app, we collect the lesson, the student, the reason category, and any note. Please don't include medical details in the note; we don't need them.

Newsletter Sign-Up. Our newsletter is for parents and adult students. When you sign up, we collect your email address, which sign-up form you used, and the dates you signed up or unsubscribed. We store this in a database hosted by our cloud platform provider. When you sign up, we email you a link to confirm, and you join the list only after you confirm. The link works for 7 days; if you don't confirm, your address is deleted from our records. Every newsletter includes a link to unsubscribe.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information from students using our online services

In Short: Enrolled students' work and messages are kept in the services we run for teaching.

When an enrolled student uses a StevensED sign-in account, Canvas, our apps, a StevensED email address, or an online lesson, we collect the information described in Children's privacy: the student's name and StevensED email address, sign-in records, submitted work (which may include the student's image or voice), quiz answers, document markup, discussion posts, messages, a profile picture if the student or a parent uploads one, and live lesson video and audio. Messages sent to a student's StevensED email address, including Canvas email notifications, are forwarded to the forwarding email the family has set up with us (a parent's email, the student's own personal email, or both), which only a parent can change for a student under 13, and the Office of the Registrar keeps a copy. A lesson is recorded only with consent.

Information automatically collected

In Short: Some information, such as your Internet Protocol (IP) address and browser and device type, is collected automatically when you use our Services.

We automatically collect limited technical information when you visit or use the Services. We use it only to run, secure, and fix our Services, never to build profiles or for advertising. It includes:

• Log Data. Our hosting providers' servers record requests to our Services, which can include your IP address, browser and device type, the date and time, and the page or feature requested. Our sign-in service keeps a security log of sign-ins and account changes with the IP address and browser type. Canvas records which course pages a signed-in user opens, and teachers and administrators can see those access reports.
• Device Tokens. If you turn on notifications in one of our apps, we receive a device token from Apple so we can deliver them.
• Spam-Protection Counters. To protect our message, booking, order, and newsletter forms from spam and abuse, we briefly keep a count of how many times each IP address has used a form. These counters are held in our cloud platform's temporary cache, contain only the IP address and a number, and expire automatically within an hour. They are not stored long-term or used for any other purpose.
• Bot Protection. Our forms (newsletter sign-up, Contact form, front-desk widget, booking and store checkout) use a bot-protection service from our cloud platform provider to tell people from automated bots. When you use a form, the service checks your browser, usually without you noticing, and occasionally asks you to tick a box. It does not set advertising cookies, and the provider may use this information only to provide and secure the service.

We do not collect your device's precise location.

Information collected from other sources

In Short: We get information about students from their parents, and payment status from our billing system.

Most information about a student comes from the student's parent or guardian. If someone else pays for a student's tuition, we collect the payer's contact and billing details from them. Zoho Books tells us when an invoice is paid. We do not buy personal information from data brokers or marketing partners.

2. How do we use your information?

In Short: We use your information to teach, run your account, communicate with you, keep our Services secure, and comply with law.

We process your personal information to:

• Teach. Provide lessons and courses, give feedback and evaluations, and keep the student records described in our Student Records and Privacy Policy.
• Run accounts. Set up and secure StevensED accounts, let students and parents sign in, and let a parent see their own student's information.
• Schedule and bill. Book, change, and cancel sessions, record absences under our attendance policy, fulfill orders, and send and collect invoices.
• Communicate. Answer your messages, send confirmations, lesson and account notices, and changes to our terms and policies.
• Send the newsletter. Only to people who confirmed they want it. You can unsubscribe at any time.
• Protect our Services. Prevent spam, fraud, and misuse, and investigate security problems.
• Comply with law. Meet our legal obligations, respond to lawful requests, and establish or defend legal claims.

We do not sell personal information, use it for advertising, use it to build profiles, or use students' information to train artificial intelligence. No software makes decisions about students or payers; authorized StevensED staff make them under our published policies.

3. Who do we share your information with?

In Short: Only with the service providers that run our Services for us, and otherwise only as the law requires or allows.

Service Providers. We use the following service providers. Each may use the information only to provide its service to us, under terms that require it to protect the information.

Outside services that receive limited technical information. These are not our service providers: each handles what it receives under its own privacy terms. None of them receives names, email addresses, or account information from us, except the coded email address Gravatar receives for people 13 or older who choose a Gravatar picture. For students under 13, see Children's privacy.

We also may need to share your personal information in the following situations:

• Within your family. A parent can see their own minor student's information. Messages to a student's StevensED email address are forwarded to the forwarding email the family has set up with us (see Section 1).
• Teachers and classmates. A student's instructors see the student's work. Students may post in course discussions and send Canvas messages that their instructor and classmates can see. Nothing a student posts in Canvas is made public.
• Legal requirements and safety. When the law requires it, to respond to lawful requests, to protect a student's safety, or to establish or defend legal claims, as described in our Student Records and Privacy Policy.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. Any successor must honor this notice and our policies for the information it receives.

We do not share personal information with anyone else, such as advertisers, data brokers, or marketing partners.

4. Children's privacy (students under 13)

In Short: Our websites are for adults, but our online services for enrolled students are used by children under 13, after a parent consents. Our full children's privacy notice is Section 10 of the Student Records and Privacy Policy (STU-006), which also contains our full retention policy for children's information.

This section summarizes our notice under the Children's Online Privacy Protection Act (COPPA). StevensED LLC is the operator of our online services for students and responds to all questions and requests about children's information collected through them. You can reach us about children's privacy at [email protected], (801) 413-3879, or StevensED LLC, ATTN: Office of Legal Operations and Institutional Compliance, P.O. Box 900342, Sandy, UT 84090.

Parents and guardians act for children. Our websites, forms, and newsletter are for parents, payers, and adult students. Children under 13 should not use them; a parent or guardian books, enrolls, pays, and signs forms for a child. If we learn that a child under 13 has given us personal information through our website without a parent's consent, we will delete it.

Parental consent. Before a student under 13 receives a StevensED account, a Canvas account, or a StevensED email address, a parent signs our Parental Consent for Online Services (FRM-108), and we verify that the person consenting is the student's parent. We choose one of these methods, and a parent may ask us to use one of the others instead: (1) an identity check through an identity verification service (currently Stripe), which matches the parent's government-issued photo ID to a photo of the parent taken at the time, after which the service and StevensED promptly delete the ID and photo images and keep only the result; (2) a payment in the parent's name by credit or debit card or another online payment system that notifies the account holder of each transaction; (3) a video call with a trained StevensED staff member, or a meeting in person; (4) a paper copy of the form signed by the parent and returned by mail, fax, or scan; or (5) a check of the parent's government-issued ID information against government or other authoritative databases through the identity verification service, after which the service and StevensED promptly delete the ID information and keep only the result. The consent takes effect only when we have recorded the verification. The form asks for one consent to the practices in this section. For a student under 13 who already had an account before November 1, 2026, we asked a parent for consent; if it has not been verified by November 8, 2026, we pause the student's sign-in, and collect nothing more online from the student, until it is; if a parent declines or has not consented within 60 days after we ask, we close the accounts and, after offering the parent a copy, delete what we collected online from the student. If a parent does not consent, we do not collect information online from the student, and we teach the student without student accounts where practical. We will ask for new consent before any material change in what we collect from children, how we use it, or who receives it.

What we collect from children online. Only through our sign-in service, Canvas, our apps, StevensED email, and online lessons: sign-in records, and the student's activity, such as assignments, submitted work (which may include the student's image or voice), document markup, quiz answers, discussion posts, and messages; a profile picture, if the student or a parent uploads one (visible to people in the student's courses); live lesson video and audio; and the technical information needed to run and secure these services (IP address, browser or device type, and a device token for app notifications), which we use only to run and secure the services, never to build profiles or for advertising. We set up the student's name, user name, and StevensED email address from what a parent gave us; they are not collected from the student. Students can share information with their instructor and classmates in course discussions and messages, visible only to people in the course; students cannot make personal information public. We ask for no more information than an activity reasonably needs.

How we use it. Only to teach the student, give feedback and evaluations, communicate with the student and family about lessons, keep accounts secure, keep student records, and meet legal duties. We do not sell children's information, use it for advertising, or use it to train artificial intelligence.

Who receives it. The service providers that support these services: our server hosting provider, our cloud platform provider, Google Workspace, Zoom, Apple, and software services that assist our staff with drafting, organizing, and administrative work, as well as DocuSeal, Zoho, and Stripe for information that comes from parents and payers; the student's instructors and classmates in the course; and the web font and code-library services described in Section 3 (Google Fonts, jsDelivr, and cdnjs), which receive a device's IP address and browser details when a child's device opens our sign-in pages or Policy Library or the StevensED LMS app loads its math-display library. These disclosures are integral to our online instruction, and the one consent on our consent form covers them. That includes embedded YouTube videos (Section 3), which are assigned course material, and some students take their lessons and coursework online. Gravatar is used only for people we have verified as 13 or older: we never send it any information about a child under 13, and children's devices do not contact it. We do not disclose children's information to any other third party. If that ever changes, we will first ask a parent for separate consent.

A parent's rights. A parent of a student under 13 may, at any time, by writing to [email protected]:

• ask for a description of the types of information we have collected online from the child;
• review that information and receive a copy;
• refuse further collection or use of it, in which case we close the student's accounts and continue instruction without them where practical; and
• direct us to delete it, in which case we delete everything we collected online from the child: submitted work, files, quiz answers, discussion posts, messages the child wrote, document markup, recordings, sign-in data, and sign-in and device records, including copies in a grading or dispute file, and close the student's accounts.

We verify that the requester is the child's parent, normally by responding only to the parent's email address or phone number on file, and we respond and complete the deletion within 30 days; deleted information leaves our backups within 90 days. Records that we create, or that a parent gives us, are not collected from the child, and we keep them for their periods in our Records Retention Policy: enrollment, attendance, grades, completion, and billing records; instructors' feedback on the child's work, in the instructors' own words only (anything in it that reproduces the child's work is deleted with the work); the closed account record (name, user name, StevensED email address, and links to parents), so the academic record stays attached to the right student, until 7 years after the last term; and signed forms, including the consent record. We also keep information that is under a litigation hold or is part of a safeguarding record, and we will tell you what we kept and why.

How long we keep it. Only as long as reasonably needed, and never indefinitely. Canvas work, messages, discussion posts, document markup, and instructors' feedback on that work are deleted 3 years after the end of the term; sign-in and security logs after 180 days; device registrations 90 days after the device stops receiving notifications or the account is closed; sign-in data 90 days after the account is closed; email to or from the student's StevensED address after 3 years; lesson recordings 90 days after recording, unless a safety concern or dispute requires keeping one longer; and the closed account record 7 years after the last term. The full retention policy, with the purpose and business need for each period, is Section 10.7 of STU-006 and the Records Retention Policy (INF-002), Section 3.6. See also Section 8.

Students 13 to 17. We apply the same uses, limits, recipients, and retention periods to the online information of every minor student, and a parent of any minor student may make the requests in Section 10.

5. Our apps

In Short: Our two iPhone apps have no advertising, analytics, or tracking, and send your information only to StevensED's own services.

StevensED app. The StevensED app is for families. You sign in with your StevensED account. The app shows your account balance, invoices, and payments from Zoho Books, and lets you book, change, and cancel sessions and report absences. It sends to us the information you enter, such as bookings (with an optional phone number and notes) and absence reports, and records when you open an invoice to pay it. Payments are made on Zoho Books' hosted payment page, which the app opens in a browser window; the app never sees your card or bank details. A parent can sign their child in on the family's device.

StevensED LMS app. The StevensED LMS app is the mobile app for Canvas, our online classroom, for students, parents, and teachers. It connects only to StevensED's Canvas server and our document markup service, and handles the same information as Canvas: names and email addresses, courses, grades, submissions (including photos, video, and audio), messages, discussion posts, quiz answers, document markup, calendar items, and any problem report you send us. If you turn on notifications, your device token is registered with our Canvas server so we can send them through Apple. The app may download a math-display library from cdnjs, a public code-library network, which receives your device's IP address and browser details (see Section 3).

What both apps do and don't do. Neither app contains advertising, analytics, or crash-reporting software, tracks you across other companies' apps or websites, or uses your location, contacts, or advertising identifier. Each app keeps on your device only what it needs to work: your sign-in tokens, the people who use the app on that device, and each person's PIN, stored only as a protected (hashed) value. PINs and Face ID never leave your device. Removing a profile or deleting the app removes them.

Deleting an account. StevensED accounts are managed by StevensED, as at other schools: our staff create student accounts and most family accounts, close them when a student leaves, and delete them on our records retention schedule. A parent may also create a Canvas parent account on our website at canvas.stevensed.org with a pairing code we provide; neither app has a sign-up. Accounts can't be deleted by students or families themselves, in the apps or online. To ask us to close an account or delete information, email [email protected] (see Section 10). What we delete and what we keep, and why, is described there, in Section 4, and in Section 8.

6. Payments

In Short: You pay on a page hosted by Zoho, and your card or bank details go to the payment processor, not to us.

When you pay a StevensED invoice, whether from an invoice email, our billing portal, or the StevensED app, you pay on Zoho Books' hosted payment page. That page uses Stripe, the payment processor that StevensED has connected to Zoho Books, which handles your card or bank details under the payment card industry (PCI) security standards and its own privacy terms. StevensED never sees or stores full card numbers or security codes. Zoho Books tells us the amount, date, and status of your payment. Please never send card or bank numbers to us by email or text; if you do, we will delete the message and send you a secure payment link.

7. Do we use cookies and other tracking technologies?

In Short: We use only the cookies and browser storage needed for sign-in, security, your preferences, and your cart. We do not use advertising or analytics trackers.

We use secure cookies for sign-in and protected member areas, and your browser's local storage to remember your cookie choices, the contents of your store cart, and whether you are signed in so our menus display correctly. We do not use advertising cookies, tracking pixels, or third-party analytics, and we do not let others place them on our Services, except that a YouTube video embedded in a Canvas lesson (in privacy-enhanced mode) may store YouTube's own cookies or similar identifiers once it is played (see Section 3). Our front-desk widget, Contact form, and newsletter sign-up, confirmation, and unsubscribe pages do not set cookies or store information in your browser. The bot-protection check on our forms runs in its own frame served by our cloud platform provider, as described above, and our website's typefaces are loaded from Google Fonts.

Details, and how to change your choices, are in our Cookie Policy: stevensed.org/cookies.

8. How long do we keep your information?

In Short: For the periods in our Records Retention Policy (INF-002), and then we delete it.

We keep each kind of record for the period set in our Records Retention Policy (INF-002). That policy is also our written retention policy for information collected online from children. It states the purpose, the business need, and the deletion time for each kind of record. Some examples:

We delete records within 90 days after their period ends, and deleted records expire from our backups within 90 days after that. We keep records longer only when they are under a litigation hold or are part of a safeguarding record, as our Records Retention Policy describes.

9. How do we keep your information safe?

In Short: We protect your personal information under a written information security program.

We protect personal information, including children's information, under our Data Protection and Security Policy (INF-006). For example, our Services use encrypted connections, passwords and PINs are stored only in protected (hashed) form, and we choose service providers that commit to protecting the information they handle for us. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorized third parties will never be able to defeat our security. If a security incident affects your information, we will notify you as the law and our policy require.

10. Your privacy rights and how to make a request

In Short: You can ask to see, correct, or delete your information by emailing [email protected]. We respond within 30 days.

A parent of a minor student, an adult student, or (for billing and account information) a payer may ask us to:

• see their information, or get a copy of it, under our Document Access and Release Policy (INF-001);
• correct information that is inaccurate, under our Student Records and Privacy Policy (STU-006); or
• delete information. We delete information that our Records Retention Policy does not keep. Information that the policy keeps for a set period, or that is under a litigation hold, is kept until its period ends, and we will tell you what we kept and why. On a request about a student, we delete what was collected online from the student and keep the records we create or a parent gives us, as described in Section 4. A parent of a student under 13 may also direct us, at any time, to delete the information we collected online from the child, or refuse its further collection (see Section 4).

How to make a request. Email the Office of Legal Operations and Institutional Compliance at [email protected], or write to us at the address in Section 15. Tell us who you are, which student or account the request is about, and what you would like us to do. We do not delete accounts through our apps, and accounts cannot be deleted by students or families themselves. We make information available for review within 30 days after we receive your request, and answer other requests within a reasonable time, normally within 45 days. Until November 19, 2026, we answer every request, including a request to delete, within 30 days, as the current version of our Data Protection and Security Policy (INF-006), Section 11, provides.

Request Verification. We will verify that you are the person the information is about, or that person's parent or authorized representative, before we act. We normally do this by replying only to the email address or phone number we already have on file. We will use information you give us for verification only for that purpose.

Withdrawing your consent. If we rely on your consent, you may withdraw it at any time by emailing [email protected]. This does not affect processing before the withdrawal, or processing that relies on another lawful basis.

Opting out of our newsletter. Use the unsubscribe link in any newsletter, or email [email protected]. If we send you text messages, reply "STOP" to stop them. We will still send messages you need about your lessons, account, and invoices.

Cookies and similar technologies: Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject cookies. If you do, you may be signed out and some features may not work. For further information, please see our Cookie Policy: stevensed.org/cookies.

11. Controls for do-not-track features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") or Global Privacy Control setting that signals your preference not to have your online activity tracked. We do not track you across other companies' websites or apps, sell your personal information, or share it for targeted advertising, so there is no such tracking for these signals to turn off. No uniform standard for responding to DNT signals has been adopted. If one is adopted that we must follow, we will describe our practice in a revised version of this notice.

12. Do United States residents have specific privacy rights?

In Short: Depending on the state you live in, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of Personal Information We Collect

We have collected the following categories of personal information in the past twelve (12) months:

We collect and use sensitive personal information only for the purposes in this notice, and not to infer characteristics about you. We keep each category for the periods in Section 8.

Sources of Personal Information

Learn more about the sources of personal information we collect in "What information do we collect?"

How We Use and Share Personal Information

Learn about how we use your personal information in the section, "How do we use your information?"

Will your information be shared with anyone else?

We disclose personal information to our service providers under written terms between us and each provider, for the business purpose of providing our Services. The outside services described in Section 3 (YouTube, Gravatar, Google Fonts, jsDelivr, and cdnjs) receive limited technical information under their own terms; we do not receive anything from them in return. Learn more in the section, "Who do we share your information with?" In the preceding twelve (12) months, we have disclosed the following categories of personal information to service providers for a business purpose: Categories A, B, C, D, F, H, J, and L.

We have not sold or shared personal information, including the personal information of anyone under 16, for money or for cross-context behavioral (targeted) advertising, in the preceding twelve (12) months, and we do not do so.

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling"). We do none of these.

Depending upon the state where you live, you may also have the following rights:

• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including California's and Delaware's privacy law)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including Oregon's privacy law). Our service providers are listed in Section 3.
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including California's privacy law)

How to Exercise Your Rights

To exercise these rights, email [email protected] or write to us at the address at the bottom of this notice, as described in Section 10.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws, and we may need to verify your identity directly.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at [email protected]. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. You may still make such a request by using the contact details provided in the section "How can you contact us about this notice?"

13. What is our stance on third-party websites?

In Short: This notice does not cover other companies' websites that we link to.

The Services may link to other websites, services, or apps that we do not operate, such as our social media pages. This notice does not cover them, and we are not responsible for their content or their privacy and security practices. Please review their privacy policies before you give them information.

14. Do we make updates to this notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this privacy notice. If we make material changes, we will post a notice of the changes or send you a notification, as our policies require. Before any material change in what we collect online from children under 13, how we use it, or who receives it, we will ask parents for new consent.

15. How can you contact us about this notice?

For privacy questions and requests, email the Office of Legal Operations and Institutional Compliance at [email protected] or call (801) 413-3879. For anything else, email [email protected]. You can also contact us by post at:

StevensED LLC
ATTN: Office of Legal Operations and Institutional Compliance
P.O. Box 900342
Sandy, UT 84090
United States