ALTOS ACADEMY PRIVACY POLICY - EFFECTIVE APRIL 23, 2025

What information does the Academy collect and how is that information used?

Information Collected

In order to apply for and use our Services, you generally provide name, email address, phone number, date of birth, school, etc. to us. You may voluntarily provide additional personal information, or we may ask for additional personal information, in connection with the purchase and use of Services.

In some cases, you will purchase access to the Services by entering a credit card or information for a form of payment (e.g., Stripe). Academy may arrange for the collection of financial information such as your payment method (valid credit card number, type, expiration date or other financial information).

Any personal information that you communicate with other users of the Services is your own choice and the privacy of such information cannot be guaranteed. Information shared should be considered public information.

Cookies

A "cookie" is a small piece of data placed on your computer by the Site. Within your web browser, cookies placed by our website can only be accessed by our website. We use cookies to maintain session and preference information to improve the use of the website. You may set your web browser to decline our cookies. This may reduce your user experience to certain extent.

We may also allow cookies to be placed on your computer by third parties for the purpose of website analytics. This allows the third parties to collect data about your use of our website. The data collected by these cookies may include information such as your IP address or mobile identifier, the type of computer operating system, the web browser, the frequency with which the user visits various parts of our website or applications, and information regarding the online or mobile service provider. We don't share the data that a third party collects with anyone besides that third party. The third parties are required not to share any personally identifiable information they may collect with anyone other than us (except as may be required by law). We use the data that is collected in the following ways:

• to report, in aggregate, how our visitors find and use our website;
• to understand overall visitor behavior; and
• to inform how we update and improve our website.

Academy also gathers information about its users collectively and automatically logs IP addresses, session sources, and other data that track access to the website. We analyze these logs to better understand aggregate behavior and to monitor Services performance. The logs are analyzed to ascertain the overall aggregate trends they reveal about our users, but not as a means of tracking the behavior of individual users outside our website. This information is used for the purposes of maintaining and improving the Services, and expanding its capabilities.

Job Applicants

If you apply for a job with the Academy via our website or a third party website, we will obtain the information you choose to provide us in your application for that purpose. For example, we collect contact information (e.g. name, email, telephone); professional and employment-related information (e.g. your resume, employment history, experience, qualifications, portfolios, work samples); education information (e.g. degrees obtained, academic records); other employment details (e.g. how you heard about the position, willingness to relocate, and other job preferences); and information provided during the hiring process (e.g. assessments, phone interviews, reference checks). We will use the information we collect to carry out our application and recruitment process; to improve our application and recruitment process, and to comply with applicable laws and regulations and create reports required under local laws or regulations. We may also optionally collect demographic information (e.g. race, ethnicity, gender, disability status) that is collected for the sole purpose of creating reports required under local laws and regulations. By submitting a job application, you agree that we may contact you using any of the contact information provided.

Use and Disclosure of Collected Information

We do not use or share your personal information with others except as indicated in this Privacy Policy.

Academy will use your personal information to provide the Services to you, alert you of new Services features and enhancements, respond to your support issues, and/or notify you of upgrade opportunities, promotions, and special offers. You agree that we may communicate with you via email and other electronic communication tools for any purpose relating to the website or the Services. We may share your name, phone number, and email address with third parties for sending correspondence. If you opt into marketing communications, we may share that information with third party social media platforms you may use to share updates and information about our services/related services with you on those platforms. We will not share this information with any other third party, except as may be required by law.

We will share payment information with our credit card payment processor. We will store all of this information on our server, except for your credit card information; however, the credit card information may be retained by our credit card processor for the purpose of processing additional transactions, refunds, and/or chargebacks. We will not use this information for any purpose other than to process your purchase, and will not share this information with any other third party, except as described above or as may be required by law.

We may access and copy information of users of the Services for the purposes of backup, internal maintenance, improvement of the Services, and technical support. We take the utmost efforts to not divulge such information to unauthorized individuals. We strive to ascertain whether authorized persons are able to access the information correctly and to inform these authorized persons how to access the information.

Academy may aggregate information to enhance our Services, perform educational research, and to develop new Services. We may disclose aggregated and statistical information to third parties that does not identify a specific user.

Academy may also disclose personal information:

• When we have your permission to do so; or
• To companies as vendors or contractors to provide one or more parts of the Services or that provide related administrative functions (such as support Services, web analytics, and fraud detection). These third parties may have access to your personal information; if they do, this access is only so that they may perform these tasks on our behalf and they are obligated not to disclose or use it for any other purpose; or
• When we believe in good faith that disclosure is reasonably necessary to (1) comply with a legal process or law, or to respond to a government request for information, (2) enforce the terms of use or other agreements, (3) respond to claims that any content on the website or Services violates the rights of third parties, or that otherwise arise from your use of the Services, or (4) protect the rights, property, or personal safety of Academy, its users, or the public.

In the event the Academy is involved in a merger, acquisition, sale of business assets involving customer information, change of control, or similar transaction, your information may be transferred or shared as part of the transaction. We will work to require the recipient to protect all personal information collected from the Academy users in accordance with the terms of this Privacy Policy.

Opt-Out

We provide you the opportunity to opt-out of receiving certain communications from us by contacting customer support. In addition, all marketing emails from Academy will provide you with the opportunity to unsubscribe from future marketing mailings. Even if you opt out of such communication, however, we reserve the right to send you transactional messages, including email and other communications to provide account-related information, disclose maintenance, transaction-related matters (e.g., order confirmation, shipping information, account status information, etc.) and other service-related issues.

Access to Account

If you are a registered user of the Services, you can change your account information through the account profile component of the Services. You may need to supply certain information so that we can verify your authority to modify this information.

Third-Party Sites

The website and Services may contain links and/or other connections to other sites, web services, and information. We have no responsibility for the privacy practices of other web sites and services.

The fact that we may link to a website is not an endorsement, authorization or representation of our affiliation with that third party, nor is it an endorsement of their privacy or information security policies or practices. We do not exercise control over third party websites or services. These other websites or services may place their own cookies or other files on your computer, collect data or solicit personal information from you. Other websites and services follow different rules regarding the use or disclosure of the personal information you submit to them. We encourage you to read the privacy policies or statements of the other websites you visit and services you use.

Legal Requirements

We intend to protect your privacy to the fullest extent possible as described in this Privacy Policy while also fulfilling our responsibility to uphold all applicable laws and regulations. Due to potential legal requirements and other possible circumstances, we cannot ensure that all of your private communications and other personally identifiable information will never be disclosed or accessed in ways not otherwise described in this policy. We may be compelled under law to disclose information to government or third parties under certain circumstances or third parties may unlawfully intercept or access transmissions or private communications. Further, we can, and you hereby authorize us to, disclose any information to law enforcement or other government officials that we, in our sole discretion, believe necessary or appropriate in compliance with the law and/or government requests.

United States

The Services are hosted in the United States. If you are accessing the website or Services from outside the United States, please be advised that through your continued use of the website or Services, which is governed by U.S. law and this Privacy Policy, you are transferring your personal information to the United States and you consent to that transfer.

Security

We implement commercially reasonable security methods to protect the information we collect from you. We maintain internal data management policies and procedures, system monitoring, and incident response plans. While the security of your personal information is of the utmost importance to us, we cannot absolutely guarantee the security of any information you choose to disclose.

Data Retention

The following describes Academy's data retention policies for categories of personal information that are collected:

The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you (for example, for as long as you are a customer or prospective customer) and the length of time thereafter during which we may have a legitimate need to reference your personal information to address issues that may arise;
• Whether there is a legal obligation to which we are subject to (for example, certain laws require us to keep records for a certain period of time before we can delete them); or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

Notice of Consumer Rights

You may have rights with respect to personal information that has been collected in the last twelve (12) months, including:

• The right to know what personal information a business has about them and what that business does with that information
• The right to know whether their data is sold or disclosed, and to whom
• The right to opt-out (prevent) the sale of their data
• The right to opt-out of sharing personal information for cross-context or targeted behavioral advertising purposes
• The right to correct inaccurate personal information
• The right to restrict the processing of sensitive personal information
• The right to delete their personal information, subject to certain exceptions
• The right to appeal a refusal to take action on a consumer rights request

We will never sell users' personal information. For information on what personal information we collect and how it is used, please refer to the "What information does the Academy collect and how is that information used?" section above.

Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your personal information. To designate an authorized agent, you must provide a signed, written authorization or a valid power of attorney issued pursuant to California Probate Code sections 4000 to 4465. You may also make a request on behalf of your child by contacting us through the email associated with the parent account for that child.

To exercise any of these rights, please submit a request by emailing us per our contact information with the subject line, "Consumer Rights Request". We will need to verify your identity before processing your request, which may require us to request additional personal information from you or require you to log into your account, if you have one.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or as permitted by law.

We will not discriminate against you for exercising any of these rights, including denying you goods or services, charging you different prices or rates for goods or services, or providing you a different level or quality of goods or services.

Changes

Academy posts any changes to this Privacy Policy on the website. Your continued use of the website and Services constitutes your agreement to this Privacy Policy and any future revisions.

Contact Information

Questions or comments about this Privacy Policy may be sent to:

This Privacy Policy is effective April 23, 2025. This Privacy Policy may be updated from time to time as necessary.

COPPA Policy

The federal Children's Online Privacy Protection Act (COPPA) requires that we inform you of our practices with regards to our collection, use, or disclosure of personal information from children under the age of 13, and to obtain verifiable parental consent prior to collecting, using, or disclosing any such information. If we discover we have collected information from a child in a manner inconsistent with COPPA's requirements, we will either seek the parent's consent for that collection or delete the information. We won't require a child to disclose more information than is reasonably necessary to participate in an activity.

1. Information we collect and share

When we use the term "children" or "child", it refers to individuals under the age of 13.

We may collect and share the following personal information with verifiable parental consent (where necessary under COPPA) from children:

(a) A username used to uniquely identify each child is created during registration. This username may be disclosed on our website, for example in our message boards or any other part of the website on which the child may participate.

(b) The child's real name will only be used for internal purposes or will be disclosed only to third parties to whom the child's parent has given specific authorization.

(c) Other non-identifying data may be collected in the course of a child's participation on the website; for example, online homework submissions, etc. These data may be combined or associated with the child's username, and may be publicly available on the website, at the child's or parent's discretion.

(d) We strongly discourage users from sharing personal information beyond username, but we cannot prevent it in every instance, should the child choose to do so. This policy addresses how parents can delete information posted by their children below. Please refer to the Section parental rights and responsibilities.

(e) When children use our websites, certain information may automatically be collected by third parties: IP address or mobile identifier, the type of computer operating system, the web browser, the frequency with which the user visits various parts of our website or applications, and information regarding the online or mobile service provider. This information is collected using technologies such as cookies, which are described above. This data is primarily collected and shared with third parties for internal purposes, in order to:

• report, in aggregate, how our users find and use our website;
• understand overall users behavior; and
• inform how we update and improve our website.

This information is not used to target advertising to specific users.

(h) We may disclose a child's personal information if permitted or required by law, for example, in response to a court order or a subpoena.

(i) We generally do not collect personal information from a child until we have received verifiable parental consent in accordance with COPPA. There are limited instances where we may collect information without parental consent in compliance with COPPA, including:

• an email address is collected from a child at the time of registration, solely to contact the child's parent in order to obtain the necessary parental consent;
• to protect the security or integrity of our website and Services; and
• a username is selected by the child; however, this username cannot be used to contact the child, nor be used for the purposes listed in sections (c) and (d) of above, unless and until we receive verifiable parental consent.

2. Parental rights and responsibilities

a. At any time, a parent can review or ask us to delete a child's personal information, or can refuse to permit its further collection or use, by contacting us by any of the means listed in Section contact information.

b. Parents may also access their child's personal information by logging onto their account and can delete their child's personal information. Parents will need their child's username and password, and our login page explains how parents can recover a username or password if they cannot recall this information.

3. Contact information

Questions or comments about this policy, or requests pursuant to Section parental rights and responsibilities above, may be sent to:

This COPPA Policy is current as of April 23, 2025. We may change this COPPA Policy from time to time, so please be sure to review periodically.