Legal Center

For purposes of this Policy, the following terms have the meanings set forth below:

1. I.
   "Child" or "Children" means an individual or individuals under 13 years of age.
2. II.
   "Education Records" means records, files, documents, and other materials that contain information directly related to a student and are maintained by an educational agency, institution, or by a party acting for the agency or institution, as defined under FERPA, 20 U.S.C. § 1232g(a)(4).
3. III.
   "Parent" means a parent or legal guardian of a Student who is either under 18 years of age or under 13 years of age, as context requires.
4. IV.
   "Parental Consent" means verifiable consent from a Parent as required under COPPA for Children under 13, obtained through the methods described in Article 4 below.
5. V.
   "Personal Information" means information that identifies, relates to, describes, or is capable of being associated with a particular Student, including but not limited to:

   1. A.
      First and last name;
   2. B.
      Home or other physical address;
   3. C.
      Email address;
   4. D.
      Telephone number;
   5. E.
      Social Security number;
   6. F.
      Date of birth;
   7. G.
      Photographs, videos, or audio recordings;
   8. H.
      Geolocation information;
   9. I.
      Persistent identifiers such as customer number, IP address, device identifiers, or other unique identifiers;
   10. J.
       Academic records, including grades, test scores, course schedules, and transcripts;
   11. K.
       Athletic statistics, performance metrics, and related data;
   12. L.
       Biometric information;
   13. M.
       Any other information that, alone or in combination, is linked or reasonably linkable to a specific Student.
6. VI.
   "School Official" means a contractor, consultant, volunteer, or other party to whom an educational agency or institution has outsourced institutional services or functions that it would otherwise use employees to perform, and who meets the criteria set forth in 34 C.F.R. § 99.31(a)(1)(i)(B).
7. VII.
   "Services" means the RecruitPathIQ Platform, including all features, tools, content, and functionality provided through our website, mobile applications, and related services.
8. VIII.
   "Student" means any individual who creates or on whose behalf is created a user account on the RecruitPathIQ Platform for the purpose of college recruitment.
9. IX.
   "Student Data" means Personal Information and Education Records concerning a Student that are provided to RecruitPathIQ by or on behalf of the Student, Parent, or School, or generated by the Student's use of the Services.
10. X.
    "Usage Information" means information automatically collected about a user's interaction with the Services, including IP addresses, browser types, device identifiers, pages viewed, links clicked, and time spent on the Platform.

1. I.
   Student Data Provided by Users.

   1. A.
      Account Information. When a Student or Parent creates an account on behalf of a Student, we collect identifying information including:

      1. 1.
         Student's full name, date of birth, grade level, and gender;
      2. 2.
         Parent's full name, email address, telephone number, and relationship to Student;
      3. 3.
         School name, school district, and geographic location;
      4. 4.
         Username and password credentials;
      5. 5.
         Profile photograph (optional).
   2. B.
      Academic Information. Students or Parents may upload and we collect:

      1. 1.
         Grade point average (GPA) and class rank;
      2. 2.
         Standardized test scores (SAT, ACT, and other assessments);
      3. 3.
         Course transcripts and schedules;
      4. 4.
         Academic honors, awards, and recognitions;
      5. 5.
         Teacher or counselor recommendations (if provided).
   3. C.
      Athletic Information. Students or Parents may upload and we collect:

      1. 1.
         Sport(s) played and position(s);
      2. 2.
         Athletic statistics, performance metrics, and game results;
      3. 3.
         Videos and photographs of athletic performances;
      4. 4.
         Coaching staff contact information;
      5. 5.
         Athletic honors, awards, and achievements;
      6. 6.
         Physical measurements (height, weight, speed metrics).
   4. D.
      Other Academic Indicators. Students or Parents may provide:

      1. 1.
         Extracurricular activities and leadership roles;
      2. 2.
         Community service and volunteer work;
      3. 3.
         Personal statements, essays, and biographical information;
      4. 4.
         References and contact information for recommenders.
2. II.
   Information Collected from Schools.

   1. A.
      When Schools register Students or integrate their student information systems with the Platform, we may receive Education Records and Student Data directly from the School, including academic transcripts, attendance records, and disciplinary records as authorized by the School and permitted under FERPA.
   2. B.
      Schools may designate RecruitPathIQ as a School Official with a legitimate educational interest in Student Data for the purpose of facilitating college recruitment services.
3. III.
   Usage Information and Cookies.

   1. A.
      Automatic Data Collection. We automatically collect Usage Information when Students, Parents, or other users visit or interact with the Platform, including:

      1. 1.
         Device information (device type, operating system, browser type);
      2. 2.
         IP address and geolocation data;
      3. 3.
         Pages viewed, features accessed, and time spent on the Platform;
      4. 4.
         Clickstream data and navigation patterns;
      5. 5.
         Referring and exit pages.
   2. B.
      Cookies and Tracking Technologies. We use cookies, web beacons, pixel tags, and similar technologies to collect Usage Information, remember user preferences, authenticate users, and analyze Platform performance. Users may control cookie settings through their browser, but disabling cookies may limit functionality.
   3. C.
      Usage Information is not used to personally identify Students except when combined with Personal Information that Students or Parents have voluntarily provided.
4. IV.
   Information from Third Parties.

   1. A.
      We may receive information about Students from college recruiters, athletic organizations, or third-party services that Students have authorized to share information with RecruitPathIQ.
   2. B.
      We do not purchase or otherwise acquire Student Data from data brokers or similar third parties.
5. V.
   Parental Consent for Children Under 13.

   1. A.
      We do not knowingly collect Personal Information from Children under 13 without first obtaining verifiable Parental Consent as required by COPPA.
   2. B.
      If we discover that we have collected Personal Information from a Child under 13 without Parental Consent, we will delete that information as quickly as possible.
   3. C.
      The process for obtaining and verifying Parental Consent is described in Article 4 below.

1. I.
   Permitted Uses.

   1. A.
      We use Student Data solely for the following purposes:

      1. 1.
         Platform Services. To provide, maintain, and improve the RecruitPathIQ Platform and enable Students to create recruitment profiles, showcase their achievements, and connect with college recruiters;
      2. 2.
         College Recruitment. To facilitate communication and information sharing between Students and college recruiters, coaches, and admissions personnel;
      3. 3.
         Account Management. To create and manage user accounts, authenticate users, and provide customer support;
      4. 4.
         Parental Controls. To enable Parents to exercise their rights to consent, access, review, modify, and delete Student Data;
      5. 5.
         Communication. To send account-related notifications, service updates, and responses to inquiries;
      6. 6.
         Analytics and Improvement. To analyze usage patterns, improve Platform functionality, develop new features, and enhance user experience;
      7. 7.
         Legal Compliance. To comply with applicable laws, regulations, legal processes, and governmental requests;
      8. 8.
         Safety and Security. To detect, prevent, and respond to fraud, security incidents, violations of our Terms of Service, and other harmful or illegal activity;
      9. 9.
         Research. To conduct research and analysis in aggregated, de-identified form that does not identify individual Students.
2. II.
   Limitations on Use.

   1. A.
      We will not use Student Data to:

      1. 1.
         Engage in targeted advertising to Students based on their Personal Information or browsing behavior on the Platform or third-party sites;
      2. 2.
         Create individual or household profiles for commercial purposes unrelated to the provision of the Services;
      3. 3.
         Sell or rent Student Data to third parties;
      4. 4.
         Use or disclose Student Data for any purpose other than those described in this Policy without obtaining additional consent from Parents (for Children under 13) or from Students and Parents (for Students 13 and older).
   2. B.
      RecruitPathIQ does not display third-party advertisements on the Platform.
3. III.
   De-Identified Data.

   1. A.
      We may aggregate and de-identify Student Data to create statistical or analytical information that cannot reasonably be used to identify any individual Student.
   2. B.
      De-identified data may be used for research, analytics, benchmarking, and product development without restriction.
   3. C.
      We will maintain and use de-identified data only in de-identified form and will not attempt to re-identify such data.

1. I.
   Verifiable Parental Consent for Children Under 13.

   1. A.
      Consent Requirement. Before permitting a Child under 13 to register for or access the Platform, we require verifiable Parental Consent as mandated by COPPA.
   2. B.
      Consent Methods. We obtain verifiable Parental Consent through one or more of the following methods:

      1. 1.
         Signed Consent Form. Parent completes, signs, and returns a written consent form by mail, email (scanned document), or fax;
      2. 2.
         Credit Card or Debit Card Verification. Parent provides a credit card, debit card, or other payment method in connection with a transaction, and we verify the card information;
      3. 3.
         Video Conferencing. Parent participates in a video conference call during which a government-issued identification document is presented and identity is verified;
      4. 4.
         Knowledge-Based Authentication. Parent answers a series of knowledge-based authentication questions;
      5. 5.
         Electronic Signature. Parent provides an electronic signature through a secure, third-party service that verifies identity.
   3. C.
      Consent Notification. Prior to obtaining consent, we provide Parents with:

      1. 1.
         A link to this Policy;
      2. 2.
         A description of the types of Personal Information we collect from Children;
      3. 3.
         How we use, disclose, and protect that information;
      4. 4.
         Parental rights regarding access, review, and deletion of their Child's information;
      5. 5.
         A statement that Parental Consent is required and that the Parent may revoke consent at any time.
   4. D.
      Consent Retention. We retain records of Parental Consent for the duration of the Child's account and as required by law.
2. II.
   Parental Acknowledgment for Students 13 and Older.

   1. A.
      For Students aged 13 to 17, we require Parental acknowledgment before the Student may access the Platform.
   2. B.
      Parental acknowledgment confirms that the Parent has reviewed this Policy and authorizes the Student's use of the Platform.
   3. C.
      Parents of Students aged 13 to 17 retain substantial rights to access, review, modify, and delete their child's Student Data as described in Section III below.
3. III.
   Comprehensive Parental Rights and Powers.

   1. A.
      Right to Access and Review. Parents have the right to access and review all Student Data collected and maintained by RecruitPathIQ concerning their child, including:

      1. 1.
         Account and profile information;
      2. 2.
         Academic and athletic data;
      3. 3.
         Communications sent or received through the Platform;
      4. 4.
         Usage Information and activity logs.
   2. B.
      Right to Modify and Correct. Parents have the right to request correction or modification of any inaccurate, incomplete, or outdated Student Data. We will respond to such requests within 30 days and make corrections as appropriate.
   3. C.
      Right to Delete. Parents have the right to request deletion of their child's Student Data at any time by contacting us at hello@recruitpathiq.com. Upon receipt of a verified deletion request, we will:

      1. 1.
         Delete the Student's account and all associated Personal Information from our active systems within 30 days;
      2. 2.
         Notify any third parties to whom the data was disclosed (including college recruiters) and request deletion, where feasible;
      3. 3.
         Retain only such information as is necessary to comply with legal obligations or as permitted under applicable law.
   4. D.
      Right to Withdraw Consent. Parents may revoke Parental Consent at any time. Revocation of consent will result in:

      1. 1.
         Immediate termination of the Child's access to the Platform;
      2. 2.
         Deletion of the Child's Student Data as described in subsection C above.
   5. E.
      Right to Refuse Further Collection. Parents may refuse to permit further collection or use of their child's Personal Information. Such refusal will terminate the Student's access to the Platform.
   6. F.
      Right to Control Disclosure. Parents may control whether and to whom their child's Student Data is disclosed, including:

      1. 1.
         College recruiters and admissions personnel;
      2. 2.
         Athletic organizations and scouts;
      3. 3.
         Third-party service providers.
   7. G.
      Right to Export Data. Parents have the right to receive a copy of their child's Student Data in a portable, machine-readable format upon request.
4. IV.
   How Parents Can Exercise Their Rights.

   1. A.
      Parents may exercise any of the rights described in this Article 4 by:

      1. 1.
         Logging into their Parent account on the Platform and accessing the Parental Controls dashboard;
      2. 2.
         Contacting us by email at hello@recruitpathiq.com;
      3. 3.
         Calling us at our support line (available on request);
      4. 4.
         Writing to us at our mailing address (available on request).
   2. B.
      To verify identity and protect Student Data, we may require Parents to provide:

      1. 1.
         The Student's full name, date of birth, and username;
      2. 2.
         The Parent's full name, email address, and relationship to the Student;
      3. 3.
         A copy of a government-issued identification document (driver's license, passport) or other verification materials.
   3. C.
      We will respond to verified requests within 30 days, or sooner if required by applicable law.

1. I.
   Disclosure to College Recruiters.

   1. A.
      The primary purpose of the RecruitPathIQ Platform is to enable Students to share their academic and athletic profiles with college recruiters, coaches, and admissions personnel.
   2. B.
      Students and Parents control which portions of the Student's profile are visible to recruiters and may adjust privacy settings at any time through the Platform.
   3. C.
      When a Student or Parent authorizes disclosure, we share Student Data with college recruiters, including:

      1. 1.
         Name, contact information, and demographic information;
      2. 2.
         Academic records, GPA, test scores, and transcripts;
      3. 3.
         Athletic statistics, videos, and performance metrics;
      4. 4.
         Extracurricular activities and honors.
   4. D.
      College recruiters who receive Student Data through the Platform are bound by their own privacy policies and institutional practices. We require recruiters to use Student Data solely for recruitment and admissions purposes and to protect Student Data in accordance with applicable law, but we are not responsible for recruiters' data practices once Student Data is disclosed.
2. II.
   Disclosure to Schools.

   1. A.
      When a School registers Students or integrates with the Platform, we may share information with the School concerning:

      1. 1.
         Student account activity and engagement;
      2. 2.
         Recruitment inquiries and interest from colleges;
      3. 3.
         Platform usage statistics.
   2. B.
      We share such information only as authorized by the School and consistent with FERPA.
3. III.
   Service Providers and Business Partners.

   1. A.
      We engage third-party service providers to perform functions on our behalf, including:

      1. 1.
         Cloud hosting and data storage providers;
      2. 2.
         Customer support and communication platforms;
      3. 3.
         Analytics and performance monitoring tools;
      4. 4.
         Payment processors (if applicable);
      5. 5.
         Identity verification and fraud prevention services.
   2. B.
      These service providers are granted access to Student Data only to the extent necessary to perform their designated functions and are contractually obligated to:

      1. 1.
         Use Student Data solely for the purposes for which it was disclosed;
      2. 2.
         Implement and maintain appropriate security measures;
      3. 3.
         Comply with applicable privacy laws, including FERPA and COPPA;
      4. 4.
         Not disclose Student Data to any other party without our authorization;
      5. 5.
         Delete or return Student Data upon termination of the service relationship or at our request.
   3. C.
      A current list of our primary service providers is available upon request by contacting hello@recruitpathiq.com.
4. IV.
   Legal and Regulatory Disclosures.

   1. A.
      We may disclose Student Data without prior consent when required or permitted by law, including:

      1. 1.
         In response to a subpoena, court order, or other legal process;
      2. 2.
         To comply with applicable federal, state, or local laws and regulations;
      3. 3.
         To respond to lawful requests from government authorities, law enforcement, or regulatory agencies;
      4. 4.
         To enforce our Terms of Service or other agreements;
      5. 5.
         To protect the rights, property, safety, or security of RecruitPathIQ, our users, or the public;
      6. 6.
         In connection with the investigation or prevention of fraud, security incidents, or illegal activity.
   2. B.
      When legally permitted, we will provide advance notice to Parents and Students before disclosing Student Data in response to legal process.
5. V.
   Business Transfers.

   1. A.
      In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, Student Data may be transferred to a successor entity.
   2. B.
      We will provide advance notice to Parents and Students via email and through a prominent notice on the Platform before Student Data is transferred or becomes subject to a different privacy policy.
   3. C.
      Parents will have the opportunity to delete their child's Student Data before any such transfer.
6. VI.
   Aggregate and De-Identified Information.

   1. A.
      We may share aggregated, de-identified, or anonymized information that does not identify individual Students with third parties for research, analytics, marketing, or other purposes.
   2. B.
      Such information is not subject to the restrictions in this Article 5.
7. VII.
   Prohibited Disclosures.

   1. A.
      We will not sell, rent, or lease Student Data to third parties for their direct marketing purposes.
   2. B.
      We will not disclose Student Data to third parties for purposes unrelated to the Services without obtaining additional consent from Parents (for Children under 13) or Students and Parents (for Students 13 and older).

1. I.
   General Retention Principles.

   1. A.
      We retain Student Data only for as long as necessary to fulfill the purposes for which it was collected, provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.
   2. B.
      Retention periods are determined based on:

      1. 1.
         The nature and sensitivity of the Student Data;
      2. 2.
         The purposes for which the data is processed;
      3. 3.
         Applicable legal, regulatory, and contractual requirements;
      4. 4.
         Legitimate business needs.
2. II.
   Active Account Retention.

   1. A.
      While a Student's account remains active, we retain all Student Data necessary to provide the Services, including:

      1. 1.
         Account and profile information;
      2. 2.
         Academic and athletic data;
      3. 3.
         Communications and activity logs;
      4. 4.
         Usage Information.
   2. B.
      Students and Parents may modify or delete specific data elements at any time through their account settings.
3. III.
   Inactive Account Retention and Deletion.

   1. A.
      Inactive Account Defined. An account is considered inactive if the Student or Parent has not logged into the Platform or accessed any Services for a continuous period of 24 months.
   2. B.
      Notification. We will send email notifications to the Student and Parent at 18 months, 22 months, and 24 months of inactivity, advising that the account will be deactivated and Student Data will be deleted unless the account is reactivated.
   3. C.
      Automatic Deletion. If the account remains inactive for 24 consecutive months and the Student or Parent does not respond to our notifications, we will:

      1. 1.
         Deactivate the account;
      2. 2.
         Delete all Personal Information and Student Data from our active systems within 30 days;
      3. 3.
         Remove the Student's profile from visibility to college recruiters;
      4. 4.
         Retain only de-identified, aggregated data and such records as are necessary to comply with legal obligations.
   4. D.
      Exceptions. We may retain Student Data beyond the 24-month inactive period if:

      1. 1.
         Required to comply with a legal obligation, court order, or regulatory requirement;
      2. 2.
         Necessary to resolve disputes, enforce our Terms of Service, or protect our legal rights;
      3. 3.
         The Student or Parent has requested an extended retention period in writing.
4. IV.
   Account Closure and Deletion Requests.

   1. A.
      Students or Parents may close an account and request deletion of Student Data at any time by:

      1. 1.
         Using the account deletion feature in the Platform settings; or
      2. 2.
         Contacting us at hello@recruitpathiq.com.
   2. B.
      Upon receipt of a verified deletion request, we will:

      1. 1.
         Deactivate the account immediately;
      2. 2.
         Delete all Student Data from our active databases and systems within 30 days;
      3. 3.
         Notify any third parties (including college recruiters) to whom the Student Data was disclosed and request deletion, where technically feasible and legally permissible;
      4. 4.
         Provide confirmation of deletion to the Parent or Student via email.
   3. C.
      We may retain certain information as necessary to:

      1. 1.
         Comply with legal retention requirements (e.g., tax records, transaction logs);
      2. 2.
         Resolve pending disputes or claims;
      3. 3.
         Enforce our Terms of Service;
      4. 4.
         Maintain de-identified, aggregated data for analytics.
5. V.
   Backup and Archival Copies.

   1. A.
      Student Data may persist in backup or archival systems for up to 90 days following deletion from active systems.
   2. B.
      Backup copies are maintained solely for disaster recovery purposes and are not accessible for operational use.
   3. C.
      We will delete Student Data from backup systems in accordance with our standard backup rotation schedule.
6. VI.
   Third-Party Data Retention.

   1. A.
      When Student Data is disclosed to college recruiters or other third parties, those parties become independent data controllers responsible for their own data retention and deletion practices.
   2. B.
      We are not responsible for the retention or deletion practices of third parties, but we will make reasonable efforts to notify such parties of deletion requests where feasible.
7. VII.
   De-Identified and Aggregated Data.

   1. A.
      De-identified and aggregated data that cannot reasonably be used to identify an individual Student may be retained indefinitely for research, analytics, and product development purposes.
   2. B.
      Such data is not subject to the deletion requirements in this Article 6.
8. VIII.
   Records of Parental Consent.

   1. A.
      We retain records of Parental Consent for Children under 13 for the duration of the Child's account and for a period of the period required by applicable law following account closure or deletion, as required by COPPA.

1. I.
   Commitment to Security.

   1. A.
      RecruitPathIQ is committed to protecting Student Data from unauthorized access, use, disclosure, alteration, and destruction.
   2. B.
      We implement and maintain comprehensive administrative, technical, and physical security measures designed to safeguard Student Data in accordance with industry best practices and applicable legal requirements.
2. II.
   Administrative Safeguards.

   1. A.
      Privacy and Security Policies. We maintain written information security policies and procedures governing the collection, use, disclosure, retention, and destruction of Student Data.
   2. B.
      Employee Training. All employees, contractors, and agents with access to Student Data receive regular training on:

      1. 1.
         Privacy and data protection principles;
      2. 2.
         FERPA, COPPA, and other applicable privacy laws;
      3. 3.
         Our internal security policies and procedures;
      4. 4.
         Incident response and breach notification protocols;
      5. 5.
         Social engineering and phishing awareness.
   3. C.
      Access Controls. Access to Student Data is restricted to employees, contractors, and agents who require such access to perform their job functions. We enforce:

      1. 1.
         Role-based access controls (RBAC) limiting access based on job responsibilities;
      2. 2.
         Principles of least privilege and need-to-know;
      3. 3.
         Regular reviews of access permissions and prompt revocation of access upon termination of employment or contract.
   4. D.
      Background Checks. We conduct background checks on employees and contractors with access to Student Data, to the extent permitted by applicable law.
   5. E.
      Confidentiality Agreements. All employees, contractors, and service providers with access to Student Data are required to execute confidentiality and data protection agreements.
   6. F.
      Vendor Management. We conduct due diligence on third-party service providers prior to engagement, including:

      1. 1.
         Review of privacy and security policies;
      2. 2.
         Assessment of security controls and certifications;
      3. 3.
         Execution of data processing agreements containing security, confidentiality, and breach notification obligations.
   7. G.
      Incident Response Plan. We maintain a written incident response plan that includes procedures for detecting, responding to, and recovering from security incidents and data breaches.
3. III.
   Technical Safeguards.

   1. A.
      Encryption.

      1. 1.
         Data in Transit. All Student Data transmitted over public networks is encrypted using Transport Layer Security (TLS) 1.2 or higher with strong cipher suites.
      2. 2.
         Data at Rest. Student Data stored in our databases and systems is encrypted using industry-standard encryption algorithms (AES-256 or equivalent).
      3. 3.
         Backup Encryption. All backup copies of Student Data are encrypted.
   2. B.
      Authentication and Access Security.

      1. 1.
         User accounts are protected by secure password requirements, including minimum length, complexity, and periodic expiration.
      2. 2.
         We support and encourage the use of multi-factor authentication (MFA) for all user accounts.
      3. 3.
         Administrative and privileged accounts require multi-factor authentication.
      4. 4.
         We implement account lockout mechanisms to prevent brute-force attacks.
   3. C.
      Network Security.

      1. 1.
         Firewalls and intrusion detection/prevention systems (IDS/IPS) monitor and protect our network perimeter.
      2. 2.
         We employ network segmentation to isolate systems containing Student Data from other network resources.
      3. 3.
         All systems are regularly patched and updated to address known security vulnerabilities.
   4. D.
      Application Security.

      1. 1.
         We follow secure coding practices and conduct regular code reviews.
      2. 2.
         Applications are tested for common vulnerabilities (e.g., SQL injection, cross-site scripting, cross-site request forgery) prior to deployment.
      3. 3.
         We conduct periodic penetration testing and vulnerability assessments by qualified third-party security firms.
   5. E.
      Logging and Monitoring.

      1. 1.
         We maintain detailed logs of access to Student Data, including user identity, date, time, and actions performed.
      2. 2.
         Logs are monitored for suspicious activity and retained for a minimum of one year.
      3. 3.
         Automated alerts notify our security team of potential security incidents.
   6. F.
      Malware Protection. Anti-malware and anti-virus software is deployed on all systems and is updated regularly with the latest threat signatures.
   7. G.
      Data Loss Prevention. We employ data loss prevention (DLP) tools and techniques to detect and prevent unauthorized transmission of Student Data.
4. IV.
   Physical Safeguards.

   1. A.
      Data Center Security. Student Data is hosted in secure, third-party data centers that maintain:

      1. 1.
         24/7 physical security and monitoring;
      2. 2.
         Restricted access controls (keycards, biometric authentication);
      3. 3.
         Video surveillance;
      4. 4.
         Environmental controls (fire suppression, climate control, backup power).
   2. B.
      Device Security. Company-owned devices with access to Student Data are subject to:

      1. 1.
         Full-disk encryption;
      2. 2.
         Automatic screen locks and timeouts;
      3. 3.
         Remote wipe capabilities in the event of loss or theft;
      4. 4.
         Prohibition on storage of Student Data on removable media without encryption and authorization.
   3. C.
      Facility Access. Access to RecruitPathIQ offices and facilities is controlled through keycard systems, visitor logs, and employee escorts for non-employees.
5. V.
   Data Minimization and Anonymization.

   1. A.
      We collect and retain only the minimum Student Data necessary to provide the Services.
   2. B.
      When feasible, we de-identify or anonymize Student Data used for analytics, research, and product development.
6. VI.
   Regular Security Assessments.

   1. A.
      We conduct periodic risk assessments to identify and address potential security vulnerabilities and threats to Student Data.
   2. B.
      Our security program is audited annually by independent third-party auditors, and we implement recommended improvements.
   3. C.
      We maintain recognized information-security standards to demonstrate our commitment to information security.
7. VII.
   Limitations and User Responsibilities.

   1. A.
      No Absolute Security. While we employ robust security measures, no system is completely secure. We cannot guarantee that unauthorized access, hacking, data loss, or breaches will never occur.
   2. B.
      User Responsibilities. Students and Parents are responsible for:

      1. 1.
         Maintaining the confidentiality of their account credentials;
      2. 2.
         Using strong, unique passwords;
      3. 3.
         Enabling multi-factor authentication;
      4. 4.
         Logging out of accounts when using shared or public devices;
      5. 5.
         Promptly notifying us of any suspected unauthorized access or security incidents by contacting hello@recruitpathiq.com.

1. I.
   Breach Detection and Response.

   1. A.
      In the event that we discover or are notified of a data breach involving Student Data, we will promptly initiate our incident response procedures, including:

      1. 1.
         Containing and mitigating the breach;
      2. 2.
         Conducting a thorough investigation to determine the scope, cause, and impact of the breach;
      3. 3.
         Identifying affected individuals and the categories of Student Data involved;
      4. 4.
         Taking corrective action to prevent recurrence.
2. II.
   Notification to Parents and Students.

   1. A.
      Timing. If we determine that a data breach has resulted in unauthorized access to, acquisition of, or disclosure of Student Data, we will notify affected Parents and Students without unreasonable delay and in no event later than:

      1. 1.
         30 days after discovery of the breach, or such shorter period as may be required by applicable state or federal law; or
      2. 2.
         As soon as reasonably practicable following completion of our investigation if additional time is necessary to determine the scope of affected individuals and restore system integrity.
   2. B.
      Method of Notification. We will provide notice by:

      1. 1.
         Email to the email address associated with the Parent's or Student's account;
      2. 2.
         Prominent notice posted on the Platform homepage;
      3. 3.
         Direct mail or telephone, if email notification is not feasible or if required by law.
   3. C.
      Content of Notification. Breach notifications will include, to the extent known at the time of notification:

      1. 1.
         A description of the breach, including the date or estimated date of the breach and the date of discovery;
      2. 2.
         The types of Student Data that were involved (e.g., names, Social Security numbers, academic records);
      3. 3.
         The number of individuals affected, if known;
      4. 4.
         A description of the steps we have taken or are taking to respond to the breach and mitigate harm;
      5. 5.
         Contact information for individuals to obtain additional information and assistance;
      6. 6.
         Steps that Parents and Students can take to protect themselves, such as monitoring accounts or enrolling in credit monitoring services (if applicable);
      7. 7.
         Information about identity theft protection services we are offering, if any.
3. III.
   Notification to Schools.

   1. A.
      If a breach involves Education Records or Student Data provided by or on behalf of a School, we will notify the School without unreasonable delay and in compliance with any data processing agreement or service agreement in place.
   2. B.
      We will cooperate with the School in its own notification obligations under FERPA and state law.
4. IV.
   Notification to Regulatory Authorities.

   1. A.
      We will notify appropriate federal and state regulatory authorities of any data breach as required by applicable law, including:

      1. 1.
         The Federal Trade Commission (if the breach involves Children under 13 and COPPA applies);
      2. 2.
         State attorneys general (as required by state breach notification laws);
      3. 3.
         The U.S. Department of Education (if the breach involves Education Records and is reportable under FERPA).
   2. B.
      We will provide all information and cooperation required by regulatory authorities in connection with breach investigations.
5. V.
   Notification to Third Parties.

   1. A.
      If Student Data disclosed to college recruiters or other third parties is involved in a breach, we will notify those third parties and request that they take appropriate action to protect the data.
6. VI.
   Documentation and Recordkeeping.

   1. A.
      We will maintain detailed records of all data breaches, including:

      1. 1.
         The date and circumstances of the breach;
      2. 2.
         The categories and approximate number of individuals and records affected;
      3. 3.
         Actions taken to respond to and mitigate the breach;
      4. 4.
         Notifications provided and to whom;
      5. 5.
         Subsequent communications and remediation efforts.
   2. B.
      Breach records will be retained for a minimum of five years or as required by applicable law.

1. I.
   Policy Review and Updates.

   1. A.
      RecruitPathIQ reserves the right to modify, amend, or update this Policy at any time to reflect changes in our practices, Services, legal requirements, or for other operational, legal, or regulatory reasons.
   2. B.
      We will review this Policy at least annually and make updates as necessary to ensure continued compliance with applicable laws and alignment with best practices.
2. II.
   Notice of Material Changes.

   1. A.
      Material Change Defined. A "material change" includes any modification that:

      1. 1.
         Expands the categories of Student Data we collect;
      2. 2.
         Changes the purposes for which Student Data is used;
      3. 3.
         Expands the categories of third parties to whom Student Data is disclosed;
      4. 4.
         Reduces Parents' or Students' rights or protections;
      5. 5.
         Materially alters our security practices or data retention periods.
   2. B.
      Advance Notice. We will provide advance notice of any material changes at least 30 days before the changes take effect by:

      1. 1.
         Sending email notification to all registered Parents and Students at the email addresses associated with their accounts;
      2. 2.
         Posting a prominent notice on the Platform homepage and login screens;
      3. 3.
         Posting the revised Policy on our website with the "Last Updated" date clearly indicated;
      4. 4.
         Providing an in-Platform notification upon the user's next login.
   3. C.
      Content of Notice. Change notifications will include:

      1. 1.
         A summary of the material changes in plain language;
      2. 2.
         The effective date of the revised Policy;
      3. 3.
         A link to the full text of the revised Policy;
      4. 4.
         Information about Parents' and Students' options and rights in response to the changes.
3. III.
   Parental Consent to Material Changes.

   1. A.
      Children Under 13. If a material change affects the collection, use, or disclosure of Personal Information from Children under 13, we will obtain renewed verifiable Parental Consent before implementing the change.
   2. B.
      Students 13 and Older. For Students aged 13 to 17, we will notify Parents and Students of material changes and provide an opportunity to opt out or delete the Student's account before the changes take effect.
   3. C.
      Failure to Consent. If a Parent does not provide renewed consent or affirmatively opts out, we will:

      1. 1.
         Not apply the material changes to that Student's account;
      2. 2.
         Continue to operate the account under the prior Policy terms, if feasible; or
      3. 3.
         Provide the Parent with the option to close the account and delete all Student Data.
4. IV.
   Non-Material Changes.

   1. A.
      Non-material changes, such as updates to contact information, clarifications, formatting changes, or changes that enhance privacy protections, may be implemented without advance notice.
   2. B.
      We will update the "Last Updated" date at the top of this Policy and maintain a change log available upon request.
5. V.
   Continued Use After Changes.

   1. A.
      Continued use of the Platform following notice of Policy changes constitutes acceptance of the revised Policy, except where renewed Parental Consent is required as described in Section III above.
   2. B.
      If Parents or Students do not agree to the revised Policy, they may close the account and request deletion of Student Data as described in Article 4.
6. VI.
   Access to Prior Versions.

   1. A.
      We will maintain archived copies of prior versions of this Policy for a period of five years.
   2. B.
      Parents and Students may request access to prior versions by contacting hello@recruitpathiq.com.

1. I.
   Commitment to COPPA Compliance.

   1. A.
      RecruitPathIQ is committed to complying with the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. §§ 6501-6506, and the COPPA Rule, 16 C.F.R. Part 312.
   2. B.
      We do not knowingly collect, use, or disclose Personal Information from Children under 13 without first obtaining verifiable Parental Consent.
2. II.
   Age-Gated Registration.

   1. A.
      During the account registration process, we require users to provide the Student's date of birth.
   2. B.
      If the date of birth indicates that the Student is under 13, the registration process will not proceed until verifiable Parental Consent has been obtained.
3. III.
   Parental Consent Mechanism.

   1. A.
      The specific methods for obtaining verifiable Parental Consent are described in Article 4, Section I above.
   2. B.
      We provide Parents with clear, prominent notice of our information practices before requesting consent, including:

      1. 1.
         The types of Personal Information we collect from Children;
      2. 2.
         How we use and disclose such information;
      3. 3.
         Parental rights to access, review, and delete their Child's information;
      4. 4.
         The consequences of refusing consent or later revoking consent.
4. IV.
   Limitations on Collection from Children.

   1. A.
      We collect from Children under 13 only the Personal Information that is reasonably necessary to participate in the Platform and receive the Services.
   2. B.
      We do not condition a Child's participation in the Platform on the Child providing more Personal Information than is reasonably necessary.
5. V.
   No Targeted Advertising to Children.

   1. A.
      We do not display targeted advertising to Children under 13 based on their Personal Information or online activities.
   2. B.
      We do not use persistent identifiers to track Children across third-party websites or online services for behavioral advertising purposes.
6. VI.
   Parental Rights Summary.

   1. A.
      As detailed in Article 4, Parents of Children under 13 have the right to:

      1. 1.
         Review the Personal Information collected from their Child;
      2. 2.
         Request correction or deletion of their Child's Personal Information;
      3. 3.
         Refuse to permit further collection or use of their Child's information;
      4. 4.
         Revoke consent at any time.
   2. B.
      Exercise of these rights will not affect any information previously disclosed to third parties with consent, but we will request that such third parties delete the information where feasible.
7. VII.
   Child Safety Resources.

   1. A.
      We encourage Parents to discuss online safety with their Children and to monitor their Children's online activities.
   2. B.
      We provide Parents with resources and guidance on:

      1. 1.
         Reviewing privacy settings and controlling data sharing;
      2. 2.
         Understanding how college recruiters may contact Students;
      3. 3.
         Reporting inappropriate or suspicious communications;
      4. 4.
         Teaching Children about protecting Personal Information online.

1. I.
   FERPA Applicability.

   1. A.
      The Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232g, and its implementing regulations, 34 C.F.R. Part 99, govern the privacy of Education Records maintained by educational agencies and institutions that receive federal funding.
   2. B.
      When Schools use the RecruitPathIQ Platform and provide or authorize the disclosure of Education Records, RecruitPathIQ may receive and process Education Records as a School Official or service provider acting on behalf of the School.
2. II.
   RecruitPathIQ as School Official.

   1. A.
      To the extent required by a School's data sharing agreement or as otherwise authorized under FERPA, RecruitPathIQ acts as a School Official with a legitimate educational interest in accessing Education Records for the purpose of providing college recruitment services.
   2. B.
      As a School Official, we agree to:

      1. 1.
         Use Education Records solely for the purpose of providing the Services as directed by the School;
      2. 2.
         Not disclose Education Records to third parties without the School's authorization or as permitted under FERPA;
      3. 3.
         Implement and maintain appropriate security measures to protect Education Records;
      4. 4.
         Destroy or return Education Records when no longer needed for the authorized purpose or upon the School's request.
3. III.
   Student and Parental Rights Under FERPA.

   1. A.
      Under FERPA, eligible students (students 18 years or older or attending a postsecondary institution) and Parents of students under 18 have the right to:

      1. 1.
         Inspect and review the student's Education Records;
      2. 2.
         Request amendment of inaccurate or misleading records;
      3. 3.
         Consent to disclosures of personally identifiable information from Education Records, except as permitted by FERPA without consent;
      4. 4.
         File a complaint with the U.S. Department of Education concerning alleged failures to comply with FERPA.
   2. B.
      Questions or requests concerning Education Records provided by a School should be directed to the School. We will cooperate with Schools to facilitate the exercise of FERPA rights.
4. IV.
   Disclosure of Education Records.

   1. A.
      We disclose Education Records only:

      1. 1.
         With the prior written consent of the eligible student or Parent, as applicable;
      2. 2.
         As directed by the School;
      3. 3.
         To the extent permitted by FERPA without consent, including disclosures:

         1. a.
            To School Officials with legitimate educational interests;
         2. b.
            To officials of another school or school system in which the student seeks or intends to enroll, upon request and with notice;
         3. c.
            To comply with a judicial order or lawfully issued subpoena;
         4. d.
            In connection with a health or safety emergency;
         5. e.
            As otherwise permitted under 34 C.F.R. § 99.31.
   2. B.
      We maintain records of all disclosures of Education Records as required by FERPA.
5. V.
   Directory Information.

   1. A.
      Certain information about students may be designated as "directory information" by a School and disclosed without consent under FERPA, provided the School has given public notice and an opportunity to opt out.
   2. B.
      When a School designates information as directory information, we will treat such information in accordance with the School's FERPA policy and any opt-out requests.
6. VI.
   Coordination with Schools.

   1. A.
      We will cooperate with Schools to ensure FERPA compliance, including:

      1. 1.
         Executing data processing or data sharing agreements as required by the School;
      2. 2.
         Providing Schools with access to Education Records in our custody upon request;
      3. 3.
         Amending or deleting Education Records as directed by the School;
      4. 4.
         Providing Schools with copies of this Policy and our data security practices.

1. I.
   Right to Access.

   1. A.
      Students aged 13 and older and Parents of Students under 18 have the right to access, review, and obtain a copy of all Student Data maintained by RecruitPathIQ in connection with the Student's account.
   2. B.
      Access rights include:

      1. 1.
         Account and profile information;
      2. 2.
         Academic and athletic data uploaded or provided by the Student, Parent, or School;
      3. 3.
         Communications sent or received through the Platform;
      4. 4.
         Recruitment inquiries and interest from college recruiters;
      5. 5.
         Activity logs and Usage Information.
2. II.
   How to Request Access.

   1. A.
      Students and Parents may access Student Data by:

      1. 1.
         Logging into the account and navigating to the account settings and data management dashboard;
      2. 2.
         Contacting us by email at hello@recruitpathiq.com;
      3. 3.
         Calling us at our support line (available on request);
      4. 4.
         Writing to us at our mailing address (available on request).
   2. B.
      To protect Student Data and verify identity, we may require the requestor to provide:

      1. 1.
         The Student's full name, date of birth, and account username;
      2. 2.
         The requestor's full name, email address, and relationship to the Student;
      3. 3.
         A copy of a government-issued identification document or other verification materials.
3. III.
   Response Timeframe.

   1. A.
      We will respond to verified access requests within 30 days of receipt.
   2. B.
      We will provide the requested Student Data in a commonly used, machine-readable format (e.g., PDF, CSV, JSON) via secure email, secure download link, or through the Platform interface.
   3. C.
      If we are unable to fulfill the request within 30 days, we will notify the requestor of the delay and the expected response date.
4. IV.
   No Fee for Access.

   1. A.
      We will provide access to Student Data at no charge.
   2. B.
      If a requestor makes excessive, repetitive, or manifestly unfounded requests, we reserve the right to charge a reasonable fee based on administrative costs or to decline the request. We will notify the requestor before charging any fee.
5. V.
   Right to Correct or Modify Data.

   1. A.
      Students and Parents may request correction or modification of inaccurate, incomplete, or outdated Student Data.
   2. B.
      We will review requests for correction and make appropriate changes within 30 days of receipt of a verified request.
   3. C.
      If we determine that the requested change is not warranted, we will notify the requestor and provide an explanation. The requestor may submit a statement of disagreement, which we will maintain with the Student Data.
6. VI.
   Right to Export Data (Data Portability).

   1. A.
      Students and Parents may request a portable copy of Student Data in a structured, commonly used format to facilitate transfer to another service provider.
   2. B.
      Exportable data includes:

      1. 1.
         Profile information and account settings;
      2. 2.
         Academic and athletic records uploaded by the Student or Parent;
      3. 3.
         Communications and messages (subject to technical feasibility).
   3. C.
      We will provide the export within 30 days of receipt of a verified request via secure download link or other secure transmission method.
7. VII.
   Limitations on Access.

   1. A.
      We may deny or limit access requests if:

      1. 1.
         Providing access would violate another person's privacy rights or confidentiality obligations;
      2. 2.
         The request is manifestly unfounded, excessive, or made in bad faith;
      3. 3.
         Disclosure is prohibited by law or court order;
      4. 4.
         Providing access would compromise the security or integrity of our systems.
   2. B.
      If we deny or limit an access request, we will notify the requestor in writing and provide an explanation.

1. I.
   Third-Party Websites and Content.

   1. A.
      The Platform may contain links to third-party websites, services, applications, or content, including:

      1. 1.
         College and university websites;
      2. 2.
         Athletic organization and recruiting service websites;
      3. 3.
         Social media platforms;
      4. 4.
         Educational resources and tools.
   2. B.
      These third-party sites and services are not under RecruitPathIQ's control, and we are not responsible for their privacy practices, content, or functionality.
2. II.
   No Endorsement.

   1. A.
      The inclusion of a link to a third-party website or service does not constitute an endorsement, sponsorship, or recommendation by RecruitPathIQ.
   2. B.
      We do not make any representations or warranties regarding third-party sites or services.
3. III.
   Third-Party Privacy Policies.

   1. A.
      Third-party websites and services have their own privacy policies and terms of service.
   2. B.
      We encourage Students and Parents to review the privacy policies of any third-party sites or services before providing Personal Information or interacting with those sites.
4. IV.
   Limitation of Liability.

   1. A.
      RecruitPathIQ is not responsible for any loss, damage, or harm resulting from interactions with third-party sites or services accessed through links on the Platform.
   2. B.
      Any disputes or issues arising from use of third-party sites or services must be resolved directly with the third party.
5. V.
   Social Media Integration.

   1. A.
      If Students or Parents choose to connect their RecruitPathIQ account with social media platforms (e.g., by linking accounts or sharing content), information may be shared between the Platform and the social media platform according to the permissions granted.
   2. B.
      We encourage users to review and adjust their social media privacy settings to control what information is shared.

This Article describes how RecruitPathIQ accesses and uses data from a Student's Google Account. It applies only when a Student chooses to connect a Google Account to the Platform. Connecting a Google Account is optional; the Platform is usable without it, and a Student who does not connect one simply does not receive the coach-email features described below.

1. I.
   Permissions We Request.

   1. A.
      When a Student connects a Google Account, Google asks them to grant the following permissions, and only these:

      1. 1.
         Create and update email drafts, and send email, from the Student's own Gmail account (the "compose" permission). This is what allows the Platform to place a coach outreach email into the Student's Drafts folder for review, and to send it when the Student chooses to send it.
      2. 2.
         Read the Student's Gmail messages (the "read" permission). This is used solely to look at the message threads created by outreach the Platform itself sent, in order to detect a reply from a coach or a delivery failure (a "bounce").
      3. 3.
         Create and manage files that the Platform itself creates in the Student's Google Drive (the "drive.file" permission). This permission does not give the Platform access to any other file in the Student's Drive.
   2. B.
      We deliberately do NOT request permission to modify Gmail labels or settings, or any broader access to the Google Account than the permissions listed above.
2. II.
   Email Is Sent From the Student's Own Account, By the Student.

   1. A.
      Coach outreach email is composed in, and sent from, the Student's own Gmail account. RecruitPathIQ does not send this email from its own systems or its own domain, and the Student is the sender of record.
   2. B.
      No outreach email is sent automatically. A draft is prepared for the Student, and the email leaves the Student's account only when the Student affirmatively chooses to send it.
   3. C.
      A Parent or guardian with access to the Student's account may create and edit outreach drafts on the Student's behalf, but may NOT send them. Sending is restricted to the Student and to helper profiles the Student has authorized on their own account.
   4. D.
      Every outreach email sent through the Platform carries a short visible line identifying that it was sent using RecruitPathIQ, together with a hidden technical identifier used to match replies back to the correct draft. Neither is concealed from the Student, and both are described in the Platform's own settings.
3. III.
   Google Data We Store.

   1. A.
      From a connected Google Account we store only what the features require:

      1. 1.
         Access and refresh credentials for the Google Account, held so that drafting and reply monitoring can continue without asking the Student to sign in repeatedly;
      2. 2.
         Identifiers for the drafts, messages and message threads the Platform itself created;
      3. 3.
         For replies to Platform outreach: the sender's name and email address, the subject line, the date received, and the full text of the reply message itself;
      4. 4.
         For delivery failures: the fact of the failure, its stated reason, and the date.
   2. B.
      We do not copy, index, or store the full contents of the Student's mailbox, and we do not read message threads other than those created by outreach sent through the Platform.
4. IV.
   How Google Data Is Used, and the Limits On That Use.

   1. A.
      Data obtained from a Student's Google Account is used only to provide and improve the user-facing features the Student connected it for, namely:

      1. 1.
         Preparing, updating and sending coach outreach email at the Student's direction, including replies the Student writes within an existing email conversation;
      2. 2.
         Showing the Student which of their outreach emails received a reply and which failed to be delivered;
      3. 3.
         Generating a suggestion to the Student about how and when to follow up.
   2. B.
      To generate the follow-up suggestion described above, the coach's name and email address, the subject line, and the short message preview are transmitted to a third-party artificial-intelligence provider that acts as our service provider. That provider processes the information to produce the suggestion and is not permitted to use it to train generalized artificial-intelligence models.
   3. C.
      We affirmatively commit that data obtained from a Student's Google Account is NOT:

      1. 1.
         Used or transferred for advertising, marketing, or any form of targeted or personalized advertising;
      2. 2.
         Sold, rented, or licensed to any party;
      3. 3.
         Used to train generalized or standalone artificial-intelligence models;
      4. 4.
         Used for creditworthiness or lending decisions;
      5. 5.
         Read by any RecruitPathIQ employee, except with the Student's or Parent's explicit permission for a specific support request, where required by law, to investigate a security incident or abuse, or in aggregated and anonymized form for internal reliability measurement.
   4. D.
      These limits apply in addition to, and do not narrow, every other protection this Policy provides for Student Data.
5. V.
   Disconnecting and Deletion.

   1. A.
      A Student or Parent may disconnect the Google Account from the Platform at any time in the Platform's Settings, and may independently revoke the Platform's access from the Google Account security settings at myaccount.google.com. Either action stops all further access.
   2. B.
      On disconnection we delete the stored Google credentials. Reply and delivery-failure records already shown in the Student's own account history are retained under the retention rules in Article 6 of this Policy, because they are part of the Student's own recruiting record; a Student or Parent may request their deletion under Article 12.
   3. C.
      Disconnecting does not delete or recall email the Student has already sent, which resides in the Student's own Gmail account and is outside RecruitPathIQ's control.
6. VI.
   Relationship to Google's Terms.

   1. A.
      RecruitPathIQ's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
   2. B.
      The Student's Google Account itself is governed by Google's own terms of service and privacy policy, not by this Policy. Where a Student is under 18, we encourage Parents to review the guidance in Article 4 regarding supervision of third-party accounts.

1. I.
   Governing Law.

   1. A.
      This Policy and any disputes arising out of or related to this Policy or our data practices shall be governed by and construed in accordance with the laws of the state of Nevada, without regard to its conflict of laws principles.
   2. B.
      To the extent permitted by law, the federal courts located in and the state courts located in Clark County, Nevada shall have exclusive jurisdiction over any disputes arising out of or related to this Policy.
2. II.
   Dispute Resolution.

   1. A.
      Dispute resolution shall be governed by RecruitPathIQ's Terms of Service.

1. I.
   General Contact Information.

   1. A.
      For questions, concerns, or requests regarding this Policy or our data practices, please contact us:

RecruitPathIQ Attn: Privacy Officer Address: our mailing address (available on request) Email: hello@recruitpathiq.com Phone: our support line (available on request) Website: recruitpathiq.com

1. I.
   Complaints to Regulatory Authorities.

   1. A.
      If you believe that we have violated your privacy rights or applicable law, you have the right to file a complaint with appropriate regulatory authorities, including:

      1. 1.
         Federal Trade Commission (FTC): Consumer Response Center 600 Pennsylvania Avenue NW Washington, DC 20580 Phone: 1-877-FTC-HELP (1-877-382-4357) Website: www.ftc.gov/complaint
      2. 2.
         U.S. Department of Education (for FERPA complaints): Student Privacy Policy Office U.S. Department of Education 400 Maryland Avenue SW Washington, DC 20202 Email: FERPA@ed.gov Website: studentprivacy.ed.gov
      3. 3.
         State Attorney General (contact information for your state's Attorney General is available through the National Association of Attorneys General at www.naag.org).
   2. B.
      Filing a complaint with a regulatory authority does not preclude you from pursuing other remedies available under law.

1. I.
   Effective Date.

   1. A.
      This Student Data Privacy Policy is effective as of July 16, 2026 and was last updated on July 16, 2026.
2. II.
   Acknowledgment.

   1. A.
      By using the RecruitPathIQ Platform, or by permitting your child to use the Platform, you acknowledge that:

      1. 1.
         You have read and understood this Policy;
      2. 2.
         You consent to the collection, use, disclosure, and processing of Student Data as described herein;
      3. 3.
         You understand your rights and the rights of your child under this Policy and applicable law.
3. III.
   Questions.

   1. A.
      If you have any questions about this Policy or our data practices, please contact us using the information provided in Article 15.