Children’s Privacy Policy

1. Who We Are

UND Academy is operated by Universal Network Development LLC, doing business as “U.N.D Industries,” a limited liability company organized under the laws of the State of Florida, United States. This Children’s Privacy Policy applies specifically to the UND Academy educational platform and services that may be used by children under the age of 13.

For questions or requests regarding this policy, contact us at [email protected].

2. Our Commitment to Children’s Privacy

UND Academy complies with the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and the FTC’s implementing rule at 16 CFR Part 312, including the amendments effective April 22, 2026 (RIN 3084-AB20). We are committed to protecting the privacy of children who use our educational services.

3. Information We Collect from Children

We collect only the minimum information necessary to provide educational instruction. Specifically:

• First name — so the instructor can address the student by name during lessons.
• Date of birth — to determine age-appropriate content and verify COPPA applicability.
• Course progress data — which modules and lessons have been completed, with timestamps, to track learning outcomes and generate progress reports for parents.

We do NOT collect from children: last name, home address, school name, phone number, social media accounts, photographs, government identifiers, or any information beyond what is listed above.

4. How We Use Children’s Information

Children’s information is used solely for educational purposes:

• Delivering age-appropriate tutoring sessions
• Tracking course progress and completion
• Generating progress reports for the parent or guardian
• Communicating with the parent about the child’s enrollment (never directly with the child)

We do NOT use children’s information for marketing, behavioral advertising, profiling, or any purpose unrelated to educational instruction.

5. Disclosure to Third Parties

We do NOT sell, rent, trade, or share children’s personal information with any third party for any purpose, including marketing or advertising.

The only third-party services that may process data in connection with a child’s enrollment are:

• Stripe — processes the parent’s payment only. Stripe never receives the child’s personal information. The parent is the Stripe customer.
• Supabase — our database and authentication provider, which stores encrypted data at rest. Supabase acts as a data processor under our instruction.
• Cloudflare — our hosting and security provider, which may process connection metadata (IP addresses) for security purposes only.

We may disclose information if required by law, court order, or governmental regulation, or to protect the safety of a child.

6. Verifiable Parental Consent (VPC)

Before collecting any information from a child under 13, we require verifiable parental consent as required by COPPA (16 CFR § 312.5). Our VPC method is:

Payment Card Verification: The parent or legal guardian provides payment via Stripe during enrollment. Per 16 CFR § 312.5(b)(2), providing a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder constitutes valid verifiable parental consent. The parent also affirmatively checks separate consent boxes for: (a) COPPA data collection consent, (b) Florida recording consent, and (c) age attestation.

A child cannot self-enroll in UND Academy. Only a parent or legal guardian can create a child’s enrollment.

7. Parent’s Rights Under COPPA

As a parent or legal guardian, you have the right to:

• Review all personal information we have collected from your child. Log into your parent portal at academy-parent.html or email us.
• Request deletion of your child’s personal information. This can be done through the parent portal (“Delete Child’s Data” button) or by emailing us. Deletion is permanent and will be completed within 48 hours.
• Revoke consent for future collection. Once revoked, we will stop collecting additional data but will retain existing data until you request deletion.
• Refuse further collection without penalty. You will not be penalized for exercising these rights. Unused tutoring hours will be refunded.

To exercise any of these rights, use the Parent Portal or contact [email protected].

8. Session Recordings

All tutoring sessions are recorded for the safety and protection of all participants, including children. Florida is an all-party consent state (Fla. Stat. § 934.03). Parental consent for recording is obtained as a required part of the enrollment process.

Recordings are:

• Stored securely with encryption at rest
• Accessible only to the parent, the instructor, and UND administration
• Used only for educational review, safety documentation, and dispute resolution
• Never shared publicly, sold, or used for marketing
• Retained for no longer than 12 months after the last session, then permanently deleted

9. Data Retention & Security

Retention Policy: Children’s personal information is retained only for as long as the child is actively enrolled. Upon unenrollment, consent revocation, or parent-requested deletion, all personal data is permanently deleted within 48 hours. Progress records (anonymized) may be retained for up to 12 months for educational reporting purposes. Session recordings are deleted within 12 months of the last session.

Information Security Program: In accordance with the 2025 COPPA amendments, we maintain a written information security program that includes:

• Encryption at rest and in transit (TLS 1.3 via Cloudflare)
• Row-Level Security on all database tables
• Service-role-only access to children’s data (no direct API exposure)
• Regular security audits of our database and API endpoints
• Access controls limiting who can view children’s data to the parent, assigned instructor, and account owner

10. No Advertising or Tracking on Children’s Pages

UND Academy pages that serve children contain zero advertising scripts, zero analytics trackers, and zero third-party cookies. Our Content Security Policy explicitly blocks ad networks and analytics providers. We do not engage in behavioral advertising directed at children.

11. California & State-Specific Rights

CCPA/CPRA: We do not sell or share (as defined by California law) any child’s personal information. California residents under 16 have heightened protections under CPRA — we comply by never selling or sharing children’s data regardless of state.

State Student Privacy Laws (SOPIPA and analogues): For students residing in states with student-privacy laws (California, New York, Colorado, and others), we comply with all applicable provisions: no targeted advertising to students, no selling student data, no non-educational profiling.

12. Changes to This Policy

We will notify parents directly (via the email on their account) before making any material changes to this policy. No changes will retroactively reduce the protections described here for data already collected.

13. Contact Us

For questions, concerns, or requests regarding this Children’s Privacy Policy or your child’s data, contact:

Universal Network Development LLC
d/b/a U.N.D Industries
Email: [email protected]
Subject line: “COPPA Privacy Request”