Privacy Policy

1. Who We Are

Coco's Academy is an adaptive learning platform operated by Wolf Pak Strategies LLC, a Florida limited liability company. Contact: leo@cocosacademy.com

2. Information We Collect

• Account information: Name, email address, and password or OAuth token.
• Learning activity: Questions answered, session durations, Logic ELO scores, and knowledge path progress.
• Device and usage data: Browser type, OS, IP address, and page interaction logs for platform stability and security.
• Payment information: Processed through Microsoft Azure Marketplace or Stripe. We do not store credit card numbers on our servers.
• Institutional data: For school and enterprise subscribers, roster data (student names, grade levels) provided under a signed Data Privacy Agreement.

3. How We Use Your Information

• To personalize your adaptive learning experience and track Logic ELO progress.
• To deliver and maintain platform services, including account management and billing.
• To generate anonymized aggregate reports for institutional subscribers that do not identify individual students.
• To comply with applicable law, including FERPA, COPPA, and Florida Statute 1002.222.

4. Children's Privacy (COPPA)

Coco's Academy serves K-12 students, including children under 13. We comply with the Children's Online Privacy Protection Act (COPPA).

• We do not knowingly collect personal information from children under 13 without verifiable parental consent or school operator authorization.
• When deployed through a school under a signed Data Privacy Agreement, the school acts as the authorized operator under the school official exception.
• For direct subscriptions involving students under 13, a parent or guardian must create the account and provide consent.
• Parents may review, correct, or request deletion of their child's data by contacting leo@cocosacademy.com.

5. Student Data (FERPA)

When used by educational institutions, we act as a school official with a legitimate educational interest under FERPA 34 CFR 99.31(a)(1). We use student education records solely to provide the contracted educational service and do not disclose records to third parties without written institutional consent.

6. Florida Student Data Privacy (Statute 1002.222)

For Florida public school subscribers, we comply with Florida Statute 1002.222 and will execute a Student Data Privacy Agreement (DPA) with each district before accessing any student data.

7. Data Sharing

We do not sell student data or share personal information for advertising. We share data only with:

• Service providers: Microsoft Azure (hosting), Stripe (payments), Cloudflare (CDN/security) — all bound by data processing agreements.
• Legal requirements: As required by law or court order.
• Institutional administrators: Progress reports for users within their organization.

8. Data Security

• HTTPS encryption for all data in transit.
• Encrypted storage via Microsoft Azure with access controls and audit logging.
• Role-based access controls limiting staff access to student data.

9. Data Retention

We retain data while your account is active. For institutional subscribers, per the signed DPA terms. Upon account deletion or contract termination, personal data is deleted within 30 days unless retention is required by law.

10. Your Rights

You may request access, correction, or deletion of your personal information. For students and parents, you may review and request correction of education records. Contact leo@cocosacademy.com. We respond within 30 days.

11. Microsoft Marketplace Subscribers

If you subscribe through the Microsoft Azure Marketplace, payment is processed by Microsoft under their terms. We receive only your subscription status and email address to provision your account.

12. GDPR — Rights for European Union Users

If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Access: Request a copy of your personal data we hold.
• Rectification: Request correction of inaccurate personal data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a machine-readable format.
• Restriction: Request that we restrict processing of your data.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.

Lawful Basis for Processing: We process personal data under the following legal bases: (a) performance of a contract (providing the service); (b) consent (for users under 16 in EU); (c) legitimate interests (platform security and improvement); (d) legal obligation (compliance with FERPA, COPPA, and applicable law).

Data Transfers: Your data is stored on Microsoft Azure (East US) and may be transferred outside the EU under Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46.

To exercise any of these rights, contact: privacy@wolfpakstrategies.com. We respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

13. CCPA — Rights for California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: We limit our use of sensitive personal information to what is necessary to provide our services.

To exercise your CCPA rights or submit a "Do Not Sell My Personal Information" request, contact: privacy@wolfpakstrategies.com or use the link in the footer of our website.

Shine the Light: California Civil Code Section 1798.83 allows California residents to request information about personal information disclosed to third parties for direct marketing purposes. We do not share personal information for direct marketing.

14. Cookie Policy

We use the following types of cookies and similar technologies:

• Strictly Necessary: Required for platform function (authentication, CSRF protection). Cannot be disabled.
• Functional: Remember your preferences (grade level, theme, avatar). Disabled if you decline cookies.
• Analytics: Anonymous usage data to improve the platform (Cloudflare Web Analytics — no cross-site tracking). Disabled if you decline cookies.

We do not use advertising or tracking cookies. We do not share cookie data with advertisers.

You can manage cookie preferences via the banner that appears on your first visit, or by contacting us. Most browsers also allow you to control cookies through their settings.

15. Changes to This Policy

Material changes will be communicated by email at least 30 days before taking effect. Continued use after the effective date constitutes acceptance.

16. Contact Us

• Privacy inquiries: privacy@wolfpakstrategies.com
• General support: leo@cocosacademy.com
• Website: cocosacademy.com
• Wolf Pak Strategies LLC, Florida, USA