Privacy Policy

# Privacy Policy

**Product:** Brainrise (the "Service")
**Operator:** Southwest CP Investment LLC, a Texas limited liability company ("Company," "we," "us," or "our")
**Version:** 1.1
**Effective Date:** August 16, 2026
**Last Updated:** 2026-08-25

This Privacy Policy explains how Company collects, uses, discloses, and protects personal information when you use Brainrise. It uses the same defined terms as the Brainrise Terms of Service ("Terms"), including "Parent," "Student," "User," "Account," "Account Holder," "Content," and "AI Coach." By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

Because the Service is designed primarily for Students aged 13–17, this Policy places special emphasis on the protection of minors, including our compliance approach under the **Children's Online Privacy Protection Act and its implementing Rule ("COPPA," 16 C.F.R. Part 312, as currently in effect)** and the **Texas Securing Children Online through Parental Empowerment Act ("SCOPE Act")**.

---

## 1. Who Controls Your Data

Southwest CP Investment LLC, a Texas limited liability company with its registered office at 7301 State Highway 161, #148, Irving, TX 75039, is the entity responsible for personal information processed through the Service. Contact: southwest@southwestcpinvestment.com / 7301 State Highway 161, #148, Irving, TX 75039.

## 2. Neutral Age Gate and Children Under 13

2.1 **Neutral age gate.** Consistent with the **Children's Online Privacy Protection Rule (16 C.F.R. Part 312) as currently in effect**, we present a **neutral age-screening mechanism** at registration that asks for date of birth or age in a neutral manner that does not encourage users to falsify their age. We use the result to route registration appropriately and to withhold the Service from anyone under 13.

2.2 **Under 13 not permitted.** The Service is not directed to and is not intended for children under 13, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under 13 without required parental consent, we will promptly delete it. Parents who believe we have such information should contact southwest@southwestcpinvestment.com.

2.3 **Students 13–17.** A Student aged 13–17 may use the Service only through a Parent-created, Parent-supervised Account, with the Parent's agreement to the Terms and completion of the Parental Consent Form. Company records the Parent's consent as described in Section 9 of the Parental Consent and Acknowledgment Form. Where the Parent provides a payment card and a charge is completed in the Parent's name — including the first charge at the end of any free trial — Company additionally binds the consent record to that payment authorization. Before any charge is completed — during a free trial, or where the Parent enrolls without a payment method — the Student's Account operates under the limits described in Section 9 of that Form, until a payment authorization completes (see Terms Section 2.1).

2.4 **Residence — the Service is not offered in New York; additional consent requirements in other states.** The Service is **not offered to, and may not be purchased by, residents of the State of New York** (Terms Section 2.7). Company therefore does **not** operate the New York–specific consent mechanics that the New York Child Data Protection Act would require of a service offered in that State, and **nothing in this Policy is a promise of New York–specific compliance behavior.** Company monitors that statute and will update this Policy before offering the Service in New York. This is a business decision about where Company offers the Service, not a statement about New York or about any person.

Separately, in states where the Service **is** offered, some laws may require the **Student's own informed consent** to the processing of the Student's personal data, for Students aged 13 through 17, in addition to the Parent's consent. Company is reviewing how those requirements apply to the Service. Where the law limits processing of a Student's personal data to what is strictly necessary regardless of consent, Company applies that stricter standard rather than relying on consent, as described in Section 4.

## 3. Information We Collect

**(a) Account and identity information** — Parent name and email; Student first name (or display name) and grade/age band; login credentials; billing contact information. Payment card data is collected and stored by our payment processor (Stripe), not by us.

**(b) Practice and performance data** — diagnostic results, practice-question responses, answer selections, timing, accuracy, topic mastery, study streaks, progress metrics, and generated score-band estimates (which are practice-only and not predictive; see the Educational Disclaimer and Waiver). See Section 7A for how design features involving minors are limited.

**(c) AI Coach chat content** — the text you or the Student submit to the AI Coach and the AI-generated responses are processed to generate a reply and are **not stored by Company as a conversation transcript.** Chat history exists only in the Student's browser session. Where an automated safety or misuse rule is triggered, Company retains a short excerpt of the triggering message (no more than 500 characters), the rule category, and a timestamp, for safety review (see Section 9).

**(d) Device and usage data** — IP address, device/browser type, operating system, pages viewed, features used, referring URLs, and diagnostic logs, collected via cookies and similar technologies.

**(e) Support and communications** — messages you send us and related records.

We do **not** intentionally collect Social Security numbers, government IDs, precise geolocation, health or mental-health information, or other sensitive categories of data, and **we ask that you not submit them through the Service or the AI Coach.** The AI Coach is not a health or mental-health service (see the AI Disclosure and Student Safety Policy, Sections 5.1 and 5.6), and health information volunteered in chat is not retained as a transcript.

**Biometric data (reserved).** The Service does **not** currently collect biometric identifiers or biometric information (such as fingerprints, faceprints, or voiceprints). If we ever introduce any feature that would collect biometric data, we will update this Policy, disclose the specific data and purpose, and obtain any consent required by applicable law before doing so.

## 4. How We Use Information

We use personal information to:
(a) create and manage Accounts and authenticate Users;
(b) provide, personalize, and operate the Service, including diagnostics, practice, the AI Coach, dashboards, and parent reports;
(c) process payments, subscriptions, trials, and refunds (via Stripe);
(d) generate progress reports for the Parent;
(e) maintain safety and security, prevent fraud and abuse, and enforce the Terms;
(f) provide customer support and respond to requests;
(g) analyze and improve the Service and develop new features, using aggregated or de-identified data where feasible; and
(h) comply with legal obligations.

We rely on the performance of our contract with you, your consent (including verifiable parental consent for Students), our legitimate interests in operating and securing the Service, and legal compliance, as applicable. **Where a state's law requires that processing of a minor's personal data be limited to what is strictly necessary regardless of consent, we apply that stricter standard rather than relying on consent.**

## 5. No Sale of Data; No Targeted Advertising to Minors

5.1 **We do not sell personal information.** We do not sell, rent, or trade personal information, and we do not "share" it for cross-context behavioral advertising.

5.2 **No targeted advertising to minors.** Consistent with the SCOPE Act, we do **not** use a known minor's personal information to deliver targeted or personalized advertising, and we do not permit our subprocessors to do so. The Service is subscription-funded, not ad-funded.

5.3 **Data minimization.** Consistent with the SCOPE Act and COPPA, we collect only the information reasonably necessary to provide the Service to a known minor, and we limit use and retention accordingly.

## 6. How We Disclose Information

We disclose personal information only:
(a) **to subprocessors/service providers** under contract, bound to protect it and use it only to provide services to us (see Section 10);
(b) **to the Parent** associated with a Student's Account (progress reports, dashboards, account data);
(c) **for legal reasons**, to comply with law, respond to lawful requests, or protect the rights, safety, and property of Company, Users, or the public;
(d) **in a business transfer**, in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy; and
(e) **with your consent.**

**Change of control involving a known minor's data.** Where personal information of a known minor would be transferred in connection with a merger, acquisition, financing, or sale of assets, we will (i) notify the associated Parent/Account Holder by email at least **thirty (30) days** before the transfer takes effect, (ii) provide an opportunity to delete the Student's personal information before transfer, and (iii) require the acquirer to be bound by this Policy, or by a policy no less protective, with respect to the transferred information.

We do not otherwise disclose personal information to third parties for their own purposes.

## 7. SCOPE Act — Parental Rights and Tools

For Accounts associated with a known minor, and consistent with the SCOPE Act, we provide the Parent with tools and rights to:
(a) **access and review** the categories of personal information collected about the Student;
(b) **request correction** of inaccurate information;
(c) **request deletion** of the Student's personal information;
(d) **control and manage** the Student's Account settings, including consent, data-sharing limits, and use of certain features;
(e) **withdraw consent** and discontinue the Student's use;
(f) **limit collection** to what is necessary for the Service, consistent with data-minimization requirements; and
(g) **Student removal right.** A registered Student may remove, or request that we remove, content or information the Student posted or submitted through the Service, at any time, by using the in-Service control or contacting southwest@southwestcpinvestment.com. Removal does not ensure complete or comprehensive removal — for example, a copy may have been made by another person, and a copy may persist in an encrypted, access-controlled backup or archive that cannot be selectively edited; where that is so, we do not restore that copy into any active system, we do not use it for any purpose, and it is overwritten in the ordinary course of our backup rotation within ninety (90) days — and we may retain content where law requires. We notify Students of this right in the Service.

Parents may exercise these rights at southwest@southwestcpinvestment.com or through in-Service account controls. We will verify the Parent's identity and relationship to the Student before acting and will respond within the time required by applicable law and in any event within the period stated in Section 13B.

## 7A. Age-Appropriate Design and Minors' Design Protections

Company designs the Service in a manner consistent with the best interests of the Students who use it.

**What the Service does use.** The Service uses study streaks, progress indicators, experience points, and achievement badges. Their purpose is to support consistent study planning for a test that rewards spaced practice. **Company does not use unpredictable or variable rewards, autoplay, infinite scroll, engagement-driven push notifications, or any feature designed to prolong a session beyond the study the Student intends.** Company does not send push notifications of any kind, and does not send email or messages prompting a Student to return to the Service when it is not in use.

**Parental control.** For a Student the Service knows to be a minor, **streaks, points, and badges are off by default**. A Parent may switch them on or off at any time from the parent controls in the Parent's account. **A Parent may also disable the AI Coach entirely at any time, without affecting any other part of the Service.** Where a feature is switched off, no progress-metric prompt of any kind is shown to the Student — the feature is absent, not merely reduced. **A Student cannot re-enable a control the Parent has switched off.**

**Marketing pages.** Company's public marketing pages, which are not part of a Student's signed-in experience, illustrate these features to prospective Parents. Nothing in this Section limits Company's description of the Service to adults deciding whether to buy it.

**Assessment.** Company maintains a **written data protection assessment** covering its processing of minors' personal data and its use of profiling (including adaptive difficulty), reviews it at least annually and within 90 days of any material change to processing, and makes it available to a regulator on request.

## 8. COPPA Parental Rights

Where COPPA applies, a Parent may review the personal information collected from a child, request its deletion, and refuse to permit further collection or use, by contacting southwest@southwestcpinvestment.com. We will take reasonable steps to verify the Parent's identity before granting access.

## 9. Data Retention

We retain personal information only as long as needed for the purposes described in this Policy, then delete or de-identify it. Practice data and AI Coach safety records associated with a minor are retained only as long as necessary for the purposes described and are deleted upon a valid Parent deletion request, subject to the limited legal-retention periods below. **Our retention schedule is set out in the table below** (published here in the notice itself, consistent with the amended COPPA rule, 16 CFR § 312.10):

| Data category | Purpose | Retention timeframe |
|---|---|---|
| Account and identity information (Parent/Student name, email, login credentials, billing contact) | Provide and secure the Account; authenticate Users | Life of the Account; deleted or de-identified within 90 days after Account closure, except records retained for legal/tax obligations below |
| Practice and performance data (diagnostics, question responses, timing, mastery, progress, score-band estimates) | Provide the Service; generate parent reports | Life of the Account; deleted within 90 days after Account closure or upon a valid Parent deletion request |
| AI Coach chat content | Generate a reply | **Not retained as a transcript.** Processed transiently; history exists only in the Student's browser session |
| Safety-rule excerpts (triggering message excerpt of no more than 500 characters, rule category, timestamp) | Safety review and abuse-prevention | Up to 12 months, then deleted, subject to any safety or legal hold; **also deleted when the Account is closed or on a valid deletion request** |
| Device and usage data (IP address, device/browser, diagnostic logs) | Security, fraud prevention, analytics | Up to 24 months, then deleted or de-identified |
| Support and communications records | Respond to and document support requests | Up to 24 months after the last interaction |
| Auto-renewal consent records (terms shown, timestamp, user identifier, IP address) | Prove consent under automatic-renewal law | The longer of three (3) years from the date consent was given, or one (1) year after the subscription terminates (see Refund and Subscription Policy Section 5.5) |
| Other billing and tax records | Tax, accounting, and dispute-resolution obligations | As required by applicable law (generally up to 4 years) |

**These timeframes are enforced automatically by a scheduled deletion process, not by manual review.** Where a Parent submits a valid deletion request, we delete the Student's personal information — **including any retained safety-rule excerpt** — within **thirty (30) days** of verifying the request, except where a specific record is subject to a documented legal hold or is required to be retained by law, in which case we will tell the Parent which category is being retained and why.

Where a longer period is required by law, or to preserve information subject to a legal hold, we retain the affected records for that period and then delete or de-identify them.

## 10. Subprocessors

We rely on the following third-party subprocessors to operate the Service. Each is bound by contract to safeguard personal information and to process it only on our instructions.

| Subprocessor | Purpose |
|---|---|
| **Supabase** | Database, authentication, and application backend |
| **Cloudflare** | Hosting, content delivery, security/DDoS protection, **and AI inference for the AI Coach (Cloudflare Workers AI)** |
| **Meta Llama 3.3 (via Cloudflare Workers AI)** | Large-language model that generates AI Coach responses; processes chat inputs and outputs |
| **Stripe** | Payment processing and subscription billing |
| **Resend** | Transactional email delivery (e.g., account and report notifications) |

We will maintain a current subprocessor list and update it as our providers change. AI Coach inputs sent to the model provider are processed to generate responses and are not used to serve advertising to minors. We instruct our AI subprocessor to process AI Coach inputs and outputs solely to provide the feature, and **we do not permit the AI subprocessor to use a Student's AI Coach inputs to train its general foundation models** where such controls are available. See the AI Disclosure and Student Safety Policy for how the AI Coach works, its limits, and the safety design of the Service.

## 11. Cookies and Similar Technologies

We use strictly necessary cookies to operate the Service (authentication, security, session management) and limited analytics cookies to understand and improve usage. We do not use advertising or cross-site tracking cookies for known minors. You can control non-essential cookies through your browser settings; disabling necessary cookies may impair the Service.

## 12. Security and Data-Breach Response

12.1 We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and least-privilege practices with our subprocessors. **Company maintains a written information security program, designates an individual responsible for it, assesses risks at least annually, and requires its subprocessors by contract to maintain comparable safeguards.** No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential (see Terms Section 3).

12.2 **Breach notification.** If a breach of system security results in the unauthorized acquisition of personal information we maintain, we will investigate promptly and notify affected individuals, regulators, and other parties **in accordance with the breach-notification law of each affected individual's state of residence**, and in every case without unreasonable delay. **Where the laws of two or more affected states impose different deadlines or content requirements, we will apply the shortest deadline and the most protective content requirement across all affected individuals**, so that no individual receives less protection than their own state's law requires. Several states require notice within thirty (30) or forty-five (45) days, and we will meet the applicable deadline for each affected resident. We separately comply with the Texas Identity Theft Enforcement and Protection Act (Tex. Bus. & Com. Code Ch. 521), including notice to affected Texas residents no later than the sixtieth (60th) day after we determine a breach occurred and notice to the **Texas Attorney General** where a single breach requires notification to **at least 250 Texas residents.** Where affected individuals include known minors, we will notify the associated Parent/Account Holder in addition to any notice required to the individual; because Parents provide the Student's and Parent's contact information, notice sent to the Parent's email or address on file constitutes notice for these purposes. Notice may be delayed as needed for law enforcement and for measures necessary to determine the scope of the breach and restore reasonable integrity to our systems.

12.3 This Section describes our commitment and legal obligations; it does not, to the maximum extent permitted by law, create any private right of action or liability beyond what the applicable statute requires, and it is subject to the disclaimers and limitations in Terms Sections 12 and 13.

12.4 **Incident response.** We maintain a written incident-response plan. On becoming aware of a suspected incident we will begin investigation within **twenty-four (24) hours**, preserve relevant logs and forensic evidence, notify affected subprocessors, and take reasonable steps to contain the incident. We maintain a record of each incident, the investigation, and the notifications made.

## 12A. Government and Legal Requests

We sometimes receive requests for account information from law enforcement, courts, or parties to litigation. This Section governs how we respond, and **controls over Sections 6(c) and 13A to the extent they differ**; nothing in this Section limits Section 7A, under which we make our written data protection assessment available to a regulator on request.

**What we hold.** As Section 9 explains, Chispa chat is **not retained as a transcript** — it is processed to generate a reply and exists only in the Student's browser session. In the ordinary case there is therefore no chat content for us to produce. What we do hold, and what a request can reach, is account and billing information, device and usage records, and any safety-rule excerpt retained under Section 9.

**Content.** Where we hold the contents of a communication, we will require a **search warrant** before disclosing it to a governmental entity, except where the law compels disclosure on other process or where an exception in 18 U.S.C. § 2702(b) applies — including an emergency involving danger of death or serious physical injury. **We do not disclose the contents of communications in response to a civil subpoena,** because federal law does not permit it.

**Other records.** For account, billing, device, and usage records, we disclose only where we believe in good faith that a valid subpoena, court order, warrant, or other lawful process requires it, or where an applicable law permits it. You should know that under 18 U.S.C. § 2703(c)(2) basic subscriber information — including the name, address, and **means and source of payment** on an account — can be reached by an administrative subpoena, without a warrant.

**Notice.** Where permitted by law and reasonably feasible, we will try to notify the Parent account holder of record before we respond, so the family can object. We may be unable to do so where a court or statute prohibits notice, or in an emergency.

**Disputes between parents.** Where parents disagree, or where a person other than the account holder claims a right to a Student's records, **we take no position between them.** We notify the account holder of record and produce records concerning a Student only as a court directs.

**Our review.** We review every request and may object to, narrow, or decline any request we believe is improper or overbroad.

**Where to send legal process.** Legal process should be directed to Southwest CP Investment LLC's registered agent, whose current name and address appear on the entity's filing with the Texas Secretary of State, with a courtesy copy to southwest@southwestcpinvestment.com. **A courtesy copy is not service.**

## 13. Your Choices and Communications

13.1 You may access and update Account information, cancel your subscription (see the Refund and Subscription Policy), and request access, correction, or deletion of personal information as described above. To exercise any right, contact southwest@southwestcpinvestment.com.

13.2 **Email communications.** We send transactional and Service-related email (account, billing, security, and parent reports); these are part of the Service. We may also send marketing email to the Parent/Account Holder, which always includes an unsubscribe link and complies with the **CAN-SPAM Act.** You can opt out of marketing email at any time; transactional email will continue.

13.3 **Text messages (reserved).** We do not currently send SMS/text messages. If we add texting in the future, we will obtain prior express written consent as required by the **Telephone Consumer Protection Act (TCPA)** before sending and will honor opt-outs. See Terms Section 20.

## 13A. Safety Monitoring of AI Coach Content

Consistent with the AI Disclosure and Student Safety Policy, AI Coach chat content is **not confidential** and is not privileged. Company does not retain conversation transcripts; safety-rule excerpts (see Section 3(c)) may be reviewed for safety and abuse-prevention and may be disclosed to authorities where we believe in good faith that disclosure is necessary to prevent imminent harm or to comply with law. The AI Coach is not a crisis, counseling, or medical service. In an emergency, contact 911 or 988.

## 13B. State Privacy Rights

Although the Service is offered only in the United States and is operated from Texas, residents of many states have privacy rights under state law, including the **California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA),** the **Colorado Privacy Act** (including its 2025 minors amendments, which apply with no revenue or volume threshold), the **Connecticut Data Privacy Act,** the **Texas Data Privacy and Security Act,** the **Maryland Online Data Privacy Act,** and comparable statutes in other states, several of which contain specific protections for the personal data of consumers known to be minors (including opt-in consent requirements for processing and a prohibition on selling — or using for targeted advertising — a known minor's data).

**New York.** The Service is **not offered to, and may not be purchased by, residents of the State of New York** (Terms Section 2.7; Section 2.4 above). Company monitors New York's **Child Data Protection Act** and other New York statutes, but **this Policy makes no New York–specific compliance commitment while the Service is not offered there.** Independently of any state's law, **where Company holds personal information about an individual, Company honors the rights described in this Section for that individual, whatever their state of residence.**

**Your rights.** An eligible resident (or a Parent on a minor's behalf) may: (a) confirm whether we process their personal information and access it; (b) correct inaccurate personal information; (c) delete personal information; (d) obtain a portable copy; and (e) opt out of any "sale," "sharing," targeted advertising, or profiling in furtherance of decisions producing legal or similarly significant effects. **We do not sell or share personal information and do not use a known minor's data for targeted advertising** (see Section 5), so several of these rights are already satisfied by our standing practices.

**How to exercise a right, and how fast we answer.** Contact southwest@southwestcpinvestment.com. We will verify the request and **respond within forty-five (45) days**, extendable once by a further forty-five (45) days where reasonably necessary, in which case we will tell you before the first period ends. **We apply this single 45-day standard in every state; we do not apply a slower schedule anywhere.** **Where the request is a deletion request concerning a Student's personal information, we act within the thirty (30) days stated in Section 9 and do not extend it.** We will not discriminate against you for exercising a right.

**Authorized agents.** You may use an authorized agent to submit a request. We may ask the agent for written proof of authorization and may ask you to verify your own identity directly.

**Appeals.** **If we decline your request in whole or in part, you may appeal.** Reply to our decision, or write to southwest@southwestcpinvestment.com with the subject line "Privacy Appeal," within a reasonable time. We will review the appeal and **respond in writing within forty-five (45) days**, explaining the reasons for our decision. If we deny the appeal, we will provide you with a method to contact your state Attorney General to submit a complaint. **We make this appeal process available to residents of every state, whether or not the state requires one.**

**Universal opt-out signals.** We do not currently detect or process the Global Privacy Control (GPC) or other universal opt-out preference signals. Because we do not sell or share personal information and do not use a known minor's data for targeted advertising, a GPC signal would not change our practices. We will not state that we honor GPC until we do.

## 13C. Consumer Health Data (Washington and Similar Laws)

The AI Coach is a study tool, not a health service, and we do not ask for health information. But a Student may volunteer health-adjacent information in free text — for example, test anxiety, a diagnosis, a medication, or an IEP or Section 504 accommodation. **Where a law such as Washington's My Health My Data Act treats that information, or any inference drawn from it, as "consumer health data," we treat it as consumer health data.**

**We do not sell consumer health data, we do not share it for advertising, and we do not operate any geofence around any health care facility.** Because AI Coach chat is not retained as a transcript (Section 3(c)), we hold no ongoing store of it.

**Our separate Consumer Health Data Privacy Policy** describes the categories we may collect, the sources, the purposes, who receives it, and how to exercise your rights to access, withdraw consent, and delete. It is published separately from this Policy and linked from our homepage. Requests: southwest@southwestcpinvestment.com.

## 14. United States Only; International Users

14.1 **U.S.-only offering.** The Service is offered and directed **solely to users located in the United States** and is operated from the United States. It is **not** directed to or intended for individuals in the European Union, the United Kingdom, or other jurisdictions, and Company does not intend, by offering the Service, to subject itself to the EU/UK **General Data Protection Regulation (GDPR)** or other non-U.S. data-protection regimes.

14.2 **Access from elsewhere.** If you access the Service from outside the United States, you do so on your own initiative and at your own risk, and you consent to the collection, transfer, and processing of your information in the United States, which may have different (and potentially less protective) data-protection laws than your jurisdiction. Where any non-U.S. law is nonetheless found to apply, we will comply only to the extent legally required.

## 15. Changes to This Policy

We may update this Policy from time to time. Material changes will be posted with a new version number and a new "Last Updated" date and, where appropriate, communicated by email or in-Service notice. For changes affecting a known minor's data, we will obtain any additional parental consent required by law. Continued use after the effective date constitutes acceptance.

## 16. Contact

Southwest CP Investment LLC
7301 State Highway 161, #148, Irving, TX 75039
Privacy inquiries: southwest@southwestcpinvestment.com
General support: southwest@southwestcpinvestment.com

---

*This Privacy Policy is part of the Brainrise legal pack and should be read together with the Terms of Service, the Educational Disclaimer and Waiver, and the Parental Consent Form.*