Yeti Confetti Kids Privacy Policy (Schools Version for New York City)

Effective Date: March 18, 2025

Introduction

Lirvana Labs, Inc. (“Company,” “we,” “us,” “our”) is dedicated to protecting the privacy of our users, including students, teachers, and school administrators, as they interact with Yeti Confetti Kids (“Service”). This Privacy Policy outlines how we collect, use, share, and protect your personal information in accordance with the Children’s Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), New York Education Law 2-d, and the California Consumer Privacy Act (CCPA).

We also comply with NYC DOE’s data security and privacy policy, including the NYC DOE Parents’ Bill of Rights.

Our data storage location for the Service is in Oregon, United States, using Google Cloud, to ensure high security and compliance standards.

If you have any questions about this Privacy Policy or data practices, contact us at support@lirvanalabs.com.

---

1. Information We Collect

We collect the following types of information to provide and improve our Service:

1.1 Personal Information Provided by Schools

• Student Data: To enhance student learning experiences, we collect limited information, such as the student’s preferred name. We do not require sensitive personal data (e.g., full legal name, address).
• Teacher and Administrator Data: Contact information, including names, email addresses, and school-related data, is collected to facilitate account creation, support, and communication with educators.

1.2 Automatically Collected Data

We collect data related to usage, including:

• Device information, IP address, browser type, and usage patterns (e.g., time spent on different educational modules) to monitor and improve the Service.
• Analytics data from cookies or similar tracking technologies to understand how the Service is used. This data is aggregated and anonymized whenever possible.

---

2. How We Use the Information

We use the data collected for the following purposes:

• Service Operation and Maintenance: To facilitate a smooth and effective user experience.
• Improvements and Personalization: To tailor content and features to best support educators and enhance student engagement.
• Communication with Educators: To provide updates, respond to inquiries, and deliver relevant information related to the Service.

---

3. Detailed Information on the Processing of Your Personal Data

Our Service Providers may have access to your personal information to assist in operating our Service. These third-party providers are contractually obligated to protect data with at least the same level of security and confidentiality we provide under our agreements with schools. We periodically review their certifications (e.g., SOC 2) or security practices to ensure ongoing compliance.

3.1 Analytics

We use analytics providers to monitor and analyze Service usage to improve user experience and optimize our offerings:

• Mixpanel
  Mixpanel is provided by Mixpanel, Inc. For information on the data Mixpanel collects and its privacy practices, visit the Mixpanel Terms of Use: https://mixpanel.com/terms/.
  You can opt-out of Mixpanel's data analytics by contacting support@lirvanalabs.com.
• LaunchDarkly
  LaunchDarkly, a feature management platform, is provided by Catamorphic Co. Details about its data collection practices can be found at: https://launchdarkly.com/policies/privacy/.
• Google Analytics
  Google Analytics, provided by Google LLC, helps us analyze how users interact with the Service. To prevent Google Analytics from using your information, contact support@lirvanalabs.com. More details on Google Analytics data collection can be found at: https://marketingplatform.google.com/about/analytics/terms/gb/.

3.2 Email Notifications

We may use your information to send newsletters, educational updates, and relevant notifications. You may unsubscribe using the link in each email or contact us directly.

• MoEngage
  MoEngage is an engagement platform used to send push notifications, in-app messages, and emails. For MoEngage’s privacy policy, please refer to: https://www.moengage.com/privacy-policy/.

3.3 API and Additional Terms

We use YouTube API services, subject to YouTube’s Terms of Service, which can be reviewed at: https://www.youtube.com/t/terms.

---

4. Data Storage and Security

Administrative, Operational, and Technical Safeguards

• Role-Based Access & MFA: Only authorized personnel can view Protected Information, and multi-factor authentication is enabled for sensitive systems.
• Staff Training & Confidentiality: Before accessing student data, our employees and relevant contractors must complete privacy/confidentiality training covering FERPA, COPPA, NY Education Law 2-d, and NYC DOE data security policies. We also provide periodic refresher sessions to ensure ongoing compliance.
• Encryption: Data is encrypted both at rest and in transit using current standards (e.g., TLS 1.2 or higher).
• Physical Security: Our data centers have restricted access, surveillance (where appropriate), and robust environmental controls.

4.2 Incident Response & Notification

• Identification of Breaches: We continuously monitor systems for suspicious activity.
• Response Protocols: If we confirm or suspect a security incident involving Protected Information, we immediately investigate, contain the issue, and mitigate any vulnerabilities within 24 hours.
• Notification: In case of breach, we promptly notify the schools and educational organization (e.g. NYC DOE) in accordance with applicable regulations and within the timeframe required by applicable law (e.g. New York Education Law 2-d).

4.3 Data Security Measures

We employ technical, administrative, and physical safeguards to protect the information we collect. These include encryption, password protection, and restricted access measures. While we strive to ensure data security, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Schools will receive a 30-day advance notice regarding any material changes to data security process or protocols, including those that lessen protections previously noted in the Privacy Policy.

4.3 Data Security Measures

We employ technical, administrative, and physical safeguards to protect the information we collect. These include encryption, password protection, and restricted access measures. While we strive to ensure data security, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Schools will receive a 30-day advance notice regarding any material changes to data security process or protocols, including those that lessen protections previously noted in the Privacy Policy.

4.4 Student Data and Retention Policy

Student’s Personally Identifiable Information (PII) are under the direct control of the school. During arrangement with Lirvana Labs, the school remains in control of the Student’s PII. While we maintain standard retention periods as outlined below, schools can request these at any time.

Upon request from a school administrator or under applicable legal standards, we will delete student PII data in accordance with FERPA and related laws. Upon account termination or contract completion, student data will be retained for one year post-termination. Furthermore, inactive student data will be retained for one year after which, schools will receive a 30-day advance notice through email before deletion. For custom data deletion requests, contact us at support@lirvanalabs.com.

In the case of bankruptcy, merger, acquisition and asset sale of Lirvana Labs, we will provide an advanced notice before data is transferred or becomes subject to a different Privacy Policy. Schools will be given time whether to accept or reject the new policy.

---

5. Children’s Privacy

Our Service is intended for use in educational settings under the guidance of teachers and school administrators. In compliance with COPPA, we obtain consent from schools to collect data from children under 13 years of age, who may then act on behalf of parents in granting consent.

---

6. California Privacy Rights

Under the CCPA, California residents have specific rights regarding their personal data, including the right to request access to or deletion of their data. To exercise these rights, please contact us at support@lirvanalabs.com. We will verify and respond to requests in accordance with applicable California laws.

---

7. California Privacy Rights

Under the CCPA, California residents have specific rights regarding their personal data, including the right to request access to or deletion of their data. To exercise these rights, please contact us at support@lirvanalabs.com. We will verify and respond to requests in accordance with applicable California laws.

---

8. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect legal, technical, or operational changes. We will notify the school through email about any changes to the terms 30-days prior to the changes taking effect. Your continued use of the Service constitutes acceptance of the updated policy.

---

Contact Us

For inquiries or requests regarding this Privacy Policy, please contact us at:

Lirvana Labs, Inc.

Yeti Confetti Kids (U.S. Office)
101 Jefferson Drive, Rm 106, Menlo Park, CA 94025
Email: support@lirvanalabs.com
Phone: +1 (650) 609-8886