Privacy Policy

Who we are

BrainBytes Academy ("we," "us") provides in-person STEM classes, camps, private lessons, and parties for kids and adults. This policy covers the BrainBytes Academy website and parent portal. You can reach us at privacy@brainbytesacademy.com or 48 Stiles Ln, Suite 203, Pine Brook, NJ 07058.

Information we collect

We collect information you give us directly:

• Your account information — name, email, and phone number, when you sign up or book a class. Every account belongs to a parent or guardian; students never create their own login.
• Your student's information — name, date of birth, grade level, and any notes you choose to share (including medical notes, used only to keep your child safe during a class). You provide this yourself; we never collect it from a child directly.
• Payment information — handled entirely by Stripe. We never see or store your card number; we only keep a reference ID for your transaction history.
• Communications — emails and texts you send or receive from us, kept so our staff has context on your account.
• Signed agreements — if you sign an enrollment contract, liability waiver, or medical release, we keep a timestamped copy of what you signed and the IP address it was signed from, as a record of consent.

We also collect a small amount of information automatically:

• A first-party cookie recording which link or ad first brought you to the site, so we know which programs and channels families find us through. See "Cookies" below.
• IP addresses on form submissions, kept briefly to prevent abuse (e.g. spam form submissions).

How we use it

We use your information to:

• Run the classes, camps, and events you book, and keep your student safe during them
• Process payments and send receipts
• Send booking confirmations, schedule reminders, and account-related messages
• Respond when you contact us
• Understand which marketing channels are working, so we can spend our time and budget well
• Meet our legal and financial recordkeeping obligations (e.g. invoices for tax purposes)

We do not sell your information, and we do not use third-party ad-tracking networks or pixels.

Who we share it with

We share information only with the outside services that help us run BrainBytes Academy, each for a specific purpose:

• Stripe — processes payments. Stripe never shares your full card number with us.
• Supabase — hosts our database, accounts, and file storage.
• Twilio — delivers text messages we send you.
• Resend — delivers emails we send you.
• Google Calendar — used internally by our staff to schedule sessions; your family's information is not shared with Google beyond a class time and student name on an internal staff calendar.

We may also disclose information if required by law, or to protect the safety of a student.

Children's privacy

Our classes are designed for kids, but our website is not directed at children, and no child ever creates their own account, logs in, or submits their own information to us. A parent or guardian creates the account and enters their student's information. If you believe a child has submitted information to us directly, contact us and we will delete it.

Cookies

We use two kinds of cookies:

• Necessary cookies — keep you signed in. The site can't function without these, so they're not optional.
• Attribution cookie — a first-party cookie noting which link or ad first brought you to the site. You can decline this one from the cookie banner shown on your first visit, or at any time by clearing your cookies.

Data security

Staff accounts require two-factor authentication. Access to student and family data is restricted by role — a parent can only see their own family's information, and only staff can see medical notes. Login attempts are rate-limited to slow down password-guessing, and connected calendar credentials are encrypted at rest.

How long we keep it, and your rights

We keep account and student information for as long as your account is active, and financial records (like invoices) for as long as required for tax and accounting purposes. To request a copy of your information, a correction, or deletion, contact us at privacy@brainbytesacademy.com. We'll respond within 30 days. If you're in the EU, UK, or California, you may have additional rights under GDPR or the CCPA — the same contact above is how to exercise them.

Changes to this policy

If we make a material change to how we handle your information, we'll update the date at the top of this page and, for significant changes, let account holders know by email.