Privacy Policy

MyCoop ("we," "us," or "our") operates a Software-as-a-Service platform for homeschool co-op management. This policy applies to all users — both Organization Administrators (co-op directors who subscribe to MyCoop) and Family Users(parents and guardians who access MyCoop through their co-op's portal to enroll children, sign documents, and manage their family account).

In providing the Service, we act in two distinct roles:

• Data Processor: For all family, student, and enrollment data entered by co-op Organizations, MyCoop acts as a data processor. The Organization is the data controller and determines how that data is collected, used, and retained. MyCoop processes this data only as directed by the Organization.
• Data Controller: For account data and platform-level information (e.g., login credentials, subscription records, legal acceptance records), MyCoop is the data controller.

Account Information: When you create an account, we collect your name, email address, and authentication credentials (managed by Clerk, Inc.). Organization administrators also provide billing and subscription information (managed by Whop, Inc.).

Organization-Provided Data: Organizations enter the following data into MyCoop on behalf of their co-op members:

• Family information: names, email addresses, phone numbers, home addresses
• Student/child information: names, dates of birth, grade levels, medical notes (if entered by the org)
• Enrollment records: class registrations, attendance, waitlist status
• Payment records: transaction amounts, dates, last 4 digits of payment cards
• Waiver signatures: typed names, IP addresses, timestamps
• Photos and media uploaded to the gallery
• Volunteer hours, teacher profiles, compliance records
• Communications: emails and SMS messages sent through the platform

Automatically Collected Data: When you use the Service, we may automatically collect IP addresses, browser type, operating system, pages visited, and timestamps for security and audit purposes.

Legal Acceptance Records: We collect your name, email, IP address, user agent, and a timestamp when you accept our Terms of Service and Privacy Policy. A PDF certificate is generated and stored as a legal record.

Communications Consent: If you opt in to SMS or voice communications through an Organization, we record your consent including the version of consent text shown and the timestamp of acceptance.

MyCoop does not knowingly solicit, collect, or store personal information directly from children under 13.

MyCoop is a tool used by adult co-op administrators and parents to manage co-op operations. Student records (including records of children under 13) are entered into MyCoop by adult Organization administrators and parents — not by the children themselves.

Organization Responsibility: Organizations are responsible for obtaining all required verifiable parental consent before entering any child's information into MyCoop, in compliance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and applicable state laws.

Parental Rights: Parents and guardians have the right to:

• Request access to their child's personal information stored in MyCoop
• Request correction of inaccurate information
• Request deletion of their child's personal information
• Withdraw consent for future collection or use

To exercise these rights, contact the Organization administrator directly. Organizations are responsible for honoring these requests. MyCoop will cooperate with Organizations in processing verified deletion requests within 30 days.

Photos of Minors: Organizations that upload photos of children to the gallery are responsible for obtaining appropriate parental consent for each child depicted. MyCoop does not use uploaded photos for any purpose other than displaying them to authorized org members as configured by the Organization.

We use information to:

• Provide, operate, and improve the Service
• Authenticate users and manage accounts
• Process payments and manage subscriptions
• Send transactional emails and SMS messages as requested by Organizations or users
• Generate reports, PDFs, and other outputs requested by authorized Organization administrators
• Maintain audit logs for security and compliance purposes
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

Communications: We use your contact information to send service communications (account notices, billing alerts, security notifications, legal updates), onboarding and consultation outreach (particularly for new Organizations), and optional product/marketing emails. See the Terms of Service, Section 4 for full details and opt-out rights.

We do not use your data for advertising, sale to third parties, or machine learning model training. We do not sell, rent, or trade personal information.

MyCoop shares data only in the following limited circumstances:

• Service Providers: We share data with our vetted technology partners solely to operate the Service (listed in Section 6 below).
• Within the Organization: Information entered by an Organization is accessible to authorized administrators, teachers, and staff of that Organization as configured by the Organization's admin.
• Legal Requirements: We may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of MyCoop, our users, or the public.
• Business Transfer: If MyCoop is acquired or merged, user data may be transferred to the acquiring entity, subject to the same privacy commitments.

We share data with the following service providers, each bound by data processing agreements:

MyCoop implements industry-standard technical and organizational security measures, including:

• SSL/TLS encryption for all data in transit
• Encryption at rest for sensitive data (passwords, payment tokens, personal records)
• Role-based access controls — users can only access data their Organization permits
• Audit logging of all administrative actions
• Regular security reviews

No method of electronic transmission or storage is 100% secure. In the event of a security incident affecting personal data, MyCoop will notify affected Organizations within 72 hours of confirmed discovery. Organizations are responsible for notifying parents and families as required by applicable state breach notification laws.

Organization Security Responsibilities: Organizations are responsible for using strong passwords, managing user access permissions, and training staff on data security best practices.

Organization Data: Organizations control retention of family, student, and operational data. Organizations may delete records at any time through the admin dashboard. MyCoop will remove deleted data from live systems within 30 business days and from backups within 90 days.

Account Data: Account information is retained while your account is active. Upon account deletion, account data is removed within 30 days.

Payment Records: Retained for 7 years as required by tax and financial record-keeping laws.

Legal Acceptance Records: TOS/Privacy Policy acceptance records are retained for 7 years as legal compliance records.

Subscription Termination: Upon termination of an Organization's subscription, all Organization data is retained for 90 days to allow data export, then permanently deleted.

Depending on your location, you may have rights including:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request your data in a structured, machine-readable format
• Opt-out of SMS/Voice: Reply STOP to any MyCoop SMS message at any time to opt out of SMS communications from that Organization

To exercise rights regarding Organization-entered data (family records, enrollment records), contact your Organization administrator directly. For account-level data managed by MyCoop directly, contact us at [email protected].

California Residents (CCPA): California residents have additional rights under the California Consumer Privacy Act. We do not sell personal information. To exercise CCPA rights, contact [email protected].

Photos uploaded to MyCoop by Organizations are stored in Cloudflare R2 and are only accessible to authorized members of that Organization as configured by the Organization's admin. MyCoop does not use uploaded photos for advertising, training AI/ML models, or any purpose other than displaying them within the Organization's MyCoop instance.

Organizations are solely responsible for obtaining appropriate parental consent before uploading photos of minors to the platform.

We may update this Privacy Policy from time to time. When we make material changes, we will update the version date at the top of this page and require users to re-accept via the acceptance screen on their next login.

For privacy questions, data requests, or concerns: