Privacy policy
Effective Date: August 6, 2025
BrAInClub PBC Inc. (“we,” “our,” or “us”) is committed to protecting the privacy of our users, including children and their parents or guardians, who participate in our afterschool activities in Chicago. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in compliance with applicable laws, including the Children’s Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA), and other relevant federal and state laws.
By using our services or visiting our website, you agree to the terms of this Privacy Policy. Please read it carefully.
1. Who Does This Privacy Policy Apply To?
This Privacy Policy applies to:
- Visitors to our website brainclub.io.
- Parents, guardians, and children registering for or participating in our afterschool activities.
- Other individuals who use BrAInClub’s services.
We are registered in Delaware and operate in Chicago, Illinois. Our contact information is:
BrAInClub PBC Inc.
8 The Green,
Dover, DE 19901
Email: [email protected]
2. What Information Do We Collect?
We collect personal information to provide and improve our services. The types of information we collect include:
- Contact Information: Names, email addresses, phone numbers, and mailing addresses of parents or guardians.
- Children’s Information: Names and ages of participating children (with parental consent).
- Payment Information: Billing details, such as credit card information or other payment methods, processed through secure third-party payment processors.
- Registration Data: Information provided during program registration, including emergency contacts and medical information (if applicable).
- Website Usage Data: IP addresses, browser types, and activity on our website, collected through cookies and similar technologies.
Some of this data is collected and processed through the Exoclass system, which we use to manage certain aspects of our services.
3. How Do We Use Your Information?
We use the collected information to:
- Provide and manage our afterschool activities.
- Process payments and registrations.
- Communicate with parents or guardians about their child’s participation.
- Improve our website and services.
- Comply with legal obligations, including COPPA requirements for children’s data.
4. What Legal Bases Do We Rely On To Process Your Information?
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.
If you are located in the EU or UK, this section applies to you.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:
- Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
- Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
- Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to:
- Send users information about special offers and discounts on our products and services
- Develop and display personalized and relevant advertising content for our users
- Analyze how our Services are used so we can improve them to engage and retain users
- Support our marketing activities
- Diagnose problems and/or prevent fraudulent activities
- Understand how our users use our products and services so we can improve user experience
- Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
- Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.
5. Parental Consent and Children’s Privacy
In compliance with COPPA, we obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13. This consent is typically obtained through a secure online form requiring parental email verification to confirm the parent’s identity. Parents or guardians can:
- Review their child’s personal information.
- Request deletion of their child’s data.
- Refuse further collection or use of their child’s data.
To exercise these rights, please contact us at [email protected].
6. Use of the Exoclass System
BrAInClub uses the Exoclass platform to manage certain aspects of our services. Some personal data may be processed through Exoclass. Exoclass acts as a data processor, and their data handling practices are governed by their privacy policy, available at https://exoclass.io/privacy-policy/. We encourage you to review their policy in conjunction with ours.
While Exoclass processes certain data on our behalf, BrAInClub remains the data controller and is responsible for ensuring your personal information is protected in accordance with this Privacy Policy and applicable laws.
7. Sharing of Information
We may share your personal information with:
- Service Providers: Third-party vendors who assist in providing our services, such as payment processors and IT service providers.
- Exoclass: As part of our service delivery, some data is processed through the Exoclass system (see Section 5).
- Legal Authorities: When required by law or to protect our rights and safety.
We do not sell or rent personal information to third parties.
8. Data Security
We implement reasonable security measures to protect your personal information, including encryption and secure servers. However, no method of data transmission over the internet is completely secure, and we cannot guarantee absolute security.
9. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
10. International Data Transfers
Our services are provided in the United States, but we utilize the Exoclass platform, which is located in Lithuania (Europe). This means that some of your personal information will be transferred to, stored, and processed in a country other than your own. We ensure that such transfers comply with applicable data protection laws and that your information is protected according to the high standards of the European Union’s General Data Protection Regulation (GDPR) and this Privacy Policy.
11. Your Rights
Depending on your location, you may have the following rights:
- Access: Request a copy of your personal information.
- Correction: Request correction of inaccurate data.
- Deletion: Request deletion of your data, subject to legal requirements.
- Opt-Out: Opt out of marketing communications or certain data processing activities.
To exercise these rights, please contact us at [email protected].
11.1. International Privacy Rights (EEA, UK, and Switzerland)
If you are a resident in some regions, such as the European Economic Area (EEA), United Kingdom (UK), and Switzerland, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.
In these regions (like the EEA, UK, and Switzerland), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section ’16. Contact Us’ below.
We will consider and act upon any request in accordance with applicable data protection laws.
If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority:
If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner:
11.2. Specific US State Privacy Rights
If you are a resident of California, Virginia, Colorado, Connecticut, or Utah, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.
12. Cookies and Tracking Technologies
Our website uses cookies to enhance user experience and collect usage data. You can manage cookie settings through your browser preferences.
13. Third-Party Links
Our website may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.
14. Do Not Track Disclosure
Some web browsers may transmit “do not track” signals to websites with which the browser communicates. We do not currently respond to “do not track” signals. To learn more about “Do Not Track,” please visit www.allaboutdnt.com.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on our website, and the updated policy will take effect immediately upon posting.
16. Contact Us
If you have any questions or concerns about this Privacy Policy, please contact us at:
BrAInClub PBC Inc.
8 The Green, Dover,
DE 19901
Email: [email protected]