Parents' Bill of Rights

1. Privacy Commitment

When a school, district, or educational agency contracts with LaxAi for student use, the following commitments apply to all data about students collected through that contract:

• Student personally identifiable information (PII) is never sold
• Student PII is never released for any commercial or marketing purpose other than operating LaxAi for the contracting educational agency
• Private student-submitted content — practice plans, custom drills, plays, training logs — is never used to train AI models, ours or any third party's
• Student PII is never sublicensed, rented, or transferred to a third party except the operational sub-processors disclosed in our Privacy Policy, Section 5, each of which is bound by a written data-processing agreement
• Targeted advertising is never directed at student users

2. Student Data We Collect

For students using LaxAi under an educational agency contract, the categories of data we collect are the same as for any other user. The full list is in the Privacy Policy, Section 3. In brief:

• Account information (email, display name, month/year of birth for age verification, state/province, role)
• Coaching and training data the student or coach creates (saved drills, practice plans, training logs, team rosters, skill preferences)
• Usage data (which drills are browsed, how practice plans are built) — used to personalize the student's experience

We do not collect: exact date of birth, government identifiers, HIPAA-covered medical records, financial information (payments are processed by Stripe, not us), or photos and videos of students.

3. How We Protect Student Data

• Encryption at rest and in transit. All data is encrypted in our Firestore database and over HTTPS (TLS 1.2+) on the network.
• Role-based access control enforced at the database layer through Firestore security rules. A user can only read their own data, the data of their team, and data that has been explicitly shared with them.
• Audit logging on sensitive events — account creation, deletion, role changes, and administrative actions.
• Sub-processor agreements with every third party that receives personal information. The current list is published in our Privacy Policy, Section 5.
• Breach notification within 7 days of discovery to affected users and to the applicable state authorities where required.
• Access to systems handling student data is restricted to authorized personnel. As LaxAi grows, additional personnel controls (such as background checks and confidentiality agreements) will be applied to anyone with access to student data.

4. Rights of Parents and Eligible Students

Parents of students aged 13–17 (and students 18 or older themselves) have the following rights with respect to their child's data in LaxAi:

• Right to inspect any data we hold about the student. Request via privacy@laxai.app.
• Right to correctinaccurate data, either through the student's profile settings or by emailing us.
• Right to deletethe student's account and all associated data. Account deletion through the in-app profile page purges primary data within 30 days; encrypted backups roll off within 90 days.
• Right to receive a copyof the student's data in a machine-readable format. Available via the data export endpoint accessible from the student's profile page.
• Right to withdraw consentfor analytics and AI personalization at any time through the privacy settings in the student's profile.

We may light-touch verify parental identity before fulfilling requests that affect a minor's account — for example, by confirming the child's email and birth month — to ensure the request is legitimate.

5. Filing a Complaint

If you believe your child's data has been mishandled, please contact LaxAi first at privacy@laxai.app. We respond within 7 business days and will work directly with you to resolve any concerns.

If your child uses LaxAi through a school or district contract and you cannot resolve the issue with us, you may also contact your child's school or district's Data Protection Officer or Chief Privacy Officer. Where applicable, parents and eligible students retain the right to file complaints with the applicable state education department or privacy regulator in their jurisdiction.

6. Where to Get More Information

7. Supplemental Information (Per-Contract)

When LaxAi enters into a signed contract with a specific educational agency, the following supplemental information is provided to that agency and made available to parents of affected students:

• The exclusive purposes for which student data will be used under that contract
• The specific sub-processors LaxAi will use, and the duties each performs, as of the contract effective date
• The contract's term and the date by which all student data will be returned or destroyed
• Procedures the educational agency may use to challenge the accuracy of student data, including how disputes are resolved
• Where student data will be stored — region, encryption posture, and access controls applied
• The security and privacy measures LaxAi takes to protect student data, framed against the NIST Cybersecurity Framework where the contracting agency requests it

The current sub-processor list (applies generally, not just per-contract) is in our Privacy Policy, Section 5.

8. Contracting with Schools and Districts

Schools, districts, and educational agencies wishing to formalize use of LaxAi for student-facing programs can contact privacy@laxai.app to begin contract review. We will provide a signed copy of this Parents' Bill of Rights tailored to the contract, a draft Data Privacy Agreement (DPA) for the agency's review, and a current summary of the sub-processor list, encryption posture, and access controls in effect during the contract term.

The commitments described in Sections 1–7 apply uniformly to all student use of LaxAi. The per-contract specifics in Section 7 are negotiated as part of contracting.