Privacy Policy
Effective: September 10, 2026
Version: 2026-09-10
Program: Twin Forest Education Center (the "Program," "we," or "us").
Privacy contact: info@twinforesteducationcenter.com · (626) 268-3016
1. Scope
This notice explains information used to operate our website, adult family portal, tutoring, Afterschool, and optional school pickup. It describes the Program's practices; payment and other service providers may also have their own notices. It is not a release of privacy rights or blanket permission for new uses.
The family portal is intended for adults authorized to act for children. Children should not create accounts or submit information through it. Staff have separate accounts. Parent-provided information about a child is still personal information requiring protection.
2. Information and purposes
| Category | Examples | Principal purposes |
|---|---|---|
| Adult account and contact information | Email, password hash, phone, guardian relationships, permissions, time zone | Account access, communication, authorized administration |
| Child profile and education information | Name, birth date, grade, school, optional interests, enrollment, attendance, teacher notes, submitted work or work links | Instruction, scheduling, attendance, family progress updates |
| Health and emergency information | Disclosed allergies, medical notes, emergency contacts, authorized collection details | Safety planning, emergency response, appropriate handoffs |
| Transportation information | School, pickup request, route arrangement, attendance and handoff information | Optional school-to-center collection |
| Transactions | Charges, subscription and payment identifiers, bookings, credit, refunds, Zelle matching reference | Billing, reconciliation, fraud prevention, required records |
| Agreement and security records | Policy version, signature where used, timestamps, signing IP/browser where recorded, sign-in and access logs | Evidence of agreement, account protection, troubleshooting |
We obtain information from adults using the portal, Program staff, payment providers, and, where necessary for an authorized pickup, school personnel. Provide information about other contacts only when authorized and let them know it will be used for these purposes. School information may be collected as part of the child profile even when transportation is not requested.
Card details are entered through Stripe checkout. We do not collect full card numbers or security codes through our enrollment forms. Do not send card details, bank credentials, Social Security numbers, or unrelated sensitive information by email, notes, or work links. Payment providers may supply limited billing details in addition to transaction identifiers.
3. Photos, recordings, and linked content
The participation and pickup agreements do not authorize photography, recording, public galleries, or marketing use of a child's likeness. If we offer those uses, we will describe them and obtain any required separate permission before proceeding. Declining optional publicity permission does not authorize us to exclude a child from the underlying service.
Student work and work links may contain personal information. A guardian or teacher should include only information appropriate for instruction and the intended audience. A work submission is not permission to use the child's identity or image in advertising or a public gallery. Contact us to ask about a specific image, recording, audience, or removal request.
A link to a third-party classroom or work service may expose information to that provider when opened. We will identify required services before use and assess appropriate data protection. Families should not publish another child's information in shared material.
4. Use and disclosure
We use information for the purposes above, to respond to requests, fulfill legal obligations, investigate abuse, and protect safety. We do not sell personal information or share it for cross-context behavioral advertising. We do not authorize use of child information to train general-purpose AI models.
Access depends on role and legitimate need: authorized guardians, staff responsible for the child's instruction or safety, and administrators performing their duties. Portal permissions do not decide legal custody rights. Medical-field encryption and access logging are safeguards, not a promise that every possible human disclosure is automatically logged.
| Recipient or provider | Information and purpose |
|---|---|
| Stripe | Hosted checkout, subscriptions, billing, refunds, and associated transaction data |
| Hosting and database services, including Render | Hosting, storage, operational security, and support |
| Transactional email services, including Resend or Zoho as used for message delivery | Recipient details and necessary message content, such as reminders and password resets |
| School personnel and assigned transportation staff | Information reasonably needed to identify the correct child and complete the authorized handoff |
| Emergency responders, authorities, professional advisers, or insurers | Information necessary for emergency care, legally required reporting, lawful requests, or a relevant claim |
The providers involved depend on the service used. A separately arranged video session or linked work service may involve an additional provider identified in that service. Contact us to ask which providers handle your information and where it is processed. We do not authorize providers to use child information for unrelated advertising.
5. Security
The application uses password hashing, access controls, staff multi-factor authentication, and encryption for designated medical fields. Access to protected fields is logged through the application's controlled access paths. We restrict staff and provider access to legitimate needs and address security incidents. No system can guarantee absolute security.
Do not treat Program medical notes as a medical record service or substitute for giving staff urgent care instructions. We do not claim that all Program information is governed by HIPAA. Any applicable confidentiality or privacy duties still apply.
If a reportable breach occurs, we will provide notices within applicable legal deadlines. An investigation will not be used to postpone a legally required notice beyond what the law allows.
6. Retention
We retain information only for the service, safety, recordkeeping, and other lawful purposes for which it is needed, considering account activity, required retention periods, and actual disputes or legal holds. We then delete or deidentify it as appropriate. Deidentification must prevent identification to the standard required by applicable law.
Our ordinary child-record retention target is three years after the last recorded class, subject to an ongoing enrollment, unresolved balance, a deletion request, or a lawful retention need. Medical notes normally follow the child record's schedule unless removed earlier. Former staff personal details ordinarily become eligible for removal 90 days after departure. Deletion requests are reviewed and ordinarily include a seven-day grace period before execution. These are retention targets, not a promise that every copy is erased at the same instant.
Financial and agreement evidence may need separate retention. We retain financial records for applicable accounting and tax obligations and agreement evidence as reasonably needed to establish accepted terms or resolve claims. Security records are retained while needed to investigate and prevent abuse. Backup copies may remain until their normal replacement or deletion cycle and should not be restored to ordinary use without applying the relevant deletion request.
7. Access, correction, and deletion requests
Contact the privacy address above to request access, correction, a copy, or deletion of your or your child's information, or to ask about a use or disclosure. We will verify identity and authority proportionately without requesting unnecessary information. We will explain any lawful refusal, retention exception, or need for clarification.
California statutory rights, including rights under the CCPA/CPRA where applicable, depend on the law's coverage and exceptions. Where those laws apply, we will honor applicable request deadlines, authorized-agent procedures, nondiscrimination protections, and relevant opt-out or limitation rights. Nothing in this policy narrows those rights. We also accept privacy questions and requests whether or not a particular statute applies to us.
Deleting essential enrollment or safety information may make continued participation impossible; we will explain the specific effect. Optional data uses should not be made a condition of participation. We will resolve refundable balances without using that process to avoid legal response deadlines. A review or grace period is not a promise of immediate erasure and does not extend a statutory deadline.
8. Children's information
We do not invite children to use the adult portal. If we learn that a child submitted information directly through it, we will assess the collection and take the notice, consent, deletion, or other steps required by applicable law. Contact us if you believe this has happened.
Before introducing a child-facing service or direct collection from children, we will assess children's privacy obligations, including COPPA where applicable. Adult account design alone does not establish that every service or collection is exempt.
9. Cookies and communications
The portal uses session mechanisms necessary for authentication and security. Payment pages, video services, and other linked third-party sites may use their own cookies under their notices. We will describe any additional optional tracking we introduce and honor applicable choices before using it.
You may opt out of optional marketing through the message's method or by contacting us. Necessary safety and transaction notices may still be sent through an appropriate lawful channel. We will honor applicable text-message and automated-call revocation rules.
10. Updates and copies
We will identify this policy's effective date, provide required notice of material changes, and obtain separate consent where required. Changes do not retroactively authorize incompatible uses. Contact us for a copy or to ask which version applied at a particular time.