Privacy Policy

Introduction

Massachusetts Higher Education Assistance Corporation, d/b/a Britebound™ (""we" or "us") respects your privacy and is committed to protecting it through our compliance with this privacy policy ("Policy").

This Policy describes the types of information we may directly or indirectly collect from you or receive from you when you use our services, including Next Voice, Futurescape, and EvolveMe (the "Services"), including any page, functionality or feature, and all content, information, links and other materials ("Materials") made available on or through the Services. For certain Services, you may be able to accumulate points ("Points") by engaging with Materials and third-party services made available on or through our Services (including on websites of our third-party partners) (such Materials and third-party services, "Experiences"). For clarity, this Policy does not apply to information collected by any third-party website(s) or service(s) that you may access or otherwise intentionally interact with on or off of our Services. The handling of the collection, use, and disclosure of information about you in such circumstances can be found in the privacy policies governing those third-party websites or services.

We may aggregate or de-identify information described in this Policy. Aggregate or de-identified information that we do not attempt to re-identify is not subject to this Policy.

As described in greater detail below, this policy applies to information we collect:

• In the course of providing the Services; and
• In any email(s), text(s), and other electronic messages that we send or receive from you in relation to the Services.

Please read this Policy carefully to understand our practices in relation to your information and how we will treat it. If you do not agree with this Policy, you may choose not to use the Services. By accessing or using the Services, you acknowledge that you have read and understood this Policy.

This Policy may change from time to time (see "Changes to Our Privacy Policy" at the end of this Policy). Your continued use of the Services after we make changes represents your acceptance of those changes.

Children Under the Age of 13

We designed the Services to avoid collecting personal information from children under 13 years of age, and therefore do not knowingly collect personal information from children who identify as being under 13 years of age. If you are under 13 years of age, do not register on the Services, do not use any of the interactive features of the Services, and do not provide any personal information about yourself including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn that we have collected or received personal information from a child under 13 years of age without parental consent, we will delete that information in accordance with applicable law. If you believe that we might have collected personal information from or about a child under 13 years of age, please contact us as soon as possible at support@accounts.britebound.org.

Information We Collect About You and How We Collect It

We may collect several types of information from or about you when you use the Services, including:

• Information by which you may be personally identified, such as your name, date of birth, postal address, e-mail address, telephone number, or any other identifier by which you may be identified or contacted online or offline;
• Information you voluntarily provide, such as gender or ethnicity;
• Information about your activity when using our Services, such as pages visited, links clicked on, Experiences completed, Points accumulated, rewards redeemed, duration of your usage of the Services, and other usage details; and
• Information about your internet connection and the device(s) you use to access the Services.

We collect this information in several ways:

• Directly from you when you provide it to us; and
• Automatically as you use the Services. Information collected automatically may include usage details and IP addresses, as well as information collected through application program interfaces ("APIs"), cookies, web beacons, and other tracking technologies, as further detailed below.

Information You Provide to Us

The information we collect from you on or through the Services may include:

• Information that you provide when using the Services, including information that you provide at the time you register to use an Britebound-operated website. We may also ask you for information when you report a problem with the Services;
• Information you provide to us to participate in contests, sweepstakes, and other promotions on or through the Services, such as your name, age, contact details, and parent/guardian contact details;
• Records and copies of communications between you and Britebound(including email addresses) if you contact us;
• Your responses to surveys that we might ask you to complete for research purposes; and
• If you use any AI-enabled features (including any chatbot experience), we may collect the content you submit (such as your prompts, questions, and other information you choose to include), the content you receive (such as responses or outputs), and related metadata (such as the date/time, feature used, and technical usage information). This information may be processed by Britebound and its service providers that support such features.

User Contributions

You may also provide information for publication or display ("Posted") on public areas of the Services or and websites you access through the Services (collectively, "User Contributions"). Your User Contributions are Posted and transmitted to others at your own risk. We cannot control the actions of third parties with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

Sensitive Information

We do not knowingly collect, and ask that you do not submit, any sensitive personal information through the Services, such as government identification numbers, health or medical information, biometric data, financial account information, or information concerning political opinions, religious or philosophical beliefs, trade union membership, or sexual orientation.

AI-Enabled Features; Automated Processing

Certain features within the Services may be generated, supported, or enhanced using automated technologies, including artificial intelligence (“AI”), including through third-party service providers. If you choose to use AI-enabled features (including any chatbot experience), information you submit through those features (such as prompts/questions and any information you include in them) will be processed to provide the feature and generate outputs. We may also store and use AI interaction information (including prompts and outputs) as reasonably necessary to: (i) provide, maintain, and secure the Services; (ii) troubleshoot and improve feature performance and user experience; and (iii) enforce our terms, prevent fraud/misuse, and comply with law.

For certain AI-enabled features made available through the Services, including chatbot functionality provided with the support of third-party providers such as Kuder, user prompts, questions, and related outputs may be stored and processed on the provider’s systems in order to operate the feature, provide responses, maintain and secure the feature, troubleshoot issues, and improve the user experience. To reduce privacy risk, chatbot interactions may be stored in a pseudonymous form and not directly alongside identifying account information.

We and our providers may review chatbot interactions in aggregate to identify common issues, improve instructions or guardrails, and enhance feature performance. In limited cases, individual interactions may be reviewed to investigate a flagged response, prevent misuse, or comply with law. Chatbot interactions are not used to train underlying third-party foundation models unless we specifically disclose otherwise and obtain any consent required by law.

Please do not include sensitive personal information in any AI-enabled feature.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with the Services, we, and our partners and vendors, may use automatic data collection technologies to collect and analyze certain information about your equipment, browsing actions, Experiences completed, Points accumulated , rewards redeemed, and usage patterns, including:

• Details of your visits to a website when using the Services, including real-time information about the location of your device, IP Address, operating system, browser type, traffic data, URL source, generalized location data based on IP address, logs, and other communication data, and the resources that you access and use on the Services; and
• Metadata and other information associated with other files stored on your device. This may include, for example, photographs, audio and video clips, personal contacts, and address book information..

The information we collect automatically helps us to deliver and provide better and more personalized Services, including by enabling us to:

• Track the completion of Experiences, Points accumulated, and rewards redeemed (as applicable);
• Estimate our audience size and usage patterns;
• Store information about your preferences, allowing us to customize the Services according to your individual interests;
• Speed up your searches; and
• Recognize you when you return to the Services.

The technologies we and our partners and vendors use to carry out such automatic data collection may include:

• Application Program Interfaces ("APIs"). To track your completion of Experiences on third-party sites, we assign a user ID to you and related information, which is communicated back to us through an API so that we can record completion of such Experiences, allocate Points, and enable you to redeem rewards when eligible. We also use APIs in coordination with our third-party service providers to enable you to participate in contests, sweepstakes, and other promotions on or through the Services.
• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer that allows us to understand how users interact with the Services. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may not be able to access certain parts of the Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to the Services
• Tracking Pixels. The Services may contain embedded HTML code snippets that enable Briteboundto measure the performance of advertising and marketing campaigns carried out on third-party websites and services; and
• Web Beacons. The Services may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Britebound, for example, to count users who have visited those pages and analyze other related statistics (for example, recording the popularity of certain content and verifying system and server integrity).

Third-Party Information Collection

When you use the Services or its content, certain third parties may use automatic information collection technologies to collect information about you or your device. These third parties may include advertisers, ad networks, ad servers and analytics companies. These third parties may use tracking technologies to collect information about you when you use the Services. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites, apps, and other online services websites. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content. We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies or block the use of other tracking technologies, some parts of the Services may then be inaccessible or not function properly.

We retain personal information pursuant to our records retention program for as long as is necessary for the purposes set out in this Policy, unless a longer period is required or permitted under applicable law or is needed to resolve disputes or protect our legal rights. For example, we may retain certain personal information for an additional period of time to prevent, protect against, detect, and respond to incidents of fraud on the Services.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information, for the following purposes:

• To present and provide you with access to the Services, including to verify your account or provide interactive features, where applicable;
• To recognize you across our Services, including when you use multiple devices or accounts;
• To track the completion of Experiences and Points accumulated on the Services;
• To enable the redemption of rewards (as applicable);
• To enable you to participate in contests, sweepstakes, and other promotions on or through the Services, including by verifying your age to ensure you are eligible to enter for a drawing under the applicable Terms of Use, and to contact you and/or your parent or guardian in the event that your entry is selected;
• To evaluate the use, results, and effectiveness of our Services;
• To provide you with information or other services that you request from us;
• To fulfill any other purpose for which you provide it;
• To carry out our obligations and enforce our rights arising out of this Policy, the Terms of Use, which are accessible here (Terms of Use), and any other legal terms applicable to use of the Services;
• To notify you about changes to the Services;
• To protect the rights, property, or safety of Britebound, our customers, or others;
• To prevent, protect against, detect, and respond to incidents of fraud on the Services;
• To measure the performance of our advertising and marketing campaigns, including through third-party websites and services;
• In any other way we may describe when you provide the information; and
• For any other purpose with your consent.

Opting Out of Communications

We may send you occasional promotional emails or text messages related to the Services. You can opt out of receiving these communications at any time by following the instructions included in the message (e.g., clicking “unsubscribe” in emails or replying “STOP” to text messages). You also can also opt-out of receiving promotional emails or text messages, or from receiving advertisements according to our advertisers' target-audience preferences, by logging into the Services and adjusting your user preferences in your account profile by checking or unchecking the relevant boxes. Please note that even if you opt out of promotional communications, we may still send you administrative or service-related messages related to your account.

Disclosure of Your Information

We may disclose information without restriction that does not identify an individual, including information in aggregated or de-identified form. This may include aggregated information gathered via cookies, web beacons, and tracking pixels.

We may disclose personal information that we collect for the following purposes:

• To vendors, contractors, and other third parties that support us in providing the Services and who are bound by contract to keep personal information confidential and use it only for the business purposes for which we disclose it to them;
• To third parties that provide a feature, functionality or service that you have otherwise requested;
• To fulfill the purpose(s) for which you provided it;
• For any other purpose disclosed by us when you provide the information;
• To comply with any court order, law, or legal process, including to respond to any government or regulatory request;
• To enforce or apply this Policy, the Terms of Use, or any other terms that apply to the use of the Services;
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Britebound, our customers, or others;
• As part of a change in business structure or ownership of Britebound, we may disclose personal information to the buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Britebound’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Britebound about users of the Services is among the assets transferred; and
• For any other purpose with your consent.

We do not sell your personal information, nor does Britebound display any targeted advertising on Britebound-operated websites.

Britebound does share data with advertising service providers to measure the performance of our advertising and marketing campaigns on other websites, apps, or services, including on Facebook, Snapchat, various Google services, and other social networks.

Per the above, please note that we use our best efforts and take multiple steps to avoid the collection of information for targeted advertising purposes from children under 13 years of age, including by prohibiting children under 13 years of age from creating a user profile on the Services. In addition, we prohibit access to certain areas of the Services by children under 13 years of age in this Policy.

Personal Information Rights

Applicable law may recognize certain rights in relation to personal information, including the right to access, correct, or delete personal information, restrict the processing of personal information (including sensitive personal information, as applicable), and data portability, among others. Many states, including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia provide (now or in the future) their state residents with rights to:

• Confirm whether we process their personal information.
• Access and delete certain personal information.
• Correct inaccuracies in their personal information, taking into account the information's nature processing purpose (excluding Iowa and Utah).
• Data portability.
• Opt-out of personal data processing for: • targeted advertising (excluding Iowa); • sales; or • profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
• Either limit (opt-out of) or require consent to process sensitive personal data or process personal data of minors under 18, 17, or 16 years old.

The exact scope of these rights may vary by state. To exercise any of these rights or to appeal a decision regarding a consumer rights, please send a request or send a notice explaining your basis for appeal to webmaster@britebound.org.

You can review and update your personal information by logging into the Services and visiting your account profile page. You may also send us an email at support@accounts.britebound.org to exercise rights applicable to your personal information, or to have an authorized agent do so on your behalf. We will respond to such requests in accordance with applicable law, and we may request further information from you to verify your identity and/or verify the identity of your authorized agent (as well as confirm their authority to act on your behalf). We may not accommodate a request if we believe the change would violate any law or legal requirement, cause the information to be incorrect, or otherwise is subject to an applicable exception under law. We will inform you in accordance with applicable law if we do not accommodate your request. You may have the right to appeal our determination under local law, which can also be exercised by contacting us at support@accounts.britebound.org. We will not discriminate against you when you exercise personal information rights.

Data Transfers

As set out in our Terms of Use, our Services are strictly for use by and solely directed to persons located in the United States. If you are not in the United States, YOU MAY NOT ACCESS OR USE THE SERVICES. If you access or use the Services from outside the United States, you do so at your own risk and are responsible for compliance with local laws.

Data Security

We have implemented industry-standard security technologies, procedures, and organizational measures designed to secure your personal information from accidental loss and or unauthorized access, use, alteration, or disclosure.

The safety and security of your information also depends on you. If you choose or are provided with a username, a password, or any other information as part of our security procedures, you must keep that information confidential and not disclose it to any other person or entity. You may not provide any other person with access to the Services or portions of it using your user name, password, or other security information. You are responsible for all activity occurring under your account or with use of your username and password.

You agree to notify us immediately of any unauthorized access to or use of your username or password, or any other breach of security of which you become aware. You may report unauthorized access by sending an email to support@accounts.britebound.org.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to the Services. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Services.

Changes to Our Privacy Policy

We may revise and/or update this Policy from time to time in our sole discretion. The date this Policy was last revised is identified at the top of the page. If we make material changes to how we treat our users' personal information, we will notify users with an account by email to the email address specified in your account. You are responsible for ensuring we have an up-to-date active and deliverable email address where we can reach you if you have an account, and for periodically visiting the Services and this Policy to check for any changes, regardless of whether you have an account or not.

Contact Information

To ask questions or comment about this Policy and our privacy practices, or to register a complaint or concern, contact us at support@accounts.britebound.org.