Introduction

We understand the importance of your personal privacy. Therefore, we have created this Privacy Policy so that you know how we use and disclose your information when you make it available to us. The Privacy Policy below discloses our practices regarding information collection and usage of the website located at https://www.roxxem.com, the related mobile website, and the mobile application (collectively, the “Applications”) and the service provided thereon (the “Service”).

By using or accessing the Applications and the Service, you signify your agreement to be bound by this Privacy Policy. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY YOU MAY NOT ACCESS OR OTHERWISE USE OUR SERVICE OR PARTICIPATE IN OUR SERVICES.

In order to safeguard your privacy, we commit to the following principles:

• We never sell or share your Personal Information.
• We do not advertise on Roxxem.
• The information we collect is used exclusively for the purpose of building, improving, and maintaining Roxxem Services.
• We encrypt data in motion and at rest and use industry best practices to securely store and transmit your information.
• You have the right to view, request, and remove your Personal Information.

We are also in compliance with major US and state privacy laws, including:

• United States: the Children's Online Privacy Protection Act (“COPPA”); the Family Educational Rights and Privacy Act (“FERPA”)
• California: the California Consumer Privacy Act (“CCPA”); the Student Online Personal Information Protection Act (“SOPIPA”)
• Illinois: the Student Online Personal Protection Act (“SOPPA”)
• New York: Education Law Section 2-D (“Ed Law 2-D”)

Roxxem is a signatory of the Student Privacy Pledge.

1. Personally Identifiable Information That We Collect

We may ask you for, or you may voluntarily submit, personally identifiable information when you are using the Service. If you create an Account, the personally identifiable information which you may provide to us could include:

• Your name;
• Your email address;
• Your school.

In addition, if you choose to make a purchase on the Applications and/or Service, our payment processors (Stripe on the web, Apple in the iOS app, and Google in the Android app) will collect your credit card information. We do not collect or store your credit card information.

The information noted above is the only Personal Information we collect. You have full control of maintaining the accuracy of the information we collect, including by updating and deleting your information from inside of your Account or notifying us at privacy@roxxem.com if you wish to have the information changed or removed. We need to collect the information listed below to provide the Services to you, or because we are legally required to do so.

If you submit any Personal Information relating to other people to us or to our service providers in connection with the Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

2. Non-Personal Or Aggregate Information That We Collect

When you access our Service, we may automatically collect non-personally identifiable information from you, such as IP host address, web pages viewed, browser type, operating system, referring service, search information, device type, page views, usage and browsing habits on the Service and similar data. We may also aggregate demographic information collected from our users (such as the number of users in a particular geographical location) in a manner which does not identify any one individual.

It is possible at times when collecting non-personally identifiable information through automatic means that we may unintentionally collect or receive personally identifiable information that is mixed in with the non-personally identifiable information. While we will make reasonable efforts to prevent such incidental data collection, the possibility still exists. If you believe that we have inadvertently collected your Personal Information, please notify us by email at privacy@roxxem.com.

3. Creating Accounts

Roxxem has three different Account types: Personal, Teacher, and Student. The requirements and information we collect for each Account type are listed below.

Personal Accounts

Personal Accounts are designed for users who are learning a language on their own and using Roxxem for their own personal use. When you create a Personal Account, you are representing to us that you are at least over thirteen (13) in the United States or over sixteen (16) outside of the United States.

To create a Personal Account, we ask you for:

• First name (only collected when using our Service through an Integrated Single Sign-On solution)
• Last name (only collected when using our Service through an Integrated Single Sign-On solution)
• Unique username
• Email address

Teacher Accounts

Teacher Accounts are designed for educators who teach students. When you create a Teacher Account, you are representing to us that you are at least eighteen (18) years of age or older.

To create an Teacher Account, we ask you for:

• First name (only collected when using our Service through an Integrated Single Sign-On solution)
• Last name (only collected when using our Service through an Integrated Single Sign-On solution)
• Unique username
• Your school (optional)

Student Accounts

Student Accounts are designed for students in a class with a Teacher. Student Accounts in Roxxem are available but not required for Students to access and play Roxxem. We only collect Student Personal Information when a Student Account is created. We do not allow Students under thirteen (13) in the United States or under sixteen (16) outside of the United States to create Student Accounts or submit Personal Information to us without Parental or Guardian Consent.

To create a Student Account we ask for:

• First name (optional)
• Last name (optional)
• Unique username
• Email address (optional - Student Accounts can be created without an email)

The Student Personal Information we collect and the methods we use to create Student Accounts comply with Federal Privacy Laws as well as with all of the Privacy Laws mentioned in the above “Introduction” section.

Creating Student Accounts

Student Accounts cannot be created without a class invitation link from a Teacher. This restriction allows Teachers to provide parental consent for Students of any age to sign up for Roxxem by sharing with them a class invitation link.

By inviting Students to create accounts using a class invitation link, Teachers provide consent for the collection of Student Personal Information as discussed under the COPPA Compliance section of this Privacy Policy. When a Student creates a Student Account and uses Roxxem, the information we collect, including all collected Personal Information, will be stored in our Service as per the consent provided by the Teacher.

4. Use of Your Information

We will only use your personally identifiable information as described below, unless you have specifically consented to another type of use, either at the time the personally identifiable information is collected from you or through some other form of consent from you or notification to you:

• We will never sell your data to a third party.
• We may use your personally identifiable information to respond to your inquiries or requests.
• We may use your personally identifiable information to send you emails from time to time about our services, but we will not provide your personally identifiable information to third parties for them to contact you directly unless otherwise permitted by this Privacy Policy or you provide your consent.
• We may share your personally identifiable information with third parties (collectively, the “Third Party Vendors”) to further the purpose for which you provided such information to us. For example, we may share your information with Mailjet, for the purpose of sending emails.
• We may disclose personally identifiable information as required by law or legal process.
• We may disclose personally identifiable information to investigate suspected fraud, harassment or other violations of any law, rule or regulation, or the terms or policies for our services or our sponsors.
• We may transfer your personally identifiable information in connection with the sale or merger or change of control of Roxxem or the division responsible for the services with which your personally identifiable information is associated. Any acquirer of our merging entity may continue to use your Personal Information in compliance with this policy.
• Non-personally identifiable or aggregate information may be used by us for any purposes permitted by law and may be shared with any number of parties, provided that such information shall not specifically identify you.

We use the information we collect (which may include your Personal Information) exclusively for the purpose of building, improving, and maintaining Roxxem Services.

We do not collect, maintain, use, or share your Personal Information beyond that needed for authorized educational or school purposes (including developing and improving Roxxem Services for educational use), or as authorized by the user (and/or parents, if the user is a student).

We do not sell or use your Personal Information for any commercial purposes, including targeted advertising, or to build user profiles for commercial purposes. We do not ever use behavioral information to ever provide targeted advertising to students. We do not maintain student profiles that would allow us to use the student profile in a way that is not for an educational purpose.

5. Cookies and Similar Technologies

“Cookies” are pieces of information that may be placed on your computer by a service for the purpose of facilitating and enhancing your communication and interaction with that service. Many services use cookies for these purposes. We may use cookies (and similar items such as local storage, clear gifs, web beacons, tags, etc.) on our Service to customize your visit and for other purposes to make your visit more convenient or to enable us to enhance our Service. We may also use and place cookies (and similar items) on your computer from our third party service providers in connection with the Service, such as an analytics provider that helps us manage and analyze Service usage, as described more fully below. You may stop or restrict the placement of cookies on your computer or flush them from your browser by adjusting your web browser preferences, in which case you may still use our Service, but it may interfere with some of its functionality. Cookies and similar items are not used by us to automatically retrieve personally identifiable information from your computer without your knowledge.

If you delete your cookies, change browsers or use a different cookie, our cookie (or an opt-out cookie) may no longer work and you will have to reinput (or opt-out) again.

6. Analytics and Conversion Tracking

We may use analytics services that use cookies, Javascript and similar technologies to help us analyze how users use the Service. The information generated by these services about your use of the Service (including your IP address or a truncated version of your IP address) is transmitted to and stored by analytics service providers on their servers. Those service providers will use this information for the purpose of evaluating your, and other users', use of the Service, compiling reports for us on website activity and providing other services relating to website activity and Internet usage.

We may collect information about your computer, including your IP address, operating system and browser type, for system administration and in order to create reports. This is statistical data about our users' browsing actions and patterns, and does not identify any individual.

For example, we use cookies on our site for Google Analytics (the “Analytics Service”). The Analytics Service is a web-based analytics tool that helps website owners understand how visitors engage with their website. The Analytics Service customers can view a variety of reports about how visitors interact with their website so that they can improve it.

The Analytics Service collects information anonymously. They report website trends without identifying individual visitors. You can opt out of the Analytics Service without affecting how you visit our site. For more information on opting out of being tracked by Google Analytics across all websites you use, use Google's Analytics Opt-out tool.

We may also use Google conversion tracking and/or similar services to help us understand your and other users' use of the Service.

7. Automatically Collected Information

When you access the Service or open one of our HTML emails, we may automatically record certain information from your system by using cookies and other types of tracking technologies. This “automatically collected” information may include Internet Protocol address (“IP Address”), a unique user ID, device type, device identifiers, browser types and language, referring and exit pages, platform type, version of software installed, system type, the content and pages that you access on the Service, the number of clicks, the amount of time spent on pages, the dates and times that you visit the Service, and other similar information. Depending on the law of your country of residence, your IP address may legally be considered personally identifiable information.

8. Your Disclosures In Social Media

You should be aware that personally identifiable information which you voluntarily include and transmit online on the Service or in a publicly accessible blog, chat room, social media platform or otherwise online, or that you share in an open forum such as an in-person panel or survey, may be viewed and used by others without any restrictions. We are unable to control such uses of your personally identifiable information, and by using the Service or any other online services you assume the risk that the personally identifiable information provided by you may be viewed and used by third parties for any number of purposes.

9. Other Services

As a convenience to you, we may provide links to third-party Services from within our Service. We are not responsible for the privacy practices or content of these third-party sites. When you link away from our Service, you do so at your own risk.

10. Communications with Roxxem

By providing your contact information to us (collectively the “Channels”) to us, you expressly consent to receive communications from us. We may use the Channels to communicate with you, to send information that you have requested or to send information about other products or services developed or provided by us or our business partners, provided that, we will not give your contact information to another party to promote their products or services directly to you without your consent or as set forth in this Privacy Policy.

By using the Service, you expressly consent to receive in-product communications from us (including, without limitation, push notifications on the App).

Any communication or material you transmit to us by email or otherwise, including any data, questions, comments, suggestions, or the like is, and will be treated as, non-confidential and nonproprietary. Furthermore, you expressly agree that we are free to use any ideas, concepts, know-how, or techniques contained in any communication you send to us, as well as any data developed using the content of such communication, without compensation and for any purpose whatsoever, including but not limited to, developing, manufacturing and marketing products and services using such information.

11. YouTube

Roxxem uses YouTube to display video content on the Service. YouTube incorporates tracking technologies, which may be present in the YouTube videos embedded on the Service, which may collect information from your browser when you view the video on the Service, including device identifiers and/or cookie IDs. This information is collected directly and automatically by YouTube and its partners, and Roxxem does not participate in these data transmissions. Roxxem does not provide any Personal Information, such as user names, to YouTube.

12. Information from Integrated Sign-On Services such as Apple or Google

If you decide to register through or otherwise grant access to a third-party social networking or integrated service (what we call an “Integrated Service”), such as Apple, Google, or similar single sign-on service, Roxxem may also collect the name and the email address that is already associated with your Integrated Service account.

You may revoke Roxxem's access to your account on any Integrated Service, such as Google or Apple, at any time by updating the appropriate settings in the account preferences of the respective Integrated Service. Please review each Integrated Service's terms of use and privacy policies carefully before using their services and connecting to our Service.

13. Servers

We store information in the cloud on secure servers located in the United States (using Mongo Atlas). By using the Service, you freely and specifically give us your consent to export your personally identifiable information to the United States and to store and use it in the United States as specified in this Privacy Policy. You understand that data stored in the United States may be subject to lawful requests by the courts or law enforcement authorities in the United States.

14. Protection of Your Information

The security of your personally identifiable information is very important to us. When we collect your personally identifiable information online, we use reasonable efforts to protect it from unauthorized access. However, due to the inherent open nature of the Internet, we cannot guarantee that your personally identifiable information will be completely free from unauthorized access by third parties such as hackers and your use of our Service demonstrates your assumption of this risk.

We have put in place reasonable physical, electronic, and managerial procedures to safeguard the information we collect, including but not limited to:

• We store information in the cloud on secure servers located in the United States, with server authentication and data encryption. We fully encrypt all data while in motion using TLS and at rest using AES-256.
• We use SSL / HTTPS for all data transmission over the Internet.
• We have multifactor authentication on administrator-level access.
• We protect devices with firewalls, security software, and consistent updates.
• We regularly assess and document potential risks and vulnerabilities.

Only those employees who need access to your information in order to perform their duties are authorized to have access to your personally identifiable information.

15. Third Party Vendors

Roxxem uses Third Party Vendors to help us provide, analyze, and improve our services. These include but are not limited to data storage, maintenance services, payment processing, web analytics, email communications, and management. We only share data (including student data) with trusted third-party service providers whose privacy policies, practices, and commitments are consistent with ours. The Third Party Vendors we work with will only have access to the information they need to provide the Roxxem Service.

Below is a list of the Third Party Vendors we use who, subject to their terms of service and privacy policies, may have access to your data:

• Heroku for website hosting
• Mongo Atlas for database hosting
• Google Firebase for hosting Roxxem's live games
• Stripe for payment processing
• Google Analytics for data analytics
• PostHog for data analytics
• Mailjet for email communications
• Sentry for error tracking
• RevenueCat for tracking revenue metrics
• Slack for internal communications

16. Incident Response Plan

If we discover or receive reports of a security breach, we will take the following steps to address it:

The staff member who detects or receives a report of a breach will forward all details to Roxxem's Leadership Team. The Leadership Team will:

• Determine the severity of the potential impact. Is it real or perceived? Is it still in progress? What data is threatened and how critical is it? What is the impact on the business should the attack succeed - minimal, serious, or critical?
• If the breach is real, determine the system(s) being targeted, along with all relevant details such as the attacker's IP address.
• Determine how the incident can be contained, and contain it. This may involve changing passwords, encryption keys, or other system access information.
• Determine what data has been compromised, and who should be notified about the incident.
• Notify affected parties by email, including relevant details including the data that was compromised and the measures being taken to prevent future incidents.
• Document the incident, including date detected, date occurred, notifications issued, and response.
• Consider how the intrusion could have been prevented, and make changes to systems and/or policies accordingly.

17. Retention of Your Information

The data and information we collect is stored and maintained by Roxxem or our third-party service providers until you delete it or instruct us to delete it, or until it is deleted by us either for violation of this Privacy Policy or our Terms of Service agreement or following 24 months of inactivity. We will retain a backup of the data and information we collect for a period of 30 days after your Account is deleted, at which time all backup information will be permanently deleted. We only retain data for as long as is reasonably necessary to fulfill the purpose for which the information was collected.

18. Access and Accuracy of Information

To review, access, or update your Personal Information, to review the accuracy of the data we collected, or to request Account deletion, visit your Account section at app.roxxem.com/account or contact us at privacy@roxxem.com.

If you believe that the Personal Information maintained by Roxxem about you is inaccurate or incomplete, you may make updates to the information directly in your Account or notify us by describing in detail any inaccuracies or omissions via email at privacy@roxxem.com. Following receipt of a properly submitted notice, we will, within a reasonable time period and acting in our sole discretion, use commercially reasonable efforts to either: (a) amend or correct your Personal Information to reflect corrected or additional information provided by you, or (b) in connection with your Personal Information, make note of any claimed inaccuracies or omissions reported in the notice submitted by you.

19. Our Policy Regarding Children

Roxxem recognizes the privacy interest of children and we encourage Parents and Guardians to take an active role in their children's use of the Applications and/or Services. Children under the age of thirteen (13) in the United States, or sixteen (16) outside of the United States, may only create Accounts on and submit Personal Information to the Applications and/or Services through the class invitation link of a Teacher as described above in the Student Account section of this policy. If an Teacher wishes for a Student under the age of thirteen (13) in the United States, or sixteen (16) outside of the United States (each a “Permitted Minor”), to use to the Applications and/or Services with a Student Account, after obtaining consent from the Permitted Minor's parent or legal guardian, the Teacher may use our Classes system to provide a class invitation link to the Permitted Minor so the Permitted Minor can register a Student Account. Any Teacher who presents a class invitation link to a Permitted Minor hereby represents and warrants that the Teacher has obtained the necessary consent(s) from the parent or legal guardian of each Permitted Minor as required under this Privacy Policy.

If a parent/guardian or Teacher becomes aware that a Student under the age of thirteen (13) in the United States, or sixteen (16) outside of the United States, has accessed to the Applications and/or Services on their own, registered for Roxxem in a way that violates this Policy or our Terms of Service, or provided us with inaccurate information, contact us at privacy@roxxem.com. We will use all reasonable efforts to delete such information from our database.

If we believe a Child has registered for Roxxem and is under the age of thirteen (13) in the United States, under sixteen (16) outside of the United States, has not received parental consent as described above, or is otherwise in violation of this Policy or our Terms of Service we may restrict or remove access to to the Applications and/or Services at our sole discretion.

20. COPPA and Students

Notice to Parents and Schools

Under the United States Children's Online Privacy Protection Act ("COPPA"), verifiable parental consent is needed to collect, use, or disclose Personal Information (e.g., full name and email address) from each user under 13 years old. In accordance with COPPA, an Educator such as a Teacher may act as the agent of the parent or legal guardian of a Student and provide consent on their behalf for Roxxem's collection, use, and disclosure of the Student's Personal Information. By enrolling a Student under 13 to use the Service using our Classes system, the School provides such consent to Roxxem and agrees that the Students' activities while on the Service are subject to our Terms of Service.

This Privacy Policy does not govern any School's collection, use, or disclosure of a Student user's Personal Information through the Service, and we are not responsible for any such collection, use, or disclosure. Parents should contact the Educator or School directly to understand the Educator's or School's privacy practices or to request to access, change, or delete information collected by the Educator or School in connection with the Service that cannot otherwise be accessed, changed or deleted as described in this Privacy Policy.

As required under COPPA, parents can make certain choices regarding how their child's information is used. For more details, see “Parents' Choices Regarding Information on Students Under 13”. Parents should submit these requests to the Educators, who, as the parent's agent, must pass those requests to us by emailing privacy@roxxem.com.

Parents' Choices Regarding Information on Students Under 13

Under COPPA, parents of Students under 13 have certain rights with respect to our collection, use, retention, and disclosure of their Students' information. This includes the right to review, update, or delete Student information, as well as prohibit our sharing Student information with third parties. Parents can exercise these rights by contacting the Student's Teacher, who should submit these requests, on the parent's behalf, to Roxxem by emailing privacy@roxxem.com. Notwithstanding any such requests, we may continue to share the Student information as described in this Policy.

A Parent should request deletion of the Student's information through the Teacher. Upon receiving such requests, the Teacher can request deletion of the Student's information by emailing privacy@roxxem.com. This action will allow us to delete the Student information from our live databases. Students or Parents with access to the Student Account can also delete the Account and all Personal Information we collected from inside of the Account from app.roxxem.com/account. We will not have any liability whatsoever for any termination of the Account or related deletion of the Student information. When we delete Personal Information, it will be deleted from our active databases but may remain in our archives for 30 days.

Schools and Roxxem Teachers should always obtain parental consent for a Student under 13 in the United States to use the Service using your school or district's forms and documentation for obtaining parental consent.

21. No Rights of Third Parties

This Privacy Policy does not create rights enforceable by third parties, nor does it require disclosure of any personal information relating to users of the Service.

22. Terms of Use

Use of this Service is governed by, and subject to, the Terms of Use located at https://www.roxxem.com/terms (the “Terms”). This Privacy Policy is incorporated into the Terms. Your use, or access, of the Service constitutes your agreement to be bound by these provisions. IF YOU DO NOT AGREE TO THE TERMS AND THIS PRIVACY POLICY YOU MAY NOT ACCESS OR OTHERWISE USE THE SERVICE.

23. Changes to this Privacy Policy

We reserve the right, at our discretion, to change, modify, add, or remove portions from this Privacy Policy at any time. However, if at any time in the future we plan to use personally identifiable information in a way that materially differs from this Privacy Policy, we will post such changes here and provide you the opportunity to opt-out of such differing uses.

We will notify you inside the Roxxem Applications of any material changes to this policy. We do this the first time you use the Service following changes to this policy with a prominent note that explains you are providing consent by continuing to use Roxxem. Your continued use of the Service and our services following the posting of any changes to this Privacy Policy means you accept such changes.

24. Governing Law

This Privacy Policy and our legal obligations hereunder are subject to the laws of the State of California regardless of your location. You hereby consent to the exclusive jurisdiction of and venue in the courts located in the State of California, County of Santa Clara, in all disputes arising out of or relating to the Services.

25. Contact

For questions or concerns relating to privacy, we can be contacted via email at privacy@roxxem.com.