Rapunzl Privacy Policy

We at Rapunzl Investments, LLC (“Rapunzl,” “we,” “us,” “our”) care about you (“you,” “user,” “learner,” “educator,” and/or “business professional” as appropriate) and how your personal information is used and shared. This Policy applies to all Rapunzl products, services, and websites owned and operated by Rapunzl (the “Services”) and is designed to help you understand what information we collect, why we collect it, and what we do with it.

Rapunzl provides users with a mobile and web-based, real-time investment simulator to manage near-real-time stock and cryptocurrency portfolios, paired with a personal-finance curriculum geared toward middle- and high-school students. Educators access this curriculum through Rapunzl’s Educator Dashboard. Rapunzl also offers optional paid consumer plans purchased by adult parents or guardians. By using these Services, you acknowledge that Rapunzl will handle your personal information as described in this Policy and in our Terms of Use.

We may collect information about you directly from you and automatically through your usage, including: (a) contact information and common identifiers (first name, last name, email address, phone number); (b) login details (username and password); (c) employment and education details (role, organization or school name, whether an individual is an educator); (d) preferences and personalization based on activity within the Service (content viewed, started or finished, assessments or scores, and related information); and (e) date of birth to support compliance with the Children’s Online Privacy Protection Act (“COPPA”). Date of birth is not viewable externally and is used to maintain an over/under-13 flag. Rapunzl does not collect geolocation, biometric, or health data. For users under 13, we collect only the first name and first initial of the last name, and we do not send messages to email addresses for students under 13, except to confirm a valid email to verify students for scholarship competitions.

Payment information. When an adult account holder purchases a paid plan, we (or our third-party payment processor) collect billing information such as name, billing contact details, and the payment-card or account information necessary to process the transaction. Full payment-card numbers are handled by our payment processor under its security standards and are not stored by Rapunzl. We do not collect payment information from students or minors.

We also collect information automatically via cookies, JavaScript, and log files (including IP addresses, browser and device type, time stamps, and referring URLs), and we use cookies, clear GIFs, pixel tags, and third-party analytics tools (for example, GA4) to evaluate and improve the Service. Business professionals who request a demo may provide their name, email, phone, job title, company or school, and communication preferences, and we may enhance our marketing database of business professionals using publicly available information. We do not obtain or use any identifiable information about children for marketing purposes.

Rapunzl operates these Services and collects children’s personal information as described in this Policy. Even where courses are offered with an outside partner, the partner will not receive any individual personal information from users, including children. Parents may ask us to stop collecting information from their child by emailing privacy@rapunzl.com. We collect information about children’s performance and activities for internal use only; we do not disclose it to other entities or use it in personally identifiable form for commercial purposes. We never use unique identifiers to track users across third-party apps or websites, and we may use aggregate or de-identified information for research and to improve the Services.

Parental consent for family plans. When a parent or guardian purchases a paid plan and creates a profile for a child under 13, the parent provides verifiable parental consent to our collection and use of that child’s information as described in this Policy, consistent with COPPA. The Parent Account Holder controls the child’s profile and may review, correct, or request deletion of the child’s information at any time by contacting privacy@rapunzl.com or through account settings. As with school accounts, we collect only limited information for young learners and never serve them advertising.

We do not sell children’s personal information, and a child may not make protected personal identifiable information public through our Services. We may disclose children’s personal information only to comply with the law or to protect Rapunzl and other users, or in connection with a business transfer as described below. Parents may request information we have collected about their child by contacting privacy@rapunzl.com.

Rapunzl generally uses the information we collect to: (A) provide the Services to learners, including creating login details; (B) communicate about users’ use of the Services, respond to inquiries, and fulfill customer-service requests; (C) understand how users access and use the Service in order to improve it and troubleshoot technical issues; (D) develop aggregated reports and related analysis; and (E) comply with applicable legal obligations.

Marketing communications. We send marketing or promotional communications only to adult account holders and to business professionals who have requested information. We do not send marketing, promotional, or upgrade offers to student or minor users. Student and minor users receive only communications necessary to operate the Service (for example, account, security, or scholarship-verification messages).

Rapunzl does not sell any user personal information and does not share any protected personal identifiable information for purposes of targeted advertising, data mining, or marketing research. We never sell the personal information of minors and never use student or minor data to advertise or to solicit consumer purchases, including of our paid plans; marketing decisions are based only on adult account-holder and business-professional data. We share information only as follows:

A. Authorized Entities. If you access the Services through a school, district, institution, employer, or other organization (an “Authorized Entity”), we share information we collect about you (such as course progress and completion, assessment scores, email address, and user ID/username) with that Authorized Entity.

B. Social-Media Sharing. Our platform prohibits users from sharing information such as assessment scores through social-media outlets.

C. Third-Party Sponsors. Where third-party sponsors bring the Services to some users free of charge, we share only anonymized and/or aggregated information with those sponsors.

D. Legal Disclosures. We may disclose information where required to comply with law or legal process, to detect fraud, or to protect the safety and security of our users, the Services, or the public.

E. Service Providers. We may employ contractors and vendors to provide services such as hosting, payment processing and fraud screening, and email and marketing services.

F. Business Transfers. We may transfer information, including personal information, in connection with a sale, merger, or transfer of all or substantially all of our assets, including as part of a bankruptcy proceeding.

Rapunzl commits to implementing applicable state, federal, and local data-security and privacy requirements, regularly reviewing and updating our data-protection policies, and conducting regular audits and risk assessments. We implement strict access controls, use encryption protocols for data in transit and sensitive data at rest, regularly update and patch software, and utilize firewalls and intrusion-detection systems. We maintain an incident-response plan to detect, respond, notify, and remediate in the event of a security or privacy incident. All officers, employees, and assignees with access to Protected Information receive training on FERPA, COPPA, and related laws before access and at least annually. We conduct due diligence on subcontractors. Upon written request, we provide parents of younger learners access to review and submit corrections to their child’s information and to request deletion where permitted by law. Upon contract termination or expiration, we handle Protected Information as directed by the relevant parties, including secure return, transition, deletion, or destruction. We use TLS encryption for data transfers; however, no transmission over the Internet can be guaranteed 100% secure.

Consumers in certain states (including under the California Consumer Privacy Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, and Virginia Consumer Data Protection Act) have additional rights, including the right to know what information we collect and disclose; to access a copy of their data; to request deletion or correction; and to opt out of the sale of data or its sharing for targeted advertising. Rapunzl does not sell personal information or share it for targeted advertising. To exercise these rights, contact us through our website; we will verify identity where required. You may opt out of marketing emails using the opt-out instructions in the email or by contacting privacy@rapunzl.com; opt-out requests may take up to 10 business days to process, and we will still send service emails about your account. We will respond within the time required by applicable law.

Rapunzl may amend this Privacy Policy from time to time. We will provide notice of material changes by prominently posting the revised Policy with an updated revision date. If we make material changes that affect information previously collected, we will provide notice (or, in the case of a child, to the parent or legal guardian, or to the school/educational institution) via email or within the Service.

If you have questions about this Privacy Policy or our security measures, or wish to appeal a decision regarding your privacy rights, please contact us at hello@rapunzl.com. Our mailing address is 323 West Schiller Street, #1W, Chicago, Illinois 60610, and we can be reached by phone at 312-618-9956.