Skip to content

Privacy Policy

Effective Date: 09-Jun-2026  ·  Last Updated: 09-Oct-2026

Recent update (09-Oct-2026): When we issue a credential, we email a link that opens the credential page even while it is private. For a Minor, that email goes to their parent or legal guardian. Sections 2, 3.11, 5, 7.4 and 12 now explain who can see a private credential page, and why you should not forward that email.

Earlier update (02-Oct-2026): Student self-registration and pending accounts; the definition of Minor (state age of majority); students who are adults but still in high school; students’ own opt-out choices; deletion within 30 days on request; our children’s data retention policy; credential pages for children under 13; FERPA protections for all student data; cookies on student pages, including for children under 13; survey responses and how we quote them (Sections 2, 3.10, 3.12, 5, 7.1, 7.4, 7.7, 8, 9, 10, 12, 14). Consent forms and agreements can also now be signed through Stellr’s own signing system as well as DocuSign (Sections 2, 3.10, 4, 5 and 7.1): when you sign, we record your name, email, the date and time, and the internet address and browser you used. Medical information is deleted within 90 days after the event, and dietary details are kept on your member record for future events (Section 8); the photo and media permission on the consent form is an opt-out (Section 7.4); we list every provider we use, including Google Workspace, Checkr, Printful and Discord (Section 7.1); and school registrations are covered by our new School Data Terms (Section 7.7).

Earlier update (23 Sep 2026): We now describe credentials and LinkedIn sharing in full (Sections 3.11, 5, 7.4, 10, 12 and 13): what a credential page shows, that it is private until you choose to make it public, how a parent or guardian can say no for a student under 18, and that once you share a credential on LinkedIn, Stellr cannot control what LinkedIn does with it. Section 14 now explains that we announce changes to this policy here, on our website, rather than by email. The 21 Sep 2026 update first introduced credential pages in Section 7.4. The 17 Aug 2026 update covered Sections 3, 5, 7 and 9 to describe our use of Apollo.io, a business-audience tool that identifies the organization — not the individual — associated with visitors to our educator and partner pages. It runs only on those pages, only where you have accepted advertising cookies, and never on student registration pages or the participant platform. The 10 Aug 2026 update covered our cookie categories, the providers involved, and how to give or withdraw consent at any time via Cookie settings at the bottom of any page.

1. Introduction

Stellr Education (“Stellr,” “we,” “us,” or “our”) operates STEM competitions and an online community for middle and high school students. We are committed to protecting the privacy of all participants, including minors. This Privacy Policy explains what personal information we collect, how we use and protect it, and your rights regarding that information.

By registering for a Stellr competition or creating an account on our platform, you (and, where applicable, your parent or guardian) agree to the practices described in this Policy.

This Privacy Policy applies to: our website, competition registration portals, and online community platform (collectively, the “Services”).

2. A Note About Minors, COPPA, and FERPA

Our Services are directed to school students, many of whom are under the age of 18, and some of whom may be under the age of 13. We comply with the Children’s Online Privacy Protection Act (COPPA) and, where applicable, the Family Educational Rights and Privacy Act (FERPA).

  • Minors. In this policy, a “Minor” is anyone under the age of majority in their state of residence (18 in most states, 19 in Alabama and Nebraska, 21 in Mississippi), anyone still enrolled in high school, or anyone who is a ward of the state or under guardianship. A person who has been legally emancipated is not a Minor once they give us proof. A Minor needs a parent or legal guardian to sign Stellr’s Participation Agreement — Student / Minor (through DocuSign or Stellr’s own signing system) before they can take part in Stellr activities. One signed agreement covers the student’s membership and every Stellr activity, however they joined. The form is emailed to the parent or guardian address given at registration, and the parent or guardian signs first. We follow up on any form that is still outstanding before the event.
  • How we confirm who is signing: The form is sent to the parent or guardian email address given at registration, and only the person who has that email can open it. Where the form is about a child, the person opening it also confirms the child’s year of birth, and a parent or guardian confirms that they are the child’s parent or legal guardian before signing. We record the date, time, internet address and browser of each signature, so it can be checked later.
  • Participants under 13: We do not knowingly collect personal information from a child under 13 without the parental consent described above. A student under 13 signs their own section of a form only after their parent or guardian has signed. If we discover we have collected a child’s information without consent, we will delete it promptly. Parents or guardians may contact us at privacy@stellreducation.org to review, correct, or request deletion of their child’s information. When a child under 13 creates an account themselves, before a parent consents we collect no more than the child’s name, date of birth, and email address and the parent’s name and email address, and we use them only to seek consent. A child’s credential pages always stay private while the child is under 13: only the child, signed in, and their parent or legal guardian, through the link in the email we send when a credential is issued, can open them (Section 7.4). We do not disclose a child’s personal information to third parties except to the service providers in Section 7.1 that we need to run our programs; we will not disclose it for any other purpose, such as advertising, without the parent’s separate consent.
  • Parent and guardian data: When we ask for consent, we collect the parent or guardian’s full name, email address, phone number and relationship to the student. We use it to obtain and record consent, and as the student’s emergency contact for the event. It is not used for marketing or shared beyond what is necessary.
  • FERPA. We treat the information we hold about students as education records protected by FERPA. When a school registers students, we act as a “school official” under a data processing agreement with the school — our School Data Terms, which the registering teacher accepts on the school’s behalf. When a student joins on their own, we apply the same protections. We use student information only to run our programs and do not disclose it except as FERPA permits or with consent. The signed Participation Agreement is the parent’s (or, for a student aged 18 or over, the student’s) written consent to the disclosures it describes, such as public credential pages and photo and media use. Section 7.7 explains this in full.
  • Self-registration and pending accounts. Students may create a Stellr account themselves. When a Minor does, we ask for their date of birth and their parent’s or legal guardian’s name and email address, and send the parent or legal guardian the Participation Agreement. Until it is signed, the account is pending: we use the information only to seek consent and manage the pending account, the student cannot use the community portal, mentoring, courses, or event registration, no credential page can be made public, and we send the student only messages about the pending account. If consent is not given within 30 days, we delete the pending account and all information collected for it. We may take reasonable steps to confirm that the person consenting is the student’s parent or legal guardian.
  • Students who are adults but still in high school. Students who have reached the age of majority where they live but are still in high school are adults and agree to our terms in their own name. Because we have a duty of care to every high school student, we also require a parent or legal guardian to co-sign the Participation Agreement before the student can take part. By registering, the student authorizes us to share information about their account, consents, and participation with the co-signing parent or legal guardian, and to contact them in an emergency.
  • Students’ own choices (age 13 and over). Students aged 13 or over make their own choices about uses of their information that are not needed to run their account, events, and courses. We use their photos, videos, name, work, and quotes from their survey responses (attributed by first name and last initial, grade, and school or state; anonymous for children under 13) in our promotional materials unless they or their parent or legal guardian opt out, which they can do at any time by emailing privacy@stellreducation.org. Credential pages stay private unless the student chooses to make each one public. A Minor’s parent or legal guardian can always open their credential pages, through the link in the email we send when a credential is issued (Section 7.4). Where state law requires a student’s own agreement first (currently New York and Colorado), these uses stay off for students aged 13 to 17 until the student turns them on. Opting out never affects participation.

3. Information We Collect

We collect the following categories of personal information:

3.1 Identity and Contact Information

  • Full name
  • Email address
  • Phone number
  • Mailing address (where required for in-person events or prize delivery)
  • Discord ‘handle’ (i.e. username)

3.2 Academic and School Information

  • School name and address
  • Year level / grade
  • Teacher or faculty sponsor name and contact details
  • Team or group affiliations

3.3 Account and Login Credentials

  • Username
  • Encrypted password
  • Account preferences and settings
  • Login activity and session data

3.4 Age, Date of Birth and Event Details

  • Date of birth or age range (used for age-group eligibility verification and COPPA compliance)
  • Gender, where a registration form asks for it
  • Ethnicity, where a registration form asks for it. It is used only in totals, to see whether our programs reach a broad range of students, and is never published about an individual
  • T-shirt size, for event shirts

3.5 Health and Medical Information

  • Medical conditions, allergies, or requirements disclosed for in-person event safety purposes (e.g., EpiPen requirements, chronic conditions requiring accommodation)
  • This is sensitive personal information and is collected only when necessary for participant safety
  • It is kept on your member record while you have an upcoming event, and deleted within 90 days after the event unless it is needed for an incident record. You can change or remove it at any time (see Section 8)

3.6 Dietary Requirements

  • Dietary restrictions or preferences disclosed for catered in-person events (e.g., vegetarian, vegan, halal, kosher, nut allergy)
  • Kept on your member record for future events; you can change or remove it at any time

3.7 Billing and Payment Information

  • Competition registration fees: name on card, billing address, and last four digits of payment method
  • Transaction history and payment status
  • Full payment card numbers are never stored by Stellr — payments are processed by Stripe, our third-party payment processor(s)

3.8 Photos and Videos

  • Competition event photographs and recordings in which you may appear
  • Profile photographs uploaded to your account
  • Submitted project videos or presentations

3.9 Technical and Usage Data

  • IP address, browser type, and device information
  • Pages visited and features used within our platform
  • Cookies and similar tracking technologies (see Section 9)
  • The organization — for example a school, district, or company — associated with your IP address. This is inferred on our educator and partner pages only, and only where you have accepted advertising cookies. It tells us that “someone at this school district read our educators page,” not who you are (see Section 9.2)

3.10 Consent Forms, Agreements and Signing Records

  • For a participant under 18: the parent or legal guardian’s full name, email address, phone number and relationship to the student, as provided at registration or in the emergency contact fields
  • The signed document itself — a parental consent form, a participation, mentor or membership agreement — including any choices made on it, such as opting out of photo and media use
  • For every person who signs: their name and email address, the date and time they opened, agreed to sign electronically and signed, the internet (IP) address and browser they used, and the name they typed as their signature
  • A tamper-evident audit trail of each step, and a fingerprint (hash) of the signed document, so a copy can be checked against the original

Forms signed through Stellr’s own signing system are generated and held by Stellr. Forms signed through DocuSign are held by DocuSign, and we keep our own copy of each, including DocuSign’s certificate of completion. A typed signature is stored as text. If you choose to draw your signature instead, we keep the finished picture of it, with the signed form, and nothing about how it was drawn: no timing, pressure or pen-stroke data. Each completed form is sealed with Stellr’s digital certificate and a trusted timestamp; the timestamp service receives only a fingerprint (hash), never the form. Signing records are used only to obtain and prove the signature. They are not used for marketing or analytics.

We also record how the student joined Stellr (school or group registration, or self-registration), the version of the Participation Agreement signed, and, for students who are adults but still in high school, the co-signing parent’s or legal guardian’s name and email address.

3.11 Credentials

  • Credentials we issue to you for completing a course or taking part in an event — the credential title, issue date, credential number, your role, and any award
  • Whether each credential page is private or public, which you control
  • Activity on your credential pages — how many times a page was viewed, and when you used the share, copy-link, or download buttons. We record the action and the time, not who viewed the page. Opening a page from the link in our email is not counted

3.12 Survey and Feedback Responses

  • Answers participants give in Stellr surveys and feedback forms

4. How We Collect Information

We collect personal information in the following ways:

  • Directly from you when you register, create an account, complete forms, or communicate with us
  • From parents or guardians providing consent or registering on behalf of a minor
  • Via electronic consent forms and agreements that parents, guardians, participants, mentors and members sign through Stellr’s own signing system or through DocuSign; for DocuSign, the signed form and its signing record are returned to us when everyone has signed
  • From schools and educators facilitating group registrations
  • Automatically through cookies and analytics tools when you use our platform
  • From payment processors who provide transaction confirmation data

5. How We Use Your Information

We use collected information for the following purposes:

PurposeData Used
Registering and managing competition participationIdentity, school, age, account data
Verifying age eligibility and triggering parental consentDate of birth / age
Obtaining parental consent for minor participants, and agreements from participants, mentors and membersParent/guardian name, email, phone and relationship; participant name, date of birth, school and event details (signed through Stellr signing or DocuSign)
Showing that a signature is genuine, if it is ever questionedSigning records: name, email, IP address, browser, timestamps, audit trail
Managing pending accounts and contacting a parent or legal guardian for consentStudent name, date of birth, and email; parent or guardian name and email
Providing access to the online communityAccount / login credentials
Communicating with participants about competitions and resultsContact information
Ensuring participant safety at in-person eventsMedical requirements (deleted within 90 days after the event) and dietary requirements
Supervision and emergency contact for students attending in-person events without a school groupParent or guardian contact details; name and contact details of a designated responsible adult
Processing registration payments and refundsBilling history
Publishing competition results, photos, and highlightsPhotos, videos, name
Issuing verifiable credentials, emailing a link to the credential (for a Minor, to their parent or legal guardian), and showing a credential page publicly when you choose to (credential pages of children under 13 are never public)Name, credential details, date of birth (to apply the age rules in Section 7.4), email address of the holder or of a Minor’s parent or legal guardian, parental consent record for students under 18
Improving programs, and quoting survey responses in promotional materials (attributed by first name and last initial, grade, and school or state; anonymous for children under 13; subject to opt-out)Survey and feedback responses; first name, last initial, grade, school or state
Improving our Services through analyticsTechnical and usage data
Understanding which schools and organizations are interested in partnering with usTechnical data and inferred organization — educator and partner pages only, with advertising consent
Complying with legal obligationsAll categories as required
Responding to inquiries and support requestsContact information

We do not sell your information to third parties, and we do not use it in automated decision-making that produces legal or similarly significant effects.

We do not use the information you give us — your name, email, registration details, or anything in your account — for targeted advertising. Where you have accepted advertising cookies, we measure our advertising using cookie identifiers only, in aggregate, to understand which campaigns bring people to our programs. Registration and education records are never used for this purpose (see Sections 7.7 and 9).

6. Legal Basis for Processing

We process personal information on the following legal grounds:

  • Consent — for sensitive data (medical, dietary) and for users under 13 (parental consent)
  • Contract performance — to fulfill competition registration and service agreements
  • Legitimate interests — for platform improvement, security, and fraud prevention, where these do not override your rights
  • Legal obligation — to comply with applicable laws including COPPA and FERPA

7. Sharing Your Information

We do not sell, rent, or trade your personal information. We may share information only in the following circumstances:

7.1 Service Providers

We engage trusted third-party vendors to assist in delivering our Services. Our current subprocessors include:

ProviderPurposeData Shared
StripePayment processingName, billing address, payment card data
SupabaseCloud database, file storage and hosting (United States)All account and registration data, signed consent forms and agreements, and their signing records
ClerkUser authentication and identityName, email, login credentials
ResendTransactional email delivery, including requests to sign and copies of signed documentsName, email address, and the content of the email — including the private link to sign or download a document. Signed documents are never sent as attachments
DocuSignElectronic consent for Minors (parent or guardian, and the student where they have reached the age of majority), and other agreements, until our DocuSign contract ends in 2027Student name, membership or event name, parent or guardian name and email, and for students who are adults, the student's email, with the other details pre-filled on the form; DocuSign keeps its own copy of signed forms under its data processing terms
VercelWebsite hosting and delivery, and aggregate page analytics (Vercel Analytics)Usage/technical data, including the internet address and browser of people who sign documents. Page analytics do not run on signing pages
Google WorkspaceStaff email and documents; spreadsheets schools use to send us their group roster; an encrypted backup copy of signed agreementsGroup roster details a school shares (which can include names, dates of birth, health information and emergency contacts). Backup copies are encrypted before they leave our systems, with a key Google does not hold
CheckrBackground checks for adult mentors and volunteersName and email, and the details you give Checkr directly
PrintfulMaking and shipping orders from our online storeName and delivery address for your order
DiscordCommunity chat, for members who choose to join itYour Discord username and what you post there
Timestamp authority (from mid-October 2026)Adding a trusted timestamp to signed agreementsA one-way fingerprint (hash) of the document only — no personal information
SanityContent managementNo personal data
HubSpotMarketing contact management and inquiry handlingName, email, and the inquiry you submitted
Google (Analytics, Tag Manager, Ads)Aggregate website analytics; advertising measurement where you have accepted advertising cookiesUsage/technical data and cookie identifiers — no name, email, or registration data. Not loaded on signing pages or on private payment and join links
Meta and LinkedInAdvertising measurement, configured within Google Tag Manager, only where you have accepted advertising cookiesCookie identifiers and pages visited — no name, email, or registration data. Not loaded on signing pages or private links
Apollo.ioIdentifying the organization associated with visitors to our educator and partner pages, where you have accepted advertising cookiesIP address, cookie identifiers, and the pages visited — no name, email, or registration data; not loaded on student registration pages or the participant platform. Governed by Apollo's standard Data Processing Addendum, linked below

All providers are contractually required to handle your data securely, use it only as directed by us, and not disclose it to third parties for their own commercial purposes. Data processing terms apply to each provider in one of two ways: an agreement executed directly between that provider and Stellr, or the provider’s own standard data processing addendum, which governs our use of their service. Where the arrangement is specific to Stellr, the table above says so.

Two providers are worth naming directly. Our business-audience provider Apollo.io operates under its standard GDPR data processing addendum, published at apollo.io/dpa. DocuSign handles the forms signed through it under its standard data processing terms; when our DocuSign contract ends, it will no longer receive new information from us. If we add a provider that receives personal information, we will add it to this table before it does.

7.2 Schools and Educators

With the school or teacher who registered a student, limited to information relevant to competition participation (e.g., registration status, results).

7.3 Competition Partners and Sponsors

Competition results, participant names, and school affiliations may be shared with co-organizing institutions or sponsors where you have been notified and consented at registration.

7.4 Public Recognition and Credentials

Unless you opt out, competition results, names, school affiliations, and photographs may be published on our website, social media channels, or press releases. For participants under 18, the parent or guardian consent form includes our photo and media permission, with a box to opt out; opting out does not affect participation. We do not publish identifiable photographs or video of a participant whose parent or guardian has opted out, and anyone can ask us to remove a photograph at any time. Students aged 13 or over can also opt out themselves, and students aged 13 to 17 in New York and Colorado are opted out until they opt in (Section 2).

Credential pages. When you complete a Stellr course or take part in a Stellr event, we issue a verifiable credential with its own web page showing your name, the credential title, the issuing program, the issue date, and a credential number. Every credential page is private by default. You choose whether to make it public, and you can make it private again at any time from your Stellr account. Once a page is public, anyone with the link can view it. Credential pages are not submitted to search engines.

Who can see a private credential page. A private page can be opened only by its holder, signed in to Stellr; by Stellr staff who run our programs; and by anyone who opens it from the link in the email we send when the credential is issued. For a Minor, that email goes to their parent or legal guardian, with a copy to the student when we have the student’s email address. The emailed link opens a read-only view of the page: it shows the holder’s name and the credential, but no sharing controls, and it is not listed anywhere or submitted to search engines. The link does not expire, and anyone who has it can open the page, so please do not forward that email. If you think the link has reached someone it should not have, contact privacy@stellreducation.org.

Sharing on LinkedIn. From a public credential page you can choose to add the credential to your LinkedIn profile or share it in a LinkedIn post. Stellr does not connect to your LinkedIn account and does not send your information to LinkedIn. The buttons open LinkedIn with the credential details filled in, and you decide whether to save or post them. When a credential page is shared, LinkedIn reads that public page, including your name and the credential image. LinkedIn requires its members to be 16 or older, so these buttons are not shown to anyone under 16.

Once shared, it is out of our hands. After you add a credential to LinkedIn or share it there, what happens to that information is governed by LinkedIn’s terms and privacy policy, not ours. Stellr cannot control, change, or remove what LinkedIn — or anyone who has seen or copied the post — does with it, and LinkedIn may keep its own copy of the post preview. Making the page private, or asking us to revoke or erase a credential, changes the page on our site: it stops showing your name and shows the credential as private, revoked, or withdrawn, so that anyone checking the link is not misled. To remove a LinkedIn profile entry or post, delete it on LinkedIn.

Students who are Minors. Permission for a Minor to make credential pages public is part of the Participation Agreement their parent or legal guardian signs. Parents and guardians may decline, or withdraw permission at any time by contacting privacy@stellreducation.org, and any public pages are made private. Credential pages of a child under 13 always stay private, and no credential page can be made public while an account is pending consent. A parent or legal guardian can always open their child’s private credential pages from the link in the email we send them, whether or not the pages are public.

7.5 Legal Requirements

We may disclose information when required by law, court order, or to protect the safety of participants or the public.

7.6 Business Transfers

In the event of a merger, acquisition, or transfer of assets, personal information may be transferred to a successor organization, subject to the same privacy protections described here.

7.7 FERPA — Education Records

We treat the information we hold about students as education records protected by FERPA, however it reaches us:

  • From a school or teacher registering a group. We act as a “school official” under a data processing agreement with the school: our School Data Terms, which the registering teacher accepts on the school’s behalf, or the school’s own agreement where it has one. We use that information only to run the competition, never for advertising, profiling or product development, and we do not disclose it to anyone else except as FERPA and the agreement allow (for example, to the providers in Section 7.1 that host our services). We delete it within 30 days of the school’s request, or sooner if the school’s agreement requires.
  • From a parent, guardian or student directly, including everything on a signed consent form or agreement. We apply these protections to all student information on our platform, including for students who join on their own without a school. After a deletion request, we keep only the minimal signed-agreement record described in Section 10.
  • Schools and parents may exercise their rights by contacting us at privacy@stellreducation.org.

8. Sensitive Information

We treat the following categories as sensitive and apply heightened protections:

  • Medical and health information — collected solely for participant safety; accessible only to staff with a direct need; never shared with sponsors, partners, or the public; deleted within 90 days after the event unless it is needed for an incident record. You can change or remove it sooner at any time in your account, or ask us to delete it
  • Dietary requirements — used only for event catering, and kept under our standard retention periods (Section 10); you can change or remove it at any time
  • Signing records — the internet address and browser recorded when you sign are used only to show the signature is yours; never used for analytics or advertising
  • Date of birth — used for eligibility and COPPA compliance; not displayed publicly
  • Payment data — handled exclusively by our payment processor Stripe; Stellr retains only transaction confirmations and last-four-digit references

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Keep you logged in to your account
  • Remember your preferences
  • Collect aggregate analytics on how our platform is used
  • Measure whether our advertising reaches the students, families and educators it is meant to reach — only if you accept advertising cookies
  • Recognize which schools, districts and organizations are reading our educator and partner pages, so we can follow up with those exploring a partnership — only if you accept advertising cookies

9.1 Categories We Use

CategoryPurposeConsent
EssentialLogin sessions, security, and core site functionAlways on — the site cannot work without these
AnalyticsAggregate usage measurement (Google Analytics, HubSpot)On by default; denied until you accept in the UK, EEA and Switzerland; limited for children under 13 (Section 9.4)
AdvertisingCampaign measurement and remarketing (Google Ads, Meta, LinkedIn); business-audience identification on educator and partner pages (Apollo.io)Off until you accept; never for students or children under 13 (Section 9.4)

9.2 Business-Audience Identification

Stellr works with schools, districts, universities, and sponsoring organizations as well as with students. To understand which of those organizations are interested in partnering with us, we use Apollo.io on our educator and partner pages. It matches the IP address a visit comes from against a database of business networks and tells us the organization that address belongs to.

We want to be precise about the limits of this:

  • It identifies organizations, not people. It tells us that someone at a given school district or company visited a page. It does not tell us your name, your email address, or anything about you as an individual, and we do not attempt to combine it with registration data to work out who you are.
  • It runs on a limited set of pages only — our educator, host-an-event, mentor, network, volunteer, impact, and why-Stellr pages. It is not loaded on competition registration pages, on the participant platform, or anywhere a student is signing up or logged in.
  • It requires your consent. Apollo.io is an advertising-category cookie and does not load at all until you accept advertising cookies. If you decline, or later withdraw, it is never loaded.
  • Home and school networks are generally not identifiable in this way. The matching relies on business network records, so most residential connections return no organization at all.

9.3 Your Choices

When you first visit, we ask whether to enable advertising cookies. Until you accept, advertising and remarketing tags are disabled — we use Google Consent Mode, so the choice is enforced on the tags themselves rather than only recorded.

You can change your mind at any time. Select Cookie settings at the bottom of any page to reopen the banner and turn advertising cookies on or off. Withdrawing takes exactly as many clicks as giving, and takes effect immediately — no further advertising data is sent from that point, and on your next visit those tags do not load at all.

We do not sell your personal information, and we do not use advertising cookies to build profiles of individual students. Advertising measurement is used to understand which campaigns bring people to our programs in aggregate. Disabling non-essential cookies does not affect your ability to register for or take part in any Stellr event.

9.4 Students, and Children Under 13

Advertising cookies and tags (including Google Ads remarketing and Apollo.io) are never loaded on registration pages, on the participant platform, or for any signed-in student, whatever the cookie settings. For a child under 13, this applies even if “Accept” was selected in Cookie settings, because a child cannot give that consent. For children under 13 we use analytics only to operate, secure, and improve our Services, as COPPA permits for the support of internal operations, and never to build a profile of the child, to target advertising, or to share identifiers with third parties for those purposes.

10. Data Retention

This section is our written data retention policy, including for personal information collected from children under 13 (16 CFR 312.10). We keep student information for the duration of membership and for seven years after an account is deactivated so that we hold a record of consents and participation if questions or claims arise after a student leaves, and so that we can verify credentials we have issued. When a retention period ends, we securely delete the information. A school, parent, guardian, or student may ask us to delete it sooner (Section 12). We delete it within 30 days of the request, or sooner if a school’s agreement with us requires it. We keep only a minimal record of the signed Participation Agreement (the names of the student and signers, the dates, and the signed document) until seven years after the account is deactivated, so that we can show what was agreed if a question or claim arises later. The parent or legal guardian (or adult student) consents to us keeping this record when they sign.

We retain personal information only as long as necessary:

Data TypeRetention Period
Account and competition recordsDuration of membership + 7 years after deactivation (all ages, including under 13)
Pending accounts with no parental consentDeleted within 30 days of registration
Medical information90 days after the event, unless needed for an incident record. You can remove it sooner at any time
Dietary informationSame as account and competition records, so it is ready for future events. You can remove it at any time
Payment transaction records7 years (US tax/accounting requirements)
Signed consent forms and agreements, and their signing records (names, emails, internet address, browser, timestamps, audit trail)Duration of membership + 7 years after deactivation. After a deletion request, only the minimal signed-agreement record is kept, restricted so it can be produced if a claim is made and used for nothing else
Encrypted backup copies of signed agreementsDeleted with the original. Our nightly encrypted database copies, which may also contain it, are each kept for 30 days
Requests to sign that are never completedCanceled 30 days after the last signing link we sent, and everything entered on the form (including any partial signature) deleted then; the request itself is deleted with the participant record
Data subject to a deletion request (school, parent, or student)Deleted within 30 days of the request (sooner if a school's agreement requires), except the minimal signed-agreement record
Parent/guardian contact informationDuration of account, or until the associated minor participant record is deleted. The copy within a signed consent form is kept with that form
Profile photosSame as account and competition records
Event photos and videosUntil removal is requested; reviewed every 2 years, and deleted when no longer needed
CredentialsDuration of account. If you ask us to erase your data, the credential number is kept so a copy can be checked, but your name is removed and the page shows the credential as withdrawn
Credential page activity (views and share clicks)Duration of the credential; deleted with it
Survey and feedback responsesSame as account and competition records
Technical/usage logsGenerally 12 months, with minor exceptions on a platform-specific basis

You may request earlier deletion subject to Section 12.

11. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information, including:

  • Encryption of passwords and sensitive data at rest and in transit (TLS/SSL)
  • Restricted staff access on a need-to-know basis
  • Signed documents are kept in private storage and can be opened only through a link that expires within minutes, issued after we check who is asking. Every time a signed document is opened, we record who opened it
  • Each signing step is written to an audit trail that cannot be edited, where every entry carries a fingerprint of the one before it, so any change would show
  • Pages reached through a private link (to sign, pay or join) load no analytics or advertising tags
  • Regular security reviews of our platform
  • If a data breach affects you, we will tell you without unreasonable delay and as applicable law requires (for Colorado residents, within 30 days of determining the breach), and tell any school whose students are affected as our School Data Terms require

Our main database and file storage are in the United States.

No system is completely secure. If you believe your account has been compromised, contact us immediately at privacy@stellreducation.org.

12. Your Rights

All Users

  • Access — request a copy of personal information we hold about you
  • Correction — request correction of inaccurate information
  • Deletion — request deletion. We delete within 30 days, keeping only the minimal signed-agreement record described in Section 10
  • Paper copies — sign on paper instead of electronically, or ask for a paper copy of anything you have signed, at no cost
  • Withdrawal of consent — withdraw consent for processing based on consent (e.g., for publication of photos)
  • Credential privacy — make any credential page private at any time from your Stellr account
  • Opt-out of communications — unsubscribe from non-essential emails at any time

To make a request, use our privacy request form or email privacy@stellreducation.org. We email a link to the address you give, to confirm the request came from you, and answer within 30 days of confirmation. Requests never confirmed are deleted after 30 days; we keep a record of how each confirmed request was answered for 3 years.

Parents and Guardians (COPPA Rights)

  • Review personal information collected from your child under 13
  • Request correction or deletion of that information (only the minimal signed-agreement record is kept, as described in Section 10)
  • Withdraw consent you have given, including to photo and media use
  • Refuse further collection or use of your child’s information
  • Decline public credential pages for your child who is a Minor — any pages already public are made private (see Section 7.4). You can still open them from the link in the email we send when a credential is issued
  • Contact us at any time: privacy@stellreducation.org

For a student who has reached the age of majority but is still in high school, the student exercises these rights in their own name. Their co-signing parent or legal guardian receives the information the student has authorized us to share (Section 2).

FERPA Rights

Parents of students who are Minors under the age of majority, and adult students, may exercise these rights directly with us, including where the student joined Stellr on their own. Schools and educators may exercise them for students they registered.

Schools whose students’ education records are processed by Stellr have the right to:

  • Inspect and review the records the school shared with Stellr about its students
  • Request correction of inaccurate records
  • Request deletion of those records. We delete within 30 days, or sooner if the school’s agreement requires, keeping only the minimal signed-agreement record described in Section 10
  • Receive a copy of our School Data Terms and of our list of providers (Section 7.1)

Contact us at privacy@stellreducation.org with the subject line FERPA Request.

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act:

  • Right to know what personal information is collected, used, shared, or sold
  • Right to delete personal information
  • Right to opt out of the sale or sharing of personal information. We do not sell personal information. Where you have accepted advertising cookies, technical identifiers may be disclosed to our advertising and business-audience providers in a way that CPRA treats as “sharing” for cross-context behavioral advertising. You can opt out at any time by selecting Cookie settings at the bottom of any page
  • Right to non-discrimination for exercising your privacy rights
  • Right to correct inaccurate personal information
  • Right to limit use of sensitive personal information

To exercise any of these rights, contact privacy@stellreducation.org. We will respond within 45 days.

13. Third-Party Links

Our platform may contain links to third-party websites or resources (e.g., partner organizations, competition hosts) and to LinkedIn, where you can choose to add or share a credential (see Section 7.4). We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version on this page with an updated “Last Updated” date and a notice at the top of the page summarizing what changed. Except as described below, we give notice of changes on our public website only; we do not send notice by email. Please check this page from time to time. Continued use of our Services after a change is posted constitutes acceptance of the updated Policy.

If a change materially affects how we collect, use, or disclose the personal information of a Minor whose parent or legal guardian has consented, including any child under 13, we will email the parent or legal guardian and obtain new consent before the change applies to that student. Continued use alone is not treated as consent for these changes.

15. Contact Us

For questions, concerns, or to exercise your privacy rights, please contact:

Stellr Education — Privacy Team
Email: privacy@stellreducation.org

For urgent concerns involving a minor’s data, please mark your email URGENT: Minor Data.

We use essential and analytics cookies to run this site. With your permission we'd also use advertising cookies to measure our campaigns. Read our privacy policy.