ComplyEQ General Privacy Policy

Last Updated: August 05, 2026

We at Everfi, LLC (“,” “we,” “us,” “our”) care about you (“you,” “user,” “learner,” and/or “business professional” as appropriate) and how your personal information is used and shared. We take your privacy seriously and are committed to creating a safe and secure environment for learners of all ages. This Policy is designed to help you understand what information we collect, why we collect it, and what we do with it. Thank you for taking the time to carefully read it.

1. About Everfi

Everfi is a leading critical skills education company. We empower learners of all ages with the skills necessary to be successful in life and work.

Scope and Applicability of This Policy

Everfi offers multiple products and services across different operational contexts. The role we play with respect to your personal information depends on which product or service you are using and, in some cases, on the agreement between Everfi and the school, employer, or other organization through which you access our services.

When we decide how and why your personal information is collected, used, and shared, we are acting as the “data controller.” In those situations, the law may require us to give you this Privacy Policy and to handle any requests you make to access or manage your personal information. However, in some cases, we handle your personal information on behalf of another organization. When we do this, we are acting as a “data processor,” and the other organization is the “data controller.” The Policy does not cover our data practices when we act as a “data processor” because we aren’t in control of your data or responsible for managing your data rights. In such cases, if required by law, we will identify that organization upon your request so you can review its privacy policy and contact it directly to exercise your data rights.

In sum:

Where we provide our K-12 Learning Platform, whether we are the processor or the controller will vary according to the specific K-12 districts that we have contracted with.
When we provide our White-Labeled Financial Education and ComplyEQ Training, Everfi acts as a data processor on behalf of the financial institution, employer, or other customer providing the training.
We act as the data controller for all data collected through our marketing websites, including https://everfi.com/ and https://complyeq.com.
In this Policy, when we refer to our “Services”, we mean those websites, platforms, and services that manage as a data controller and not those where we only act as a data processor.

2. Personal Information We Collect

Everfi’s digital learning platform offers educational courses on different critical skills in the K-12, Higher Education, and Adult markets. We may collect information about you directly from you and automatically through your usage of our platforms.

Information We Collect:

Where you register with us, or communicate to us, depending on the Service, we may collect the following information:

Contact information and common identifiers: such as name, address, and email address;
Login details: including username and password;
Preferences: Based on user-specific implementations and information about user activities within the Service, including information about the content modules a user views, starts or finishes (including data and time stamps), assessments or scores, and related information, and other information about a user’s activities and use of the Service in order to ensure our digital learning is appropriately teaching the desired critical skill;
User-generated content information. When you communicate with us, either by email, phone, or other means of communication, we also may collect the content of these communications, including but not limited to recordings of phone calls where permitted by law.

With respect to our K-12 market, we may also collect the following data:

Date of birth (to support COPPA compliance and related regulations), which is only stored as an over/under applicable age flag within Everfi’s system;
First name and first initial of last name (for under 13);
First name and last name (for over 13);
Email address (only for over 13);
Employment details including information about a user’s employment or educational role, company details, school or organization name, and details of whether an individual is an educator;
Home state or province or postal code which may be used to locate your school or other educational opportunities in your area.

With respect our ComplyEQ offerings, we may also collect the following data:

Employment details including information about a user’s employment, company details, hire date, roles and responsibilities which may be used to help customers ensure alignment with training mandates and other regulatory compliance activities.

With respect to our white-labeled financial education offerings, we may collect the following data:

Demographic information: For example where an offering asks an individual to specify a banding of credit score rating for financial health courses, or asks an individual to specify income level or postal code;
Employment details: including information about a user’s employment or educational role, company details. This may reveal general salary bandings based on industry knowledge;
Financial information. Financial information, such as your payment information (credit card information), bank account information, investments, income, expenses, assets, liabilities, financial goals, investing risk tolerance or other similar types of information about your job or business.

With respect to our marketing websites, we may collect the following data:

Inferences about customer preferences and characteristics. We may infer from information provided by you, information collected directly from your browser or device, or from information obtained from third-party marketing database partners.
Employment details including information about a user’s employment, company details, roles & responsibilities which may be used for providing access to requested resources, responding to inquiries, understanding and categorizing interest in Everfi’s products and services, tailoring relevant business communications, and supporting sales, marketing, sponsor engagement, and customer relationship activities.

Everfi educational assessments and surveys may ask questions based on race, ethnicity, and/or sexual preference. This information is considered a “sensitive” or “special category” data under applicable privacy laws; therefore we will only collect it where you choose to provide this information and consent to us receiving it — the questions are always optional.

When we receive the surveys, we take steps to fully de-identify it and will only share responses on a fully de-identified and aggregated basis. In our K-12 and Higher Education markets, Everfi extracts any personal information from survey data before analyzing such data in an aggregated research setting. We will only maintain and use deidentified information in deidentified form and we will not attempt to reidentify this information, except for the purposes of validating our deidentification process.

In our K-12 market, protecting the privacy of our younger learners is extremely important to us. To review our COPPA Privacy Policy, which applies to the personal information we knowingly collect from children under 13, please go to https://everfi.com/privacy-policy/coppa-policy/. Where we make courses available to children under the age of 13 in Europe or the United Kingdom, we will only do so where we have obtained parental or guardian consent (which may be managed by your school/educational organization). For children under 13 using our learning platform, we generally collect only the learner’s first name, the initial of the learner’s last name, and information about course progress, unless additional information is provided by a parent, legal guardian, school, or other authorized adult for a separate program, such as a scholarship, grant, award, savings contribution, or similar educational opportunity.

Everfi does not sell or share for purposes of targeted advertising any personal information collected through the K-12 Learning Platform, the white-labeled financial education platform, or the corporate compliance training platform. Everfi does not use student data to create student profiles or perform any other type of data mining that might result in damaging or discriminatory representations of student ability.

With respect to the marketing website (everfi.com), Everfi uses third-party advertising and analytics technologies that may collect online identifiers (including IP address, device identifiers, and cookie identifiers) and disclose them to third parties. These technologies do not load until the website visitor provides consent through our cookie consent banner. Some of these disclosures are considered a “sale” of personal information, “sharing” for cross-context behavior advertising or use for purposes of targeted advertising” under California and other state privacy laws, even though no money is exchanged. You may refuse consent, withdraw consent at any time, or exercise your opt-out rights as described in Section 9. Everfi does not engage in any sale or sharing of personal information for targeted advertising if it has knowledge that the individual is under sixteen years of age, such as in regard to individuals utilizing the K-12 Learning Platform or other similar platform contexts.

With respect to the marketing website, third-party advertising and analytics technologies (where loaded with consent) may infer approximate location from IP address.

Scholarship, grant, award, and contribution application information:

Where Everfi offers or supports educational scholarships, grants, awards, savings contributions, or related programs for students or families, we may collect information needed to submit, evaluate, verify, administer, fund, and report on an application or award. This may include student information, parent or guardian information, school or educational information, eligibility information, application responses, supporting materials, and financial, tax, account, or contribution-related information where required for the specific program.

For students under 13, we do not ask the student to provide scholarship, grant, award, or contribution application information directly. A parent, legal guardian, school, or other authorized adult must provide any required information on the student’s behalf, including any required parent or guardian personal information.

Information Business Professionals May Provide:

If you want to request a demo of any Service and/or have a conversation with one of our product experts to learn how Everfi can power your education initiatives, you can provide us with:

Contact Information: first name, last name, email address, phone number;
Job Details: job title and a note of which industry you are in;
Communications preferences.

Information Obtained from Third Parties/Public Sources:

We use third party service providers to enhance and enrich our marketing database of business professionals who have requested further information on our products. They may use information that is made public by you for example via LinkedIn. On the marketing website, where the visitor consents, we may also use B2B identification and intent-data services to identify the organization associated with a visitor and provide context to our sales team. These services do not identify individual visitors by name without separate consent.

We do not obtain or use any identifiable information about children for marketing purposes.

Information We Collect Automatically

We collect information automatically about users via a variety of methods, such as cookies, web beacons, JavaScript, and log files. This information may include user IP addresses, browser types, domain names, device type, time stamp, referring URL and other log file information; user activities within the Service; aggregate and statistical information regarding overall server/visitor traffic and navigation patterns for the Service. Web servers collect this type of basic information automatically as part of Web log processes. Online identifiers such as IP addresses, device identifiers, and cookie identifiers are not anonymous under most applicable U.S. state privacy laws and are treated as personal information. For more information, see the “How We Use Cookies, Analytics, and Advertising Technologies ” section below.

3. How We Use Personal Information

Everfi generally uses the information we collect as follows:

To provide the Service directly to learners (where applicable).
To create log-in details for learners (where we are contracting with a sponsoring organization such as a financial institution or higher education institution i.e. a university), to communicate with you about your use of the Service (including via email); to respond to your inquiries; to send you surveys; to fulfill your requests; and for other customer service or internal purposes.
To troubleshoot any technical issues you might experience while using our Service.
To administer scholarship, grant, award, savings contribution, or similar educational opportunity programs, including to receive and review applications, confirm eligibility, communicate with applicants, parents, guardians, schools, sponsors, program administrators, or service providers, process or facilitate awards or contributions, maintain records, prevent fraud or misuse, comply with legal and tax obligations, and prepare reporting related to program participation and outcomes.
To send you communications about digital courses, services and other information we think may interest you. Where you are a business professional who has requested further information on our products, we may also enrich our marketing database using publicly available information to tailor our communications and ensure these are relevant to your industry and of interest to you.
To better understand how users access and use our Service, in order to improve our Service, to respond to user desires and preferences, and for other research and analytical purposes.
To develop aggregated reports and related analysis regarding user activities.
To tailor the educational content and information that we may send or display to you, to offer personalized help and instructions, and to otherwise personalize your learning experience while using our Service.
To comply with applicable legal obligations, including responding to a subpoena or court order.
Where we believe it is necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of our Terms of Use or this Policy.
On the marketing website only, where you have provided consent through our cookie consent banner: to deliver and measure the effectiveness of online advertising; to understand visitor engagement with our marketing content; and to identify the business or organization with which a visitor is associated for purposes of business-to-business outreach.

Aggregate and De-Identified Information.

We may also provide aggregate, anonymous and/or de-identified information about users and the Service for marketing and research purposes. For example, we might inform third parties regarding the number of unique users who visit the Service, the demographic breakdown of our registered users of the Service, and the educational progress of categories of users.

4. Disclosing Personal Information to Third Parties

With respect to the marketing website, please see Section 2 above and Section 5 below for a description of advertising and analytics technologies that operate on the marketing website with your consent, and that are considered a “sale” of personal information, “sharing” for cross-context behavior advertising or use for purposes of “targeted advertising” under California and other state privacy laws.

We disclose the information we collect about you with the following third parties for the following business purposes:

Authorized Entities.

If you access the Service through, or are granted access to the Service by, a school, school district, college, university, person, institution, employer, or other organization (an “Authorized Entity”), we will share the information we collect about you with the Authorized Entity or its representatives. Such information may include: course progress/completion; assessment scores; email address; user ID/identifying tag or username (if applicable); additional aggregated data the Authorized Entity requests.

Social Media Sharing.

If a user chooses to share information such as assessment scores through social media outlets, such as Facebook and Twitter, third parties may receive information about a user’s performance on the Service, such as information about digital learning badges and prizes received in connection with the Service.

Third-Party Sponsors.

In the K-12 market and, in certain instances, the Higher Education market, Everfi works with third-party sponsors to bring the Service to some users free-of-charge. In such situations, Everfi will only share anonymized and/or aggregated user information with those third-party sponsors. This may include aggregated and/or anonymous demographic and geographic profiles to demonstrate the learning progress of these categories of Service users. Student information is only shared with third-party sponsors upon parental consent.

Scholarship, Grant, Award, and Contribution Program Partners.

Where Everfi offers or supports a scholarship, grant, award, savings contribution, or similar educational opportunity program, we may disclose application and eligibility information to the sponsor, program administrator, financial institution, trustee, custodian, school, service provider, government entity, or other authorized party involved in reviewing, verifying, funding, administering, reporting on, or complying with legal obligations related to the program. For students under 13, any required consent or authorization will be obtained from a parent, legal guardian, school, or other authorized adult, as applicable.

Legal Disclosures.

We may disclose a Service user’s information (including personal information) where we believe that we are required to do so in order to comply with an applicable statute, regulation, rule or law, a subpoena, a warrant or administrative request, a court or regulatory order, or other valid legal processes. We may also disclose personal information where we believe it is necessary to identify, contact or bring legal action against someone who may be violating the Terms of Service for our Service, to detect fraud, for assistance with a delinquent account, as evidence in litigation in which we are involved, or to protect the safety and/or security of our users, the Service or the general public.

Service Providers.

We may disclose your information to third-party service providers to support our internal and business operations. In such cases, service providers may use the information only as necessary to provide the services to us and are contractually required to keep your information confidential and secure. They are required to implement reasonable privacy and information protection controls to maintain the privacy and security of information provided to them consistent with the privacy practices outlined in this Privacy Policy. We use service providers, for example, in the following circumstances:

For website, application development, hosting, data storage, maintenance, and other services for us.
For internal marketing, delivery of emails, including promotional, marketing and transactional materials, delivery of other promotional materials, including via postal mailers, SMS and text messaging, and online and social media promotions and advertising.
For fraud prevention and security purposes.

Business Transfers.

We reserve the right to transfer information (including personal information) to a third party in the event of a sale, merger or other transfer of all or substantially all of the assets of Everfi or any of its Affiliates (including as part of a bankruptcy proceeding). We may disclose personal information about Service users to our affiliated companies. Our affiliates’ use of your personal information will be in accordance with the terms of this Privacy Policy.

International Transfers.

Everfi is a U.S. company and the information we collect will be transferred to, stored and processed in the U.S., as well as other international locations where we have affiliates and service providers. The U.S. and other jurisdictions to where we transfer your information may not offer an equivalent level of data protection as in your home country. As a result, where the personal information that we collect through or in connection with the Service is processed in the United States or collected directly by EverFi, LLC in the U.S., we will take steps to ensure that the information receives the same level of protection as if it remained within your home country. Specific information about international transfers applicable to Canadian residents is provided in Section 10.

Advertising and Analytics Partners (Marketing Website Only).

On the marketing website (everfi.com), and only where the visitor has provided consent through our cookie consent banner, we use third-party advertising and analytics technologies. These partners receive online identifiers (such as IP address, cookie identifiers, and device identifiers) and information about the visitor’s interaction with the marketing website. A list of categories and named technologies is provided in Section 5 As described in Section 9, you may opt out of these disclosures at any time.

5. How We Use Cookies, Analytics, and Advertising Technologies

This Section describes our use of cookies, analytics technologies, and (with respect to the marketing website only) advertising technologies. Our use of these technologies differs significantly between the marketing website and our platform services. Please read this Section carefully.

Marketing Websites

On the marketing website, we operate an opt-in consent model. When you first visit the marketing website, a cookie consent banner is displayed. No analytics or advertising technologies will load or transmit data to third parties until you provide consent through the banner. You may also use the banner’s preference settings to consent to some categories (such as analytics) but not others (such as advertising), or to refuse all non-essential technologies.

We honor the Global Privacy Control (“GPC”) signal in your browser as a request to opt out of the sale or sharing of personal information for purposes of targeted advertising, in accordance with applicable U.S. state privacy laws.

The categories of technologies used on the marketing website include:

Strictly Necessary. Technologies required for the website to function, such as session management and security. These are required for the website to operate properly and cannot be disabled.
Preference. These technologies are used to remember information you have entered or choices you make (such as your username, language or your region) on the website. They also store your preferences when personalizing the website to optimize your use of the website. These preferences are remembered, through the use of the persistent technologies, and the next time you visit the website you will not have to set them again.
Analytics. These technologies that help us understand how visitors interact with the marketing website, including Google Analytics and HubSpot analytics. These technologies do not load until you provide consent.
Advertising. These technologies are placed by us and third party advertising platforms or networks in order to deliver ads, track ad performance, and enable advertising networks to deliver ads that may be relevant to you based upon your activities (this is sometimes called “behavioral” tracking or “targeted” advertising) on our marketing website. They may subsequently use information about your visit to target you with advertising that you may be interested in. These may include pixels and tags from Meta (Facebook), LinkedIn, TikTok, Pinterest, Microsoft (Bing), Google Ads (DoubleClick), The Trade Desk, and LiveRamp. These technologies do not load until you provide consent. The disclosure of online identifiers to these third parties is a “sale” of personal information and “sharing” for purposes of cross-context behavior advertising or “targeted advertising” under California and other U.S. state privacy laws; you may opt out of these disclosures at any time using the cookie consent banner or the methods described in Section 9.
Business-to-Business Identification. Technologies that identify the organization associated with a marketing-website visitor. These technologies do not load until you provide consent.
Embedded Media. Technologies that enable embedded video and chat features on the marketing website (such as Vimeo). These technologies may be classified as functional or analytics depending on their configuration; refer to the cookie consent banner for current categorization.

If you would like to exercise any of the rights described in this Policy in connection with the marketing website, please see Sections 9 and 10 below or visit our “Your Privacy Choices” page at https://everfi.com/data-subject-rights-request/.

Platform Services (K-12 Learning Platform; White-Labeled and Corporate Platforms)

Our-K-12 platform and ComplyEQ offering services do not present a cookie consent banner because they do not load advertising technologies. Our platform services use only essential, functional, and analytics technologies. Everfi does not load Google Analytics, advertising pixels, or session-replay technologies in these learner experiences.

On our white-labeled financial education platform, our customer may implement tag manager solutions (e.g. Google Tag Manager). Those solutions are not loaded until consent is provided. Our agreements with these customers restrict their use of platform user information to the purposes for which we engage them and prohibit secondary use, sale, or retention of personal information beyond the scope of our engagement, as required under applicable U.S. state privacy laws.

Where Everfi acts as a data processor for a school district or customer, the controller determines the use of analytics technologies on the platform.

Cookies

We use cookies to track visitor activity on our marketing site. A cookie is a text file that a website transfers to your computer’s hard drive for record-keeping purposes. We, and our service providers, use cookies to track user activities on our Service, such as the pages visited and time spent on our Service. Most browsers allow users to refuse cookies. but some of our Services will not function properly with cookies disabled.

You can control and delete cookies through your browser settings through the following:

You can also opt-out of cookies by:

visiting the Network Advertising Initiative (NAI) website opt-out page: http://www.networkadvertising.org/choices;
visiting the Digital Advertising Alliance (DAA) opt-out page: http://www.aboutads.info/; and
downloading and installing the Google browser plug-in from the following link: http://tools.google.com/dlpage/gaoptout.

Please be aware that restricting cookies may impact the functionality of the marketing site. For example, refusing cookies will not allow us to present the marketing site in your preferred language or remember your log-in information. Additional general information about cookies, including how to be notified about the placement of new cookies and how to disable cookies, can be found at www.allaboutcookies.org.

Alternatively, you may visit the U.S. Federal Trade Commission’s website www.consumer.ftc.gov to obtain comprehensive general information about cookies and how to adjust the cookie settings on various browsers.

Global Privacy Control is described in the Marketing Website subsection above.

Local Shared Objects

We may use local shared objects (“LSOs”), such as Flash LSOs to store your preferences and to personalize your visit. LSOs are different from browser cookies because of the amount and type of data stored. Typically, you cannot control, delete, or disable LSOs through your web browser. For more information or to learn how to manage your Flash LSO settings, go to the Adobe Flash Player Help Page, choose “Global Storage Settings Panel” and follow the instructions.

Clear GIFs, pixel tags and other technologies

Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your computer’s hard drive, clear GIFs are embedded invisibly on web pages and cannot be disabled through your browser. We may use clear GIFs (a.k.a. web beacons, web bugs or pixel tags), in connection with our Service to, among other things, track the activities of users, help us manage content, and compile statistics about usage. We, and our service providers may also use clear GIFs in HTML emails to our customers to help us track email response rates, identify when our emails are viewed, and track whether our emails are forwarded.

Third-Party Analytics

From time to time we may use various tools to evaluate usage of our Service. We use these tools to help us improve our services, performance, and user experiences. These entities may use cookies and other tracking technologies to perform their services. By way of example, Google Analytics is one of the tools we may use. To learn more about Google’s privacy practices, please review the Google privacy policy at https://www.google.com/policies/privacy/. You can also download the Google Analytics Opt-out Browser Add-on to prevent their data from being used by Google Analytics at https://tools.google.com/dlpage/gaoptout. For a complete description of the analytics technologies used on the marketing website and on our platform services, please refer to the subsections above.

6. How We Link and Interact with Other Websites

Our Service may contain links to other websites not owned or operated by Everfi, and may provide Service users with access to other websites and services. This may include providing users with the ability to share and automatically post updates (including updates about badges and prizes received in connection with the Service) through social media outlets, such as Facebook and Twitter. Please be aware that we are not responsible for the privacy practices of such third-party websites or services and any access to and use of such linked websites is not governed by this Policy. We encourage you to read the privacy policies or statements of each and every website you visit.

7. How We Protect Personal Information

Everfi implements reasonable and appropriate physical, administrative and technical safeguards to help us protect your personal information from unauthorized access, use and disclosure, and to maintain accuracy and ensure the appropriate use of your information. Everfi conducts vulnerability and penetration security testing. Where appropriate, these safeguards include encryption — Everfi uses TLS encryption for data transfers. However, no data transmissions over the Internet can be guaranteed to be 100% secure. Consequently, we cannot ensure or warrant the security of any information you transmit to us and you do so at your own risk. We believe that we have put in place appropriate physical, electronic, and managerial procedures to help safeguard and help prevent unauthorized access, maintain data security, and correctly use the information we collect online. Everfi uses role-based access for staff, limited to users who require such access to perform their job responsibilities.

Public Area and User Generated Content.

The Service may feature various community areas, open text areas, and other public forums (the “Public Areas”) where users can share information or post questions for others to answer. These Public Areas are open to the public and should not be considered private. We cannot prevent such information from being used in a manner that may violate this Privacy Policy, the law, or your personal privacy. We are not responsible for the results of such postings or for the accuracy of any information contained in those postings.

You should think carefully before posting any information in any Public Area. What you post can be seen, disclosed to or collected by others and may be used by others in ways we cannot control or predict. As with any public forum on any website, the information you post may also show up in third-party search engines like Google.

De-Identified Data.

Everfi will maintain and use de-identified data only in a de-identified form and not attempt to re-identify de-identified data.

8. Information for Individuals in the United Kingdom and European Union

Everfi does not actively market its products and services to residents of the United Kingdom or the European Union. The limited information in this Section is retained for the benefit of legacy users who may have used Everfi services prior to the cessation of active EU/UK marketing. New EU/UK users should not expect Everfi services to be configured for EU/UK residency. If you are a UK or EU resident and believe Everfi is processing your personal information, please contact us using the information in Section 12.

Legacy UK and EU users may continue to exercise the rights afforded to them under the UK GDPR and EU GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing. Requests may be submitted to [email protected]. Everfi will respond in accordance with applicable law.

Retention

We will keep your information accurate, complete and up to date. We will retain your data for the period necessary to fulfill the different purposes outlined in Section 3, typically for students this will be a period of four years and for corporate organizations will be as long as we are contracted to maintain data. Where we are required to do so to meet legal and regulatory requirements, we will retain your data for longer periods of time, but only where permitted to do so, including so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a possibility of legal action relating to your data or dealings. With respect to our K-12 markets, students’ personally identifiable information is retained only for educational purposes.

9. U.S. Consumer Privacy Rights

What U.S. Data Rights Do You Have (Non-California)?

Please note that if you are a resident of California, you have access to special data rights and disclosures that are described in this Policy under a separate section titled Your California Privacy Rights and Disclosures.

If you are a consumer living in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia you have the following rights with regards to your personal data. These rights are explained in further detail below:

Consumer Privacy Rights	Colorado, Connecticut, Indiana, Kentucky, Montana, Nebraska, New Hampshire, New Jersey, Rhode Island, Tennessee, Texas, Virginia	Delaware, Maryland, Oregon	Minnesota	Iowa	Utah	Nevada
Confirmation of personal data processing and access to that personal data	X	X	X	X	X
Correction of personal data	X	X	X		X
Portability of personal data	X	X	X	X	X
Deletion of personal data	X	X	X	X	X
Opt-out of targeted advertising using personal data	X	X	X	X	X
Opt-out of sale of personal data	X	X	X	X	X	X
Opt-out of certain profiling using personal data	X	X	X
Question the results of profiling			X
List of third-parties that have received personal data disclosures		X	X

Right to Confirmation and Access. You may have the right to confirm whether or not Everfi is processing your personal data and to access such personal data.
Right to Correct. You may have the right to request that Everfi correct inaccurate personal data that we maintain about you, taking into account the nature of the personal data and the purposes of the processing of the personal data.
Right to Delete. You may have the right to request that Everfi delete the personal data that Everfi maintains about you.
Right to Portability. You may have the right to request to receive your personal data in a portable and readily usable format, to the extent technically feasible.
Right to Opt-Out of Sale/Targeted Advertising. You may have the right to request to opt out of a “sale” of your personal data or processing of your personal data for purposes of targeted advertising (if any). “Targeted advertising” generally means displaying advertisements where the advertisement is selected based on personal data obtained from your activities over time and across websites or online applications to predict your preferences or interests.

Everfi does not sell or share for purposes of targeted advertising any personal information collected through the K-12 Learning Platform, the white-labeled financial education platform, or the ComplyEQ training platform. With respect to the marketing websites, as described in Sections 2 and 5, certain disclosures of online identifiers to advertising and analytics partners is considered a “sale” of personal information or use for purposes of “targeted advertising” under applicable U.S. state privacy laws. You may opt out of these disclosures at any time using the cookie consent banner on the marketing website, by enabling the Global Privacy Control signal in your browser.

Right to Opt-Out of Profiling. You may have the right to request to opt out of automated profiling using your personal data that produces legal or similarly significant effects concerning you (if any). Applicable state laws allow you to opt out of the application of automated profiling when it relates to substantive decision making, such as denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health-care services, or access to essential goods or services.
Right to Information About Third Parties. Oregon, Maryland and Delaware residents may have the right to request, at our option, a list of specific third parties, other than natural persons, to which Everfi has disclosed either your personal data or any personal data in general.
Right to Question the Results of Profiling. Minnesota residents may have the right to question the results of any automated processing of their personal data to evaluate, analyze, or predict personal aspects related to their economic situation, health, personal preferences, interests, reliability, behavior, location, or movements in furtherance of decisions that produce legal or similarly significant effects concerning them.

Your California Privacy Rights And Disclosures

The California Consumer Privacy Act (“CCPA”) provides the residents of California with the right to request the data rights as described in this section.

Right to Know: California residents have the right to know what personal data Everfi has collected about them, including the categories of personal data, the categories of sources from which the personal data is collected in the past 12 months, the business or commercial purpose for collecting, selling, or sharing personal data, the categories of third parties to whom Everfi discloses personal data, and the specific pieces of personal data Everfi has collected about them.
Right to Delete: California residents have the right to request the deletion of their personal data maintained by Everfi.
Right to Correct: California residents have the right to request that a business correct inaccurate personal data about them.
Right to Non-Discrimination: California residents have the right to not be discriminated against due to the exercise of their privacy rights under the CCPA.
Right to Opt-Out: California residents have the right to opt-out of the “sale” or “sharing” of their personal data. “Sharing” here means the disclosure of your personal data for the purposes of cross-context behavioral advertising.

Everfi does not sell or share for purposes of targeted advertising any personal information collected through the K-12 Learning Platform, the white-labeled financial education platform, or the ComplyEQ training platform. With respect to the marketing websites, as described in Sections 2 and 5, certain disclosures of online identifiers to advertising and analytics partners is considered a “sale” of personal information or “sharing” for purposes of cross-context behavior advertising under California law. You may opt out of these disclosures at any time using the cookie consent banner on the marketing website or by enabling the Global Privacy Control signal in your browser.

Right to Limit Use and Disclosure of Sensitive Personal data: California residents have the right to direct a business to limit its use and disclosure of their “sensitive” personal data.
Right to Make Requests Through an Authorized Agent: California residents can designate an authorized agent to make a request under the CCPA on their behalf.

Exercising Your Privacy Rights.

To request access to or deletion of your personal information, or to exercise any other data rights under the laws set forth above, please see our Data Subject Rights Requests page at https://everfi.com/data-subject-rights-request/ or call our toll-free number at +1 800-945-2316. We will verify your identity where required prior to fulfilling your request, which may require government identification. Where state law specifically allows, authorized agents may be used to submit rights requests, in which cases we will take steps to verify the consumer’s identity and that the agent has authority to act on the consumer’s behalf.

Response Timing and Format.

We will respond to a consumer privacy request within the time period required under any applicable privacy laws. If we require more time, in accordance with applicable privacy laws, we will inform you of the reason and extension period in writing.

10. Information for Canadian Residents

If you are a resident of Canada, this Section provides information specific to your privacy rights under Canadian federal and provincial privacy laws, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and the Quebec Act respecting the protection of personal information in the private sector (the “Quebec Privacy Act,” as amended by Law 25). Where applicable, provincial privacy laws (including those of Alberta and British Columbia) also apply.

Designated Privacy Officer.

Everfi has designated a Privacy Officer responsible for compliance with PIPEDA, the Quebec Privacy Act, and other applicable Canadian privacy laws. The Privacy Officer can be contacted at [email protected].

Your Rights.

Subject to applicable law and verification of your identity, Canadian residents have the right to:

Access the personal information we hold about you;
Request correction of inaccurate or incomplete personal information;
Request the cessation of dissemination of personal information or de-indexing of links associated with your name where authorized by law (Quebec residents);
Withdraw consent to the processing of your personal information, subject to legal or contractual restrictions;
Receive a copy of personal information collected from you in a structured, commonly used technological format (data portability), where required by law;
File a complaint with Everfi’s Privacy Officer or with the applicable supervisory authority.

Cross-Border Transfers.

Everfi is a U.S. company headquartered in Washington, D.C. Personal information collected from Canadian residents is transferred to and processed in the United States and may be transferred to other jurisdictions where Everfi or its service providers operate. Everfi takes reasonable contractual, technical, and organizational measures to ensure that personal information receives a level of protection comparable to that required under Canadian privacy laws, including by entering into written agreements with service providers that restrict the use, disclosure, and retention of personal information. While personal information is in another jurisdiction, it may be subject to the laws of that jurisdiction, including lawful access by foreign government authorities.

Automated Decision-Making.

Everfi does not use automated decision-making to make decisions about Canadian residents that produce legal or similarly significant effects.

Filing a Complaint.

If you have a privacy complaint, please first contact our Privacy Officer at the address above. If your complaint is not resolved to your satisfaction, you may file a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/) or with the Commission d’accès à l’information du Québec (https://www.cai.gouv.qc.ca/) or another applicable provincial supervisory authority.

11. Changes to Our Privacy Policy

EverFi may amend this Privacy Policy from time to time. We will provide notice of any material changes made to our Privacy Policy by prominently posting the revised Policy with an updated date of revision on our homepage. We encourage you to check this page periodically for any changes. If we make any material changes that affect information we have previously collected about you, we will provide you with notice (or in the case of a child, to your parent or legal guardian — or to your school/educational institution who will make it available to you or your parent or legal guardian), via email or within the Service.

12. How to Contact Us

If you have any questions about this Privacy Policy or our security measures at EverFi, or where applicable to appeal a decision we’ve made regarding your privacy rights, please contact us at [email protected]. Our mailing address is 1500 K Street NW, Floor 2, Washington, D.C. 20005 and we can be reached by phone at 800-945-2316. For Canadian privacy inquiries, please contact our designated Privacy Officer as described in Section 10.

Request to Remove or Update Data

If you mistakenly post personal information in a Public Area or if parents want to request the deletion of their student’s data, you can send us an email to request that we remove it by contacting us at [email protected]. If you would like to amend your profile information, you may log in to your account and do so or email us at [email protected]. You should understand that in some cases, we may retain copies of such information in our systems or databases where required or permitted by law.

Request to Opt-Out of Emails

Where we have permission, we may send periodic marketing emails to you. You may opt-out of such communications by following the opt-out instructions contained in the email or by contacting us at [email protected]. Please note that it may take up to 10 business days for us to process opt-out requests. If you opt-out of receiving emails about recommendations or other content we think may interest you, we will still send you service emails about your EverFi account or any services you have requested or received from us.