About StudyPug: StudyPug Inc. is a company incorporated under the laws of Canada, extra-provincially registered in British Columbia, with its headquarters in Richmond, BC. StudyPug USA Inc. is a company incorporated in Nevada, USA. References to “StudyPug,” “we,” “us,” and “our” throughout this Privacy Policy include both entities where the context requires. In the United States, billing is administered by StudyPug USA Inc. as the designated billing entity. StudyPug Inc. is the data controller responsible for the personal information described in this Privacy Policy for users in all markets. Capitalized terms used in this Privacy Policy have the same meaning as in the StudyPug Terms of Service unless otherwise defined here. “Home Customers” are individual subscribers and their family members using the Services on a personal basis. “Institutional Customers” are school boards, adult education centres, literacy agencies, and other publicly funded or private educational institutions purchasing services from StudyPug.

This Privacy Policy applies to www.studypug.com and our mobile applications (collectively, the “Services”). It does not apply to third-party websites accessible from our Services, which may have their own data practices.

1. Purpose of Policy

StudyPug is committed to respecting the privacy rights of its customers, visitors, and other users. We created this Privacy Policy to give you confidence as you visit our Website and use our Services, and to demonstrate our commitment to fair information practices and the protection of privacy.

2. Information Collection Practices

Traffic Data

Traffic Data is anonymous information that does not personally identify you but helps us improve your experience. We automatically collect: IP addresses, domain servers, types of computers accessing the Website, and types of web browsers used.

Cookies

We use cookies to recognize you, maintain your sign-in status, and customize content by grade level and region. All cookies expire after a set period. For Home Customers, we may employ third-party analytics (such as Google Analytics) to analyze Website usage. For Institutional Customers and their students, Google Analytics and all third-party analytics and tracking services are excluded. No student data from Institutional Customer sessions is transmitted to third-party analytics providers.

Advertising Cookies and Tracking Technologies

StudyPug's consumer-facing website pages (such as the homepage, pricing pages, and blog) use advertising tracking technologies, including the Meta Pixel, Google Ads conversion tag, TikTok Pixel, and Microsoft Advertising (Bing UET), to measure the effectiveness of advertising campaigns, understand how visitors interact with the site, and serve relevant advertisements on other websites and platforms. These technologies collect information such as pages visited, actions taken, browser type, device identifiers, and IP address. These tracking technologies are not active on any pages or features used by Institutional Customer students, and are not active within authenticated student learning sessions.

Cookie consent and opt-out: When you first visit studypug.com, a cookie consent banner allows you to accept or decline non-essential cookies, including advertising cookies used by StudyPug's advertising partners. You may update your preferences at any time through the Cookie Preference Centre. StudyPug honours the Global Privacy Control (GPC) browser signal; when detected, it is treated as a request to opt out of the sale and sharing of personal information associated with that browser. You may also opt out of interest-based advertising through the Network Advertising Initiative (optout.networkadvertising.org), the Digital Advertising Alliance (optout.aboutads.info), or through your device's ad tracking settings. Under certain U.S. state privacy laws, the disclosure of personal information to advertising partners described in Section 4 may be considered a “sale” or “sharing” of personal information. You can exercise your right to opt out by using the cookie consent controls or by enabling GPC in your browser.

Personal Information

Personal Information includes the following categories:

• Contact Data — name, mailing address, email address

• Financial Data — account or credit card number (billing contact only)

• Demographic Data — postal code, grade level

• Learning Activity Data — course progress and completion, quiz and assessment scores, topic mastery levels, time-on-task, diagnostic assessment results, and adaptive practice performance

• Institutional Administration Data (Institutional Customers) — institution name, programme or class identifiers, administrator and teacher contact details, seat allocation records

If you communicate with us by email, social media, or online forms, information provided may be collected as Personal Information. Institutional Customers provide student information on behalf of their learners. Home Customers provide consent at registration; for minors, parental or guardian consent is required.

3. Use of Information Collected

We use Contact Data to: send account and service information; administer your account; respond to inquiries; send promotional material (Home Customers only — Institutional Customer students do not receive marketing); contact you when necessary.

We use Financial Data to: verify qualifications for certain Services; process billing.

We use Demographic Data to: customize your experience and tailor content to your interests.

We use Learning Activity Data to: deliver and improve educational services; generate progress reports; identify knowledge gaps; adapt content difficulty; produce aggregated institutional reporting; improve platform quality.

Student Learning Activity Data is not used to train, develop, or improve StudyPug's AI models or any third-party AI systems. AI features (such as diagnostic assessment and adaptive practice) operate on the individual student's data within their session only.

4. Sharing of Personal Information

Advertising Partnerships (Home Customers Only)

StudyPug works with advertising platforms, including Meta (Facebook/Instagram), Google Ads, TikTok, and Microsoft Advertising (Bing), to show relevant advertisements to current and prospective Home Customers. To do this, StudyPug may share a hashed (cryptographically scrambled) version of your name or email address with these platforms, which match it against their own user databases to deliver StudyPug's ads or to create audiences of people with similar interests. Hashing converts your information into an unreadable string of characters before it leaves StudyPug's systems; the advertising platform cannot reverse this process to recover your original information. This practice applies only to adult Home Customer accounts.

Tracking Technologies on Consumer-Facing Pages

StudyPug's consumer-facing pages use tracking technologies including the Meta Pixel, Google Ads conversion tag, TikTok Pixel, and Microsoft Advertising (Bing UET) to measure advertising campaign effectiveness, understand visitor behaviour, and serve relevant ads on other platforms. See Section 2 for details and opt-out mechanisms.

Institutional and Children's Data — Advertising Exclusion

StudyPug does not use or disclose any student information collected through its educational services for behavioural targeting of advertisements, and does not build advertising profiles of students. Student data processed on behalf of Institutional Customers is used solely to provide the educational services specified in the institutional agreement, and for no other commercial purpose. StudyPug does not knowingly share personal information of children under 13 with advertising platforms and disables all third-party advertising tracking for users identified as children.

Other Sharing

• We share Contact Data and Financial Data with sub-processors who perform core services (hosting, billing, data storage) related to our operation of the Website. We require all sub-processors to comply with obligations consistent with this Privacy Policy. StudyPug remains responsible for sub-processor data handling.

• We share Financial Data with third-party payment processors for billing. These processors adhere to PCI-DSS standards.

• With your explicit consent, we may use testimonials for marketing. Student names are never used in marketing without explicit written consent from the student (if an adult) or their parent or guardian.

• We provide data to government education departments and schools for legitimate educational purposes where we are an Institutional Customer's service provider. We require these third parties to use the data only for legitimate educational interests.

5. How We Collect and Process Your Information

We collect personal information: directly from you; from Institutional Customers (teachers or administrators); and from third-party distributors. We collect only the personal information reasonably necessary to deliver the educational services contracted by you or your institution. We collect approximate location derived from your IP address and your selected region for content regionalisation. We do not collect precise geolocation (GPS or cell-tower) from any user. We do not collect biometric data, social media identifiers, health information, or data beyond what is necessary.

For Institutional Customer student registrations, the Institutional Customer provides consent on behalf of its learners. For Home Customers, consent is obtained at registration. Where the user is a minor, parental or guardian consent is required.

6. Data Retention and Deletion

Home Customers

We retain personal information as long as needed to provide access to the Services. We will delete it upon opt-out or deletion request, subject to legal retention obligations.

Institutional Customers

Learning Activity Data and personal information are retained for the duration of the institutional subscription agreement plus ninety (90) days to allow for renewal, data export, or transition. After this period, all personally identifiable information and Learning Activity Data are permanently deleted, unless the Institutional Customer requests earlier deletion. Rotating seat arrangements (e.g., summer school, continuous-intake adult education) can be configured per the Institutional Customer's preferred data handling procedure.

Deletion Requests

StudyPug will process all data deletion requests within thirty (30) calendar days of receipt. Written confirmation will be provided. Deletion is irreversible. Contact: privacynotification@studypug.com. Following deletion, we may retain anonymized aggregate data and financial transaction records for billing contacts only (not individual learners).

7. Confidentiality, Security, and Data Residency

We use appropriate technical, administrative, and physical security measures to protect personal information from unauthorized access, disclosure, use, and modification.

Data Residency by Region

Sub-Processors

StudyPug will notify Institutional Customers in writing at least thirty (30) days before engaging any new sub-processor with access to learner personal information.

8. Data Breach Notification

In the event of a security incident involving unauthorized access to, disclosure of, or loss of personal information, StudyPug will:

• For Institutional Customers: Notify the designated privacy contact within five (5) business days, and in any event no later than seven (7) calendar days, of becoming aware of the breach.

• For Home Customers: Notify affected users without unreasonable delay and in accordance with applicable privacy legislation.

• Provide a written incident report including: nature and scope of the breach; data categories and estimated number of affected users; measures taken or proposed; recommendations to mitigate harm.

• Report to the applicable privacy commissioner or regulatory authority as required by law (e.g., Office of the Privacy Commissioner of Canada under PIPEDA; Information and Privacy Commissioner of Ontario under FIPPA; FTC under COPPA).

• Co-operate with the Institutional Customer's own breach response procedures and take all reasonable steps to contain the breach and prevent recurrence.

9. Data Transfers, Storage, and Processing

StudyPug stores personal information in the region where you are located. For operational and support purposes, a copy of user data may be maintained in Canada. StudyPug Inc.'s Canadian-based team may access data stored in any region. Cross-border transfers are limited to: (a) access by the Canadian-based team; (b) sub-processors as listed in Section 7; or (c) where you request that a copy be sent to you.

Canadian Institutional Customer data is not transferred outside of Canada under any circumstances. This commitment is described in Section 7 and Section 11.

For EU/UK/IE users: user data is stored in AWS EU regions. A copy is maintained in Canada for operational purposes. Canada has an adequacy decision from the European Commission for PIPEDA-covered organisations; no Standard Contractual Clauses or other transfer mechanisms are required.

10. Special Information for Institutional Customers

This section applies to all Institutional Customers, including school boards, adult education centres, literacy agencies, and other publicly funded educational institutions purchasing services from StudyPug.

Data Usage Limitations

• Student data is used only for the educational purposes specified in the institutional service agreement.

• No student data is used for advertising, marketing, or non-educational profiling.

• No student data is used to train AI models.

• No analytics or tracking technologies operate on Institutional Customer sessions.

Institutional Customer Rights

Institutional Customers have the right to:

• Request a copy of all personal information and Learning Activity Data for their learners, in a commonly used electronic format, within thirty (30) days;

• Request correction of inaccurate personal information;

• Request deletion of learner data at any time, subject to Section 6 timelines;

• Receive written confirmation of any data deletion;

• Receive thirty (30) days' written notice before material changes to this Privacy Policy take effect;

• Designate a privacy contact to receive all notifications, breach reports, and data-related communications from StudyPug;

Supplementary Terms

Detailed institutional privacy terms are provided in the Privacy Policy Supplement for Canadian Institutional Customers and the Privacy Policy Supplement for United States Institutional Customers.

11. Special Information for Users Across Canada

This Privacy Policy has been developed to comply with applicable Canadian federal and provincial privacy legislation including:

• Ontario FIPPA (Freedom of Information and Protection of Privacy Act, Ontario)

• Municipal FIPPA (Ontario)

• BC FIPPA (Freedom of Information and Protection of Privacy Act, BC)

• Alberta FOIP

• Saskatchewan LA FOIP

• Manitoba FIPPA

• New Brunswick RTIPPA

• Newfoundland & Labrador ATIPPA 2015

• Nova Scotia PIIDPA

• PIPEDA (Personal Information Protection and Electronic Documents Act, Canada)

StudyPug acknowledges its obligations as a service provider processing personal information on behalf of publicly funded educational institutions and will comply with all applicable provincial and federal requirements. All Canadian Institutional Customer student data is stored in the Canada (Central) region of Amazon Web Services (ca-central-1), Montréal, Québec. No Canadian Institutional Customer student data is transferred outside Canada.

12. Special Information for Users in the United States

Billing for US users is administered by StudyPug USA Inc., a company incorporated in Nevada, USA. Account services and customer management for US users are provided directly by StudyPug Inc. (Canada). Detailed US institutional privacy terms are set out in the Privacy Policy Supplement for United States Institutional Customers, available at studypug.com/support/privacy-supplement-us/.

FERPA

When providing Services to US educational institutions under a written agreement, StudyPug USA Inc. may act as a “school official” with a “legitimate educational interest” under FERPA (20 U.S.C. § 1232g). In this capacity, StudyPug: performs services the institution would otherwise use employees to perform; is under the direct control of the institution with respect to education records; uses personally identifiable information only for the purposes specified in the institutional agreement; does not re-disclose education records without consent except as FERPA permits; and will execute a Data Processing Agreement (DPA) with US educational institutions specifying FERPA obligations and data handling procedures.

COPPA

StudyPug's Services include educational content for children under 13 (Kindergarten through Grade 3). StudyPug complies with COPPA (15 U.S.C. §§ 6501-6506) and the FTC's COPPA Rule, 16 C.F.R. Part 312, as amended effective June 23, 2025 (published April 22, 2025; full compliance required by April 22, 2026).

• Parental consent: For Home Customers, verifiable parental consent is obtained at registration before collecting personal information from children under 13.

• School authorization: For Institutional Customers, StudyPug relies on the school or district's authorization to collect student information for educational purposes, consistent with FTC guidance on school consent under COPPA.

• Data minimization: We collect only information necessary to provide the educational services described herein.

• No advertising: We do not use children's personal information for targeted advertising or non-educational purposes.

• Parental rights: Parents may review, correct, and delete their child's personal information by contacting privacynotification@studypug.com.

The security measures described in Section 7 constitute StudyPug's written information security program for the purposes of 16 CFR §312.8. This program applies to all personal information collected from children. StudyPug designates one or more employees to coordinate information security and performs at least annual assessments of internal and external risks to the confidentiality, security, and integrity of children's personal information.

State Student Privacy Laws

StudyPug is committed to complying with applicable state student privacy laws including California SOPIPA (Bus. & Prof. Code § 22584), New York Education Law § 2-d, Illinois SOPPA, Colorado SB 22-016, Connecticut PA 16-189, and equivalent legislation in other states. StudyPug will execute state-specific DPA addenda as required. See the US Institutional Privacy Supplement for details.

CCPA/CPRA — Sale or Sharing of Personal Information

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA), the sharing of hashed personal information with advertising platforms as described in Section 4 may constitute a “sale” or “sharing” of personal information. California residents may opt out by: (a) using the cookie consent controls on studypug.com; (b) enabling the Global Privacy Control (GPC) in their browser; or (c) contacting privacynotification@studypug.com. This right does not apply to Student Data processed on behalf of Institutional Customers, which is not used for advertising purposes under any circumstances.

US Data Residency

US user data is stored in AWS US-East-1 (Virginia). StudyPug Inc.'s Canadian-based team may access this data for support purposes as described in §9.

13. Special Information for Users in the European Union

StudyPug is committed to compliance with the EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, for users located in the European Union.

Data controller: StudyPug Inc. (BC, Canada) is the data controller for EU users. Canada has a European Commission adequacy decision for PIPEDA-covered organizations; no additional transfer mechanism is required.

Lawful basis: (a) contract performance (Article 6(1)(b)) for subscribers; (b) consent for marketing communications; (c) legitimate interests for analytics.

Data storage: EU user data is stored in AWS EU regions. A copy is maintained in Canada, and Canadian-based team members access this data for support. Canada has an EU adequacy decision; no Standard Contractual Clauses are required.

Data subject rights: EU users have the right to access, rectify, erase, restrict processing, object, and port their personal data. Contact: privacynotification@studypug.com.

European Accessibility Act: StudyPug acknowledges obligations under the EAA (Directive (EU) 2019/882). See Section 17 and our published Accessibility Statement.

14. Special Information for Users in the United Kingdom

StudyPug is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 for UK users. The rights described in Section 13 apply equally to UK users. Data storage: UK user data is stored in AWS EU regions. A copy is maintained in Canada, and Canadian-based team members access this data for support. The UK recognises Canada's adequacy status; no additional transfer mechanisms are required.

StudyPug acknowledges the ICO's Age Appropriate Design Code (Children's Code) for online services likely to be accessed by children under 18 in the UK. StudyPug processes children's data in the best interests of the child, applies privacy by default, and minimizes data collection to what is necessary for the educational service.

15. Special Information for Users in Australia, New Zealand, and Singapore

Australia

StudyPug complies with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). AU user data is stored in AWS Asia Pacific regions. Australian users have the right to access and correct their personal information and to make complaints to the Office of the Australian Information Commissioner.

New Zealand

StudyPug complies with the New Zealand Privacy Act 2020 and the Information Privacy Principles. NZ user data is stored in AWS Asia Pacific regions. NZ users have the right to access and correct their personal information and to make complaints to the Office of the Privacy Commissioner.

Singapore

StudyPug complies with the Personal Data Protection Act 2012 (PDPA) for Singapore users. SG user data is stored in AWS Asia Pacific regions. Singapore users may contact our Data Protection Officer to exercise their rights under the PDPA.

16. Children's Privacy

• Data minimization: We collect only information necessary to provide educational services. Children's accounts collect Contact Data and Learning Activity Data only. We do not collect precise geolocation (GPS or cell-tower), biometric data, or social media identifiers from children.

• No advertising or profiling: We do not use children's personal information for advertising, marketing, or non-educational profiling.

• Parental controls: Parents or guardians may review, correct, and delete their child's personal information at any time by contacting us.

• School authorization: Where an Institutional Customer provides student information to StudyPug for educational purposes, the Institutional Customer acts as the authorizing agent for that student's information.

For US-specific children's privacy protections, see Section 12 (COPPA). For UK-specific protections, see Section 14 (Children's Code).

17. Accessibility

StudyPug is committed to ensuring that our platform is accessible to all learners, including those with disabilities. We are working toward conformance with WCAG 2.1, Level AA. Our detailed Accessibility Statement, including current features, ongoing improvements, and how to report accessibility issues, is published at studypug.com/support/accessibility/. An Accessibility Conformance Report (VPAT) is available on request from accessibility@studypug.com.

18. Change of Control

Traffic Data and Personal Information will be transferred in the event of a Change of Control of StudyPug. “Change of Control” means (a) a sale to a third party of all or substantially all assets; or (b) the transfer to a third party of fifty percent (50%) or more of the outstanding voting power.

19. Dispute Resolution

This section does not apply to Institutional Customers whose institutional service agreement contains separate dispute resolution provisions. For Home Customers, all claims shall be addressed in binding, non-appearance-based arbitration. See Terms of Service for full dispute resolution terms.

20. Updates and Changes to Privacy Policy

We reserve the right to change this Privacy Policy at any time. For Institutional Customers: material changes will be communicated in writing at least thirty (30) days before taking effect. For all other users: material changes will be communicated to registered users. Continued use of the Services constitutes acceptance of the revised Policy.

21. Contact Information

For all privacy inquiries:

Privacy and Data Protection Officer
StudyPug Inc.
Email: privacynotification@studypug.com

For accessibility inquiries: accessibility@studypug.com

We will acknowledge privacy inquiries within five (5) business days.

© 2015–2026 StudyPug Inc. All rights reserved.