Privacy Policy(How JROTC CCC collects, uses, and protects personal information)

This Privacy Policy explains how JROTC CCC ("we," "us," or "our") collects, uses, and protects personal information when you use our service ("Service").

1. Information We Collect

We collect only the personal information necessary to operate the Service.

Account holders (instructors, hosts, judges, school staff, parents, and cadets who are given accounts):

• Name
• Email address
• Phone number
• Role and school affiliation
• Optional profile details a judge or instructor chooses to enter (service branch, rank, experience, awards, preferred events)

Competition records created by schools and hosts in the course of running a competition:

• Cadet names on event rosters and team lists
• Scores, placements, and judges' remarks
• Knowledge-exam attempts: the cadet's name as entered, answers, score, time started and submitted, and a device identifier and tab-change count used only to detect a second device or a second attempt during the exam
• Optional photographs of paper score sheets taken by a judge while scoring
• School address, used to show distance to a competition and to locate the school on a map

We do not collect:

• Precise location of any person
• Advertising or tracking identifiers
• Behavioral analytics
• Sensitive personal information (no dates of birth, student ID numbers, grades, health, discipline, or demographic data beyond the event division a school registers a team in)

2. Payment Information (Stripe)

Payments for the Service are processed by a third-party payment processor, Stripe.

We do not store or process credit card numbers or sensitive payment information on our servers. Stripe may collect and process payment information in accordance with its own privacy policy and security practices.

3. How We Use Information

We use personal information only to:

• Provide, operate, and maintain the Service
• Communicate regarding account activity or competition-related matters
• Send system notifications and provide user support

We do not use personal information for advertising, marketing, profiling, or analytics unrelated to service operation.

4. Data Sale and Sharing

We do not sell, rent, trade, or monetize personal information. Ever.

We may share personal information only in the following limited circumstances:

• When required by law or legal process
• With service providers that help us operate the Service (such as email, SMS, or payment providers), under confidentiality and data-protection obligations

We do not allow third parties to use personal information for their own purposes.

5. Data Retention

We retain personal information only as long as necessary to operate the Service or comply with legal obligations.

You may request deletion of your personal information by contacting us using the information below.

6. Data Security

We take reasonable technical and organizational measures to protect personal information from unauthorized access, disclosure, or misuse.

However, no system is completely secure. Use of the Service is at your own risk.

7. Students and Children

JROTC CCC is used by schools to run cadet competitions. Most information about students enters the Service when an instructor or host adds a cadet's name to a roster, records a score, or administers a knowledge exam. Students do not browse the public internet through the Service, and the Service shows no advertising.

A school may choose to give a cadet an account so the cadet can see their own team's schedule and results. Cadet accounts are created or approved by the school, never by self-registration, and hold only name, email, and phone. A parent account can be created to follow a cadet's school and is linked to that cadet only after the cadet's school email is verified.

We do not knowingly collect personal information directly from a child under 13 without the school's authorization. If we learn that we hold a child's information that a school did not authorize, we delete it promptly.

8. Student Data and Schools

When a school or district uses the Service, information about its students ("student data") is handled as follows.

Ownership and control. Student data belongs to the school or district that provided it. We hold it only as the school's service provider and only to run the competitions the school takes part in. The school controls who at the school can see or change it.

School official. We act as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA) and use student data only for the purposes the school directs. We do not use student data for advertising, marketing, profiling, or any purpose other than operating the Service.

Student access to their own work. A cadet's competition results are visible to the cadet's school and, where the host publishes results, to the public results board. A school may request a copy of its students' records in a standard export format at any time.

Review and correction. Parents, guardians, and eligible students should direct requests to review or correct student data to the school, which can correct roster and account information directly in the Service. We help the school complete any request it cannot complete itself within 10 business days.

Security. Student data is stored in the United States, encrypted in transit and at rest, and protected by role-based access rules enforced in the database so that a school can see only its own students and a host can see only the schools registered for its competition. Access by our staff is limited to support and maintenance.

Breach notification. See section 9.

Deletion and return. When a school ends its use of the Service, or on written request at any time, we delete the school's student data within 60 days, except where a competition host's published results must be kept to preserve the record of a completed competition, and except for backups, which expire on their normal schedule. We confirm deletion in writing on request.

No profiling. We do not build a profile of any student except to the extent a profile is the record of that student's own competition results.

Subprocessors. Service providers that touch student data are listed in our Subprocessor List, available on request, and are bound to these same restrictions.

Precedence. If a school or district signs a data privacy agreement with us, that agreement controls over this policy and over our Terms of Service wherever they differ.

9. Security Incidents

If we determine that student data or account holders' personal information has been accessed, acquired, or disclosed without authorization, we will:

• Notify the affected school or district's designated contact without unreasonable delay and no later than 72 hours after we confirm the incident, by email and phone
• Tell the school what happened, what information was involved, what we have done to contain it, and what we recommend the school do
• Help the school meet its own obligation to notify affected parents, guardians, and students, and provide any additional information the school needs for that notice
• Not delay notification to the school except as required by law enforcement
• Preserve relevant records and cooperate with the school's review

Where the law requires us to notify individuals directly, we will do so in the form the law requires.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information

Requests can be made using the contact information below.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last Updated" date.

Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

12. Contact Information

If you have questions or requests regarding this Privacy Policy, contact:

Aaron Carey / Carey Unlimited LLC
jrotc.admin@careyunlimited.com