Privacy Policy

The VR School is a WASC-accredited virtual reality high school offering UC A-G approved courses to students in grades 6–12 globally. Our principal place of business is 520 Lasuen Mall #200, Stanford, California, CA 94309. This Privacy Policy describes how The VR School ("we," "us," or "our") collects, uses, discloses, and protects personal information when you use our website, student portal, enrollment platform, VR labs, and related services (collectively, the "Services").

We collect the following categories of information: • Enrollment data: name, date of birth, grade level, previous school records, and contact information for students and their parents or guardians. • Account data: username, email address, password (hashed), and profile preferences. • Academic records: course enrollments, grades, attendance, assessment results, transcripts, and completion certificates. These records are protected under FERPA (see Section 6). • Usage data: pages visited, features used, session duration, device type, browser, and IP address, collected via server logs and first-party analytics. • Communications: messages sent through our contact forms, support tickets, and email correspondence. • Payment information: billing name, address, and last four digits of the payment method. Full card numbers are processed directly by our payment processor and are never stored on our servers.

We use collected information to: • Provide, operate, and improve the Services. • Process enrollment applications and manage student accounts. • Deliver courses, issue grades, track progress, and generate official transcripts. • Communicate with students and families about enrollment, academics, and school announcements. • Respond to support requests and resolve disputes. • Comply with applicable law, including reporting obligations under WASC accreditation standards. • Analyze aggregate usage trends to improve curriculum and user experience. We do not use student data for advertising, profiling unrelated to education, or sale to third parties.

We share information only in the following circumstances: • Service providers: We share data with vendors who help operate the Services (e.g., cloud hosting, payment processing, email delivery) under data processing agreements that prohibit independent use of student data. • Educational partners: With consent, we may share academic records with colleges, scholarship programs, or district partners for purposes directly related to the student's education. • Legal requirements: We disclose information when required by law, court order, or to protect the rights, property, or safety of The VR School, our students, or the public. • School officials with legitimate educational interest: As permitted under FERPA, we may share records with staff who need them to perform their professional responsibilities. We do not sell, rent, or trade personal information to third parties for commercial purposes.

The VR School serves students as young as 11 years old. For students under 13, we comply with the Children's Online Privacy Protection Act (COPPA): • We obtain verifiable parental consent before collecting personal information from students under 13. • Parents may review, correct, or request deletion of their child's personal information by contacting privacy@thevrschool.org. • We do not condition enrollment on a child providing more personal information than is reasonably necessary to participate in the Services. • We do not serve behavioral advertising to children under 13.

The Family Educational Rights and Privacy Act (FERPA) grants students and parents specific rights regarding education records: • Right to inspect and review: Eligible students (age 18+) and parents of minor students may request access to education records within 45 days of the request. • Right to request amendment: You may request that The VR School amend records you believe are inaccurate or misleading. We will notify you of our decision within a reasonable time. • Right to consent to disclosure: We will not disclose personally identifiable information from education records without written consent, except as permitted by FERPA (e.g., school officials with legitimate educational interest, health and safety emergencies). To exercise FERPA rights, contact our Registrar at registrar@thevrschool.org.

California residents have the following rights under the California Consumer Privacy Act and California Privacy Rights Act: • Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you. • Right to delete: Request deletion of personal information we have collected, subject to certain exceptions. • Right to correct: Request correction of inaccurate personal information. • Right to opt out: We do not sell or share personal information for cross-context behavioral advertising, so no opt-out is required. • Right to non-discrimination: We will not discriminate against you for exercising your privacy rights. To submit a CCPA request, email privacy@thevrschool.org with the subject line "California Privacy Request." We will verify your identity before responding. We respond within 45 days.

We retain student records for as long as required by applicable law and our accreditation obligations — typically a minimum of seven years after the student's last enrollment. Account data for inactive users is deleted or anonymized after three years of inactivity, unless retention is required by law. You may request earlier deletion of non-essential personal data at any time.

Our website uses session cookies (required for login) and first-party analytics to understand how visitors use the site. We do not use third-party advertising cookies. You may disable cookies in your browser settings; however, some features of the Services (such as the student dashboard) require cookies to function. We do not use fingerprinting, behavioral ad tracking, or cross-site tracking.

We implement industry-standard technical and organizational measures to protect personal information, including TLS encryption in transit, encrypted storage, access controls, and regular security reviews. No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@thevrschool.org.

We may update this Privacy Policy periodically. We will notify families of material changes via email and by posting a notice on the student portal at least 14 days before the changes take effect. The effective date at the top of this page reflects when the current version was last updated.

For privacy questions, records requests, or to exercise your rights: Privacy Officer · The VR School Email: privacy@thevrschool.org Mailing address: 520 Lasuen Mall #200, Stanford, California, CA 94309 For FERPA-specific requests: registrar@thevrschool.org For COPPA parental requests: privacy@thevrschool.org