This Privacy Policy explains how EXPLR PBC Inc. ("EXPLR," "we," "us," or "our") collects, uses, shares, stores, transfers, and protects personal information in connection with EXPLR — our websites, online forms, applications, courses, credentialing, communications, and related digital services (collectively, the "Services").

This Policy applies to individuals in the United States, United Kingdom, and other jurisdictions where our Services are available, subject to applicable local law. The National STEM Festival maintains its own privacy policy for Festival applications and events.

1.Who We Are

EXPLR PBC Inc. is the organization responsible for the personal information described in this Policy.

Controller: EXPLR PBC Inc.
Privacy email: hello@explr-media.com
Postal address: 82 Nassau Street #60050, New York, NY 10038, USA

EXPLR is incorporated in the United States and also conducts business activities in the United Kingdom.

2.Services and Technology Providers

We use third-party service providers to operate our websites, applications, communications, and programs. These currently include:

• Uscreen — hosting of our website, content, and courses, and payment processing for paid EXPLR Edge® programs.
• Credly (Pearson) — issuance and verification of digital credentials.
• Tally.so — online forms, applications, and registrations.
• Google Workspace — email, file storage, documents, and program administration.
• Mailchimp — email newsletters and marketing communications for individuals who choose to subscribe.
• Google Analytics — website usage and performance analytics, where permitted and, where required, after consent.

These providers may use approved subprocessors to provide their services. They process personal information in accordance with their contracts with EXPLR and their own applicable privacy and security obligations.

We do not currently use Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Mixpanel, or Segment on the Services, and we do not currently use website visitor information for behavioral advertising or advertising retargeting.

3.Information We Collect

The information we collect depends on how you interact with EXPLR. We aim to collect only the minimum personal information necessary to provide content access, credentialing, and a safe experience.

Account holders and learners

We may collect information including:

• name and preferred name;
• date of birth or age;
• email address and telephone number;
• home or postal address;
• school, grade/year, and geographic region;
• parent or guardian information where applicable;
• course activity, credentialing coursework, and portfolio artifacts you submit to earn a credential;
• for paid EXPLR Edge® programs, payment information (processed by our payment provider);
• and optional demographic information.

Optional demographic and accessibility information

We may ask you to voluntarily provide information such as race or ethnicity, gender, or accessibility or disability requirements. These questions are optional unless we clearly explain that particular information is necessary to provide a requested accommodation or service.

Some of this information may be considered sensitive or "special category" personal data under applicable law. Where required, we process such information on the basis of explicit consent or another lawful condition permitted by applicable law. We use this information only for legitimate purposes, such as understanding participation and impact, improving access, or providing accommodations. We do not use this information for behavioral advertising.

Parents and guardians

We may collect a parent or guardian's name, email address, telephone number, relationship to the account holder, permissions, and information needed to administer participation by a minor.

Email subscribers

If you choose to receive EXPLR news and updates, we collect your email address and any subscription preferences you provide. Creating an account or using our Services does not automatically subscribe you to marketing emails.

Information collected automatically

When you use our websites, certain technical information may be collected automatically, including: IP address; browser and device type; operating system; pages viewed; referring pages; approximate geographic information derived from an IP address; date and time of visits; and cookie and analytics information. We use cookies and similar technologies as described below.

4.Why We Use Personal Information

Depending on the activity and applicable law, we use personal information to:

Provide our platform, courses, and credentialing. This includes creating and managing your account, delivering courses and content, and issuing and verifying credentials.

Legal basis where UK or European data protection law applies: performance of a contract or steps requested before entering a contract, legitimate interests, and consent where appropriate.

Communicate with you and, where relevant, families. This includes information about your account, courses, credentials, participation requirements, and support.

Legal basis: contract, legitimate interests, legal obligation, or consent where required.

Send marketing communications. We send newsletters and other marketing emails only where you have chosen to receive them or where another lawful basis permits the communication.

Legal basis: consent where required.

Operate and improve our websites and programs. This includes analytics, troubleshooting, service improvement, security, fraud prevention, and aggregated reporting.

Legal basis: legitimate interests and, for non-essential cookies or analytics where required, consent.

Comply with law and protect people and EXPLR. We may process information to comply with legal obligations, investigate security incidents or misuse, establish or defend legal rights, or protect the safety of users and others.

Legal basis: legal obligation, legitimate interests, or vital interests where appropriate.

5.Children, Young People, and Payment

Many EXPLR programs are designed for teenagers. EXPLR is free to use; some EXPLR Edge® programs carry a fee.

You must be 13 or older to use EXPLR. We do not knowingly allow children under 13 to create accounts or provide personal data.

Data consent by region

• United States: individuals 13 and older may consent to their own data processing; COPPA governs children under 13.
• United Kingdom: individuals 13 and older may consent to their own data processing.
• European Union: the age of digital consent varies by member state (between 13 and 16). To operate consistently across the EU, EXPLR applies 16 as the default threshold for independent consent unless a lower age applies in the user's country. Where a user is below the age that applies in their country, we require verifiable parental or guardian consent.

Using EXPLR and buying Edge® by age

Age	Using EXPLR (free)	Buying a paid Edge® program
Under 13	Not permitted.	Not permitted.
13–17	May use EXPLR and consent to their own data where local law allows (parental consent required where under the applicable age).	An adult aged 18+ must make the purchase and hold the financial contract.
18+	Full data and legal autonomy.	May independently sign up and pay.

Where parental or guardian consent is required, we verify it through methods such as a signed consent form or another approved method. A parent or guardian may review, correct, delete, or withdraw consent for their child's information at any time by contacting hello@explr-media.com.

In the United Kingdom and other jurisdictions, children and young people have privacy rights in their own right. We take age into account when determining how information is presented, what information is collected, and when parent or guardian involvement or consent is appropriate. Where required, we obtain parent or guardian permission for activities such as identifiable student media use or other program participation.

We do not knowingly use children's personal information for behavioral advertising or advertising retargeting. If you believe a child has provided information in circumstances where required permission was not obtained, please contact hello@explr-media.com.

6.How We Share Personal Information

We do not sell personal information. We may share personal information with:

• EXPLR employees and authorized contractors who need access to operate our programs.
• Technology and service providers, including Uscreen, Credly, Tally.so, Google Workspace, Mailchimp, and Google Analytics.
• Communications and public-relations providers, limited to what is needed for authorized communications work.
• Professional advisers, insurers, auditors, and similar providers where reasonably necessary.
• Government authorities, regulators, courts, or law-enforcement bodies where disclosure is required by law or reasonably necessary to protect rights, safety, or security.
• A successor organization in connection with a merger, acquisition, restructuring, financing, or sale of all or part of EXPLR, subject to applicable privacy requirements.

We do not provide learner or account-holder personal information to sponsors for their own marketing or recruiting purposes.

7.International Data Transfers and U.S. Storage

EXPLR is a United States company, and our primary data storage and processing takes place in the United States. If you use our Services from the United Kingdom or another country outside the United States, your personal information may be transferred to, stored in, and processed in the United States.

We use U.S. data-region settings for covered Google Workspace data where available. Other service providers may process information in the United States or other countries in accordance with their service arrangements.

Where UK, European, or other applicable data protection law requires safeguards for an international transfer, we use appropriate legal mechanisms and contractual safeguards, which may include Standard Contractual Clauses, UK-approved transfer mechanisms, adequacy regulations or decisions, and supplementary safeguards where appropriate. The privacy and data-protection laws of the United States may differ from those in your country. International transfers do not remove the rights available to you under applicable data-protection law.

8.European Economic Area

EXPLR does not currently specifically offer its programs to individuals in the European Economic Area ("EEA"). If our activities expand into the EEA and EU data-protection law applies, we will comply with applicable EU GDPR requirements and, where required, appoint and identify an EU representative. Simply being able to access an EXPLR website from the EEA does not necessarily mean that an EXPLR program is being offered in that jurisdiction.

9.Marketing Communications

We use Mailchimp to manage marketing email subscriptions. Individuals are added to marketing communications only when they affirmatively choose to receive email updates or where another lawful basis expressly permits us to contact them. You may unsubscribe at any time using the unsubscribe link in our marketing emails or by contacting hello@explr-media.com. Unsubscribing from marketing does not prevent us from sending necessary operational or transactional communications relating to an account, course, credential, or other service you have requested.

10.Cookies and Analytics

We use cookies and similar technologies for website functionality, security, preferences, and analytics. Our current analytics services include Google Analytics. Where applicable law requires consent, including in the United Kingdom, non-essential analytics technologies are used only after the appropriate consent has been obtained through our cookie controls. You can change your cookie preferences using the cookie controls on our website. We do not currently use Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, or similar technologies for cross-site behavioral advertising or retargeting.

11.Data Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, operational, safeguarding, audit, and reporting requirements. As a general guide:

• Account information: retained while your account is active and for a limited period afterward, after which it is deleted or de-identified unless a longer period is required.
• Credential records: we retain a record of the credentials you earn to preserve their integrity and verifiability. Portfolio materials you submit for assessment are kept only as long as needed to assess and issue the credential.
• Marketing subscriber information: retained while you remain subscribed and for limited periods afterward where necessary to maintain suppression or compliance records.
• Financial, contractual, legal, and audit records: retained for the period required by applicable law or legitimate business requirements.
• Analytics information: retained in accordance with our configured settings and the applicable provider's retention controls.

We may retain limited information for longer where necessary to comply with law, establish or defend legal claims, prevent fraud, or demonstrate compliance.

12.Your Privacy Rights

Your rights depend on where you live and the laws that apply to our processing. Depending on applicable law, you may have rights to:

• request access to personal information we hold about you;
• request correction of inaccurate information;
• request deletion of information;
• restrict certain processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with an applicable privacy or data-protection regulator.

Withdrawing consent does not affect processing that lawfully occurred before consent was withdrawn.

United Kingdom

Where UK GDPR applies, you may have rights of access, rectification, erasure, restriction, objection, portability, and rights relating to certain automated decision-making. You also have the right to complain to the UK Information Commissioner's Office ("ICO").

United States

Residents of certain U.S. states may have additional privacy rights under applicable state law, including rights to access, correct, delete, or obtain a copy of certain personal information and, where applicable, opt out of certain uses. EXPLR does not sell personal information and does not currently share personal information for cross-context behavioral advertising or use personal information for targeted advertising as those terms are defined under applicable U.S. state privacy laws.

How to exercise your rights

Email hello@explr-media.com with your name, the email address associated with your interaction with EXPLR, your country or state, and the nature of your request. We may need to verify your identity before acting on a request. We will respond within the timeframe required by applicable law. A parent or guardian may contact us regarding information relating to their child where permitted or required by applicable law.

13.Security

We use reasonable and appropriate administrative, technical, and organizational safeguards designed to protect personal information. These measures include, where appropriate: encrypted transmission; access controls; role-based permissions; restricted access to participant information; authentication controls; secure cloud-service providers; and internal procedures governing access and handling of information. No online service or storage system can guarantee absolute security. If we become aware of a personal-data incident, we will investigate and take action consistent with applicable law, including notification to individuals or regulators where required.

14.Third-Party Websites and Services

Our Services may contain links to third-party websites, platforms, registration systems, social networks, or other services. EXPLR does not control the privacy practices of independent third parties. Their collection and use of personal information is governed by their own privacy policies and terms.

15.Aggregated and De-identified Information

We may aggregate or de-identify information so that it no longer identifies an individual. We may use this information for purposes including research, program evaluation, impact reporting, education insights, service development, funder reporting, and understanding participation trends. We do not attempt to re-identify information that has been properly de-identified except where necessary to test or maintain de-identification processes or as otherwise permitted by law.

16.Changes to This Policy

We may update this Privacy Policy periodically to reflect changes to our Services, technology, legal requirements, or privacy practices. The "Last updated" date at the top of this Policy will indicate when it was most recently revised. Where required by law, we will provide additional notice or obtain consent before making a material change that affects how personal information is used.

17.Contact Us

Questions, concerns, or privacy requests may be sent to: