UPCOT (“we,” “us,” or “our”) operates the UPCOT platform, accessible at upcot.com and related subdomains (the “Platform”). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you access or use our Platform. By using the Platform you agree to the practices described here.
This Policy is incorporated by reference into our Terms of Service. Defined terms used here carry the meanings assigned in those Terms.
When you create an account, enroll in a course, or communicate with us, we may collect:
When you interact with the Platform, our servers automatically log:
We use strictly necessary cookies to maintain your authenticated session and prevent cross-site request forgery. We do not use third-party advertising cookies or sell your data to data brokers. If you use a browser that transmits a Global Privacy Control (GPC) signal, we treat it as a valid opt-out of any sale or sharing of personal information.
If an institution uses UPCOT under an institutional license, the institution may provide us with enrollment rosters or other data about students or instructors. In those cases the institution is the data controller and we act as a data processor on its behalf.
We use the information we collect to:
We do not use your educational records or course performance data to train third-party AI models or to serve you behavioral advertising.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data under one or more of the following legal bases:
For users enrolled in courses offered by institutions that are subject to the Family Educational Rights and Privacy Act (“FERPA”), grades, attendance records, and assignment submissions constitute “education records” under FERPA. We collect and process those records as a “school official” with a legitimate educational interest, pursuant to a written Data Processing Agreement with the relevant institution (as contemplated by 34 C.F.R. § 99.3(b)). Institutions represent and warrant to UPCOT that they have obtained all legally required parental or student consents before enrolling individuals in UPCOT-powered courses. We do not disclose education records to third parties except as permitted by FERPA and described in this Policy.
When we receive a subpoena, court order, or other legal process that could require disclosure of education records, we will, to the extent legally permissible, notify the relevant educational institution before complying so that the institution may seek a protective order or otherwise respond.
Eligible students and their parents (for students under 18) have the right to inspect their education records, request corrections, and limit certain disclosures, subject to FERPA’s requirements. Requests should be directed to the institution first; if the institution directs the request to us, we will respond within 45 days.
The Platform is not directed to children under 13. We do not knowingly collect personal information from any child under 13 without verifiable parental consent. If we learn that we have collected personal information from a child under 13 without such consent, we will delete that information promptly. Parents or guardians who believe their child has submitted personal information to us should contact us at privacy@upcot.com.
Children ages 13–17: If you are between 13 and 17, you may use the Platform only with the knowledge and consent of your parent or guardian. Instructors who enroll minors are responsible for obtaining any required parental consents under applicable law.
COPPA 2025 Amendment Notice: The Federal Trade Commission’s updated Children’s Online Privacy Protection Rule takes effect April 22, 2026 — after this Policy’s effective date. The updated rule expands protections to teens under 17 and imposes enhanced consent requirements. We are committed to full compliance and will update our practices on or before April 22, 2026, and will notify users of any material changes to how we handle minors’ data.
Payments on the Platform are processed by Stripe, Inc., a PCI DSS Level 1 certified payment processor. When you enter payment information, it is transmitted directly to Stripe using TLS encryption; we receive only a non-sensitive token and the last four digits of your card. Stripe’s collection and use of your payment data is governed by Stripe’s Privacy Policy. We are not responsible for Stripe’s data practices.
Instructors who receive payments through UPCOT’s marketplace feature are subject to Stripe Connect’s identity-verification requirements, which may include collection of government ID information directly by Stripe.
We do not sell your personal information. We may share your information with:
We retain your data for as long as your account is active or as needed to provide the Platform. Specific retention periods:
You may request deletion of your account at any time (see Section 10). Deletion removes your personal profile and contact information; anonymized usage records and aggregate analytics may be retained.
We use industry-standard technical and organizational measures to protect your information, including:
No system is perfectly secure. If we learn of a security breach that is reasonably likely to harm you, we will notify you and the applicable authorities as required by law. For breaches affecting Florida residents, we will provide notification within 30 days of determining a breach has occurred, consistent with Florida’s Information Protection Act (Fla. Stat. § 501.171). For breaches affecting residents of other states, we will comply with the notification timelines required by applicable state law.
California residents have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
To exercise these rights, email privacy@upcot.com with the subject line “California Privacy Request.” We will respond within 45 days. You may designate an authorized agent to make a request on your behalf; we require written authorization signed by you and may also require a copy of a government-issued ID and a signed declaration under penalty of perjury verifying the agent’s authority. We will not discriminate against authorized agents making proper requests.
In addition to the rights above, you have the right to:
Our designated representative for GDPR purposes can be reached at privacy@upcot.com. We are in the process of designating an Article 27 representative within the European Economic Area. Until that designation is finalized, EEA/UK residents may direct inquiries to privacy@upcot.com and we will respond within the timeframes required by applicable law.
UPCOT is operated in the United States. If you access the Platform from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms as appropriate.
If you believe content on the Platform infringes your copyright, please send a written notice to our designated DMCA agent at dmca@upcot.com containing: (a) a description of the copyrighted work; (b) the URL or other location of the allegedly infringing material; (c) your contact information; (d) a statement that you have a good-faith belief the use is not authorized; (e) a statement under penalty of perjury that the notice is accurate and that you are the copyright owner or authorized to act on their behalf; and (f) your physical or electronic signature. We respond to valid notices in accordance with 17 U.S.C. § 512.
The Platform may contain links to third-party websites, including YouTube videos embedded within course lessons. We are not responsible for the privacy practices of those sites. Where technically feasible, UPCOT uses YouTube’s privacy-enhanced embed mode (youtube-nocookie.com) to limit data transmitted to Google before a user plays a video; however, once a video is played, YouTube’s data collection applies. Embedded YouTube content is subject to Google’s Privacy Policy.
Some browsers transmit Do Not Track (DNT) signals. Because no industry standard has been established for DNT, we do not currently respond to DNT signals. We do, however, honor Global Privacy Control (GPC) signals as described in Section 10.2.
We send two categories of email:
We do not send email on behalf of third parties for advertising purposes. We do not sell email addresses to third-party marketers.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (sent to the address on your account) and by posting the revised Policy with an updated effective date. Your continued use of the Platform after the effective date constitutes your acceptance of the revised Policy. If you disagree with any changes, you must stop using the Platform and may request account deletion as described in Section 10.
For privacy-related questions, requests, or complaints:
We will respond to all privacy requests within 30 days (or within the timeframe required by applicable law, if shorter).