100for100 Privacy Policy

Overview

100for100 is a mastery-based learning and rewards service. Students may complete diagnostics, lessons, practice activities, assessments, challenges, and other learning work across supported subjects. When a student meets applicable mastery requirements, 100for100 may verify the result and make a reward available under the program rules.

Different plans, schools, subjects, and programs may have different learning paths, reward amounts, reward limits, review steps, or eligibility rules. This policy covers the information we process to operate those services.

Who We Are

100for100 is operated by TimeBack Rewards LLC, a Wyoming limited liability company. In this policy, "100for100," "we," "us," and "our" mean TimeBack Rewards LLC and the 100for100 service.

Privacy and student data requests can be sent to privacy@hundredforhundred.com or by mail to the address at the end of this policy.

Eligibility and Age

100for100 is intended for use by students with the involvement of a parent, guardian, school, teacher, or other authorized adult. We do not knowingly allow children under 13 to create or use a 100for100 account without verifiable parental consent or appropriate authorization from a school or educational organization acting under applicable law.

If you believe a child has provided personal information to 100for100 without proper consent, please contact us at privacy@hundredforhundred.com and we will take appropriate steps to delete the information.

Information We Collect

We collect information in the categories below. The categories below also serve as our disclosure of "categories of personal information" for purposes of applicable U.S. state privacy laws.

Account information. Name, email address, phone number, account credentials, role, organization or school affiliation, sign-in information, and the parent, guardian, school, teacher, or administrator relationship to a student.

Student profile information. Student name, display name, grade level, supported subjects, learning settings, enrollment status, school or family links, reward preferences, and other profile details needed to configure the student experience.

Diagnostic, learning, and mastery records. Information about diagnostic assessments, placement, grade-level or subject-specific gaps, assigned learning paths, lessons, practice activity, assessment attempts, submitted answers, scores, mastery status, subject mastery records, review outcomes, progress history, and timestamps.

Reward information. Reward eligibility, qualifying mastery milestones, selected reward options, reward amount, reward status, reward delivery status, claim links or redemption details, and related reward communications.

Payment and billing information. Information needed to process subscriptions, reward-related charges, invoices, payment confirmations, billing support, refunds, disputes, and account administration. Payment card information is handled by our PCI-compliant payment provider and is not stored directly by 100for100.

Integrity, fraud-prevention, and safety information. Information related to account activity, assessment activity, mastery review, suspicious activity signals, timestamps, device or session activity, and other information used to detect or review cheating, fraud, abuse, unauthorized access, or misuse.

Usage, device, diagnostic, and security information. IP address, device type, browser type, operating system, app version, identifiers, authentication events, product interactions, pages or screens viewed, logs, crash reports, performance data, and security events.

Support and communications information. Information you provide when you contact us, request support, submit feedback, respond to messages, schedule a call, or otherwise communicate with 100for100.

Information from service providers and partners. Information we receive from learning, assessment, authentication, payment, reward fulfillment, email, analytics, infrastructure, support, school, or other service providers that help us operate 100for100.

Sensitive personal information. We do not intentionally collect Social Security numbers, driver's license numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic data, biometric identifiers, health information, or information about sex life or sexual orientation. We do not knowingly collect camera or microphone recordings, biometric identifiers, screen recordings, or keystroke biometrics from students unless we clearly disclose that a specific 100for100 feature requires it and obtain any required consent.

Sources of Information

We collect the information above from: (a) parents, guardians, and other adults who create or manage accounts; (b) students who use the Service; (c) schools, districts, and educational organizations that authorize student use; (d) automatically from devices that interact with the Service; and (e) from service providers, payment processors, reward providers, and other partners that help us operate the Service.

How We Use Information

We use information to:

• Create, authenticate, and manage parent, guardian, student, school, teacher, and administrator accounts.
• Administer diagnostics and identify grade-level or subject-specific learning gaps.
• Place students into appropriate learning paths and track progress toward mastery.
• Provide progress dashboards, reports, and account management tools to authorized adults, schools, teachers, and administrators.
• Review and verify mastery before rewards are issued.
• Operate the rewards program, including reward selection, fulfillment, delivery, support, and status tracking.
• Process subscriptions, reward-related charges, invoices, payment confirmations, refunds, disputes, and billing support.
• Send transactional emails, service updates, reward notifications, billing notices, and support messages.
• Respond to support requests and troubleshoot product issues.
• Maintain security, prevent fraud and abuse, detect unauthorized access, and protect service integrity.
• Improve product reliability, accessibility, curriculum, assessments, mastery review workflows, and user experience.
• Comply with legal obligations, enforce our terms, resolve disputes, and protect the rights, safety, and property of 100for100, students, families, schools, and others.

We may use de-identified or aggregated information for analytics, research, reporting, product improvement, and business purposes. De-identified or aggregated information does not identify a specific person, and we do not attempt to re-identify it except as permitted by law.

Children's Privacy (COPPA)

100for100 complies with the Children's Online Privacy Protection Act ("COPPA") for users under 13.

Information we collect from children under 13. When a child under 13 uses 100for100, we collect only the information described in the "Information We Collect" section that is reasonably necessary to provide the educational service, verify mastery, deliver rewards through an adult account, maintain security, and support the child's experience.

Verifiable parental consent. Before we collect personal information from a child under 13 outside the context of a school authorization (described in the next section), we obtain verifiable parental consent from a parent or legal guardian. Depending on the situation, we may verify consent through methods such as a signed consent form, payment card transaction, government-issued identification check, or another method permitted under COPPA.

Parental rights under COPPA.

Parents and guardians of a child under 13 may:

• Review the personal information we have collected from the child.
• Request that we delete the child's personal information.
• Refuse to permit further collection or use of the child's personal information.
• Agree to the collection and use of the child's personal information but not its disclosure to third parties (other than service providers acting on our behalf).

To exercise these rights, contact us at privacy@hundredforhundred.com. We may need to verify your identity and your relationship to the child before acting on your request.

Direct notice to parents. When required by COPPA, we provide direct notice to parents describing the information we collect from the child, how we use and disclose it, and how parents can exercise their rights.

Not conditioned on excessive collection. We do not condition a child's participation in 100for100 on the disclosure of more personal information than is reasonably necessary to participate.

School Use and Student Records (FERPA)

When 100for100 is used by or through a school, district, teacher, or other educational organization, we process student information to provide the services requested by that organization. This may include diagnostics, learning paths, progress reporting, mastery verification, reward administration, account support, security, and service improvement.

School authorization in place of parental consent. For users under 13 enrolled through a school, district, or educational organization, the school may authorize the collection of student personal information for educational purposes on behalf of parents, consistent with COPPA's school authorization provisions and applicable state student privacy laws.

FERPA "school official" designation. Where 100for100 receives "education records" subject to the Family Educational Rights and Privacy Act ("FERPA"), 100for100 acts as a "school official" with a "legitimate educational interest" in the records under 34 CFR § 99.31(a)(1)(i)(B), and remains under the direct control of the educational institution with respect to the use and maintenance of those records. We do not re-disclose education records except as permitted by FERPA or as directed by the educational institution.

No behavioral advertising on school data. We do not use student information from school accounts for behavioral advertising, and we do not sell or share student personal information.

Access and deletion through schools. Schools and other educational organizations may request access, correction, export, deletion, or retention review of student information associated with their accounts. Parents whose students use 100for100 through a school should direct FERPA-related requests (such as inspection or amendment of education records) to the school. We will work with the school to support such requests.

State student privacy laws. We comply with applicable state student data privacy laws, including but not limited to California's Student Online Personal Information Protection Act (SOPIPA), Texas's Student Privacy Act (Tex. Educ. Code § 32.151 et seq.), New York Education Law § 2-d, and other comparable state laws governing student data.

Rewards and Mastery Verification

100for100 may offer rewards when students meet defined achievement criteria, such as verified mastery of a subject, grade-level standard, assessment, challenge, or other qualifying milestone.

Before a reward is issued, we may review relevant learning, assessment, account, reward, and activity information to confirm eligibility and protect the integrity of the program. If a review identifies suspicious activity, potential cheating, fraud, misuse, or an account issue, a reward may be delayed, reviewed manually, rejected, or otherwise handled according to our terms and program rules.

Rewards may be fulfilled by third-party reward providers. Reward claim links or redemption details may be delivered to a parent, guardian, school, or other authorized adult depending on the account setup. Parents, guardians, and schools are responsible for supervising student use of rewards.

Reward amounts, limits, eligible activities, and tax treatment are described in the program rules and applicable terms. Recipients are responsible for any taxes associated with rewards they receive.

Payments

100for100 offers paid plans and may include reward-related charges. Parents, guardians, schools, or other payors may be charged subscription fees and reward-related amounts according to the pricing and billing terms presented during signup, checkout, or account administration.

We use third-party payment processors to handle payment information, process charges, manage invoices, and support billing-related activity. Payment card data is transmitted directly to our payment processor under PCI-DSS-compliant procedures. We do not directly store full payment card numbers.

How We Share Information

We share information only as needed to operate, support, protect, and improve 100for100, or as otherwise described in this policy.

Service providers. We use service providers to host the product, operate authentication, process payments, fulfill rewards, send email, provide analytics and diagnostics, support customers, maintain security, and support other operational functions. These providers may process information only as needed to provide services to 100for100 and our users, and are bound by contractual confidentiality and data protection obligations.

Learning, assessment, and school partners. We may share information with learning, assessment, school, or educational platform partners as needed to administer diagnostics, deliver learning paths, evaluate progress, verify mastery, provide reports, and support the educational experience.

Payment and reward providers. We may share information with payment processors and reward providers as needed to process subscriptions, charge reward-related amounts, issue rewards, deliver claim links, manage reward status, handle disputes, and support billing or reward operations.

Parents, guardians, schools, and authorized users. Depending on the account type and program configuration, we may share student progress, diagnostic results, assessment results, mastery status, reward status, account information, and related records with parents, guardians, schools, teachers, administrators, or other authorized users.

Affiliates, contractors, and business operations. We may share information with affiliates, subsidiaries, contractors, advisors, and business partners where needed to operate, improve, support, secure, or administer 100for100.

Legal, safety, and compliance. We may disclose information when required by law, subpoena, court order, legal process, or government request, or when we believe disclosure is necessary to protect safety, prevent fraud or abuse, enforce our terms, investigate misconduct, protect our rights, or maintain the security and integrity of the service.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred or disclosed as part of that transaction, subject to appropriate protections. We will provide notice and an opportunity to object where required by applicable law or contract.

Analytics, Cookies, and Tracking

100for100 uses cookies, local storage, logs, and similar technologies for the following categories of purposes:

• Strictly necessary: Keep users signed in, maintain session state, protect against fraud and abuse, and enable core functionality.
• Functional: Remember preferences, language, and account settings.
• Performance and analytics: Understand whether the product is working correctly, diagnose issues, measure educational effectiveness, and improve service reliability.
• Security: Detect unauthorized access, prevent abuse, and protect account integrity.

For students, analytics and diagnostic data are used for internal operations, product reliability, security, support, educational improvement, and service performance. We do not use student personal information to track students across other companies' apps or websites for behavioral advertising, and we do not allow third parties to do so through the student product.

Do Not Track and Global Privacy Control. Some browsers transmit "Do Not Track" or Global Privacy Control ("GPC") signals. Because 100for100 does not engage in cross-context behavioral advertising or sell personal information, these signals do not change how we process information in the student product. Where applicable law requires us to treat a GPC signal as an opt-out of "sale" or "sharing," we do so.

You may be able to disable cookies through your browser settings, but some parts of the service may not work correctly without them.

Data Retention

We keep information for as long as reasonably necessary to provide 100for100, maintain accounts, support learning records, process payments and rewards, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud or abuse, maintain security, and support legitimate business operations.

Specific retention practices include:

• Account and profile information: Retained while the account is active. After account closure, retained for up to 90 days for account recovery and reactivation, then deleted or de-identified, except as required for the categories below.
• Learning, diagnostic, progress, and mastery records: Retained while the account is active and for up to 7 years after account closure to support educational records, parent or school access, and program administration. School-account records are retained according to the school's instructions and applicable law.
• Payment, invoice, tax, and accounting records: Retained for at least 7 years or longer as required by tax, accounting, and financial recordkeeping laws.
• Reward records: Retained for up to 7 years after the reward is issued to verify eligibility, prevent abuse, support users, comply with tax obligations, and maintain program records.
• Security, fraud-prevention, and integrity records: Retained for up to 4 years to protect the service, investigate misuse, enforce program rules, and comply with legal obligations.
• Support communications: Retained for up to 3 years from the date of the communication.

When information is no longer needed, we delete it, de-identify it, or retain it only as permitted or required by law.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, loss, misuse, alteration, or disclosure. These include encryption of data in transit, encryption of stored sensitive data, access controls, authentication requirements for staff with access to personal information, vendor due diligence, monitoring, and routine security review.

No internet or electronic storage system is completely secure. We cannot guarantee absolute security, but we work to protect information and maintain the reliability and integrity of the service.

Breach notification. In the event of a security breach affecting personal information, we will notify affected users, parents, guardians, schools, and regulators as required by applicable law and within the timeframes those laws require.

Your Choices and Rights

Depending on where you live and how you use 100for100, you may have rights to request access, correction, deletion, export, portability, restriction, objection, appeal, or other controls over personal information.

Parents and guardians may request access to, correction of, deletion of, export of, or review of their child's personal information, subject to applicable law and necessary exceptions.

How to submit a request. Send privacy requests to privacy@hundredforhundred.com. Please include enough information for us to identify your account and the nature of your request.

Verification. We may need to verify your identity and authority before processing a request. For requests about a child's information, we may need to verify your relationship to the child. For school-account requests, we may need to verify your authorization from the school.

Authorized agents. You may designate an authorized agent to submit a privacy request on your behalf. We may require the agent to provide proof of authorization and may also contact you directly to verify the request.

Response timing. We will respond to verifiable privacy requests within the timeframes required by applicable law (generally 45 days for U.S. state privacy law requests, with one extension where permitted).

Appeals. If we decline a privacy request, you may appeal by replying to our response or contacting us at privacy@hundredforhundred.com. We will respond to the appeal within the timeframes required by applicable law.

Exceptions. Some information may be retained or processed despite a request where necessary for security, fraud prevention, billing, tax, legal compliance, dispute resolution, school recordkeeping, child safety, or other purposes permitted by law.

U.S. State Privacy Rights

Some U.S. state privacy laws may provide additional rights, depending on where you live and how 100for100 is offered. These rights may include the right to:

• Know or access the personal information we have collected about you.
• Correct inaccurate personal information.
• Delete personal information.
• Obtain a portable copy of personal information.
• Opt out of the sale or sharing of personal information.
• Opt out of targeted advertising.
• Limit the use and disclosure of sensitive personal information.
• Opt out of certain profiling decisions that produce legal or similarly significant effects.
• Appeal a decision about a privacy request.
• Be free from retaliation for exercising privacy rights.

100for100 does not sell personal information and does not share personal information for cross-context behavioral advertising. We do not use student personal information for behavioral advertising, and we do not engage in profiling that produces legal or similarly significant effects on consumers.

California (CCPA/CPRA). California residents have the rights described above. California's "Shine the Light" law (Cal. Civ. Code § 1798.83) permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes; we do not share personal information with third parties for their direct marketing purposes.

Texas (TDPSA). Texas residents have the rights described above under the Texas Data Privacy and Security Act, including the right to appeal as described in this policy.

Nevada. Nevada residents have the right to opt out of the sale of certain personal information. We do not sell personal information, but if you would like to submit a request, you may contact us at privacy@hundredforhundred.com.

Other states. Residents of Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, and other states with comprehensive privacy laws have rights substantially similar to those described above, subject to each law's specific terms and exceptions.

To exercise privacy rights, contact us at privacy@hundredforhundred.com.

Third-Party Links and Services

100for100 may link to or integrate with third-party websites, learning tools, payment pages, reward portals, or other services. Those third parties may have their own privacy policies and terms. We are not responsible for the privacy practices of third-party services that are not controlled by us.

International Users

100for100 is designed for use in the United States. If you access the service from outside the United States, your information may be processed in the United States or other locations where we or our service providers operate, and you consent to that processing by using the service. Data protection laws in those locations may differ from the laws of your jurisdiction.

Accessibility

We are committed to providing an accessible Service. If you need this Privacy Policy in an alternative format, or if you have accessibility feedback, please contact us at privacy@hundredforhundred.com.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify users, such as by posting the updated policy, updating the "Effective Date" and "Last Updated" date at the top of this policy, sending an email or in-product notice, or providing additional notice where required by law. For changes that require consent under COPPA or other applicable laws, we will obtain consent before applying the change to information collected under the prior version of this policy.

Contact

Privacy, student data, and parent requests can be sent to:

For California-specific or other state-specific privacy requests, please indicate the applicable state in your message so we can route your request appropriately.