Privacy policy

Field	Detail
Organization	Inner Explorer Inc
Contact email	info@innerexplorer.com
Business address	1990 Main Street, Suite 750, Sarasota, FL 34236
Product name	Inner Explorer
Product type	Website and web application
Effective date	August 6, 2026 (supersedes the policy dated February 1, 2025)

Introduction

At Inner Explorer Inc (“the company,” “we,” or “us”), we respect your privacy and are committed to protecting it as described in this privacy policy (“Policy” or the “Privacy Policy”). This Policy describes the types of information we may collect from you or that you may provide when you use our product, Inner Explorer (“the product,” “the service,” “the website,” “the app,” or “product”), and our practices for collecting, using, maintaining, protecting, and disclosing that information. Your use of the Product and Services and any information you provide on the Services are subject to the terms of this Privacy Policy, which is incorporated into and subject to our Terms of Service. Where we have signed a student data privacy agreement (“DPA”) or similar agreement with a school, district, or educational agency, the terms of that agreement control in the event of any conflict with this Policy.

Personal information that we collect

Category	Types we collect	Purpose for collection
Educator account information	Educator first and last name; school-issued (education) email address; account password (stored in encrypted/hashed form)	Account creation and management; authentication; service delivery
Organization information	School name; district name; role/grade band served	Service delivery; program administration; district-level reporting
Web browser and device data	IP address; browser and device type; in-app web browsing	App functionality; security; product personalization
Product usage data	Usage analytics for educator accounts (e.g., logins, features used, practices played)	Analytics; service improvement; aggregate program reporting to schools and districts
Student information	NONE. We do not collect any student information.	Not applicable

Data collection

We collect Personal Information you provide to us (such as the information you enter when creating an educator account), as well as Personal Information collected automatically (such as IP address and product usage data) as described below. For the purpose of this Policy, Personal Information is defined as information that identifies, relates to, or could reasonably be linked with or describes an individual or household, either directly or indirectly.

Limited Personal Information is processed on our behalf by the service providers that operate our platform and analytics, as described in the “Platform, hosting, and service providers” section below. These service providers act only on our instructions, under written agreements, and are prohibited from using your information for their own purposes. We do not combine data with additional data from third-party sources, and no third party is permitted to collect Personal Information through our product for its own use.

Collection is limited to what the product requires. Users cannot create or upload content. User information does not have to be shared or revealed in order to participate in social interactions. Aggregated or combined information, representing a collective summary of data, is treated with the same level of confidentiality and protection as personally identifiable information (PII) on our platform.

How we use your personal information

Collection and use of data is limited to product requirements, and the use of Personal Information is limited to the purposes for which it was collected. This includes:

• Service delivery: providing, operating, securing, and improving the service.
• Analytics and research using aggregated or de-identified information, for example demonstrating program usage and effectiveness to the schools and districts we serve.
• Communications with account holders about the service, including new education product updates, features, or services.
• Compliance with legal obligations.
• Retention as described below.

We do not use Personal Information for targeted advertising. We do not sell Personal Information. We do not permit partners or third parties to create data profiles for personalized advertisements, and data is not collected by the product for the purpose of tracking users across other sites or services.

Platform, hosting, and service providers

The Inner Explorer platform is built and hosted on infrastructure provided by Spotlight Series Holdings, Inc. (d/b/a Blueprint), our platform services provider. All Inner Explorer data is hosted on MongoDB Atlas on Google Cloud Platform within the United States (us-central1 region). The platform employs the following safeguards:

• Encryption in transit using SSL/TLS (TLS 1.2 or higher) and encryption at rest using AES-256 standards;
• Secure Virtual Private Cloud (VPC) configurations and Role-Based Access Control (RBAC), so only authorized personnel can access relevant data;
• Multi-Factor Authentication (MFA) and strong identity management controls protecting administrative access;
• Continuous audit logging of security events, administrative activities, and system access;
• Automated backups, disaster recovery procedures, and redundant cloud infrastructure; and
• A security architecture incorporating controls aligned with NIST SP 800-53, including identity and access management, encryption, audit logging, continuous monitoring, incident response, and risk management.

We also use Amplitude, Inc. as our analytics provider to understand how educators use the product so we can improve it. Amplitude processes educator account usage data only, acts solely as a service provider on our instructions, and maintains SOC 2 Type II and ISO 27001/27017/27018 certifications with encryption of data in transit and at rest. No student information exists in our environment, so no student information is hosted by Blueprint or transmitted to Amplitude.

Both providers are bound by written agreements that require security protections no less stringent than our own commitments to the schools and districts we serve, prohibit any sale of data or use of data for advertising, and require secure deletion of data. A current list of our service providers is available upon request at info@innerexplorer.com.

Data retention and deletion

We maintain a formal Data Retention Policy to establish clear guidelines on the lifecycle management of our data, ensure compliance with legal and regulatory requirements, bolster data security, and demonstrate a commitment to responsible and transparent data management practices within our organization. Personal Data that we collect will be deleted when it is no longer necessary to provide you with our services. We delete Personal Data upon account cancellation or termination, and upon expiration or termination of a school or district agreement we securely delete the associated data from active systems, backups, and logs using industry-standard secure deletion methods; written certification of deletion is available to educational agencies upon request.

In some cases, we may retain Personal Data beyond the length of time that you have an account with us in order to resolve disputes, comply with legal and compliance obligations, or otherwise. Anonymized data, which is no longer attached to you personally, may be retained for longer periods of time.

How we share your personal information

Collected information is only shared with the service providers described above, or with third parties the customer has authorized through a contractual arrangement. Contractual limits are placed on all third-party data use. Personal information is not shared for third-party marketing. Personal information is not sold or rented to third parties. Where user information is shared for reporting purposes, it is shared in an anonymous, aggregated, or de-identified format.

In the event of a merger, acquisition, or sale of all or substantially all of our assets, user information may be transferred only to a successor that assumes, in writing, the privacy and security obligations of this Policy and of our agreements with educational agencies, and we will provide written notice to affected schools and districts as required by those agreements and applicable law.

We do not display your personal information that you have submitted to us or that we have collected in the product. Third parties with access to information are required to provide the same security protections as the company.

Student data and education records

Because students never use accounts or enter information, Inner Explorer does not collect student education records or student personal information as defined under the Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act (COPPA), or state student privacy laws (including, for example, New York Education Law §2-d, Illinois SOPPA, and California SOPIPA). Where required, we enter into student data privacy agreements with schools, districts, and educational agencies and, in performing services under those agreements, we act as a “school official” under the direction and control of the educational agency. If our data collection practices were ever to change such that student information would be collected, we would notify our school and district partners immediately and in advance, and such collection would be governed by our agreements with those agencies.

We will never sell student information, use it for targeted advertising, or build advertising profiles. There is no student information in our systems to begin with, and our agreements with educational agencies prohibit these practices in all cases.

Your choices

Users can control how their data is displayed to others. We provide authorized employees a method to access or review a user’s personal information in accordance with our security and access policies. Users can opt out of marketing communications at any time using the unsubscribe mechanism in each message or by contacting us at info@innerexplorer.com. The product does not serve contextual or personalized advertising.

To use our Products and Services, you are required to create an account. During the account creation process, we will collect certain information to establish and manage your account effectively. This information may include, but is not limited to, your name, school-issued email address, and a password of your choice. Your account allows you to personalize your experience, track your activities, and access additional features. We are committed to protecting the privacy and security of your account information in accordance with this Privacy Policy. Our platform is equipped with access control mechanisms, allowing you to define and manage permissions for your data.

Other sites and services

The Service may contain links to websites, mobile applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or in mobile applications or other online services that are not associated with us. We do not control websites, mobile applications, or online services operated by third parties, and we are not responsible for their actions. Third-party login is not supported for our Products and Services.

Cookies and similar technologies

A cookie is a text file that is placed on your hard disk by a web page server. Our product uses only the technologies necessary to operate the service: session and authentication technologies that keep you signed in securely, and analytics identifiers used by our analytics provider to understand product usage by educator accounts. We do not use advertising cookies, and we do not use cookies or similar technologies to track users across third-party sites or services.

Sweepstakes, contests, and other promotions

We do not ask users to participate in any third-party sweepstakes, contests, or other similar promotions.

Security

We use industry-standard security practices to protect data throughout its lifecycle. All data in transit is encrypted using TLS 1.2 or higher, and all data at rest is stored in an encrypted format using AES-256 standards. Employee and physical access to user information is limited through role-based access controls and least-privilege principles, administrative access is protected by multi-factor authentication, and security events and administrative activities are continuously logged to support monitoring and forensic investigation. Our security program is aligned with nationally recognized frameworks, including the NIST Cybersecurity Framework.

We maintain a written incident response plan consistent with industry standards and applicable federal and state law. Users are provided notice in the event of a data breach affecting their personal information, and we notify affected school and district partners within the timelines required by our agreements with them (in most cases within 72 hours of confirmation of an incident) and by applicable law.

Your privacy rights

Except as otherwise provided, this section applies to residents of states where they have privacy laws applicable to us that grant their residents the rights described below. For purposes of this section, “personal information” has the meaning given to “personal data,” “personal information,” or similar terms under the applicable privacy laws of the state in which you reside. Please note that not all rights listed below may be afforded to all users, and that if you are not a resident of the relevant states, you may not be able to exercise these rights. In addition, we may not be able to process your request if you do not provide us with sufficient detail to allow us to confirm your identity or understand and respond to it. In some cases, we may provide a different privacy notice to certain categories of residents of these states, such as job applicants, in which case that notice will apply with respect to the activities it describes instead of this section.

Verification: Upon receipt of your request, we will initiate the identity verification process to confirm that you are the individual for whom we hold information in our system. This verification procedure necessitates your cooperation in supplying relevant information, allowing us to compare it with the details you previously furnished. Depending on the nature of your request, we may request specific information to align with our existing records, or we may reach out to you using a previously provided communication method (such as phone or email). In certain situations, alternative verification methods may be employed based on the circumstances. Any personal information disclosed in your request will be used solely to confirm your identity or validate your authority to make the request. Any supplementary information you provide for verification will be promptly deleted upon the completion of the verification process.

Authorized agents: Your authorized agent may be able to make a request on your behalf. However, we may need to verify your authorized agent’s identity and authority to act on your behalf. We may require a copy of a valid power of attorney given to your authorized agent pursuant to applicable law. If you have not provided your agent with such a power of attorney, we may ask you to take additional steps permitted by law to verify that your request is authorized.

• Access: You can request a copy of the personal information that we have collected about you.
• Correction: You can request that we correct inaccurate personal information that we have collected about you.
• Deletion: You can request that we delete your personal information. Please note that once we process a deletion request, we may be unable to provide access or support to any past products or services.

We never sell any data to third parties, and we do not “share” personal information with advertising partners for targeted advertising as those terms are defined under the CCPA and similar state laws, so there is no sale or sharing to opt out of. You have the right to request details on the personal information that we disclosed to a third party for a business purpose.

Children’s privacy notice

Our service is used in classrooms serving preschool through high school students, including children from 2 to 18 years old. The product is operated entirely by adult educators: students do not create accounts, do not log in, and cannot interact with the product or with other users. We do not collect Personal Information from any children, including those 18 years old and younger, and no student information of any kind, including names, identifiers, usage data, or metadata, is collected, stored, or processed by us or by our service providers. Because we collect no information from children, the parental consent requirements of COPPA are not triggered by our product. This service also provides guidance for parents or guardians to ensure a safe experience for their children, and we will notify our school and district partners immediately and in advance if these practices were ever to change.

Changes to this privacy policy

In addition to modifying this Privacy Policy and updating the effective date, we will contact you (either through the product or otherwise) to gain your consent if we change or modify the practices in which data is collected. We will provide our school and district partners with advance written notice before making material changes to this Privacy Policy as it applies to school services.

How to contact us

If you have questions or concerns regarding this Privacy Policy, please contact us using the means described in this section. A grievance or remedy mechanism is available for users to file a complaint if their content or account is restricted or removed.

• Email: info@innerexplorer.com
• Address: 1990 Main Street, Suite 750, Sarasota, FL 34236