E-Bike Safe Rider Academy Privacy Policy

1. Operator and Privacy Contact

The operator of E-Bike Safe Rider Academy is:

Company

E-Bike Safe Rider LLC, doing business as E-Bike Safe Rider Academy

Website

https://ebikesaferider.com

Privacy Email

privacy@ebikesaferider.com

Telephone

859-414-0964

Mailing Address

2600 Burlington Pike #234, Burlington, KY 41005

Parents and guardians may contact us at privacy@ebikesaferider.com regarding this Privacy Policy, information maintained about a child, consent, deletion, or other privacy matters.

2. Who the Academy Is Designed For

E-Bike Safe Rider Academy provides online e-bike safety education for riders ages 8 through 16.

A parent or guardian creates and manages the household account and rider profiles. Riders may then use Rider Mode to participate in course activities after all applicable account, course-access, privacy, and consent requirements have been satisfied.

For riders under age 13, additional privacy protections apply.

Before an under-13 rider is permitted to use Rider Mode in a way that collects personal information directly from the child, EBSR provides a Child Privacy Direct Notice to the parent or guardian and requires applicable parent verification and child-specific parental consent.

If those requirements are not completed, the applicable Rider Mode access remains locked.

3. Information We Collect From Parents and Guardians

We may collect or maintain information relating to parents or guardians, including:

• name and email address;
• account and authentication information;
• household name, account status, plan type, and rider limits;
• purchase, order, payment-status, refund, dispute, and account-credit information;
• payment-provider transaction references;
• parent-verification records;
• parental consent and course acknowledgment records;
• privacy requests, deletion requests, and consent-withdrawal records;
• notification and email preferences;
• customer-support requests and messages; and
• administrative, security, and account activity records.

When a parent chooses Sign in with Google, Google OAuth is used only for the parent's authentication. Google OAuth is not used as a child sign-in mechanism.

4. Information We Collect About Riders

Depending on the features used, EBSR may collect or maintain the following information about a rider.

Rider profile information

This may include:

• birth month and year, required for new Course Seats;
• historical rider-name and profile information, including full name, preferred name or display name, where previously provided;
• optional primary state, if a parent chooses to provide it later, or historical state values previously provided;
• learning pace, accessibility or related rider settings, including system defaults and optional parent selections.

New Course Seat setup does not collect rider names or require a primary state. We collect birth month and year rather than a full date of birth for age validation, approximate-age determination, under-13 determination and consent routing. Relationship to the rider is collected where required during consent, not during Course Seat creation.

Rider access information

This may include a Rider Mode username and security credentials.

PINs and passcodes are stored in hashed form rather than readable form.

Accessibility and learning preferences

Rider-specific accessibility and learning preferences may include system defaults. Parents may optionally configure these settings.

Course and educational information

We maintain information necessary to provide and document the Academy course, including:

• module, lesson, and section progress;
• knowledge-check and quiz responses and results;
• scenario responses and results;
• Final Exam responses and results, and attempts and retries where applicable;
• optional five-question Rider Readiness Check responses, results and support level, if used; historical placement assessment records may also be maintained;
• mastery information;
• achievements;
• optional structured practice activity, if used; the current practice flow does not collect free-text practice notes;
• graduation, certificate and credential status.

Rider pledge

The current rider pledge records structured commitments and affirmation, not a typed rider signature. Historical typed rider pledge signatures may still be maintained where previously provided. This is separate from the adult consent signature.

Consent and privacy information

For applicable riders, EBSR maintains records documenting:

• direct-notice version;
• Privacy Policy version;
• consent version;
• required acknowledgments;
• typed signature;
• notice presentation time;
• consent time;
• withdrawal status;
• related compliance evidence.

Activity and security information

We maintain limited activity timestamps, security events, audit records, lockout information, and session-security information needed to operate and protect Rider Mode.

EBSR does not maintain a child's email address, telephone number, photo, file upload, messaging history, raw IP address, or device fingerprint as part of the rider-data schema.

Our public credential-verification service may use a salted or otherwise protected hash of a visitor's IP address for rate limiting and abuse prevention. The raw IP address is not retained in that rate-limiting record.

5. How We Use Information

We use personal information only for purposes reasonably related to operating, delivering, improving, administering, and protecting E-Bike Safe Rider Academy.

These purposes include:

• creating and managing parent accounts, households, and rider profiles;
• determining whether child-specific privacy protections apply;
• providing age-appropriate course and assessment experiences;
• delivering lessons, quizzes, practice features, progress tracking, achievements, and credentials;
• operating Rider Mode and protecting rider accounts;
• providing accessibility and rider-specific learning preferences;
• verifying a parent or guardian when required;
• presenting and documenting privacy notices and parental consent;
• processing purchases, refunds, disputes, and related accounting functions;
• sending parent-facing transactional and service communications;
• providing customer support;
• maintaining course, certification, compliance, and audit records;
• preventing abuse and protecting account security;
• investigating technical or security problems; and
• conducting limited first-party analytics used to understand and improve the service.

Our first-party analytics use limited information such as state, age band, and pseudonymous household identifiers.

We do not use third-party behavioral analytics for Rider Mode.

6. Children Under 13 and Parental Consent

EBSR uses additional safeguards when a rider is under age 13.

Before an under-13 rider is permitted to use Rider Mode where personal information will be collected directly from that child, the parent or guardian is presented with a Child Privacy Direct Notice explaining:

• who is collecting the information;
• the categories of information collected;
• how the information will be used;
• relevant service-provider involvement;
• the parent's rights;
• what happens if consent is not provided; and
• how to review, withdraw consent for, or delete child information.

The parent must then complete the applicable child-specific parental-consent process.

The current process requires:

• an established parent-verification record;
• review of the Child Privacy Direct Notice;
• a typed parent signature;
• all required consent acknowledgments; and
• acceptance of the applicable notice, consent, and Privacy Policy versions.

Consent is maintained separately for each under-13 rider.

A payment by itself does not constitute child-specific consent.

Parent verification and child-specific parental consent are separate controls.

If consent is withdrawn, EBSR invalidates the applicable Rider Mode session and prevents further Rider Mode access requiring that consent.

7. Parent Verification

For current paid production enrollment, EBSR uses a successfully verified monetary transaction as its primary production parent-verification method.

Parent verification is created only after EBSR receives and verifies the applicable successful payment event and confirms that the transaction matches the expected purchase and payment environment.

Pending or failed payments do not create parent verification.

A refund may revoke paid course access but does not automatically erase limited parent-verification or consent evidence that EBSR must retain for privacy, compliance, accounting, security, or dispute-resolution purposes.

Complimentary Tester Access does not by itself create a new parent-verification record.

Historical verification evidence created under an earlier testing program may be retained for compliance and audit purposes.

8. Age Information

EBSR uses a rider's birth month and year rather than a full birth date to determine the rider's age category.

Age information is used for purposes including:

• determining whether under-13 privacy protections apply;
• selecting appropriate age-band course or exam experiences; and
• producing limited age-band analytics.

If age information is missing or invalid, EBSR treats the rider conservatively for privacy purposes and applicable Rider Mode access remains restricted.

When a rider ages out of the under-13 category, the service applies the appropriate age-based consent pathway.

9. Service Providers

EBSR uses a limited number of service providers to operate the Academy.

Lovable and Cloudflare infrastructure

Lovable and related Cloudflare infrastructure provide application hosting, delivery, and related technical infrastructure.

Supabase

Supabase provides database, authentication, storage, and related backend services.

Stripe

Stripe processes parent payment transactions and refunds.

EBSR maintains transaction amounts, payment status, order information, provider references, and related records necessary for purchase, refund, accounting, support, fraud-prevention, and compliance functions.

Stripe is used for parent payment information, not as a child identity or Rider Mode provider.

Resend

Resend is used to send parent-facing transactional and service email.

Google OAuth

Google OAuth is available for parent sign-in and authentication only.

It is not used as a child sign-in mechanism.

These providers receive information only as reasonably necessary to perform their services for EBSR.

Current production payments are processed through Stripe.

10. Advertising, Tracking, Sale of Data, and Artificial Intelligence

E-Bike Safe Rider Academy does not:

• sell or rent parent or child personal information;
• use child personal information for targeted or behavioral advertising;
• use advertising pixels for child profiling;
• use cross-site tracking for advertising;
• use third-party advertising networks;
• use third-party behavioral analytics in Rider Mode;
• create marketing profiles of children; or
• use personal information collected through the Academy to train artificial-intelligence models.

Rider Mode loads its course assets, fonts, audio, and application services without unnecessary third-party advertising or tracking requests.

11. Public Certificates and Shared Credentials

EBSR is designed so public credential verification does not reveal a rider's identity.

Public certificate-verification and credential-share pages may display limited information such as:

• credential or course name;
• completion date;
• course version;
• verification code;
• credential type or status;
• expiration information, where applicable.

These public pages do not expose:

• rider full name;
• birth information;
• primary state;
• household identifier;
• internal rider identifier;
• parent identifiers.

Public credential pages are configured not to be indexed by search engines.

When rider information is deleted, credential-verification records may be de-identified rather than deleted so that the integrity of an issued credential can continue to be verified without retaining the rider's identity.

12. Data Retention

EBSR maintains a retention schedule designed to keep information only as long as reasonably necessary for the purpose for which it was collected.

Our principal retention periods include:

Raw payment webhook bodies

90 days.

Detailed learning activity

400 days.

First-party analytics

400 days.

Certificate share tokens

400 days.

Summary educational records

Generally 36 months of inactivity, with advance parent notice before scheduled deletion.

Consent and compliance evidence

Up to 5 years after the applicable consent or verification relationship is no longer in effect.

Financial and accounting records

Generally 7 years after the end of the calendar year in which the transaction, refund, dispute, chargeback, or related financial matter is finally resolved.

Certificate verification records

May be de-identified rather than deleted so that the credential can continue to be verified without retaining the rider's identity.

For consent and compliance evidence, the retention period may begin when:

• consent is withdrawn;
• rider information is deleted;
• an account closes;
• the rider ages out of the applicable consent pathway; or
• the verification relationship otherwise becomes inoperative.

When rider information is deleted, EBSR does not retain the ordinary rider profile or course information merely because compliance evidence must be preserved.

Compliance records are minimized and may use opaque or non-identifying references where appropriate.

Financial retention does not mean that a child's ordinary profile, course progress, accessibility information, or assessment answers are retained for seven years.

Records may be retained longer when reasonably necessary because of:

• a legal hold;
• pending litigation or investigation;
• an audit;
• a tax examination;
• a court order;
• an unresolved dispute;
• a chargeback.

Once the exceptional need ends, the normal retention schedule resumes.

13. Parent Rights and Privacy Controls

Parents and guardians can use EBSR's Privacy & Data tools to exercise privacy controls relating to their household and riders.

Depending on the request, a parent may:

• review information maintained about a rider;
• view stored data categories and record counts;
• obtain an appropriate downloadable summary of rider information;
• withdraw child-specific consent;
• request deletion of a rider's personal information;
• request deletion of the family account, where authorized; and
• prevent further collection or use of child personal information by withdrawing applicable consent.

For security, EBSR may require recent reauthentication before destructive privacy actions.

When a rider is deleted, EBSR invalidates Rider Mode access and sessions before completing deletion.

Certain limited information may remain after deletion when necessary for financial, legal, compliance, fraud-prevention, dispute-resolution, credential-verification, or audit purposes.

Those records are minimized where appropriate and remain subject to the applicable retention schedule.

Parents may contact privacy@ebikesaferider.com for assistance exercising these rights.

14. Data Security

EBSR maintains technical and administrative safeguards designed to protect parent and rider information.

These safeguards include:

• server-side authorization controls;
• row-level database security;
• role-based administrative access;
• separation of privileged service credentials;
• encrypted server-side secrets;
• hashed Rider Mode credentials;
• account lockout controls;
• administrative audit records;
• session invalidation;
• authenticated and signature-verified payment webhooks; and
• rate limiting on public credential-verification services.

No method of electronic storage or transmission can guarantee absolute security, but EBSR uses safeguards appropriate to the nature of the information it maintains and periodically reviews its privacy and security controls.

15. Data Minimization

EBSR seeks to collect only the personal information reasonably necessary to operate the Academy and provide its educational, safety, account, privacy, security, and certification functions.

Optional features such as accessibility preferences, Rider Readiness checks, practice logs, and certain feedback or mastery information are not required merely to create a rider profile or participate where those features are not necessary.

We do not condition a child's participation on providing more personal information than is reasonably necessary for the relevant activity.

16. Changes to This Privacy Policy

We may update this Privacy Policy when our services, legal obligations, service providers, or information practices change.

When we make a material change affecting information practices for children under age 13, we will update the applicable Privacy Policy and notice versions and provide additional notice or obtain new parental consent when required.

The Effective Date at the top of this Privacy Policy identifies the version currently in effect.

17. Contact Us

Questions or requests regarding privacy or information maintained about a child may be directed to:

Company

E-Bike Safe Rider LLC, doing business as E-Bike Safe Rider Academy

Privacy Email

privacy@ebikesaferider.com

Telephone

859-414-0964

Mailing Address

2600 Burlington Pike #234, Burlington, KY 41005

Website

https://ebikesaferider.com