KIDZMAPS COPPA COMPLIANCE POLICY

Children's Online Privacy Protection

Last Updated: February 14, 2026

1. INTRODUCTION AND COMMITMENT

KidzMaps, LLC ("Company," "we," "us," or "our") is committed to protecting the privacy and safety of children. This COPPA Compliance Policy describes how we comply with the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. §§ 6501–6506, and the FTC's COPPA Rule, 16 C.F.R. Part 312.

Our Core Principle: The KidzMaps Platform is designed for use by adults (Parents and Activity Providers). Children under 13 are not permitted to create accounts, make bookings, submit reviews, or interact directly with the Platform. All child-related information is provided by and controlled by the Parent or legal guardian.

2. DEFINITIONS

• "Child" or "Children": Any individual under the age of 13.
• "Parent": A parent or legal guardian of a Child.
• "Personal Information" (COPPA definition): First and last name; home or physical address; email address; telephone number; Social Security number; photograph, video, or audio file containing a Child's image or voice; geolocation information; persistent identifier when linked to individually identifiable information; or any other information permitting physical or online contact with a Child.

3. INFORMATION WE COLLECT ABOUT CHILDREN

3.1 What We Collect

We collect only the minimum information necessary to facilitate Activity bookings made by Parents on behalf of their Children:

• Child's Name: Used to identify the child for Activity enrollment and attendance.
• Child's Age or Date of Birth: Used to match Children with age-appropriate Activities.
• Activity Preferences/Interests: Optional information provided by the Parent to recommend suitable Activities.
• Allergies or Medical Information: Only when voluntarily provided by the Parent for safety purposes, shared only with the relevant Activity Provider.

We do NOT collect from Children:

• Email addresses, phone numbers, or Social Security numbers of Children
• Photographs or videos uploaded by Children
• Precise geolocation data of Children
• Social media identifiers of Children
• Any information directly from Children without verifiable parental consent

3.2 How We Collect It

All information about Children is provided by the Parent/Guardian through their own account. Children do not create accounts, fill out forms, or directly provide any information to the Platform.

4. VERIFIABLE PARENTAL CONSENT

4.1 Consent Mechanisms

Before we collect, use, or disclose any Personal Information about a Child, we obtain verifiable parental consent through the following methods:

• Click-Wrap Consent During Booking: During the booking process, Parents must affirmatively check a consent checkbox (which is not pre-selected) acknowledging that they have read this COPPA Compliance Policy and consenting to the collection and sharing of their Child's information as described herein. The booking cannot be completed without this affirmative consent.
• Credit Card Verification: The act of providing payment card information during booking, processed through Stripe with address verification (AVS), serves as additional verification that the consenting individual is an adult Parent/Guardian.
• Email-Plus Method: For any data collection beyond what is necessary for the booking (e.g., marketing uses, surveys), we send a detailed consent notification to the Parent's verified email address describing the additional information to be collected, with a mechanism to provide or deny consent. We confirm consent via delayed confirmation email or phone callback.

4.2 Scope of Consent

By completing the booking process with the required consent checkbox, Parents authorize us to:

1. Collect the Child information listed in Section 3.1;
2. Share such information with the applicable Activity Provider for enrollment, attendance, and safety;
3. Use such information to recommend age-appropriate Activities to the Parent; and
4. Retain such information for the duration of the Parent's active account.

4.3 Limitations

We will not condition a Child's participation in any activity or Platform feature on the disclosure of more Personal Information than is reasonably necessary to participate.

5. HOW WE USE CHILDREN'S INFORMATION

Permitted uses:

• Facilitating Activity bookings made by the Parent;
• Enabling Activity Providers to manage enrollment and attendance;
• Matching Children with age-appropriate Activities;
• Communicating health and safety information to Providers as directed by the Parent; and
• Compliance with legal obligations.

Prohibited uses — we do NOT:

• Use Children's information for behavioral advertising or targeted marketing;
• Build individual profiles of Children for commercial purposes;
• Sell, rent, or share Children's information with advertisers or data brokers; or
• Use Children's information for any purpose not directly related to the Activity booking.

6. DISCLOSURE OF CHILDREN'S INFORMATION

• Activity Providers: Only the specific Provider with whom the Parent has booked, limited to information necessary for enrollment, attendance, and safety.
• Service Providers: Trusted service providers under contract (e.g., hosting), contractually prohibited from using the information for any other purpose.
• Law Enforcement: When required by law, court order, or to protect a Child's safety.

We NEVER sell, rent, or share Children's information with advertisers, data brokers, or third parties for commercial purposes.

7. PARENTAL RIGHTS

7.1 Right to Review

Parents may review all Personal Information collected about their Child by logging into their account or contacting privacy@kidzmaps.com.

7.2 Right to Delete

Parents may request deletion of their Child's information at any time by removing the Child's profile in account settings, contacting privacy@kidzmaps.com, or requesting full account deletion. We process deletion requests within 10 business days and direct applicable Activity Providers to delete such information.

7.3 Right to Withdraw Consent

Parents may withdraw consent for future collection at any time. Withdrawal may affect the ability to book Activities through the Platform.

7.4 Right to Refuse Further Collection

Parents may decline further collection while permitting previously collected information to be used for existing bookings.

8. DATA SECURITY

We maintain reasonable procedures to protect Children's Personal Information, including:

• Encryption at rest and in transit;
• Access controls limiting internal visibility of Children's data;
• Annual security training for employees handling Children's data;
• Contractual requirements for equivalent protections by Providers and service providers; and
• Prompt deletion when data is no longer needed.

9. DATA RETENTION

Children's data is retained only for the duration of active bookings, the Parent's active account, and as required by law. Upon account deletion or consent withdrawal, Children's data is permanently deleted within 30 days.

10. ACTIVITY PROVIDER OBLIGATIONS

Providers who receive Children's information through the Platform are bound by the KidzMaps Activity Provider Terms of Service and Data Processing Agreement to: use it only for fulfilling the booked Activity; not disclose it to third parties; implement appropriate security measures; delete it upon request; and comply with COPPA.

11. OPERATOR INFORMATION

The operator collecting or maintaining children's personal information through this Platform is:

KidzMaps, LLC

COPPA Compliance Contact: privacy@kidzmaps.com

Website: www.kidzmaps.com

12. CHANGES TO THIS POLICY

We will notify Parents of material changes by email at least 30 days before changes take effect. If new consent is required, we will obtain it before implementing changes. The updated policy will be posted on the Platform with a revised "Last Updated" date.

13. CONTACT US

KidzMaps, LLC

Email: privacy@kidzmaps.com

Website: www.kidzmaps.com

Important: If you believe we have collected Personal Information from a Child without proper parental consent, please contact us immediately at privacy@kidzmaps.com. We will promptly investigate and delete any such information.