PRIVO handles identity and consent for online services
Privacy Vaults Online, Inc., doing business as PRIVO, operates the Platform for account creation, identity verification and consent management on behalf of websites, apps, connected toys and other online services. School or district EdTech providers may also use it.
Details not recorded for this card
Supporting quotations
The PRIVO iD Platform, (aka PRIVO-Lock) is an identity and consent management platform owned and operated by Privacy Vaults Online, Inc. d/b/a PRIVO®.
EdTech providers that have an agreement with a school or district may also use the PRIVO iD Platform.
Qualifications & exceptions
EdTech use described here involves an agreement with a school or district.
Legal Rights & Agreement Rules · Restriction or exception
Client privacy practices are covered by their own policies
This policy covers the PRIVO iD Platform and myPRIVO. It does not encompass the privacy practices of services using the Platform; users must consult those services’ policies to understand their and their child’s information use.
Details not recorded for this card
Supporting quotations
This policy covers the PRIVO iD Platform and myPRIVO (my.privo.com). It is not intended to, encompass the privacy practices of the sites and services that use the Platform.
To understand how our clients, use your information, and that of your child, please review their privacy policy.
Not stated here
The clients’ policies are not supplied by this document.
PRIVO asks users who disagree to avoid the Platform
If you disagree with any part of this policy, PRIVO asks you not to use the Platform or myPRIVO.
Details not recorded for this card
Supporting quotations
If you disagree with any part of this Privacy Policy, please do not use the Platform or myPRIVO.
Legal Rights & Agreement Rules · Context
PRIVO describes separate privacy assurance programs
PRIVO also offers a COPPA Safe Harbor Program, GDPRkids Privacy Assured and Children’s Code Privacy Programs. The document directs readers to its website and a separate privacy policy for those solutions.
Details not recorded for this card
Supporting quotations
The privacy solutions offered by PRIVO also include an FTC-approved COPPA (Children’s Online Privacy Protection Act) Safe Harbor Program, as well as GDPRkids™ Privacy Assured and the Children's Code Privacy Programs.
Not stated here
The separate website privacy policy is not supplied here.
Legal Rights & Agreement Rules · Context
PRIVO is subject to FTC oversight
The policy states that PRIVO is subject to the Federal Trade Commission’s investigatory and enforcement powers.
Details not recorded for this card
Supporting quotations
PRIVO is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).
Account & Service Control · Context
The PRIVO symbol indicates technology use, not PRIVO operation
A service displaying the powered by PRIVO iD symbol uses PRIVO technology but is not operated by PRIVO. The solution supports consent for an online property’s collection, use, sharing, disclosure or blocking of personal information.
Details not recorded for this card
Supporting quotations
The powered by PRIVO iD (PiD) symbol indicates that the online service uses PRIVO's technology solution, but it is not operated by PRIVO.
The solution enables individuals to give informed consent to an online property to legally collect, use, share, disclose or block personal information.
Security & Safeguards · Company practice
Verification strength adapts to feature risk
PRIVO says it uses a sliding scale of verification assurance and authorization tailored to the data use and disclosure risk of the feature a child or other individual seeks to access.
Details not recorded for this card
Supporting quotations
The PRIVO iD Platform utilizes a sliding scale for verification assurance and authorization which adapts to the specific data use and disclosure risk associated with the feature the child or any other individual seeks to access.
Qualifications & exceptions
The scale depends on the feature’s data use and disclosure risk.
Account & Service Control · User right or choice
A PiD account lets users manage consent and account data
A PiD login can be used by services in the PRIVO iD network, which includes only COPPA compliant services and services meeting PRIVO Privacy Assured Program requirements. Account holders can manage consent, settings and PRIVO-collected data through a dashboard, myPRIVO and registered services. myPRIVO also presents program-member information.
Details not recorded for this card
Supporting quotations
Only COPPA compliant services and those that have met the requirements of the PRIVO Privacy Assured Programs are included in this network.
PiD account holders have a dashboard that allows individuals to manage consent and their account settings and data collected by PRIVO.
Individuals can manage their own PiD account on myPRIVO and with the online services they have registered with.
It also showcases information on members of PRIVO's FTC approved COPPA Safe Harbor and Kids Privacy Assured programs.
Qualifications & exceptions
Network services must satisfy the stated compliance or assurance requirements.
Legal Rights & Agreement Rules · Context
This policy was updated January 12, 2026
The policy identifies January 12, 2026 as its last update and says the update added information about service providers and data collection. Previous versions can be requested using PRIVO’s contact details.
Details not recorded for this card
Supporting quotations
Last Updated: January 12, 2026
To review previous versions of this policy please contact us using the details below.
This policy was updated on January 12, 2026, to include further information on use of service providers and data collection.
Legal Rights & Agreement Rules · Company commitment
Material data-practice changes trigger advance notice steps
PRIVO may make minor nonmaterial changes and reflect them in the last-updated date while users remain bound. For material changes to collection and processing of personal information, it promises reasonable steps to contact users first by email and a login alert, and to obtain consent when necessary before the change takes effect for them. Past versions can be requested by email.
Details not recorded for this card
Supporting quotations
We may make minor non material changes to this policy from time to time. When we do the last updated date will reflect this and you will continue to be bound by this policy.
If we make a material change, that is a change to the way we collect and process personal information we will take reasonable steps to contact you first by email and by alert on login and when necessary, obtain your consent, before making the change effective for you.
Qualifications & exceptions
Contact involves reasonable steps by email and login alert; consent is obtained when necessary.
Use & Processing · Company practice
PRIVO links account and consent processing to service features
PRIVO assists client services with account creation, identity verification, login and informed consent. It describes mapping features to necessary information, retention duration, privacy-notice recipients and identity verification of minors, adults and people with parental responsibility.
Details not recorded for this card
Supporting quotations
The PRIVO iD Platform assists companies with streamlining account creation, identity verification and the login process as well assisting to obtain informed consent for features and functionalities that can be directly mapped to: the information necessary to provide the service, the duration and retention of such data, the individual who will be provided the relevant privacy notices, as well as the processing of identity verification for minors, adults and holders of parental responsibility in order to satisfy the regulatory requirement associated with the processing of such data.
Data Access & Collection · Company practice
Some transactions log only a PRIVO-generated identifier
In some cases PRIVO may collect or maintain no personal information and log only a PRIVO-generated service identifier as a record of a transaction processed through the Platform. This is a limited scenario rather than a promise that all Platform use avoids personal information.
Details not recorded for this card
Supporting quotations
In some cases, we may not collect or maintain any personal information and only log a PRIVO generated service identifier as record of a transaction processed by an online service provider’s use of the Platform.
Qualifications & exceptions
Applies only in some cases.
Use & Processing · Company commitment
PRIVO seeks consent before using information for another purpose
PRIVO provides notice when the context of collection changes and says it will seek consent before using collected personal information for a purpose other than the one consented to. It combines the listed information to seek and obtain parental consent and verify a parent, treating the combination as personal information.
Details not recorded for this card
Supporting quotations
Notice is provided if the context in which personal information is collected changes, however, PRIVO would not use personal information collected for any purpose other than that which you consented to, without first seeking your consent.
The personal information collected below is combined to seek parent consent, verify a parent and obtain parent consent for a child. Combined information is treated as personal information.
Qualifications & exceptions
The consent requirement concerns a different purpose.
Data Access & Collection · Company practice
PRIVO may collect a child’s account details for a client service
When a child below the age of consent starts an account process for a client service, PRIVO may collect the child’s first name, date of birth, username, moderated display name and password on the service’s behalf. In some instances it may also collect gender, grade, the child’s email and a parent or guardian email to seek verifiable consent for the child’s service use.
Details not recorded for this card
Supporting quotations
A child below the age of consent may begin the process of engaging with a service that needs to record its' compliant handling of data to initiate an account for a client service using the Platform. On behalf of the service, PRIVO may collect the following:
Child first name
Date of birth
Username
Moderated display name
Password
In some instances, the following information may also be collected:
Gender
Grade
Child email address
Parent / Guardian email to seek verifiable consent in the manner described above, for the child’s use of the service.
Qualifications & exceptions
The additional gender, grade and email information is collected only in some instances.
PRIVO limits collection to what participation reasonably requires
PRIVO says it does not collect more information than reasonably necessary for a child or any individual to participate in an activity. A client service may collect additional child information or request that PRIVO do so, with disclosure in the client’s privacy policy and Platform notice.
Details not recorded for this card
Supporting quotations
PRIVO does not collect more information than reasonably necessary for a child or any individual to participate in an activity. The online service using the Platform may collect or request the Platform collects additional information from your child and will disclose this to you in its privacy policy and the Platform notice.
Qualifications & exceptions
Client services may collect or request additional information, disclosed in their policy and Platform notice.
Parents may need an account and verification widget
A parent or guardian may be asked to create an account at a service using the Platform. PRIVO’s verification widget may be used depending on the regulatory requirements for informed consent, age assurance and proof of parental responsibility.
Details not recorded for this card
Supporting quotations
A parent or guardian may be asked to create an account on service that uses the Platform and depending on the regulatory requirement for informed consent, age assurance and proof of parental responsibility, PRIVO’s verification widget may be utilized.
Qualifications & exceptions
Widget use depends on the applicable consent, age assurance and parental-responsibility requirements.
Data Access & Collection · Company practice
PRIVO may collect parent account and contact details
On a client service’s behalf, PRIVO may collect parents’ and guardians’ first name, birth date, username, password and email. When necessary it may also collect last name, display name, a child email for the child account, a physical address for uses such as catalogues, magazines and rewards, and a mobile number for authentication and communication.
Details not recorded for this card
Supporting quotations
On behalf of the online service, PRIVO may collect the following from parents and guardians:
First name
Date of birth
Username
Password
Email
The following information may also be collected from a parent or guardian when necessary:
Last name
Display name
Child email address for child account
Physical address that could be used for such things as toy catalogues, magazines, and rewards
Mobile phone number for account authentication and communication
Qualifications & exceptions
The second group of details is collected when necessary.
Data Access & Collection · Procedure
Parents may verify adulthood through financial, identity or video methods
Before asserting a parent–child relationship, a parent may be asked to choose an adulthood-verification method based on available technology. Options may include a credit-card monetary transaction, banking information, partial SSN with last name and address, birth date and/or postal code, a driver’s license number with full name and address, a trained-verifier video call, or other data reasonably designed to identify the user and parental status.
Details not recorded for this card
Supporting quotations
Before asserting a parent/guardian child relationship, a parent may be asked to verify they are an adult by choosing a method in light of available technology that may include one of the following:
A credit card number in conjunction with a monetary transaction
Banking information
Partial social security number in conjunction with their last name, address, date of birth and/or postal code
A driver’s license number in conjunction with their full name and address
Video conference with a trained verifier
Or other data that is reasonably designed to identify the user and their parental status
Qualifications & exceptions
Methods depend on available technology; the list is not exhaustive.
Not stated here
Linked verification-data and parent-information pages are not supplied here.
Retention & Deletion · Company practice
Verification may leave limited transaction records
PRIVO uses providers to verify adults’ information and says it uses that information only for identity verification. Depending on the method, it may securely retain the last four credit-card digits, hashed SSN or driver’s license number as a transaction record. The linked provider details are separate from this text.
Details not recorded for this card
Supporting quotations
PRIVO uses service providers to verify adult’s information and does not use it for any other purpose but verifying identity. Depending on the method you use to verify, PRIVO may securely retain the last four digits of your credit card, hashed SSN or driver’s license number as record of a transaction.
Qualifications & exceptions
What is retained depends on the verification method.
Not stated here
The linked provider page is not supplied; this passage sets no retention duration.
Account & Service Control · User right or choice
Parents can give verifiable consent offline
Parents may give PRIVO verifiable parental consent by mailing, faxing or emailing a signed form, or by calling PRIVO Customer Service.
Details not recorded for this card
Supporting quotations
Parents may also provide PRIVO with verifiable parental consent through an offline method, such mailing, faxing or emailing a signed form to PRIVO or calling the PRIVO Customer Service number.
Account & Service Control · Company practice
Registration provides a PiD that may work across accepting services
Each individual receives a unique PiD account after registration. Adults, teens, parents and children may use it to log into services that accept the credential, although additional consent may be required.
Details not recorded for this card
Supporting quotations
When you have completed the registration process, individuals will each receive a unique PiD account. This PiD may allow adults, teens, parents and their child(ren) to securely log into online services that accept the PiD credential, but additional consent may be required.
Qualifications & exceptions
Only accepting services can use the credential, and additional consent may be required.
Data Access & Collection · Company practice
Smart Age Gate collects age and device details
When a service uses PRIVO’s Smart Age Gate, PRIVO collects age or date of birth plus device type and model, operating system, browser, local time zone and nonpersonal data such as screen resolution and window size. Users disputing an incorrectly entered birth date must verify their age with one of the described methods to correct it.
Details not recorded for this card
Supporting quotations
If a service uses PRIVO’s Smart Age Gate™ to provide the users with an appropriate privacy protected experience, age or date of birth is collected along with device type and model, operating system, browser and local time zone along with some other non-personal data such as screen resolution and browser window size.
If a user enters the wrong date of birth and wishes to dispute and correct their already-provided age, they will be required to verify their age using one of the methods outlined above.
Qualifications & exceptions
Applies when the client service uses Smart Age Gate; correcting a disputed age requires verification.
Data Access & Collection · Company commitment
PRIVO lists categories it does not collect
PRIVO says it does not collect precise geolocation, and says it does not collect health or biometric, sensitive or behavioral data or student records from pre-K–12 students. It also says it does not collect free or reduced lunch status. These statements concern PRIVO’s Platform rather than the separate practices of client services.
Details not recorded for this card
Supporting quotations
PRIVO does not collect precise geo location data, nor does it collect health or biometric, sensitive or behavioral data or student records from pre-K - 12 students. PRIVO does not collect free or reduced lunch status.
Qualifications & exceptions
The pre-K–12 student wording is retained for the health, biometric, sensitive, behavioral and student-record list.
The Platform has no user uploads, community or social sharing
PRIVO says users cannot upload user-generated content and that it provides no community or social-sharing features, so it includes no copyright-license terms here. It describes the Platform’s sole purpose as supporting verifiable parental consent and a privacy-enhanced login credential.
Details not recorded for this card
Supporting quotations
Users cannot upload any user generated content and we do not offer any community features or social sharing; therefore we do not include information on copyright or copyright licenses in this policy. The sole purpose of the platform is to support online services to obtain verifiable parental consent and provide a privacy enhanced login credential.
PRIVO excludes third-party analytics and research sharing
PRIVO says personal information is not shared with third parties for analytics, research or product improvement. This is a purpose-specific promise, alongside the policy’s separate service-provider and legally necessary disclosure provisions.
Details not recorded for this card
Supporting quotations
Personal information is not shared with third parties for analytics, research or product improvement.
Qualifications & exceptions
This excludes the listed purposes rather than every third-party disclosure.
Sharing & Disclosure · Company commitment
PRIVO says it does not publicly display or disclose information
The policy states both that no personal information is displayed publicly and that collected information is not publicly disclosed.
Details not recorded for this card
Supporting quotations
No personal information is displayed publicly.
Information collected is not disclosed publicly.
Charges & Financial Obligations · Context
The service includes no purchases
PRIVO says its service contains no in-app purchases or purchases of any kind.
Details not recorded for this card
Supporting quotations
There are no in-app purchases or purchases of any kind included in our service.
Sharing & Disclosure · Company commitment
Service providers are limited to supporting PRIVO services
PRIVO works with providers solely to support its services, says it does not acquire personal information from them, and says information shared with them is neither used for other purposes nor shared onward. It requires appropriate third-party security measures. Users can email privacy@privo.com for details about information shared with each provider; a separate linked page lists providers and purposes.
Details not recorded for this card
Supporting quotations
PRIVO works with a number of service providers solely to support our services. Personal information is not acquired from service providers. Information shared with these third parties is not used for any other purposes or shared onwards. PRIVO requires that all third parties have appropriate security measures in place.
For more information on the personal information shared with each service provider please contact us here:
To see each service provider, what it is used for and how to find more information on each please
Qualifications & exceptions
Providers are engaged solely to support PRIVO’s services.
qualified by (model-proposed): Framework agent transfers carry conditional continuing liability — The Framework section separately states continuing liability for an agent’s inconsistent handling of EU–US Framework information, unless the organization proves nonresponsibility for the damaging event.
Sharing & Disclosure · Company practice
Some personal information is shared for customer verification
In some instances PRIVO shares personal information only to provide verification services to its customers. It limits this sharing to the personal information described earlier in the policy.
Details not recorded for this card
Supporting quotations
In some instances, personal information is shared to provide verification services to our customers only. This is limited to the personal information outlined above.
Qualifications & exceptions
Only for customer verification and limited to the earlier-described personal information.
Provider misuse would lead to termination and deletion
If PRIVO found a provider violating or misusing personal information, it says it would stop working with that provider and require deletion of all personal information when the agreement terminates.
Details not recorded for this card
Supporting quotations
If a service provider we work with was found to be violating or misusing any personal information, PRIVO would cease to work with this service provider and would require that all personal information is deleted upon termination of the agreement.
Qualifications & exceptions
Triggered by a finding of violation or misuse; deletion is required upon agreement termination.
Use & Processing · Company commitment
PRIVO disclaims advertising, profiling, tracking and data sales
PRIVO says it does not use collected data to build profiles or serve advertising to children or adults; rent or sell data; combine it with third-party data; track users; allow third parties to track users; or target users with advertising elsewhere. The policy separately allows using information to tell users about additional PRIVO products and services, so this is not a promise of no product communications.
Details not recorded for this card
Supporting quotations
PRIVO does not use data collected to build a profile, serve advertising of any kind to children or adults. We do not rent or sell your data to third parties, and we do not combine it with data from any third parties. PRIVO does not track users, allow third parties to track users, target users with advertising on other websites or build profiles of users.
We will also use your information to update you about changes to our policies and to give you information about additional products and services we may offer.
Qualifications & exceptions
The separate product-and-service communication provision remains in the policy.
Cross-references
contrast (model-proposed): PRIVO uses information for registration and required parental consent — The policy disclaims using collected data to serve advertising, yet expressly permits information use to tell users about additional products and services. Both statements are preserved without inferring an unstated advertising or messaging boundary.
Retention & Deletion · Company practice
Consent and verification data are stored for seven years
PRIVO says consent and verification data are stored for seven years to meet legal requirements. Revoked consent or a deletion request ordinarily leads to deletion within five working days, unless retention is legally required. If a parent does not consent within 30 days, the parent email and collected information are deleted. PRIVO also says it will not retain personal data beyond statutory needs. A later paragraph also gives 30 days for a parent or child deletion request; the policy does not explain how these deadlines fit together.
Details not recorded for this card
Supporting quotations
Data collected to obtain consent and verification is stored for seven years to meet legal requirements. If consent is revoked or data deletion is requested, then it will be deleted within five working days unless there is a legal requirement to retain the information. If a parent does not consent within 30 days your parent email address and any information collected will be deleted.
PRIVO will not retain personal data longer than needed to meet statutory requirements.
If parent consent is not obtained PRIVO deletes any personal information collected from a child (first name, email address, parent email address).
If a parent or child requests to delete their information this request will be met within 30 days unless there is a legal requirement to retain the information.
Qualifications & exceptions
Deletion requests and revoked consent have a five-working-day period, subject to legally required retention.
Lack of parental consent after 30 days triggers deletion.
The policy also states a 30-day deletion deadline elsewhere, without explaining the difference.
Not stated here
How the five-working-day and 30-day deletion periods relate is unspecified.
contrast (model-proposed): The policy also gives 30 days for parent or child deletion requests — One paragraph gives 30 days for parent or child deletion requests, while the retention paragraph says five working days for revoked consent or deletion requests. Both preserve legal retention. The source does not explain the difference; no preferred deadline is inferred.
The policy offers no account-closure download of user data
In its retention section, PRIVO says it does not collect personal data or content that a user could download when an account is closed. Read with its explicit account-data collection and access provisions, this describes no downloadable data at closure rather than no personal-data collection at all. Users may contact privacy@privo.com for retention information.
Details not recorded for this card
Supporting quotations
We do not collect any personal data or content from a user that the user could download when an account is closed.
For more information on data retention contact us here:
There, you will be able to see all the permissions you have set for your child, access the personally identifiable information that PRIVO has collected from you and/or your child, correct factual errors in such information and can delete this information.
Qualifications & exceptions
Concerns downloading at closure; the policy separately describes personal-information access.
Not stated here
No download process or file format is specified.
Cross-references
qualified by (model-proposed): You can request return of personal information at any time — A contact-based right to request return of personal information coexists with the statement about no downloadable data at account closure. No download format or automatic export is inferred.
PRIVO uses information for registration and required parental consent
PRIVO says it uses information collected directly from users only for stated purposes, including facilitating site and service registration and processing verifiable parental consent when required by law. It also expressly permits policy-update and additional-product communications.
Details not recorded for this card
Supporting quotations
PRIVO only uses information collected directly from you for the purposes stated. The information is used to facilitate registration on sites and services and to process verifiable parental consent when required by law.
We will also use your information to update you about changes to our policies and to give you information about additional products and services we may offer.
Qualifications & exceptions
Parental consent processing is described as required by law; policy and product communications are additional stated uses.
Cross-references
contrast (model-proposed): PRIVO disclaims advertising, profiling, tracking and data sales — The policy disclaims using collected data to serve advertising, yet expressly permits information use to tell users about additional products and services. Both statements are preserved without inferring an unstated advertising or messaging boundary.
Sharing & Disclosure · Company practice
PRIVO will disclose identifiable information when it believes legally necessary
PRIVO says it will disclose information about users or their children in identifiable form if it believes disclosure is legally necessary. Examples include court orders, civil subpoenas, and government or law-enforcement investigations involving fraud, intellectual-property infringement, illegality or possible PRIVO legal liability.
Details not recorded for this card
Supporting quotations
PRIVO will disclose information about you or your child(ren), in a manner that is not aggregated or anonymous, if we believe it is legally necessary to do so, for example, in response to a court order or civil subpoena, or to law enforcement or other government officials in connection with an investigation of fraud, intellectual property infringement, or other activity that is illegal or may expose PRIVO to legal liability.
Qualifications & exceptions
PRIVO’s belief that disclosure is legally necessary triggers the provision.
Cross-references
exception to (model-proposed): Parents can choose internal use without unaffiliated-party disclosure — Choosing internal child-data use without unaffiliated-party disclosure consent does not remove the policy’s separate identifiable disclosures when PRIVO believes legally necessary.
Customer information may transfer in a corporate transaction
In a merger, acquisition, reorganization, bankruptcy or similar event, PRIVO customer information may transfer to a successor or be assigned. The information remains governed and protected by this policy, and further use requires explicit consent. PRIVO promises email notice to users for a merger or acquisition.
Details not recorded for this card
Supporting quotations
In addition, in the event of a merger, acquisition, reorganization, bankruptcy or other similar event, PRIVO customer information may be transferred to our successor or assigned but will remain governed by and protected in strict accordance with this Privacy Policy and no further use of customer information will be made without explicit consent. PRIVO will inform users in the event of a merger or acquisition by contacting them using the email address provided.
Qualifications & exceptions
Further use requires explicit consent; the email-notice promise specifically covers mergers and acquisitions.
Parents can choose internal use without unaffiliated-party disclosure
When consenting to participation through the Platform, users may agree to PRIVO’s and its client’s collection and internal use of a child’s personal information without agreeing to their disclosure of it to unaffiliated third parties. This consent choice sits alongside separate legally necessary disclosure provisions.
Details not recorded for this card
Supporting quotations
When you provide us with consent for you and/or your child to participate at an online service using the Platform we give you the option to agree to the collection and use by ourselves and our client of your child’s personal information for internal purposes, without having to agree to the disclosure of your child’s information by us or our client to unaffiliated third parties.
PRIVO will disclose information about you or your child(ren), in a manner that is not aggregated or anonymous, if we believe it is legally necessary to do so
Qualifications & exceptions
Concerns consent to internal use and unaffiliated-party disclosure; legally necessary disclosure is separately provided for.
Users can inspect, correct and delete their or their child’s information
Users can sign in through their registered client service or my.privo.com, then use the profile image and Account & Settings to inspect child permissions, access PRIVO-collected personal information, correct factual errors and delete information. They can also contact PRIVO for deletion. PRIVO takes reasonable steps to verify identity before access. Deletion is ordinarily within five working days of a request or revoked consent, subject to legally required retention. A later paragraph also gives 30 days for a parent or child deletion request; the policy does not explain how these deadlines fit together.
Details not recorded for this card
Supporting quotations
To manage your information, or the information we maintain about your child, sign in through the client service you registered with directly or you can visit my.privo.com and click on “sign in” at the top right of your screen. Then click on your profile image and select “account & settings”.
There, you will be able to see all the permissions you have set for your child, access the personally identifiable information that PRIVO has collected from you and/or your child, correct factual errors in such information and can delete this information. Information can also be deleted by contacting PRIVO directly.
To protect your child’s privacy and security online, we will take reasonable steps to help verify your identity before granting you access to the personal information that we collect and maintain about you or your child.
If consent is revoked or data deletion is requested, then it will be deleted within five working days unless there is a legal requirement to retain the information.
If a parent or child requests to delete their information this request will be met within 30 days unless there is a legal requirement to retain the information.
Qualifications & exceptions
Identity verification precedes access; legally required retention can limit deletion.
The policy also states a 30-day deletion deadline elsewhere, without explaining the difference.
Not stated here
How the five-working-day and 30-day deletion periods relate is unspecified.
Cross-references
qualified by (model-proposed): Consent and verification data are stored for seven years — The information-deletion control is subject to legally required retention; the policy gives both five-working-day and 30-day request periods without reconciling them.
PRIVO deletes child information if parental consent is not obtained
PRIVO says it deletes collected child personal information, including first name, child email and parent email, when parent consent is not obtained. Its retention paragraph gives 30 days for a parent to consent before deletion of the parent email and collected information.
Details not recorded for this card
Supporting quotations
If parent consent is not obtained PRIVO deletes any personal information collected from a child (first name, email address, parent email address).
If a parent does not consent within 30 days your parent email address and any information collected will be deleted.
Qualifications & exceptions
The retention section specifies a 30-day consent period.
You can request return of personal information at any time
PRIVO allows users to ask at any time for their personal information to be returned by contacting privacy@privo.com. This is a contact-based request; it does not establish a downloadable account-closure export.
Details not recorded for this card
Supporting quotations
You may request your personal information is returned to you at any time by contacting us at
Not stated here
No return format or response period is stated in this passage.
Cross-references
qualifies (model-proposed): The policy offers no account-closure download of user data — A contact-based right to request return of personal information coexists with the statement about no downloadable data at account closure. No download format or automatic export is inferred.
Legal Rights & Agreement Rules · Restriction or exception
PRIVO keeps parental-consent duties separate from schools
For its service obtaining parent consent for a child’s use of a customer’s online service, PRIVO says FERPA school-official exceptions do not apply and parental-consent duties are not transferred to a school or district. It says it neither collects nor discloses directory information.
Details not recorded for this card
Supporting quotations
PRIVO’s services is provided to obtain the correct level of parent consent for a child to use an online service of one of our customers. FERPA school official exceptions do not apply in this context. PRIVO does not transfer parental consent obligations to a school or district. PRIVO does not collect or disclose directory information.
Qualifications & exceptions
These statements concern the described parent-consent service.
Retention & Deletion · Company commitment
The policy also gives 30 days for parent or child deletion requests
A paragraph directing users to client privacy policies for rights over client-collected data says parent or child deletion requests will be met within 30 days, unless legal retention is required. The earlier retention section says five working days for revoked consent or deletion requests, with the same legal-retention exception. The policy does not explain how the two deadlines fit together, so no single deadline can be inferred for every request.
Details not recorded for this card
Supporting quotations
If we are providing our service on behalf of another company, website or app then please review their privacy policy to understand your rights in relation to the personal information they have collected from you. If a parent or child requests to delete their information this request will be met within 30 days unless there is a legal requirement to retain the information.
If consent is revoked or data deletion is requested, then it will be deleted within five working days unless there is a legal requirement to retain the information.
Qualifications & exceptions
Legally required retention can limit deletion under either paragraph.
Not stated here
The relationship between the five-working-day and 30-day deadlines is unspecified.
Cross-references
contrast (model-proposed): Consent and verification data are stored for seven years — One paragraph gives 30 days for parent or child deletion requests, while the retention paragraph says five working days for revoked consent or deletion requests. Both preserve legal retention. The source does not explain the difference; no preferred deadline is inferred.
Legal Rights & Agreement Rules · User right or choice
Users can file a dispute or contact PRIVO by email
The policy offers a dispute form at privo.com/file-dispute and privacy@privo.com as routes to raise a dispute.
Details not recorded for this card
Supporting quotations
You can file a dispute by clicking here or you can contact us at privacy@privo.com.
Security & Safeguards · Company commitment
PRIVO states certifications and limits data access
PRIVO says it is SOC2 Type 2 and ISO 27001 certified, uses generally accepted safeguards and requires third parties to agree to do the same. It limits data access to people who need it for PRIVO work, uses technical access restrictions and states there is no physical access to user information. The policy separately cautions that absolute security cannot be guaranteed.
Details not recorded for this card
Supporting quotations
PRIVO is SOC2, TYPE 2 and ISO 27001 certified and uses generally accepted security measures and safeguards and requires that the third parties it works with agree to do the same. The measures and safeguards include limiting access to the data to those persons who need it to complete their work for PRIVO. Access is restricted using technical measures. There is no physical access to user information.
Therefore, while PRIVO uses reasonable efforts to protect your personal information, we cannot guarantee its absolute security.
Qualifications & exceptions
Access is limited by work need; the policy gives no absolute-security guarantee.
Cross-references
qualified by (model-proposed): PRIVO encrypts stored data and uses SSL transmission — The certification and access-safeguard statements remain subject to PRIVO’s express inability to guarantee absolute security and its breach-notice promise where required.
Security & Safeguards · Company commitment
PRIVO encrypts stored data and uses SSL transmission
PRIVO may host client registration pages. It says all data is sent through SSL and encrypted at rest, with industry-standard physical, electronic and managerial safeguards and an ability for users to update information. It uses reasonable protection efforts but cannot guarantee absolute security; affected users receive breach notice where required.
Details not recorded for this card
Supporting quotations
PRIVO may host the registration pages of sites and services that use the Platform. All data is transmitted through an SSL transmission to ensure privacy and security of your family’s information. Data is encrypted at rest.
We have put in place industry standard physical, electronic, and managerial procedures to safeguard and help prevent unauthorized access, maintain data security, and correctly use the information we collect online. PRIVO allows users to update their information.
No method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while PRIVO uses reasonable efforts to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach PRIVO will inform affected users where required.
Qualifications & exceptions
Absolute security is not guaranteed; breach notice is promised where required.
Cross-references
qualifies (model-proposed): PRIVO states certifications and limits data access — The certification and access-safeguard statements remain subject to PRIVO’s express inability to guarantee absolute security and its breach-notice promise where required.
Retention & Deletion · Company practice
PRIVO stores data on US AWS servers
PRIVO says it stores data using AWS servers in the United States. Further information can be requested at privacy@privo.com.
Details not recorded for this card
Supporting quotations
PRIVO uses AWS servers in the United States to store data. For more information on this please contact us at privacy@privo.com.
Account & Service Control · User right or choice
Email PRIVO to opt out, review or request deletion
Users can contact privacy@privo.com to opt out of services, review information or request deletion. The policy’s deletion terms remain subject to legal retention and contain both five-working-day and 30-day periods without explaining their relationship.
Details not recorded for this card
Supporting quotations
If you want to opt out of services, review your information, or delete your information, please contact us at
If consent is revoked or data deletion is requested, then it will be deleted within five working days unless there is a legal requirement to retain the information.
If a parent or child requests to delete their information this request will be met within 30 days unless there is a legal requirement to retain the information.
Qualifications & exceptions
Legal retention may limit deletion.
Not stated here
Which of the two deletion periods governs a particular request is unspecified.
California notice excludes third-party marketing disclosures and sales
The California notice says PRIVO does not disclose personal information to third parties for marketing or sell individuals’ personal information. Users can email privacy@privo.com for privacy-practice information, review or a deletion request; deletion elsewhere remains subject to legal-retention requirements.
Details not recorded for this card
Supporting quotations
PRIVO does not disclose personal information to third parties for marketing purposes or sell individuals personal information. For further information about our privacy practices, or to review and request to have deleted any personal information you have shared with us, please contact us at:
If consent is revoked or data deletion is requested, then it will be deleted within five working days unless there is a legal requirement to retain the information.
Qualifications & exceptions
This notice addresses California users; legally required retention can limit deletion.
Identity verification may use automated decisions with human review
The rights notice for US states and other jurisdictions describes opt-outs from targeted advertising, sales and automated decision-making where applicable. PRIVO says it does not target ads or sell information, but identity verification may use automated decision-making coupled with human review; all individuals have a right to reply or dispute the decision-making.
Details not recorded for this card
Supporting quotations
Applicable laws in some US states and other global jurisdictions provide individuals certain rights. These rights may include the following:
Opt out: Where applicable individuals may have the right to opt out of the following: targeted advertising, the sale of their information, and automated decision-making. PRIVO does not engage in targeted advertising or the sale of individual’s information When verifying identity automated decision making may take place coupled with human review and all individuals have the right to reply and or dispute decision making.
Qualifications & exceptions
Statutory opt-outs depend on applicability; the policy describes human review and a reply or dispute right for verification decisions.
Legal Rights & Agreement Rules · User right or choice
Applicable laws may provide access, correction, transfer and deletion rights
In its US-state and other-jurisdiction notice, PRIVO describes rights that may apply under law: review personal information; request collected or processed categories, personal information and disclosure recipients; potentially transmit information to another entity; correct inaccurate or incomplete data; and request deletion. Rights are not absolute and may be declined where law permits; legally required retention can limit deletion. PRIVO may verify identity, generally charges no fee unless reasonably justified, promises nondiscrimination and says appeal rights may apply. Contact privacy@privo.com to act.
Details not recorded for this card
Supporting quotations
Applicable laws in some US states and other global jurisdictions provide individuals certain rights. These rights may include the following:
Reviewing and transferring personal information: Individuals may review Personal Information we have about them:
Requesting access to information. Individuals may request access to information on what categories of personal information we have collected and processed about them.
Requesting information. Individuals may request access to their personal information and information on any parties their personal information is disclosed to and may have the right to transmit that information to another entity.
Requesting to correct. Individuals may request that inaccurate or incomplete Personal Information concerning them is corrected.
Deleting information : Individuals may request deletion of their personal information however some information may need to be retained if legally required.
Individuals’ rights are not absolute, and in certain cases, maybe declined if permitted by law.
PRIVO does not charge a fee for actioning these rights unless there is a reasonable case for doing so. It may be necessary to establish your identity before sharing personal information with you to protect individuals. PRIVO will not discriminate against individuals who action their rights Individuals may also have the right to appeal any decision not to action their rights.
For more information or to action any of these rights please contact: privacy@privo.com
Qualifications & exceptions
Rights depend on applicable law and may be lawfully declined; legal retention, identity checks and reasonably justified fees may apply.
Legal Rights & Agreement Rules · User right or choice
Australian users may complain to the OAIC
If Australian data-protection law applies to a person’s information and they believe its processing violates that law, the policy says they may complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Details not recorded for this card
Supporting quotations
If your personal information is subject to the applicable data protection laws of Australia and you have reason to believe that processing of your personal data violates those laws you have the right to make a complaint to the competent supervisory authority, the Office of the Australian Information Commissioner which can be contacted here:
Qualifications & exceptions
Australian data-protection law must apply and the complaint concerns believed violation.
Legal Rights & Agreement Rules · User right or choice
The EU and UK notice lists correction, access and control rights
PRIVO says it complies with EU and UK citizens’ GDPR and UK GDPR rights, listing correction, withdrawal of processing consent, a copy of held data, deletion, transfer to another controller for services, restriction and stopping processing. Users can act through privacy@privo.com. The policy elsewhere preserves legally required retention and states both five-working-day and 30-day deletion periods without explaining their relationship.
Details not recorded for this card
Supporting quotations
PRIVO complies with the rights given to EU and UK Citizens under the General Data Protection Regulation (GDPR) and the UK GDPR. These rights are as follows:
to correct the personal data we have about you;
to withdraw your consent to the processing of your personal data;
to obtain a copy of the personal data we hold about you;
to have your personal data deleted;
to transfer your personal data to another controller to provide you with services;
to restrict the personal data we have;
to request we stop processing your personal data.
You can action any of these rights by contacting us at:
If consent is revoked or data deletion is requested, then it will be deleted within five working days unless there is a legal requirement to retain the information.
If a parent or child requests to delete their information this request will be met within 30 days unless there is a legal requirement to retain the information.
Qualifications & exceptions
The list is addressed to EU and UK citizens; legally required retention may limit deletion.
Not stated here
The policy does not explain how its two deletion periods relate.
Legal Rights & Agreement Rules · User right or choice
EU citizens can complain to a data-protection authority
An EU citizen with a complaint about PRIVO’s personal-data processing can contact the relevant Data Protection Authority. PRIVO offers privacy@privo.com for further information.
Details not recorded for this card
Supporting quotations
If you are an EU citizen and would like to make a complaint about the way we process your personal data, you can contact the relevant Data Protection Authority (DPA). Please contact us at
Qualifications & exceptions
This specific notice addresses EU citizens.
Legal Rights & Agreement Rules · Company commitment
PRIVO states Data Privacy Framework compliance and Principles priority
PRIVO says it complies with the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Framework, and has certified adherence to EU–US Principles for EU and UK personal data received in reliance on those arrangements. If this policy conflicts with EU–US or Swiss–US Principles, the Principles govern. The policy identifies US AWS data storage and links to the government program and certification site.
Details not recorded for this card
Supporting quotations
PRIVO complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.
PRIVO has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.
If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.
PRIVO uses AWS servers in the United States to store data.
Qualifications & exceptions
The stated EU/UK certification concerns data received in reliance on the Framework arrangements; Principles take priority on conflict.
Not stated here
The linked Principles and certification record are not supplied; no independent certification verification is claimed.
For personal information received under the EU–US Framework and then transferred to an agent, the policy says the participating organization remains responsible and liable under the Principles if the agent processes it inconsistently with them, unless the organization proves it was not responsible for the event causing damage.
Details not recorded for this card
Supporting quotations
In the context of an onward transfer, a participating organization has responsibility for the processing of personal information it receives under the EU-U.S. DPF and subsequently transfers to a third party acting as an agent on its behalf. The participating organization shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.
Qualifications & exceptions
Applies to EU–US Framework information transferred to an agent; liability has the stated lack-of-responsibility defense.
Cross-references
qualifies (model-proposed): Service providers are limited to supporting PRIVO services — The Framework section separately states continuing liability for an agent’s inconsistent handling of EU–US Framework information, unless the organization proves nonresponsibility for the damaging event.
Legal Rights & Agreement Rules · Procedure
Framework inquiries and complaints go to PRIVO first
PRIVO commits to resolving complaints about collection or use under the EU–US Framework Principles. For Framework-policy inquiries or complaints, users should first contact PRIVO’s Privacy Officer at privacy@privo.com, telephone 703–569–0504, or 17949 Main St., #1025, Dumfries, VA 22026. The notice also supplies US and international fax numbers.
Details not recorded for this card
Supporting quotations
In compliance with the EU-U.S. DPF Principles, PRIVO commits to resolve complaints about our collection or use of your personal information. If you have any inquiries or complaints regarding our EU-U.S. Data Privacy Framework policy you should first contact PRIVO at:
17949 Main St., #1025 Dumfries, VA 22026 703–569–0504 (telephone) 866–588–8452 (fax within the US) 703–531–8424 (fax outside of the US) privacy@privo.com (email) Attn: Privacy Officer
Qualifications & exceptions
The first-contact instruction concerns the Framework policy.
Legal Rights & Agreement Rules · User right or choice
Unresolved Framework complaints can go to VeraSafe without charge
For privacy complaints or disputes involving personal data received in reliance on the Data Privacy Framework or a predecessor that internal processes cannot resolve, PRIVO agrees to participate in VeraSafe’s Framework dispute procedure. Appropriate recourse is free to the user subject to that procedure’s terms. Users must submit the required information through the linked VeraSafe dispute form.
Details not recorded for this card
Supporting quotations
If a privacy complaint or dispute relating to Personal Data received by Privacy Vaults Online, Inc in reliance on the Data Privacy Framework (or any of its predecessors) cannot be resolved through our internal processes, we have agreed to participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure. Subject to the terms of the VeraSafe Data Privacy Framework Dispute Resolution Procedure, VeraSafe will provide appropriate recourse free of charge to you.
To file a complaint with VeraSafe and participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, please submit the required information here:
Qualifications & exceptions
Requires unresolved internal handling and Framework or predecessor data; recourse is subject to the procedure’s terms.
Not stated here
The linked VeraSafe procedure is not supplied.
Cross-references
referred to by (model-proposed): Framework disputes may give users a binding-arbitration option — The conditional Framework arbitration recourse follows failure of PRIVO and the preceding dispute-resolution mechanism; it does not impose arbitration on all users or all disputes.
Legal Rights & Agreement Rules · Company commitment
PRIVO agrees to authority-panel dispute procedures after internal failure
If a complaint or dispute cannot be resolved internally, PRIVO also agrees to cooperate with EU and UK data-protection authorities and the Swiss Federal Data Protection and Information Commissioner, and to participate in their established panel’s dispute procedures. This appears in the Framework dispute-resolution section.
Details not recorded for this card
Supporting quotations
If a complaint or dispute cannot be resolved through our internal process, we have also agreed to cooperate with the EU and UK data protection authorities and the Swiss Federal Data Protection and Information Commissioner and to participate in the dispute resolution procedures of the panel established by such data protection authorities.
Qualifications & exceptions
Follows failure of the internal process within the Framework dispute section.
Legal Rights & Agreement Rules · User right or choice
Framework disputes may give users a binding-arbitration option
For a dispute about personal data received in reliance on the Framework that neither PRIVO nor the preceding dispute mechanism resolves, a user may have a right to require PRIVO to enter binding arbitration under the Framework’s Recourse, Enforcement and Liability Principle and Annex I. This is a conditional user recourse, not a requirement to arbitrate every dispute.
Details not recorded for this card
Supporting quotations
If your dispute or complaint related to your Personal Data that we received in reliance on the Data Privacy Framework cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.
Qualifications & exceptions
Applies to Framework-reliant personal data after unresolved internal and preceding dispute-resolution steps.
Not stated here
The external Principle and Annex I are not supplied; further eligibility conditions are unknown here.
Cross-references
refers to (model-proposed): Unresolved Framework complaints can go to VeraSafe without charge — The conditional Framework arbitration recourse follows failure of PRIVO and the preceding dispute-resolution mechanism; it does not impose arbitration on all users or all disputes.
Account & Service Control · Procedure
PRIVO provides postal, telephone, fax and email privacy contacts
Privacy questions can be directed to Privacy Vaults Online, Inc., doing business as PRIVO, Attn: Privacy Officer, at 17949 Main St., Unit 1025, Dumfries, VA 22026-8043; telephone 703–569–0504; US fax 866–588–8452; international fax 703–531–8424; or privacy@privo.com. The policy also supplies a privo.com/contact link.
Details not recorded for this card
Supporting quotations
Privacy Vaults Online, Inc., d/b/a PRIVO 17949 Main St., Unit 1025 Dumfries, VA 22026-8043 703–569–0504 (telephone) 866–588–8452 (fax within the US) 703–531–8424 (fax outside of the US) privacy@privo.com (email) Attn: Privacy Officer