Privacy Policy

Last updated: July 15, 2026. outcomestar is operated by SRJ Consulting & Services LLC ("outcomestar," "SRJ," "we," "us," "our"), a Texas limited liability company at 13054 Cinderella Lane, Frisco, TX 75035-5194, United States. This policy explains what we collect, why, how long we keep it, your rights, and the special protections applied to children's information. It is a companion to our Terms of Service and Disclaimer. By using the Service you agree to this policy.

outcomestar is built for families, including children. Children's records are entered and controlled by a parent or legal guardian, protected by verified parental consent, and never sold or used to train AI models. Child protections are described in Section 3 and apply regardless of any other setting.

1. What we collect

Account data — parent name, display name, email; optional student email; login credentials (passwords are stored only as salted hashes).
Student records you enter — personal, academic, activity, athletic, career, and higher-education information, milestones, documents, and media your family chooses to store.
Age-verification documents — for students aged 0–10, a birth certificate you upload at signup, used solely to confirm name and birth date (Section 3).
Payment data — handled by Stripe; we receive confirmation and a token, never your full card number.
Technical data — IP address for rate limiting, security, and abuse prevention; server logs. The application shows no advertising and runs no third-party advertising trackers.

2. How we use it

We use personal information only to operate the Service for your family: storing your records; generating the documents and websites you request; verifying eligibility and parental consent; processing payments; sending verification and service emails; securing the platform; and complying with law. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use your family's records or uploaded documents to train AI models. We show no advertising.

3. Children's privacy (COPPA & FERPA-aligned)

Accounts are created and controlled by a parent or legal guardian, who is the data controller for the student's record.
Signup for students under 13 requires verified parental consent: the parent's card payment, an FTC-recognized COPPA consent method. For students aged 0–10, a birth certificate is uploaded at signup and reviewed by an automated document-analysis service solely to confirm the student's name and birth date for free access; the document is stored privately, never displayed publicly, and never used to train AI models.
Student public websites enforce platform rules regardless of settings: first name only on public pages; no address or phone number; nondescript site links for minors; no search-engine indexing for younger age bands; and comment moderation where comments exist.
We do not knowingly collect more information from a child than is reasonably necessary, do not condition participation on disclosing more than necessary, and do not market to children.
Parents may review, correct, or delete their child's information at any time from the account or by contacting us, may refuse further collection or use, and may generate a report containing all stored data at any time.

4. Student emails

A student email, if provided, is used only to verify eligibility for free access and for age-appropriate account features. It is never sold, shared, or used for marketing.

5. How we share information

We disclose personal information only:

Service providers — processors needed to run the Service, each bound by contract to use personal information solely on our behalf: hosting and application delivery (Render), edge security and content delivery (Cloudflare), payment processing (Stripe), customer support chat and AI-assisted responses (Chatwoot Inc.), email delivery, automated document review for age verification, optional translation, and AI-model providers for optional AI features;
At your direction — for example a public showcase page you enable, or a generated document you choose to send;
Legal requirements — when required by law, regulation, subpoena, or legal process, or to protect the rights, safety, or security of our users, the public, or SRJ;
Business transfer — in a merger, acquisition, financing, or sale of assets, subject to reasonable safeguards and this policy.

We do not sell personal information and do not share it for cross-context behavioral advertising.

6. Where data lives and how it's protected

Data is stored in the United States with per-family isolation enforced at the database layer (row-level security), encrypted transport (HTTPS), encrypted storage of sensitive identifiers, salted-hash password storage, and time-limited signed links for private files. Access by our personnel is limited to operating and supporting the Service. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

7. Data retention and deletion

Category	Retention
Structured student records	Kept while the account is active; removed within 30 days of account deletion except where law requires retention.
Uploaded files (photos, video, documents)	Removed 90 days after a storage plan lapses; structured records remain.
Age-verification documents	Retained as evidence of verified consent while the account is active; deleted on account deletion.
Account & email-verification data	Life of the account; a minimal suppression record may be kept after unsubscribe.
Payment records	As required by tax and financial-record law (generally seven years).
Server & security logs	Up to 12 months.
Backups	Age out on a fixed rolling schedule.

8. Your rights and choices

You may, subject to identity verification and applicable law: generate a report containing all stored data at any time; correct anything from the portal; delete the account entirely; and opt out of any non-essential email. Depending on where you live (for example California under the CCPA/CPRA, or the EEA/UK under the GDPR), you may also have rights to access, correct, delete, port, or restrict processing of personal information, and to withdraw consent. We do not sell or share personal information, so no opt-out of sale is needed; we honor the Global Privacy Control signal on arrival. To exercise any right, contact support@outcomestar.app. We will not discriminate against you for exercising your rights.

9. Cookies and tracking

The Service uses only cookies and local storage necessary to operate (for example session and security tokens). We do not use advertising cookies or third-party advertising trackers in the application. Marketing and portal pages include the Chatwoot support-chat widget (operated by Chatwoot Inc., processed in the United States) so you can ask questions and receive AI-assisted answers. The widget sets cookies to maintain conversation state; if you send a message it transmits the message content, your email address if provided, IP address, and browser information to Chatwoot for the sole purpose of answering your inquiry. Marketing pages may also use a privacy-respecting analytics measure. These are limited to operating and improving the site.

10. Data breach notification

If we become aware of a breach compromising the confidentiality, integrity, or availability of your personal information, we will investigate promptly, take reasonable steps to contain and remediate it, and notify affected individuals and applicable regulators as required by law, by email, prominent site notice, or other reasonable means.

11. Changes and contact

We may update this policy; we will update the "last updated" date and, for material changes, provide reasonable notice such as a site banner or email to account holders. Questions or requests: support@outcomestar.app, or SRJ Consulting & Services LLC, 13054 Cinderella Lane, Frisco, TX 75035-5194, United States.

Back to home