Storilly Privacy Policy

1. Introduction and Who We Are

Storilly ("Storilly," "we," "us," or "our") is a product of Nexa Institute, Inc. ("Nexa Institute"), an Ohio corporation. We operate the Storilly platform, which includes our website located at storilly.com, our mobile application, at app.storilly.com, and all related features and services (collectively, the "Services").

Storilly is a parent coaching platform designed to help parents and caregivers support their children's speech and language development. Our Services are built for parents and guardians, not for children to use directly.

This Privacy Policy describes the information we collect, how we use and share it, and the rights you have with respect to your information. Please read it carefully. By using our Services, you agree to the practices described in this policy. If you do not agree, please do not use our Services.

2. Who This Policy Applies To

This Privacy Policy applies to:

• Parents and guardians who register for and use Storilly
• Visitors to our website at storilly.com or app.storilly.com

Storilly accounts are created and held by adults (parents and legal guardians). Children do not create accounts, log in, or interact directly with our platform. We do not direct our Services to children, and we do not knowingly collect personal information from children directly.

3. Information We Collect

3.1 Information You Provide

Account Information

When you create a Storilly account, we collect:

• Your email address
• Your password (stored in encrypted form; we never see it in plaintext)
• Your phone number (if provided)

Child Information

To personalize your coaching experience, we collect this information about your child:

• Your child's age (or approximate age range)
• Assessment answers on your child's speech and language skills over time

That is all. We do not ask for your child's name, photograph, precise date of birth, or any other identifying information about your child. You provide this age information as a self-report on behalf of your child.

Subscription and Payment Information

When you purchase a subscription, our third-party payment processor (Stripe) handles your payment card details. We receive only a transaction confirmation and billing summary. We do not store your full payment card number on our servers.

Communications

If you contact us through email, in-app chat, or our support channels, we collect the content of your message and your contact details to respond to you.

Coaching Session Data

If your subscription includes one-on-one coaching sessions, we may collect:

• Session scheduling and attendance records
• Notes from coaching conversations (as shared by you or your coach)
• Progress and goal information you choose to share

3.2 Information We Collect Automatically

When you use our Services, we automatically collect:

• Device information: device type, operating system, browser type, app version, unique device identifiers
• Usage data: features used, content viewed, session duration, in-app navigation patterns, tap and click activity
• Log data: IP address, access timestamps, referring URLs, crash reports and error logs
• General location: country and region inferred from your IP address. We do not collect or request precise GPS location.

3.3 Information Received from Third Parties

We may receive limited information from:

• Stripe: subscription status, purchase confirmations
• Payment processors: transaction confirmation, billing status, fraud signals
• Analytics partners: aggregated, anonymized usage insights

4. How We Use Your Information

We use the information we collect to:

• Provide and operate the Services: create and manage your account, deliver content and coaching resources, process payments, and facilitate scheduling
• Personalize your experience: match you with relevant books, activities, and coaching resources based on your child's age and your stated goals (see Section 6 for information about how AI supports this)
• Communicate with you: send account confirmations, booking reminders, progress updates, and responses to your support requests
• Send marketing communications: with your consent, send newsletters, product updates, and promotional offers. You can opt out of marketing emails at any time by clicking "Unsubscribe" in any email or contacting us at help@storilly.com
• Improve our Services: analyze usage patterns, conduct internal research, and develop new features
• Maintain safety and security: detect and prevent fraud, abuse, and unauthorized access to our platform
• Comply with legal obligations: respond to lawful legal requests and enforce our Terms of Service

5. How We Share Your Information

We do not sell your personal information. We do not rent or trade your personal information to third parties for their own marketing purposes.

We may share information in the following limited circumstances:

5.1 Service Providers

We work with trusted third-party companies that perform services on our behalf. These include:

• Cloud hosting and infrastructure (e.g., Amazon)
• Payment processing (e.g., Stripe)
• Email delivery services (e.g., Flodesk)
• Analytics platforms (e.g., Google Analytics)
• Customer support tools (e.g., Google Workspace)
• AI and machine learning infrastructure (see Section 6)
• Advertising platforms (e.g., Meta, Google): we may upload hashed customer information solely for audience suppression, lookalike modeling, or measurement purposes on our own campaigns. We do not authorize these platforms to use your information for their own advertising to third parties.

All service providers are contractually required to use your information solely to perform services on our behalf and to protect it using appropriate security measures.

5.2 Parent Coaches

If your plan includes access to one-on-one parent coaching sessions, your account information and any progress notes you share will be accessible to the coach assigned to your session. Coaches are bound by confidentiality obligations.

5.3 Legal Requirements

We may disclose information when we believe in good faith that disclosure is required by law, court order, or governmental authority, or where disclosure is necessary to protect the rights, property, or safety of Nexa Institute, our users, or the public.

5.4 Business Transfers

If Nexa Institute undergoes a merger, acquisition, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you in advance by email or by a prominent notice on our platform before your information becomes subject to a materially different privacy policy.

5.5 With Your Consent

We may share your information for any other purpose with your explicit prior consent.

6. Artificial Intelligence and Automated Processing

Storilly uses artificial intelligence to help match parents with relevant books and learning resources. Specifically, our AI system processes book content and metadata to identify materials that are appropriate for a child's age and relevant to your stated coaching goals.

What our AI does:

• Analyzes and indexes book content, themes, and language-development characteristics
• Matches those characteristics to your child's age and your coaching focus areas

What our AI does not do:

• Our AI does not generate coaching content, assessments, or recommendations for your child
• Our AI does not make clinical or developmental determinations about your child
• Our AI does not profile individual children based on behavior or engagement data

All AI-driven matching is based on your child's age as you have provided it and on your stated coaching goals. No automated decisions that produce legal or similarly significant effects are made about you or your child through our AI systems.

7. Children's Privacy

Storilly is a parent coaching platform. Our Services are designed for and directed to adults, meaning parents and legal guardians. We do not direct our Services to children, and children do not create accounts or interact with our platform.

The only information we collect that relates to a child is the child's age, which you as a parent provide to us. We use this information solely to personalize your coaching content. We do not use it for marketing, advertising, or any purpose unrelated to delivering your coaching experience.

COPPA: Because our platform is directed to parents (not children) and we collect only a child's age and assessment as reported by a parent, and use it solely to deliver the Services, we believe our practices are consistent with the Children's Online Privacy Protection Act (COPPA). If you have questions about our COPPA practices, please contact us at help@storilly.com.

If you believe we have inadvertently collected personal information directly from a child under 13, please notify us immediately at help@storilly.com and we will delete it promptly.

8. Data Security

We take the security of your information seriously and implement commercially reasonable administrative, technical, and physical safeguards, including:

• Encryption of data in transit using TLS/SSL
• Encryption of sensitive data at rest
• Role-based access controls limiting data access to authorized personnel
• Regular security assessments and vendor reviews

No system is completely secure. If you have reason to believe that your account has been compromised, please contact us immediately at help@storilly.com.

In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

9. Data Retention

We retain your information for as long as your account is active or as needed to deliver our Services:

• Account and profile information: retained until you delete your account or request deletion, after which it is deleted or anonymized within 30 days
• Usage and analytics data: retained in anonymized or aggregated form that is retained until you delete your account or request deletion.
• Transaction and billing records: retained until you delete your account or request deletion
• Communications and support records: retained until you delete your account or request deletion.

10. Your Privacy Rights

10.1 California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: Request a disclosure of the categories and specific pieces of personal information we hold about you
• Right to Delete: Request deletion of personal information we hold about you, subject to limited legal exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising
• Right to Limit Sensitive Personal Information: Request that we limit our use of sensitive personal information to providing the Services
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights

To submit a rights request, email us at help@storilly.com with the subject line "California Privacy Rights Request." We will verify your identity and respond within 45 days (extendable by an additional 45 days with notice).

Do Not Sell or Share My Personal Information

10.2 All Users

Regardless of your location, you may:

• Review and update your account information at any time through your account settings
• Opt out of marketing emails by clicking "Unsubscribe" in any promotional communication
• Request deletion of your account by contacting us at help@storilly.com

We will honor all deletion requests within 30 days, except where retention is required by law.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website and in our application to:

• Maintain your logged-in session
• Remember your preferences and settings
• Analyze how users interact with our Services (e.g., which features are most used)
• Measure the effectiveness of our marketing campaigns on our marketing website

Cookie types we use:

• Essential cookies: necessary for the Services to function; cannot be disabled
• Analytics cookies: help us understand usage and improve our platform (e.g., Google Analytics, Meta)
• Marketing cookies: used on our public marketing website and during the registration process on app.storilly.com.

You can control cookies through your browser or device settings. Disabling essential cookies may limit your ability to use certain features of our Services.

Manage cookie preferences

12. Third-Party Links

Our website and application may contain links to third-party websites, content, or resources. We are not responsible for the content or privacy practices of those third parties. We encourage you to review the privacy policies of any external sites you visit.

13. International Users

Our Services are operated from the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using our Services, you consent to this transfer and processing.

14. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you by email if we hold your email address
• Post a prominent notice within the Services

We encourage you to review this policy periodically. Your continued use of our Services after any changes take effect constitutes your acceptance of the updated policy.

15. Contact Us

Questions, concerns, or requests regarding this Privacy Policy should be directed to: