The FlightPlan (BETA) Privacy Policy Supplement

This Privacy Supplement explains how Curious Cardinals collects, uses, shares, and retains information when you use The FlightPlan. It supplements the Main Privacy Policy. If there is a conflict, this Privacy Supplement controls for The FlightPlan.

This Privacy Supplement applies to users located in the United States only. We do not knowingly make the Service available to users outside the United States. If you are located outside the United States, please do not use The FlightPlan.

This Supplement applies to:

• Parents/legal guardians who create and manage a FlightPlan account; and
• Students (generally ages 13 to 18) who use FlightPlan under a Parent’s account.

We collect information you choose to provide and information generated through your use of FlightPlan, including:

3.1 Voice and transcript information. The FlightPlan uses voice features which collect voice audio from conversations with our AI voice feature and text transcripts generated from those conversations. If you do not want your voice recorded, do not use The FlightPlan. We do not use voice to identify you.

3.2 Uploaded documents. We collect documents you upload, which may include school transcripts, resumes, activity lists, and other documents you choose to provide.

3.3 Account and profile information. We collect Parent account information (name, email, and billing details via our payment processor) and Student profile information you provide (for example, grade level, interests, goals).

3.4 Usage and device data. We may collect log data (e.g., timestamps and feature usage), device/browser data, and approximate location (e.g., from IP address) to help operate, secure, and improve The FlightPlan.

3.5 AI-processed information.

When you use AI features, we — and our AI and transcription service providers acting on our behalf — process your Inputs (including voice transcripts, uploaded documents, and profile information) to generate personalized AI Recommendations. This processing may involve transmitting your Inputs to third-party AI model providers.

Voiceprint clarification.We collect voice audio to create text transcripts of conversations. We do not use voice audio to build a biometric profile, voiceprint, or voice-based identifier for the purpose of identifying you as an individual. If our transcription provider’s technology creates speaker embeddings or voice models as part of the transcription process, we will update this Supplement and implement applicable consent and retention requirements for affected states.

3.6 Contact and SMS information. If you (or a Parent or Student adding a family member) provide a mobile phone number, we collect that number to send account-related text messages (SMS), such as one-time sign-in verification codes, a single-use link inviting a family member to join a FlightPlan family account, appointment reminders you choose to receive, weekly check-in reminders you enable, and messages from Sky, our coaching assistant, in conversations you start or opt in to. We also collect SMS-related information such as your consent status and any opt-out (STOP) or help (HELP) requests, so we can honor them.

We use information to:

5.1 De-identified and aggregated data (no opt-out available).We use certain FlightPlan information to create de-identified and/or aggregated data — meaning data that cannot reasonably be used to identify you or the Student — to help us evaluate and improve the Service (for example, to measure feature usage and output quality at a population level). Because this data is not personal information, we use it regardless of your Improvement Program preference described in Section 5.2. We use reasonable technical and administrative measures to prevent re-identification and do not attempt to re-identify de-identified data except as permitted by law.

5.2 Improvement Program — identifiable data (opt-out available). We may also use identifiable personal information to evaluate and improve the Service, for example by reviewing AI-generated recommendations alongside the Inputs used to generate them to assess accuracy and quality. This is the "Improvement Program." The Improvement Program does not involve training third-party AI models on your data.

The categories of personal information that may be used in the Improvement Program include:

• Voice audio recordings
• Transcripts of voice sessions
• Uploaded school transcripts and documents
• Student profile information (grade, interests, goals)
• AI-generated recommendations
• Usage and behavioral data

5.3 Improvement Program default and opt-out. You are enrolled in the Improvement Program by default. You can opt out of the Improvement Program any time through Settings or by contacting info@curiouscardinals.com. Opt-out applies going forward and does not affect de-identified or aggregated data already created under Section 5.1.

We share information only as described in the Main Privacy Policy and this Supplement, including:

6.1 Service providers (processors). We may share information with vendors who help us operate FlightPlan (for example: cloud hosting, transcription, AI/LLM providers, analytics, customer support tools, and payment processors). These vendors are authorized to use information only to provide services to us (subject to their contracts with us).

6.2 Legal and safety. We may disclose information if we believe it is reasonably necessary to comply with law or legal process; respond to lawful requests; or protect the rights, property, and safety of Curious Cardinals, our users, or others.

6.3 California: “sale” / “sharing” (FlightPlan).

• No sale. We do not sell personal information collected through FlightPlan.
• No sharing for cross-context behavioral advertising. We do not share personal information collected through FlightPlan with third parties for cross-context behavioral advertising.
• Service providers only. We disclose personal information to service providers for business purposes (for example, to host the Service, transcribe voice calls, process payments, and provide customer support) under contracts intended to restrict them from using the information for their own purposes.

6.4 Mobile and SMS information. We do not sell, rent, or share mobile phone numbers or SMS opt-in or consent information with third parties or affiliates for their own marketing or promotional purposes. We share mobile information only with service providers that help us deliver the messages you have agreed to receive (for example, our SMS provider, Twilio), and only so they can provide that service to us. Text messaging originator opt-in data and consent are not shared with any third parties for marketing purposes.

7.1 Data Retention. We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including to provide and improve The FlightPlan, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements. We do not retain personal information for longer than is reasonably necessary for these disclosed purposes.

Retention periods vary depending on the category of personal information and how it is used. For example:

• Account and Identifiers (e.g., name, email address, login credentials) are retained while an account is active and for a reasonable period thereafter to support account reactivation, legal compliance, and recordkeeping.
• Student-Provided Information / User Content (e.g., responses, assignments, inputs, and other materials submitted through the service) is retained for as long as necessary to provide the Service and support the user experience, and may be deleted or de-identified upon request, subject to applicable legal obligations.
• Audio Data (Voice Inputs and Recordings) (e.g., voice recordings submitted through the service) is retained only as long as necessary to process the request. Where feasible, audio data is transiently processed and converted to text, after which recordings may be deleted or de-identified within a short, commercially reasonable timeframe, unless longer retention is required for security, legal, or operational purposes or by request (for example, through participation in the Improvement Program).
• AI-Generated Outputs(e.g., responses, recommendations, or other outputs generated based on user inputs) are retained as part of the user’s interaction history for as long as necessary to provide the Service and maintain functionality, and may be deleted or de-identified upon request.
• Usage and Analytics Data (e.g., interaction data, device information, and performance metrics) is retained for a limited period necessary to maintain, analyze, and improve the Service and ensure security.

We may retain certain information for longer periods where required or permitted by law, including for security, fraud prevention, backup, or compliance purposes. Where appropriate, we may de-identify or aggregate personal information and retain it in that form.

7.2 Deletion requests. Parents (or users, as applicable) may request deletion of personal information by contacting us at info@curiouscardinals.com. We will verify the request and respond in accordance with applicable law.

We will delete personal information from our records and direct our service providers to do the same, unless retention is necessary for purposes permitted by law, including to:

• Complete the transaction or provide the requested service
• Detect security incidents or protect against malicious activity
• Comply with legal obligations
• Exercise or defend legal claims
• Ensure the integrity and functionality of the service

8.1 COPPA compliance.

The Service is directed to parents and legal guardians, not to children under 13. Parents create accounts and consent on behalf of Students. We do not knowingly collect personal information directly from children under 13. If a child under 13 has accessed the Service without a Parent’s account, or if you believe we have inadvertently collected personal information from a child under 13 without appropriate verifiable parental consent, please contact us immediately at info@curiouscardinals.com and we will take prompt steps to delete the information.

8.2 Teen users (ages 13–17).

Students ages 13–17 use the Service under a Parent’s account. Parents have the ability to access, review, and request deletion of their Student’s information by contacting info@curiouscardinals.com. We do not use Student information for targeted advertising. We do not sell Student information. We do not disclose Student information to third parties except as described in Section 6 (service providers, legal/safety).

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No system is 100% secure.

Privacy questions or requests: info@curiouscardinals.com

Mail: 783 Lockearn St, Los Angeles, CA 90049