NORTH STAR CONTESTS SOCIETY — PRIVACY POLICY

    Last Updated: February 13, 2026

    1. Introduction

    We are North Star Contests Society ("we," "us," "our"), a Canadian not-for-profit organization operating the online platform northstartests.com (the "Site"). This Privacy Policy explains how we collect, use, disclose, store, and protect personal information relating to parents, teachers, and student participants.

    This Policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). It also includes provisions for users located in the European Economic Area (EEA) under the General Data Protection Regulation (GDPR).

    By using our Site or Services, you consent to the practices outlined in this Policy.

    2. General Principles

    1. We collect only the minimum information required to operate our contests.
    2. Access to student and account data is restricted to authorized personnel.
    3. All data is hosted and processed using infrastructure provided by Replit, with data stored on servers located in the United States.
    4. We maintain transparency and give users control over their information.
    5. North Star Contests prioritizes child privacy and collects personal information only from parents or teachers, never directly from students.
    6. We do not profile students, track behavior unrelated to contest participation, or use personal data for advertising.

    3. Information We Collect

    3.1 Family and School Accounts

    We collect the following from Authorized Adults (parents, teachers, schools):

    • Name
    • Email address (verified)
    • Password (secure salted hash)
    • School or institution name
    • School Address
    • Payment information processed by third-party processors
    • Activity logs relating to account management

    3.2 Student Information

    For each student added under an account, we collect:

    • First name, middle name (optional) and last name (optional) (as entered by the Authorized Adult)
    • Grade level
    • School or institution name
    • Contest participation data (answers, scores, time taken, ranking)
    • Access rights and contest history

    We do not verify student identities.

    Students do not create accounts and do not provide passwords.

    3.3 Information We Do Not Collect

    North Star Contests does not collect:

    • Student email addresses (unless a student contacts us voluntarily)
    • Phone numbers (parent, teacher, or student)
    • Demographic profiles
    • Student photographs or videos
    • IP-based geolocation beyond what is technically required for secure operation
    • Credit card numbers (these are handled solely by payment processors)
    • Any data from third-party educational platforms

    This reduces privacy risk and maintains high protection for student participants.

    4. How We Use Personal Information

    We use collected data to:

    • Register and authenticate parent and teacher accounts
    • Generate unique Student IDs
    • Administer contest participation
    • Calculate, display, and store contest results
    • Issue certificates
    • Publish merit lists using only first name + last initial
    • Provide customer support
    • Process payments
    • Improve contest structure and analytics

    We do not use student data for marketing, targeted advertising, or cross-platform profiling.

    We do not sell or rent personal information to any third party.

    5. Data Hosting, Access, and Storage Security

    All data is securely stored on servers located exclusively in the United States and Canada.

    Internal Access

    • Only authorized administrative staff with signed confidentiality agreements may access stored data.
    • Role-based access controls ensure staff can only access the minimum data necessary for their duties.
    • Teachers and parents can view information only for Students under their own accounts.
    • No cross-school visibility is permitted.

    Technical Safeguards

    • SSL/TLS encryption for all transfers
    • Daily encrypted backups; weekly full-site backups
    • Passwords stored as salted hashes (never in plain text)
    • Protection against SQL injection, XSS, and brute-force login attempts
    • Cloud-based firewall and DDoS protection
    • Monitoring and audit logs for suspicious activity

    6. Data Retention

    • Contest data (including results and rankings) is retained indefinitely to allow Students and coordinators to access historical results.
    • Older records may be archived but remain accessible for legitimate educational use.
    • Payment records are retained only as long as required by Canadian financial regulations.

    7. Data Sharing and Disclosure

    We may share limited personal information with:

    • Payment processors for purchase completion
    • Hosting providers located in the United States
    • Email service providers for communication
    • Security providers for firewall or DDoS protection

    All third-party service providers operate under strict confidentiality and must meet security safeguards equivalent to ours.

    We do not share any personally identifiable student data with advertisers, marketers, or unrelated third parties.

    8. Cookies and Analytics

    The Site uses:

    • Essential cookies for login and navigation
    • Preference cookies for user settings
    • Google Analytics (with explicit consent) for aggregated, anonymized usage statistics

    Users may disable cookies without losing essential functionality.

    9. Breach Response Protocol

    In the unlikely event of a data breach, we will:

    9.1 Containment

    • Work immediately with the hosting provider
    • Reset administrative credentials
    • Restore data from backup if needed

    9.2 Notification

    • Notify affected users promptly if there is a risk of harm
    • Notify EU users in accordance with GDPR timelines (within 72 hours when applicable)
    • Place a notice on the Site for widespread-impact incidents

    9.3 Remediation

    • Investigate root cause
    • Patch vulnerabilities
    • Update internal security controls and procedures
    • Re-issue new Student IDs if integrity is compromised
    • Document all actions for compliance

    10. Access, Correction, and Deletion Requests

    Authorized Adults may request:

    • Access to their personal data
    • Correction of inaccurate information
    • Deletion of their Family or School Account

    Contest records already published in merit lists or certificates may remain archived but will be de-identified whenever possible.

    We may retain limited information for legal or financial compliance.

    To make a request, contact: admin@northstartests.com

    11. Third-Party Services

    We work with carefully selected service partners, including:

    • Replit for hosting infrastructure
    • Cloudflare or equivalent security providers
    • Stripe for payments
    • Email delivery services (e.g., Mailgun)

    Each partner meets industry-standard privacy and security obligations.

    12. Transparency and Accountability

    North Star Contests may periodically request teachers or coordinators to confirm student lists for accuracy. We will notify users when material changes are made to this Policy. We maintain internal audit logs for accountability.

    13. Updates to This Policy

    This Policy may be updated periodically. The "Last Updated" date indicates the most recent revision.

    Continued use of the Site after changes means you accept the updated Policy.

    14. Contact Information

    For privacy questions, access requests, or concerns:

    North Star Contests

    Email: admin@northstartests.com