Privacy Policy

How CooplyHQ collects, uses, and protects your information.

Effective date: June 23, 2026
Last updated: October 22, 2026

1. Overview

This Privacy Policy explains how CooplyHQ, LLC ("CooplyHQ," "we," "us," or "our") collects, uses, shares, and protects information when you use cooplyhq.com, any CooplyHQ-hosted co-op subdomain, and our related services (collectively, the "Service").

CooplyHQ is a software platform that homeschool co-ops use to build and operate their websites, manage membership, schedule classes, and communicate with families. Our direct customers are the co-ops themselves. Co-op administrators, instructors, parents, and other authorized adults are the people who interact with the Service. Children's information may appear in the Service only because a co-op administrator enters it on behalf of their co-op.

If you are a parent or guardian and want to know what information your co-op has placed in CooplyHQ about your child, contact your co-op administrator first — they control that data. We will support you and the co-op in honoring any verified request.

2. Who we are and how to reach us

The data controller (under GDPR/UK GDPR) and the business (under CCPA/CPRA) responsible for your personal information is:

CooplyHQ, LLC
PO Box 4601, Milton, FL 32572
Email: privacy@cooplyhq.com

We do not currently have an EU or UK representative. If you are located in the EEA, UK, or Switzerland and wish to exercise data-protection rights, contact us at privacy@cooplyhq.com and we will respond as required by applicable law.

3. Information we collect

3.1 Information you give us directly

When you create an account, configure a co-op, communicate with us, or pay for a subscription, you may provide:

  • Identification: name, email address, phone number, role at the co-op (admin, instructor, parent, etc.).
  • Account credentials: username, password (stored only as a cryptographic hash), single-sign-on identifiers if you use a federated login provider.
  • Co-op profile information: co-op name, location (city/state), description, logo, public-facing content you publish.
  • Billing information: payment-card details and billing address (collected and stored by our payment processor, Stripe — we do not store full card numbers).
  • Support communications: messages, attachments, screenshots, and metadata you send to our support team.

3.2 Information a co-op administrator may enter about other people

A co-op administrator may use the Service to manage their co-op's roster, which can include information about other adults (instructors, parents, volunteers) and minors enrolled in the co-op (children of co-op families). This information typically includes names, ages or grade levels, contact information for parents/guardians, course enrollments, attendance, and similar operational records.

Health and safety information about a child — sensitive personal information. The Service holds a health and safety record for each child on a co-op's roster. That record contains:

  • Medical notes and allergies — free-text information a family writes down so the co-op can keep their child safe during co-op activities.
  • Photo consent — whether the family permits the co-op to photograph their child. A blank answer means the family has not answered, which we treat as different from “no.”

Only the adults of a child's own household can enter or change that record. Within the co-op, only officers responsible for registrations and the lead of a class or event the child is actively enrolled in can read it. It is encrypted at rest and is never included when the Service lists, searches, or exports children — a page has to ask for it by name. See Section 11.

We treat this information as sensitive personal information under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) and as special-category data under Article 9 of the GDPR/UK GDPR. We use it only to provide the Service to the co-op that entered it. We do not use it for advertising, profiling, or any other purpose, and we do not sell or share it.

Information about minors is entered by adult co-op administrators acting under the authority of their co-op and the consent of the relevant parents or guardians. See Section 7 (Children's privacy) for how we treat this category of information.

3.3 Information collected automatically

When you use the Service, we automatically receive:

  • Device and browser information: IP address, browser type and version, operating system, screen size, language, time zone, device identifiers.
  • Usage information: pages viewed, links clicked, features used, referring URLs, dates and times of access, and similar interaction data.
  • Cookies and similar technologies: see Section 8.
  • Log data: server logs that may include the above plus error reports.

3.4 Information from third parties

We may receive information about you from:

  • Federated identity providers you use to sign in (e.g., Google, Microsoft, or WorkOS-supported providers).
  • Our payment processor (Stripe), which may confirm successful payment, payment failures, fraud signals, and a tokenized reference to your card.
  • Email-deliverability and anti-spam services (e.g., Brevo), which may share bounce, complaint, and engagement data.
  • Public sources, when you publicly identify yourself as a CooplyHQ user.

4. How we use information

We use information to:

  • Operate, maintain, and improve the Service.
  • Create and manage accounts and co-op workspaces.
  • Process subscriptions, payments, refunds, and invoicing.
  • Send service communications (account confirmations, billing notices, security alerts, policy updates).
  • Send product communications you have opted into.
  • Hold the health and safety information a family records about their child, so that the co-op officers and class leads responsible for that child can keep them safe during co-op activities.
  • Provide customer support and respond to inquiries.
  • Monitor for, prevent, investigate, and respond to fraud, abuse, security incidents, and violations of our Terms.
  • Analyze usage to understand which features are valuable and to plan improvements.
  • Comply with legal obligations and enforce our agreements.

We do not sell personal information, and we do not use personal information to serve cross-context behavioral advertising. We do not use children's information for any purpose other than providing the Service to the co-op that entered it.

5. Legal bases (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland, we rely on the following legal bases:

  • Contract — to provide the Service to you and the co-op you belong to.
  • Legitimate interests — to secure the Service, prevent abuse, communicate with users about their account, and improve the product, balanced against your rights and interests.
  • Legal obligation — to comply with applicable laws and lawful requests.
  • Consent — for any processing that requires it (e.g., certain marketing communications). You may withdraw consent at any time without affecting the lawfulness of processing already carried out.

6. How we share information

We share information with the following categories of recipients, only as needed and under appropriate contractual and security protections:

  • Service providers (subprocessors) — companies that help us run the Service. Current subprocessors include:
    • Stripe — payment processing.
    • Laravel Cloud (and its underlying cloud-infrastructure providers) — application hosting and database hosting.
    • Cloudflare — content delivery, DNS, and DDoS protection.
    • Brevo — transactional and operational email delivery.
    • WorkOS — authentication / single-sign-on infrastructure.
    A current list of subprocessors is available on request at privacy@cooplyhq.com.
  • An analytics provider the co-op chooses to switch on. A co-op administrator can connect the co-op's own Google Analytics or Plausible Analytics account to the co-op's CooplyHQ-hosted website. Where a co-op has done that, visitors to that co-op's site send usage data to that provider under the co-op's own account, and the co-op — not CooplyHQ — decides what is collected and for how long. We do not add an analytics provider of our own, and the analytics script does not load unless the visitor's cookie choice allows it (see Section 8).
  • The co-op you belong to. If you are an instructor, parent, or other user of a co-op's CooplyHQ workspace, the co-op administrator can see your activity within that workspace.
  • Legal and safety. We may disclose information if required by law, subpoena, court order, or other legal process, or if we believe disclosure is necessary to protect the rights, property, or safety of CooplyHQ, our users, or the public (including investigating fraud or violations of our Terms).
  • Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred to the successor entity. We will require any successor to honor the commitments in this Policy or provide notice of material changes.
  • With your direction or consent. We may share information when you direct us to or when you have given consent.

We do not share information with advertisers for cross-context behavioral advertising.

All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

7. Children's privacy (COPPA and FERPA)

CooplyHQ is intended for use by adults operating homeschool co-ops. Children do not have direct accounts or login credentials in the Service. We do not knowingly collect personal information directly from children under 13, and the Service does not offer any feature, page, or sign-up flow that solicits children to interact with us directly.

Where children's information appears in the Service, it is because an adult co-op administrator entered it on behalf of the co-op, in reliance on the co-op's own relationship with the parents or legal guardians of the children involved. Adult parents and guardians may access information about their own children through their own (adult) account; children themselves do not log in. Under our Terms, co-op administrators represent and warrant that they have obtained any parental consent required by the federal Children's Online Privacy Protection Act ("COPPA") and any analogous state law before placing children's information in the Service.

In this arrangement, the co-op is the entity collecting personal information from children and obtaining parental consent. CooplyHQ acts as the co-op's service provider with respect to that information. We use children's personal information solely to provide the Service to the co-op that entered it. We do not sell or share children's personal information, do not use it for advertising, do not use it to build profiles for purposes unrelated to the Service, and do not retain it longer than necessary for those purposes.

If you are a parent or guardian and you believe a co-op has placed your child's information into CooplyHQ without your consent, or you want that information reviewed or deleted:

  1. Contact the co-op administrator directly. They can review and delete the records.
  2. If you cannot reach the co-op or believe your request is not being honored, contact us at privacy@cooplyhq.com. We will reasonably cooperate with you and the co-op to honor a verified request.

Where CooplyHQ holds education records on behalf of a co-op functioning as an educational institution, we treat those records as confidential and use them only to provide the Service to the co-op. We do not use education records for our own marketing or product-development purposes outside of the relationship with the co-op.

8. Cookies and similar technologies

We use cookies and similar technologies to:

  • Keep you signed in and remember session state (strictly necessary).
  • Remember preferences such as language and display settings (functional).
  • Understand how the Service is used so we can improve it (analytics).

We do not use cookies for cross-context behavioral advertising.

8.1 What is set, by whom, and for how long

Strictly necessary — cannot be switched off:

  • Session cookie (CooplyHQ, first party) — maintains your signed-in session. Session / 120 minutes.
  • XSRF-TOKEN (CooplyHQ, first party) — protects forms against cross-site request forgery. Session / 120 minutes.
  • cooply_cookie_consent (CooplyHQ, first party) — stores your own cookie choices so we stop asking. 180 days.
  • __cf_bm / __cfruid / cf_clearance (Cloudflare, third party) — bot management and traffic routing for the network in front of the site. 30 minutes to 1 year.

Analytics — set only where a co-op has switched on its own analytics account, and only if you allow it:

  • _ga / _ga_* / _gid (Google Analytics, third party) — distinguishes visitors and sessions to produce aggregate traffic reports. Up to 2 years.
  • Plausible Analytics (third party) — aggregate traffic reports. Plausible sets no cookies, but we still hold its script behind your analytics choice.

We do not currently set any functional or other-category cookie beyond those listed above. If that changes, we will update this list and ask you again.

8.2 How to control them

A Cookie preferences control sits in the bottom-left corner of the Service's pages, including every page that can set an optional cookie. Opening it lets you accept or reject each optional category, and you can change your answer at any time — the control never goes away. Rejecting analytics stops the analytics script from being served at all; we do not load it and then ignore it.

If you are in the EEA or the UK, nothing optional loads until you have said yes. Elsewhere, optional categories load until you say no. You can also control cookies through your browser settings, though if you block strictly necessary cookies parts of the Service will not work.

8.3 Do Not Track and Global Privacy Control

Some browsers send a “Do Not Track” (DNT) signal. There is still no common industry or legal standard for how a site must interpret DNT, so — as California Business & Professions Code §22575(b)(5) requires us to tell you — the Service does not respond to DNT signals. We also do not allow third parties to collect personally identifiable information about your activity across other websites through the Service.

We do honor the Global Privacy Control (a Sec-GPC signal sent by your browser or an extension). We treat it as an automatic “Do Not Sell or Share My Personal Information” request: when we see it, optional categories including analytics are switched off for you without your having to click anything.

9. Your rights and choices

Depending on where you live, you may have the following rights regarding your personal information. We honor verified requests as required by applicable law and do not discriminate against users who exercise their rights.

9.1 Residents of California (CCPA/CPRA)

You have the right to:

  • Know — request the categories and specific pieces of personal information we have collected about you, the sources, purposes, and categories of third parties with whom we share it.
  • Delete — request that we delete personal information we have collected, subject to certain exceptions (e.g., to complete a transaction, detect security incidents, comply with law).
  • Correct — request that we correct inaccurate personal information.
  • Opt out of sale or sharing — we do not sell personal information for money and we do not share it for cross-context behavioral advertising. We still give you the control: see “Do Not Sell or Share” immediately below.
  • Limit the use of sensitive personal information — we do process sensitive personal information: children's medical notes and allergies, and the photo-consent answer that goes with them (Section 3.2). You may direct us to limit its use to what is necessary to provide the Service. That is already the only thing we use it for.
  • Non-discrimination — we will not discriminate against you for exercising any of these rights.

You may submit requests at privacy@cooplyhq.com or through any web form we make available. You may also designate an authorized agent to submit a request on your behalf; we will require written authorization and may require verification of your identity.

“Do Not Sell or Share My Personal Information”

Outside the EEA and the UK — which includes California and the rest of the United States — the Service shows a Do Not Sell or Share My Personal Information button alongside the Cookie preferences control described in Section 8.2. We offer it even though we do not sell personal information, because a co-op may switch on its own third-party analytics (Section 6), and some interpretations of “sharing” reach that far. Pressing it switches off every optional category for you, which stops any analytics script from being served. We honor the Global Privacy Control signal the same way, automatically — see Section 8.3.

Categories of personal information we collect

Set out in the terms the CCPA/CPRA uses, with the purpose and the recipients for each. We do not sell or share any of it for cross-context behavioral advertising.

  • Identifiers (name, email address, phone number, account identifier, IP address) — to create and run accounts, authenticate you, and secure the Service. Disclosed to our hosting, email, authentication and network providers (Section 6).
  • Customer records (billing address, payment-card details handled by our payment processor) — to take subscription payments and issue invoices. Disclosed to Stripe.
  • Commercial information (plan, subscription status, payment history) — to run billing and support. Disclosed to Stripe and our hosting provider.
  • Internet or network activity (pages viewed, features used, referring URLs, device and browser details, log data) — to operate, secure and improve the Service. Disclosed to our hosting and network providers, and, where a co-op has switched it on and you have allowed it, to that co-op's own analytics provider.
  • Education information (course enrollments, attendance, roster records for children) — to provide the Service to the co-op that entered it. Disclosed to our hosting provider only.
  • Sensitive personal information (children's medical notes and allergies, and photo consent) — held so the co-op can keep a child safe during co-op activities. Encrypted at rest; disclosed to our hosting provider only (Section 6), never sold or shared, and used for no purpose other than providing the Service.
  • Inferences — none. We do not build profiles about you.

We collect these from you directly, from the co-op administrator who entered them, and automatically from your use of the Service (Section 3).

"Shine the Light" (California Civil Code §1798.83)

California residents may ask whether we have shared their personal information with third parties for those third parties' own direct-marketing purposes during the prior calendar year. CooplyHQ does not share personal information with third parties for their own direct-marketing purposes. The service providers we use to operate the Service (such as our payment processor, email provider, hosting provider, and identity provider) process personal information only under our instructions and only to deliver the Service; they are not permitted to use that information for their own direct marketing. If you have questions about this disclosure, email privacy@cooplyhq.com.

9.2 Residents of other U.S. states with comprehensive privacy laws

If you live in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), or another state with a comprehensive privacy law that applies to your relationship with us, you have rights similar to those above, including the rights to access, correct (where required), delete, obtain a portable copy of your personal data, and opt out of targeted advertising, sale, or certain profiling (we do not engage in any of those activities). You may also appeal a denial of a request by replying to our decision at privacy@cooplyhq.com.

9.3 EEA, UK, and Switzerland (GDPR / UK GDPR)

You have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on our legitimate interests, and to withdraw consent where consent is the legal basis. You also have the right to lodge a complaint with your local data-protection supervisory authority.

9.4 Residents of Nevada

Nevada law (NRS 603A.340) lets Nevada consumers tell a website operator not to sell their covered personal information. We do not sell personal information, so there is nothing of yours for us to stop selling. If you would like us to record your direction anyway, email privacy@cooplyhq.com with the subject line “Nevada opt-out” and the email address on your account, and we will confirm it in writing.

9.5 How to exercise your rights

Email privacy@cooplyhq.com with enough information for us to verify your identity and locate your records. We will respond within the time required by applicable law (generally 45 days under U.S. state laws and one month under GDPR), and may extend that period when permitted by law.

10. Data retention

We retain personal information for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specifically:

  • Account records are retained while your account is active and for a reasonable period afterward to honor reactivation, billing reconciliation, and legal-hold needs.
  • Billing records are retained as long as required by tax and accounting law (typically up to seven years).
  • Support communications are retained for as long as needed to provide and improve support.
  • Information about minors entered by a co-op is retained per the co-op's instructions; co-op administrators can delete such records at any time, and we will delete on request from the co-op or from a verified parent/guardian.
  • Log data is retained for a limited period for security, debugging, and abuse-prevention purposes (typically 30–90 days for verbose logs).

When we no longer need personal information, we delete or de-identify it.

11. Data security

We use administrative, technical, and physical safeguards designed to protect personal information against loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. These include encryption in transit (TLS), encryption at rest for credential and payment-token data, role-based access controls, audit logging, and routine review of our security posture.

Children's medical notes get more than that. They are encrypted at rest in their own right, kept in a separate record from the rest of a child's roster entry, and left out of every list, search and export the Service produces — a screen has to request them by name, and only the people named in Section 3.2 may do so.

There is one printed document that does carry them, and it exists on purpose: the event roster sheet. An officer responsible for registrations, or the adult running a particular event, can download that event's roster as a PDF so that a child's medical notes, allergies, photo-consent answer and the household's emergency contacts are in the room with them rather than behind a login. The sheet is produced only for those same people — the ones named in Section 3.2 — only when one of them asks for it, and it is labelled confidential on its face. We never email it and we never send it anywhere: it downloads to the device of the person who requested it, and from that point it is a paper document in the care of the co-op.

No method of transmission over the internet or storage system is perfectly secure. If we become aware of a security incident that affects your personal information, we will notify you as required by applicable law.

12. International data transfers

CooplyHQ is operated from the United States and our subprocessors may process data in the United States and other countries. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States and other jurisdictions whose data-protection laws may differ from those of your country.

Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, supplemented as necessary.

13. Third-party services and links

The Service may contain links to third-party websites, services, or content that we do not control. Their privacy practices are governed by their own policies. Review them before using those services.

14. Changes to this Privacy Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date at the top. If the changes are material, we will provide notice (for example, by email or by an in-product notice) before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

15. Contact us

Questions, requests, or complaints about this Policy or our handling of your personal information:

CooplyHQ, LLC
PO Box 4601, Milton, FL 32572
Email: privacy@cooplyhq.com

Governing law: this Policy is governed by the laws of the State of Florida, without regard to its conflict-of-laws principles, except where superseded by mandatory provisions of the data-protection law applicable to you.