COPPA Notice

The Children's Online Privacy Protection Act (COPPA) is a U.S. federal law that requires operators of websites and online services directed to children under 13, or that knowingly collect personal information from children under 13, to obtain verifiable parental consent before collecting, using, or disclosing such information.

On Helix AI is a research opportunity discovery platform used by students aged 13 and older. We do not knowingly allow children under 13 to create accounts. We take our obligations under COPPA seriously and have designed our registration process accordingly.

On Helix AI does not allow users under 13 to create accounts. During registration, users who indicate they are under 13 are blocked from proceeding.

For users aged 13-15, we send a notification to a parent or guardian email address provided at sign-up so that parents are aware of their child's account. Users 16 and older can use the platform independently.

For users aged 13-17, we collect the following categories of information:

• First name or display name
• Email address (used for login and communication)
• Date of birth (to verify age and eligibility)
• Grade level and school name (to surface relevant opportunities)
• State and zip code (to show location-relevant opportunities)
• Academic interests and skill level (to personalize recommendations)
• Parent or guardian's email address (for consent and communication)
• IP address and page view data (for security and analytics purposes)

We collect only the minimum information necessary to provide the Service. We do not collect phone numbers, Social Security numbers, photos, or precise geolocation from minor users.

Information collected from minor users is used solely to:

• Create and manage the child's account
• Provide personalized research opportunity recommendations
• Send account-related communications (e.g., password resets) to the child's email
• Contact the parent or guardian (for users under 16) regarding account activity or required notices
• Comply with legal obligations and protect the security of the Service

We do not:

• Sell users' personal information to third parties
• Use users' information for targeted advertising
• Share users' information with third parties for their own marketing purposes
• Allow users to publicly post personal information on the platform

As the parent or guardian of a minor user (under 18), you have the following rights:

• Review: You may request to review the personal information we have collected from your child at any time.
• Correct: You may request that we correct inaccurate information about your child.
• Delete: You may request that we delete your child's personal information. Upon a verified deletion request, we will delete the child's account and associated data within 30 days.
• Withdraw consent: You may withdraw your consent for our continued collection or use of your child's personal information at any time. Withdrawal of consent will result in the child's account being deactivated. Note that this will not affect the lawfulness of processing that occurred before withdrawal.
• Refuse further collection: You may direct us to stop collecting further personal information from your child while still allowing the child to continue using the Service with existing information. Please contact us to discuss the options available.

To exercise any of these rights, please email us at privacy@onhelixai.com from the email address you used during the consent process. We may need to verify your identity before fulfilling your request.

• All data is transmitted over encrypted HTTPS connections.
• Passwords are hashed using industry-standard bcrypt; we never store them in plain text.
• Access to user data is restricted to authorized personnel only.
• We conduct periodic reviews of our data practices to ensure compliance.
• User profiles are not publicly visible to other users.

We retain users' personal information only as long as the account is active. If you request deletion, we will delete the associated personal information within 30 days, except where retention is required by law.

We use a limited number of third-party service providers who may process user information solely on our behalf and in accordance with our instructions:

• SendGrid — to send consent and account emails
• Railway — secure cloud hosting for our database and servers
• Sentry — error monitoring (anonymized data only)

We do not allow any third party to use users' personal information for their own purposes.

We may update this COPPA Notice from time to time. If we make material changes that affect how we collect or use users' personal information, we will notify parents and guardians of minor users by email.

If you have any questions or concerns about our COPPA practices, or to exercise your parental rights, please contact us:

You may also file a complaint with the Federal Trade Commission (FTC) at www.ftc.gov or by calling 1-877-FTC-HELP.