PRIVACY POLICY

Last Updated: April 25, 2026
Effective Date: April 25, 2026

INTRODUCTION

This Privacy Policy describes how AlphaCrew Studio LLC, doing business as HiWave Makers ("we," "us," "our"), collects, uses, shares, and protects personal information when you visit https://hiwavemakers.com or otherwise use our Services.

We are committed to protecting personal information and especially the personal information of children. We comply with the Children's Online Privacy Protection Act ("COPPA"), the Federal Trade Commission ("FTC") Act, and applicable state privacy laws.

If you do not agree with our policies and practices, please do not use the Services.

For questions: support@hiwavemakers.com.

Summary of Key Points
What Information We Collect
How We Use Your Information
Children's Information and COPPA Compliance
Class Recordings, Highlight Videos, and Marketing Use of Likeness
With Whom We Share Information
Sharing for Advertising Purposes
International Data Transfers
Cookies and Tracking Technologies
How Long We Keep Information
How We Protect Your Information
Your Privacy Rights (All Users)
Your Rights Under United States State Privacy Laws
Notice of Financial Incentives
Do Not Track and Global Privacy Control
Updates to This Policy
Contact Us
How to Submit a Privacy Request

1. SUMMARY OF KEY POINTS

Who is the data controller? AlphaCrew Studio LLC, doing business as HiWave Makers, located in Texas, USA.
What data do we collect? Names, contact information, child's first name and age (with parental consent), payment information (handled by Stripe), device and usage data, class participation records, and recordings of classes (with consent).
Do we collect sensitive personal information? We do not deliberately collect sensitive categories. Note: video and audio recordings of class participation may incidentally include voice and facial features, which are addressed in Section 5.
Do we collect data from children? Yes, with verifiable parental consent, and only what is necessary to provide our educational services (Section 4).
Who do we share data with? Service providers listed in Section 6. We do not sell personal information for monetary consideration. Some sharing for advertising purposes may constitute "sharing" under California law — see Section 7 for opt-out.
What rights do you have? Depending on your state of residence, you may have rights to access, correct, delete, port, opt out of sale/sharing, and limit use of sensitive information. See Sections 12 and 13.
How do you contact us? support@hiwavemakers.com

2. WHAT INFORMATION WE COLLECT

Information You Provide to Us

When you register an account, enroll in a program, contact support, apply for a scholarship, or otherwise interact with the Services, we collect:

Identity information: parent first and last name, child's first name and age, child's grade level (optional);
Contact information: email address, phone number, billing and shipping address;
Account credentials: username, password (stored in hashed form);
Payment information: payment card number, billing address, transaction details — processed and stored by Stripe; we do not store full card numbers on our systems;
Communications and inquiries: content of emails, SMS messages, chat messages, support tickets, and feedback you submit;
Class participation records: attendance, project work submitted, instructor notes, scoring of activities;
Scholarship application information (if you apply): household composition, income range (optional), employment status (optional), special circumstances (optional);
Media: video and audio recordings of live classes you attend (with your consent — see Section 5), photos of completed projects (if you submit them).

Information Collected Automatically

When you visit the Site or use our Services, we automatically collect: device and browser data (IP address, device type, browser type and version, operating system, language preferences); usage data (pages visited, links clicked, features used, time spent on pages); approximate location (city- or region-level derived from IP address); referrer data; and information via cookies and similar technologies — see Section 9 and our Cookies Policy.

Information from Third Parties

We may receive information about you from: payment processors (Stripe), email and SMS providers (Brevo, Twilio), advertising partners (Meta/Facebook, LinkedIn, Google), shipping carriers, customer support and chat tools (Tawk.to), and live class platform (Zoom). We do not purchase personal information from data brokers.

Sensitive Personal Information

Audio and video recordings of class participation may incidentally include voice and image data of participating students and parents. We do not use this data for facial recognition, voiceprint creation, or any biometric identification purpose. Recordings are stored securely and used only as described in Section 5.

3. HOW WE USE YOUR INFORMATION

We process information for the following purposes:

Create and manage your account (performance of contract);
Deliver classes, ship Kits, fulfill orders (performance of contract);
Process payments (performance of contract);
Send transactional communications — confirmations, reminders, schedule changes, payment alerts (performance of contract / legitimate interest);
Respond to support inquiries (performance of contract / legitimate interest);
Improve our Services and develop new features (legitimate interest);
Send marketing emails and SMS (consent — you can opt out at any time);
Personalize the website experience (legitimate interest / consent);
Detect and prevent fraud, abuse, and security incidents (legitimate interest);
Comply with legal obligations (tax, accounting, response to legal process);
Enforce our Terms of Service (legitimate interest);
Children's information for course delivery (verifiable parental consent);
Class recording for quality and learning continuity (consent);
Highlight video creation (consent);
Marketing use of student likeness (separate, explicit, revocable consent).

We do not engage in solely automated decision-making that produces legal or similarly significant effects on individuals.

4. CHILDREN'S INFORMATION AND COPPA COMPLIANCE

Our Commitment

HiWave Makers is designed for children ages 8 to 15. We are committed to complying with COPPA and similar state laws. All marketing and promotional communications are directed at parents and legal guardians, not children.

What We Collect from Children, and Only with Parental Consent

With verifiable parental consent, we collect the following information about an enrolled child, only as necessary to deliver our educational services:

Child's first name (last name is not required and we discourage providing it);
Child's age;
Child's grade level (optional);
Child's interests (optional, for class fit and personalization);
Class attendance, participation, and project work;
Audio and video recordings of class participation (with separate consent — see Section 5).

We do not knowingly collect from children: home address, phone number, email address, persistent identifiers other than as necessary for service delivery, geolocation data, social-media handles, or photos of the child outside of the class context.

Verifiable Parental Consent

We obtain verifiable parental consent before collecting any personal information about a child by: requiring the parent or legal guardian to create the account using their own contact information; requiring the parent's payment-card transaction at enrollment (a recognized FTC-acceptable verification method); confirming the parent's email address; and presenting the parent with this Privacy Policy and the Recording and Media Release at enrollment, with explicit acknowledgment.

Parents' Rights Regarding Children's Data

A parent or legal guardian may at any time: review the personal information we have collected from their child; request that we delete their child's personal information; refuse to permit further collection or use of their child's information; or withdraw any previously given consent (e.g., for recording or marketing use).

To exercise these rights, contact support@hiwavemakers.com.

Discovery of Unauthorized Child Data

If we learn that we have collected personal information from a child without verifiable parental consent, we will promptly delete the information and, if applicable, deactivate the related account.

No Persistent Identifiers for Behavioral Advertising Directed at Children

We do not use persistent identifiers to track children across services or to serve behaviorally targeted advertising directed at children. Any analytics or advertising cookies on our Services are configured to address parents/guardians. We do not publicly post a child's image, voice, full name, or other identifying information without separate, explicit parental consent (see Section 5).

5. CLASS RECORDINGS, HIGHLIGHT VIDEOS, AND MARKETING USE OF LIKENESS

Class Recordings (Functional Use — Required for Live Class Participation)

We record live class sessions for: quality assurance and instructor training; production of personalized highlight videos; catch-up sessions for students who miss a class; and compliance with law or response to legal process. Recordings are stored encrypted in cloud storage provided by Amazon Web Services and/or Google Cloud Platform.

Platform-only access. Recordings are accessible only through the HiWave Makers platform via your authenticated parent account. We do not post recordings publicly, distribute them through external links, share them on social media, email them as attachments, or make them downloadable to your device.

Functional Consent

By enrolling in a class, you consent on behalf of yourself and your minor child to the recording of class participation for the functional purposes above. Functional recording is required to participate in live classes. If you do not consent to recording, your child cannot participate in live classes.

You may withdraw consent for future recording at any time by emailing support@hiwavemakers.com. Withdrawing functional recording consent will end your child's ability to participate in live classes. Withdrawal does not affect the lawfulness of processing before withdrawal and does not affect existing recordings.

Highlight Videos (Part of Every Program)

A personalized highlight video is produced for every enrolled child as part of our program. Highlight videos are recap videos showing your child's progress through their course; they may include your child's first name, voice, image, and project work, edited from class recordings.

Highlight videos are delivered to you privately through the HiWave Makers platform. They are not public, not posted on social media, and not used in advertising or promotional materials unless you separately and expressly authorize that use through the Recording and Media Release. By enrolling, you consent to the creation and private delivery of your child's highlight video.

If you do not want a highlight video produced for your child, you must notify us at support@hiwavemakers.com before the program begins.

Marketing Use Is Opt-In and Separate

Use of any portion of class recordings, project photos, or highlight videos in our marketing, promotional materials, website content, social media, or paid advertising requires your separate, explicit, written, revocable consent, provided through our Recording and Media Release form. Granting consent in this Privacy Policy or in the Terms of Service is not sufficient.

If you grant marketing consent, you may revoke it at any time by emailing support@hiwavemakers.com. We will cease using new content for marketing within thirty (30) days of receipt of revocation.

No Biometric Identification

We do not use class recordings or highlight videos for facial recognition, voiceprint creation, or any biometric identification purpose. We do not provide recordings to any third party for biometric purposes.

6. WITH WHOM WE SHARE INFORMATION

We share personal information with the following categories of third parties solely as necessary to operate our Services. We require these parties to maintain reasonable security and to use the data only for the purposes we authorize.

Provider	Function	Where Processed
Stripe, Inc.	Payment processing	United States
Brevo (Sendinblue SAS)	Email and SMS delivery	France / United States
Twilio Inc. (via Brevo)	SMS infrastructure	United States
Google LLC (Firebase, Analytics, Ads, Tag Manager)	Cloud hosting, database, analytics, advertising	United States, EU
Amazon Web Services, Inc.	Cloud storage (recordings, large files)	United States
Tawk.to Ltd.	Live chat support	Hong Kong, regional data centers
Meta Platforms, Inc. (Facebook Pixel, Conversions API)	Advertising and conversion measurement	United States
LinkedIn (Microsoft) (Insight Tag)	Advertising and conversion measurement	United States
Anthropic, PBC	AI features (e.g., scholarship review assistance)	United States
Zoom Video Communications	Live class video conferencing	United States
Shipping carriers (USPS, UPS, FedEx, etc.)	Delivery of physical kits	United States

We may also share information: in response to legal process where required; to protect rights, safety, or property of HiWave Makers, our users, or the public; in connection with a corporate transaction; and with your consent, for purposes you authorize.

We do not sell personal information for money. Some sharing for advertising (Section 7) may constitute "sharing" under California's CPRA and similar laws; you may opt out of such sharing.

7. SHARING FOR ADVERTISING PURPOSES

We may share limited personal information with advertising platforms to: measure the effectiveness of our advertising campaigns; build custom audiences (e.g., uploading hashed email lists to Facebook Custom Audiences or LinkedIn Matched Audiences); limit how often you see an ad; and serve relevant advertising on third-party platforms.

These activities may constitute "sharing" or "sale" of personal information under California's CPRA, Texas SB 2105, Virginia's VCDPA, Colorado's CPA, and similar state laws.

You have the right to opt out of such sharing. To opt out:

Submit a request through our Privacy Request form;
Email support@hiwavemakers.com;
Configure your browser to send a Global Privacy Control (GPC) signal — we honor GPC.

We do not knowingly share personal information about a person under 16 for cross-context behavioral advertising without explicit opt-in consent.

8. INTERNATIONAL DATA TRANSFERS

We are based in the United States and we operate the Services from the United States. Some of our service providers process data outside the United States (e.g., Brevo, which is based in France; AWS, which has global regions; Tawk.to, which has Hong Kong infrastructure). When personal information is transferred internationally, we rely on appropriate safeguards including standard contractual clauses or comparable mechanisms where required.

If you access the Services from outside the United States, you understand and consent to your information being transferred to and processed in the United States, where data-protection laws may differ from those in your country.

9. COOKIES AND TRACKING TECHNOLOGIES

We use cookies, web beacons, pixels, and similar technologies to operate the Site, remember your preferences, analyze usage, and (with your consent) deliver advertising. See our separate Cookies Policy for full details, including a cookie inventory and opt-out instructions.

We honor Global Privacy Control (GPC) signals as a valid request to opt out of "sale" or "sharing" of personal information.

10. HOW LONG WE KEEP INFORMATION

We retain personal information only as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by law.

Category	Retention Period
Account information for active users	Duration of account + 12 months after closure (then deleted or anonymized)
Transaction records (purchases, refunds)	7 years (US tax/accounting requirements)
Class recordings (general)	24 months after class completion
Personalized highlight video master files	24 months after delivery
Email and SMS engagement logs	2 years
Support tickets and chat transcripts	3 years
Children's personal information after account closure	30 days, then deleted
Marketing consent records (TCPA, CAN-SPAM compliance)	4 years minimum
Backup data	Up to 90 days rotation

When the retention period expires, we delete or anonymize the data. Some data may persist in encrypted backup archives until rotation deletes it.

11. HOW WE PROTECT YOUR INFORMATION

We implement technical, administrative, and physical safeguards to protect personal information:

Encryption in transit (TLS 1.2+ for all web traffic);
Encryption at rest for stored data, including recordings and sensitive fields;
Access controls and authentication for our systems (least privilege, multi-factor for administrative access);
Logging and monitoring of access to sensitive data;
Regular security review of third-party processors;
Employee training on data handling and child privacy;
Incident response plan with notification protocols.

Despite these measures, no system is impenetrable. In the event of a data breach involving personal information of users, we will provide notice as required by applicable law.

12. YOUR PRIVACY RIGHTS (ALL USERS)

You have rights regarding your personal information:

Access: request a copy of personal information we hold about you;
Correct: request correction of inaccurate or incomplete personal information;
Delete: request deletion of your personal information;
Withdraw consent: where processing is based on consent, withdraw at any time;
Opt out of marketing: unsubscribe from marketing emails and SMS;
Opt out of sharing for advertising: see Section 7 above;
Lodge a complaint: with your state attorney general or consumer-protection authority.

Parental rights regarding a child's data are described in Section 4.

To exercise any of these rights, email support@hiwavemakers.com. We will respond within the time required by applicable law (generally 45 days, extendable in certain cases). We will not discriminate against you for exercising these rights.

13. YOUR RIGHTS UNDER UNITED STATES STATE PRIVACY LAWS

California (CCPA/CPRA)

Residents of California have the rights described above plus: right to opt out of the sale or sharing of personal information; right to limit the use and disclosure of sensitive personal information; right to non-discrimination for exercising rights; and right to designate an authorized agent.

To exercise California rights, email support@hiwavemakers.com.

Categories of personal information collected in the past 12 months (CPRA-required disclosure):

Category	Collected
A. Identifiers (name, email, phone, IP)	Yes
B. Customer records (financial info, payment)	Yes
C. Protected classifications	No
D. Commercial information (transactions, purchases)	Yes
E. Biometric information	No (incidental capture in recordings is not used for biometric purposes)
F. Internet/network activity	Yes
G. Geolocation (precise)	No (city-level approximate only)
H. Audio, electronic, sensory	Yes (class recordings, with consent)
I. Professional or employment	Limited (instructor only)
J. Education information (FERPA-covered)	No
K. Inferences	Limited
L. Sensitive personal information	No

Texas (TDPSA / SB 2105)

Texas residents have rights described above plus the right to appeal a denied privacy request. To appeal, email support@hiwavemakers.com with subject line "Texas Privacy Rights Appeal."

Virginia, Colorado, Connecticut, Utah, Oregon, and Other States

Residents of these states have substantially similar rights. To exercise: support@hiwavemakers.com.

Children-Specific Protections

Where state laws (e.g., Texas SB 2105, California Age-Appropriate Design Code Act, New York Child Data Protection Act, Maryland AADC) provide additional protections for minors, we apply those protections.

14. NOTICE OF FINANCIAL INCENTIVES

If we offer a financial incentive (e.g., a discount in exchange for opting into marketing), we will provide a separate notice of the incentive and allow you to withdraw at any time. We do not currently offer such financial incentives.

15. DO NOT TRACK AND GLOBAL PRIVACY CONTROL

Most web browsers offer a "Do Not Track" (DNT) signal. There is no industry standard for honoring DNT, and we do not currently respond to DNT browser signals.

We do honor Global Privacy Control (GPC) signals as a valid opt-out of sale/sharing under applicable state laws.

16. UPDATES TO THIS POLICY

We may update this Privacy Policy from time to time. We will indicate the date of the most recent revision at the top. Material changes will be communicated via email to active users at least thirty (30) days before they take effect, or as otherwise required by law. We encourage you to review this Privacy Policy periodically.

17. CONTACT US

For questions about this Privacy Policy or our privacy practices:

AlphaCrew Studio LLC doing business as HiWave Makers
Attn: Privacy Officer
433 Belle Grove Dr, Richardson, TX 75080, USA
Email: support@hiwavemakers.com

18. HOW TO SUBMIT A PRIVACY REQUEST

To submit a request to access, correct, delete, port, opt out, or appeal:

Email: support@hiwavemakers.com
Mail: AlphaCrew Studio LLC, Attn: Privacy Officer, 433 Belle Grove Dr, Richardson, TX 75080, USA

We will verify your identity using information already on file. If we cannot verify, we may request additional information solely for verification. Authorized agents must provide written authorization. We respond within the timeframes required by applicable law (typically 45 days, extendable to 90 days in certain cases with notice).