THYNK K-12THYNK WELLNESSPRODUCTSRESEARCHRESOURCES

Privacy Policy

Thynk Privacy Policy

Effective Date: October 17, 2025

Thynk ("us", "we", or "our") operates the https://thynk.com website and related services (collectively, the "Service"). This Privacy Policy outlines how we collect, use, disclose, and protect personal data when you use our Service, including in educational settings where applicable.

We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Children's Online Privacy Protection Act (COPPA), and the Family Educational Rights and Privacy Act (FERPA). By using the Service, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined, terms used here have the same meanings as in our Terms and Conditions, accessible from https://thynk.com.

Definitions

  • Thynk: Thynk Inc., based in the United States.
  • Service: The
  • Personal Data: Data about a living individual who can be identified from that data (or from that and other information in our possession or likely to come into our possession).
  • Usage Data: Data collected automatically from the use of the Service, such as page visit duration.
  • Cookies: Small data files stored on your device.
  • Data Controller: The entity determining the purposes and means of processing Personal Data. We act as a Data Controller for your Personal Data, except in educational contexts where we may act as a Data Processor for schools.
  • Data Processors (or Service Providers): Third parties processing data on our behalf.
  • Data Subject (or User): Any individual using our Service whose Personal Data is processed.
  • Education Records: As defined under FERPA, records directly related to a student and maintained by an educational institution or party acting for it.
  • Student Data: Personal Data collected from or about students in school environments.

Information Collection & Use

We collect information to provide, improve, and secure our Service, including for data management functions and educational programs in school settings.

Types of Data Collected

Personal Data

We may collect personally identifiable information, including:

  • Email address
  • First name and last name
  • Phone number
  • Company or school name
  • Job title or role (e.g., educator)
  • Company/school objectives
  • Payment details (processed via third-party providers)
  • In school environments: Student identifiers (e.g., name, grade, school ID), participation data, and teacher-provided info for users aged 8-13.

We use this to contact you or provide services. You may opt out of marketing communications via unsubscribe links.

Usage Data

Includes IP address, browser type, pages visited, time spent, device identifiers, and diagnostics.

Tracking & Cookies Data

We use cookies for functionality, preferences, security, and analytics. Examples:

  • Session Cookies: To operate the Service.
  • Preference Cookies: To remember settings.
  • Security Cookies: For protection.
  • Analytics Cookies: Via tools like Google Analytics.

Manage cookies via browser settings or our cookie banner. We do not honor Do Not Track signals but offer opt-outs for targeted ads.

Student Data in Educational Settings

For students aged 8-13 in school environments, we collect data only through school-rostered accounts managed by educators or institutions. This may include:

  • Student name/initials, grade, school affiliation.
  • Platform interactions (e.g., activity completions in simulations).
  • Teacher-uploaded data for educational purposes.

We do not allow direct student sign-ups or collect geolocation, biometrics, or sensitive data unless essential and consented.

Use of Data

Data is used for:

  • Providing and maintaining the Service (e.g., account management, support).
  • Notifying of changes or interactive features.
  • Customer/educator support.
  • Analytics and improvements.
  • Monitoring usage and addressing issues.
  • Marketing (with consent; no marketing to students).
  • In schools: Educational functions, such as tracking program participation.

We do not use Student Data for non-educational purposes, behavioral advertising, or profiling.

Legal Basis for Processing Personal Data

Under GDPR (for EEA users):

  • Contract performance.
  • Consent.
  • Legitimate interests (not overriding rights).
  • Legal compliance.

For Student Data:

  • Under COPPA: School institutional consent for under-13 students.
  • Under FERPA: As a "school official" with legitimate educational interest.

Retention of Data

Personal Data is retained as necessary for purposes, legal obligations, disputes, or policies. Usage Data is kept shorter unless for security/improvements.

Student Data: Retained only for educational needs or school directives; deleted upon account closure or request (e.g., end of school year). Anonymized data may be kept longer for aggregated analytics.

Transfer of Data

Data may transfer internationally (e.g., to US servers on AWS). We use Standard Contractual Clauses or equivalent safeguards for protection. Consent to this policy agrees to transfers. For Student Data, transfers comply with FERPA/COPPA.

Disclosure of Data

We disclose if necessary for:

  • Legal compliance (e.g., subpoenas).
  • Protecting rights/property/safety.
  • Business transfers (e.g., mergers).
  • Preventing fraud.

No sale of Personal Data (per CCPA). Sharing limited to Service Providers (e.g., AWS for hosting, Google Analytics for analytics, Monday.com for communications) bound by contracts requiring data protection. For Student Data: Only with FERPA/COPPA-compliant sub-processors; no sharing for marketing. List of sub-processors available on request.

Security of Data

We implement industry-standard measures: encryption (TLS 1.2+ in transit, AES-256 at rest), access controls, firewalls, regular audits, and vulnerability scans. Breach notifications provided to users/authorities as required by law (e.g., within 72 hours under GDPR). While we strive for security, no method is 100% secure.

For Student Data: Additional safeguards, including role-based access and encryption, aligned with edtech best practices.

Your Data Protection Rights

Under GDPR/CCPA and similar laws:

  • Access, rectify, erase, or port your Personal Data.
  • Object to or restrict processing.
  • Withdraw consent.
  • Opt-out of sales (none occur).
  • Non-discrimination for exercising rights.

For Student Data under FERPA: Parents/eligible students can inspect, amend, or request non-disclosure.

Contact privacy@thynk.com to exercise rights. We verify requests and respond within 30 days (GDPR/CCPA) or 45 days (FERPA). No fee for standard requests.

Student Privacy in Educational Settings

Our Service supports educational use in schools for students aged 8-13, adapting data management tools for learning (e.g., program simulations). We prioritize student privacy and comply with COPPA, FERPA, SOPIPA, and the Student Privacy Pledge.

  • Collection and Scope: Data collected solely via teacher- or school-managed accounts (e.g., via rostering tools). No direct collection from children; minimized to essentials like name/initial, grade, and interaction logs.
  • Consent Mechanisms: For under-13s, schools provide verifiable institutional consent under COPPA's educational exception. Schools must notify parents and offer opt-outs before data processing. Parents can withdraw consent anytime, triggering data deletion within 10 business days.
  • FERPA Compliance: We process Education Records only as a school official with a legitimate educational interest (per 34 CFR § 99.31). Schools retain control; we do not redisclose without authorization except as permitted (e.g., to sub-processors or audits).
  • Parental and School Rights: Parents/guardians may access, review, correct, or delete Student Data by contacting the school or privacy@thynk.com. We provide schools with notification templates and data export tools. No use of Student Data for commercial purposes.
  • Commitments:
  • Age-Specific Notes: For ages 8-12 (under 13), COPPA rules apply strictly; for 13-year-olds, enhanced teen protections but school-mediated.
  • Unauthorized Data: If collected without consent, we delete immediately upon discovery.

Service Providers

We engage trusted third parties (sub-processors) including AWS (hosting), Google Analytics (analytics), and Monday.com (communications). They access data only as instructed, under binding agreements ensuring compliance with this policy, GDPR, COPPA, and FERPA. Updated list available at [link to sub-processor page] or on request.

Links to Other Sites

Our Service may contain links to third-party sites. We are not responsible for their content or privacy practices; review them separately.

Children's Privacy Outside Education

Outside school settings, our Service is not directed to children under 16, and we do not knowingly collect Personal Data from them. If discovered, we delete it.

Changes to This Privacy Policy

We may update this policy; changes posted here with a new effective date. Material changes notified via email or site notice. Continued use constitutes acceptance. Check regularly.

Contact Us

For questions, requests, or complaints:

  • Email: privacy@thynk.com
  • Data Protection Officer: Contact via above email.