Welcome to Illuminate XR ("Company", "we", "our", or "us"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.illuminatexr.com or use our AR/XR educational services through Engage XR.
Illuminate XR is an education-focused company that delivers immersive learning experiences using Augmented Reality (AR) and Extended Reality (XR) via the Engage XR platform. We provide certified courses across the Business and Medical education sectors, as well as to students in grades 9–12 (ages 14 and above).
Our services are designed for and directed to individuals aged 14 years and older. We do not knowingly collect, use, or retain personal information from children under 14 years of age. If we discover that we have inadvertently collected information from a child under 14, we will delete such information immediately.
We provide certified courses across three sectors:
K–12 Education (ages 5–18)
Business and Professional Training
Medical Education and Healthcare Training
Our K–12 educational services are available to learners ages 5 and above. For children under 13 (United States – COPPA) or under 16 (EEA – GDPR), we require verified parental consent before collecting any personal information. We collect only the minimum data necessary for educational purposes from minor users. If we discover that we have collected information from a child without appropriate consent, we will delete such information immediately.
For educational services provided to grades 9–12 in California, we operate as a "school official" with legitimate educational interests as defined under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. Section 1232g, and act under the direct control of educational institutions regarding the use and maintenance of education records.
For purposes of this Privacy Policy:
“Student Data” means personally identifiable information in student records that is directly related to a student and maintained by an educational agency or institution or by a party acting on its behalf.
“Educational Records” means records directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution.
“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined in California Civil Code Section 1798.140(v).
“Local Educational Agency (LEA)” means a school district, county office of education, charter school, or other local public educational agency.
“Sell / Sale” means has the meaning set forth in California Civil Code Section 1798.140(ad)(1), which includes selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information to another business or third party for monetary or other valuable consideration.
“Share / Sharing” means has the meaning set forth in California Civil Code Section 1798.140(ah)(1), which includes sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information to a third party for cross-context behavioral advertising.
“Targeted Advertising” means displaying advertisements to a pupil where the advertisement is selected based on information obtained or inferred from that pupil’s online behavior, usage of online applications, or personal information. This does not include advertising to a pupil at an online location based upon that pupil’s current visit to that location, or in response to that pupil’s request for information or feedback, without retention of that pupil’s online activities or requests over time for the purpose of targeting subsequent ads.
“De-identified Data” means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular student.
“Operator” means illuminate XR as the operator of an online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes.
“Child” or “Children” means an individual under the age of 13, as defined under the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501(1).
“Parental Consent” means verifiable consent from a parent or legal guardian of a child, obtained through methods compliant with COPPA Rule 16 CFR § 312.5(b), prior to the collection, use, or disclosure of a child’s personal information.
“COPPA” means the Children’s Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501–6506, and its implementing regulations at 16 CFR Part 312.
We collect only the minimum personal information necessary to provide educational services. Below is a comprehensive description of the categories of personal information we collect, organized in accordance with California Civil Code Section 1798.100(b):
|
Category |
Specific Data Elements |
Collected? |
|
A. Personal Identifiers |
Full name, email address, username, unique user ID, IP address, device identifiers |
YES |
|
B. California Customer Records (Cal. Civ. Code § 1798.80(e)) |
Name, education information, payment information (for individual purchasers only, not students) |
YES |
|
C. Protected Classification Characteristics |
Age (to verify 14+), grade level (9–12 only), educational level |
LIMITED |
|
D. Commercial Information |
Course enrollment records, certification completion records, transaction history (for individual purchasers only) |
YES |
|
E. Biometric Information |
None |
NO |
|
F. Internet/Network Activity |
Platform usage data, interaction with XR/AR content, learning module access logs, session duration, device type, browser type, clickstream data |
YES |
|
G. Geolocation Data |
General location (city/state level only, derived from IP address) — NOT precise geolocation |
LIMITED |
|
H. Sensory Information |
Audio recordings (only if voice features are enabled by user), visual recordings from AR/XR camera (processed locally on device, not stored) |
LIMITED |
|
I. Professional/Employment Information |
For Business/Medical users: job title, professional certifications, organization name |
YES (Business/Medical only) |
|
J. Educational Information |
Course progress, assessment scores, completion status, learning analytics, skill mastery levels, certification records |
YES |
|
K. Inferences |
Learning preferences, predicted skill gaps, personalized learning recommendations (limited to educational purposes only) |
YES |
|
L. Sensitive Personal Information |
Account login credentials (encrypted), precise geolocation |
NO (except encrypted passwords) |
Given the immersive nature of our AR/XR platform, we want to be transparent about technology-specific data:
Camera Data: When using AR features, your device camera captures your environment. This visual data is processed locally on your device in real-time to overlay educational content. We do not transmit, store, or retain camera feed recordings.
Motion/Spatial Data: Device orientation, movement patterns, and spatial positioning data are collected to enable proper AR content placement and interaction tracking. This data is used solely for platform functionality and educational analytics.
Avatar/Interaction Data: If you create an avatar or interact with virtual learning environments, we collect data about these interactions (e.g., which objects you interact with, time spent in virtual spaces) for educational assessment purposes.
Microphone Data: If you enable voice features, audio is captured and may be transmitted to provide voice-command functionality or collaborative features. Audio recordings are retained only if explicitly part of an educational assignment (e.g., language learning exercises).
In accordance with California Education Code Section 49073.1 and best privacy practices, we do not collect the following:
We collect personal information from the following categories of sources, as required by California Civil Code Section 1798.100(b):
Section 1798.100(b):
|
Information Category |
Sources |
|
Personal Identifiers |
(1) Directly from you during registration; (2) Educational institutions when services are provided through school contracts; (3) Automatically through platform use |
|
Educational Information |
(1) Directly from you through platform interactions; (2) Educational institutions providing roster/enrollment data; (3) Automatically generated through learning analytics |
|
Internet/Network Activity |
(1) Automatically collected through cookies and similar technologies; (2) Device and browser information; (3) XR/AR platform interaction logs |
|
Commercial Information |
(1) Directly from you or your payment processor; (2) Educational institutions for enterprise enrollments |
|
Professional Information |
(1) Directly from you during profile creation; (2) Professional certification databases (with your permission) |
|
Inferences |
(1) Derived from analysis of your educational data and platform usage; (2) Generated by our learning analytics algorithms |
|
Audio/Visual Data |
(1) Directly from you when you use voice or camera features; (2) Generated during XR/AR sessions |
Direct Collection
Automated Collection
From Educational Institutions
From Third Parties
We use personal information SOLELY for educational purposes and as necessary to provide our services. We are committed to transparency about our data practices and comply with California Education Code Sections 49073.1 and 49073.6.
Below are the specific business/educational purposes for which we use each category of personal information, as required by California Civil Code Section 1798.100(b):
|
Information Category |
Specific Business/Educational Purposes |
|
Personal Identifiers |
(1) Account creation and authentication; (2) Course enrollment management; (3) Communication about services; (4) Customer support; (5) Platform security and fraud prevention |
|
Educational Information |
(1) Delivering personalized learning experiences; (2) Tracking course progress and completion; (3) Generating performance reports; (4) Issuing certifications; (5) Educational research and service improvement (de-identified only) |
|
Internet/Network Activity |
(1) Platform functionality and optimization; (2) Learning analytics (educational purposes only); (3) Technical troubleshooting; (4) Security monitoring; (5) Usage analytics to improve educational content |
|
Commercial Information |
(1) Processing payments; (2) Managing subscriptions; (3) Providing customer support; (4) Sending transactional communications |
|
Professional Information |
(1) Tailoring business/medical educational content; (2) Verifying professional qualifications for advanced courses; (3) Issuing professional certifications |
|
Inferences |
(1) Personalizing learning pathways; (2) Identifying knowledge gaps; (3) Recommending appropriate educational content; (4) Adaptive learning algorithms |
|
Audio/Visual Data |
(1) Enabling XR/AR platform features; (2) Language learning assessments; (3) Collaborative virtual learning experiences |
In strict compliance with SOPIPA and California Education Code Section 49073.1, we SHALL NOT:
We may use de-identified and aggregated data (data that cannot reasonably identify individual students) for:
Educational research to improve learning outcomes
Platform performance analysis
Development of new educational features
Industry research and benchmarking reports
This research use complies with California Education Code Section 49073.1(b)(3) and only occurs after data has been properly de-identified in accordance with applicable standards.
For individuals in the European Union, European Economic Area, or United Kingdom, we process personal data based on the following legal grounds under the General Data Protection Regulation (GDPR):
We only rely on legitimate interests when they are not overridden by your data protection rights and interests. You have the right to withdraw consent at any time, though this may limit your ability to use our services.
We DO NOT sell or rent personal information. We DO NOT share personal information for cross-context behavioral advertising.
As required by California Civil Code Section 1798.100(b), below are the categories of third parties with whom we share personal information:
|
Information Category |
Third-Party Categories |
Purpose of Disclosure |
|
Personal Identifiers |
(1) Educational institutions; (2) Cloud hosting providers; (3) Customer support platforms; (4) Email service providers |
Service delivery, technical support, required reporting to schools |
|
Educational Information |
(1) Educational institutions; (2) Learning management system integrations; (3) Cloud storage providers |
Reporting academic progress, service delivery, data backup |
|
Internet/Network Activity |
(1) Analytics service providers; (2) Cloud infrastructure providers; (3) Security monitoring services |
Platform optimization, security, technical operations |
|
Commercial Information |
(1) Payment processors; (2) Educational institutions (for institutional billing) |
Transaction processing, billing |
|
Professional Information |
(1) Professional certification bodies (with consent); (2) Educational institutions |
Verification, credential issuance |
|
Audio/Visual Data |
(1) Cloud hosting providers (encrypted storage only) |
Assignment submission, grading |
Educational Partners
Who: K–12 schools, school districts, and other educational institutions with which you are affiliated
What: Student Data necessary for educational purposes and as required by the institution
Why: Reporting academic progress, complying with institutional requirements, coordinating educational services
Legal Basis: FERPA school official exception, contractual obligations, legitimate educational interests
Service Providers
We share personal information with carefully vetted service providers who perform services on our behalf. All service providers are bound by written contracts that:
With your consent, we may share your information with other third parties when you explicitly consent to such sharing.
We do not disclose personal information to:
California residents have specific rights regarding their personal information under the California Consumer Privacy Act (CCPA) and other California privacy laws.
You have the right to request that we disclose to you:
For Student Data: Parents/guardians and eligible students (18+) also have rights under FERPA to inspect and review education records.
You have the right to request deletion of your personal information that we collected from you, subject to certain exceptions under California law.
Exceptions: We may deny a deletion request if retaining the information is necessary to:
For K–12 Students: Under California Assembly Bill 1172 and Education Code Section 49073.1, students (or their parents/guardians) may request deletion of student-generated content. We will complete such requests within 30 days.
You have the right to request correction of inaccurate personal information we maintain about you.
We do NOT sell or share your personal information. Therefore, there is no need to opt-out. We have not sold or shared personal information in the preceding 12 months and will not do so in the future.
You have the right to not be discriminated against for exercising any of your CCPA rights. We will not:
We do not use or disclose sensitive personal information for purposes other than those permitted under CCPA Section 1798.121. The only sensitive personal information we maintain is account login credentials, which are encrypted and used solely for authentication.
You have the right to request a copy of your personal information in a portable, structured, and machine-readable format where technically feasible.
You may exercise your California privacy rights by:
Email: Send to [email protected] with subject line "California Privacy Rights Request"
What to Include in Your Request
If we deny your request, in whole or in part, you have the right to appeal our decision:
Under California Education Code, students and parents/guardians have additional rights:
FERPA Rights
File complaints with:
Family Policy Compliance Office, U.S. Department of Education,
400 Maryland Avenue, SW,
Washington, DC 20202-5920
California Education Code Section 49073.1 Rights
As an Operator of an online service used for K–12 school purposes (grades 9–12, ages 14+), we comply with California’s Student Online Personal Information Protection Act (SOPIPA), Business and Professions Code Section 22584.
We SHALL NOT:
We MAY use student personal information for:
In accordance with California Education Code Section 49073.1, all student records obtained by Illuminate XR from educational institutions or created in the course of providing services remain the property of and under the control of the Local Educational Agency (LEA). We act solely as a custodian of this data on behalf of the LEA.
For K–12 educational services (grades 9–12), we operate as a "school official" with "legitimate educational interests" under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. Section 1232g and 34 CFR Part 99.
We qualify as a "school official" because:
Our "legitimate educational interest" is limited to:
Use Limitation
Parental Rights
Under FERPA, parents and eligible students (18+ or attending postsecondary institution) have the right to:
To Exercise FERPA Rights
We do not independently determine what constitutes "directory information." If an educational institution has designated certain information as directory information under FERPA and obtained necessary consents, we will honor those designations as directed by the institution.
We are committed to protecting children’s privacy and comply with applicable laws including the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and GDPR requirements for minors.
For individual learners under 13/16:
For school-based learners:
Under COPPA’s “school official” exception and FERPA, schools may consent on behalf of parents for educational purposes. We obtain written agreements with schools confirming parental notification.
We collect only the minimum necessary information from children under 13:
Required:
Optional (with parental consent):
Automatically collected:
We do NOT collect from children under 13 without consent:
Children’s data is used solely for:
We do NOT :
Parents/guardians can:
To exercise parental rights:
Email: [email protected] with subject “Parental Rights Request”
When students access our platform through a school:
We prohibit third-party advertising networks and social plugins on pages accessible to users identified as under 13.
All services provided to K–12 educational institutions are governed by written agreements that comply with California Education Code Section 49073.6 and SOPIPA requirements.
Our agreements with educational institutions include the following mandatory provisions:
Data Ownership
Use Restrictions
Disclosure Limitations
Security Requirements
Data Retention and Deletion
Transparency and Reporting
Audit and Compliance
Liability and Indemnification
For students receiving services through an educational institution:
We implement comprehensive technical, physical, and administrative security measures to protect personal information from unauthorized access, use, disclosure, alteration, or destruction.
In the event of a data breach involving personal information, we will comply with all applicable notification requirements:
California Civil Code Section 1798.82 (Consumer Breach Notification)
California Education Code Section 49073.1 (Student Data Breach Notification)
Notification Timeline
Notification to parents/guardians under COPPA (for children's data): As soon as reasonably possible
Notification Methods
Notification Contents
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal and regulatory requirements.
|
Data Category |
Retention Period |
Legal Basis |
|
Student Education Records |
As specified in LEA agreement, typically 3–5 years after course completion, or until deletion requested |
California Education Code, FERPA, LEA policy |
|
Account Information |
Duration of account plus 1 year, or until deletion requested |
Contractual necessity, fraud prevention |
|
Learning Analytics |
Duration of enrollment plus 3 years, or until deletion requested |
Educational purposes, service improvement |
|
Transaction Records |
7 years from transaction date |
Tax and financial regulations (IRS, Cal. Rev. & Tax Code) |
|
Communication Logs |
2 years from communication date |
Customer support, legal compliance |
|
Security Logs |
1 year minimum, 3 years for security incidents |
Security monitoring, incident investigation |
|
Marketing Communications |
Until unsubscribe/opt-out |
Consent, legitimate interest |
|
De-identified Data |
No retention limit |
No longer personal information under CCPA |
Note: All retention periods are subject to legal holds for litigation, investigations, or regulatory requests.
Automated Deletion
Manual Deletion Requests
Deletion Methods
Educational Institution Contracts
When a contract with an educational institution terminates or expires:
Notification: We notify the LEA 60 days before contract expiration
Data Export: We provide the LEA option to export all student data in portable format
Deletion Timeline: Unless otherwise directed by LEA, we delete all student data within 90 days of contract termination
Certification: We provide written certification of deletion to the LEA
Exceptions: Data may be retained longer if:
Required by law (e.g., tax records, security logs)
Necessary for pending litigation or investigations
Properly de-identified for research purposes (with LEA consent)
Individual Accounts
Upon account closure, personal information deleted within 90 days
Transactional records retained for 7 years per financial regulations
Option to download your data before deletion
14.5 Exceptions to Deletion
We may retain certain information beyond standard retention periods or despite deletion requests when:
Legal Requirements: Required by law to retain (tax records, legal holds, regulatory obligations)
Fraud Prevention: Necessary to detect, prevent, or investigate fraud or security incidents
Troubleshooting: Necessary to debug and identify errors that impair existing functionality
Free Speech: Necessary to enable solely internal uses reasonably aligned with consumer expectations
Legal Claims: Necessary for exercising or defending legal claims
De-identified Data: Data has been properly de-identified and no longer constitutes personal information
Our primary operations and data storage are within the United States. However, some of our service providers may process data internationally.
Service Providers
Some of our carefully selected service providers may process data in jurisdictions outside the United States, including:
Safeguards for International Transfers
When personal information is transferred outside the United States, we ensure adequate protection through:
1. Contractual Protections:
2. Adequacy Determinations:
3. Standard Contractual Clauses:
For individuals in the European Union, European Economic Area, or United Kingdom, we comply with GDPR requirements for international data transfers:
Legal Mechanisms
Transfer Impact Assessment
We conduct transfer impact assessments to evaluate:
Your Rights Regarding Transfers
Student Data
Individual Subscribers
If we receive a legal request from a foreign government for personal information:
We use cookies and similar tracking technologies to provide, secure, and improve our services. We are transparent about our use of these technologies and provide you with choices.
Cookies are small text files stored on your device by your web browser. They allow websites to recognize your device and remember information about your visit.
Types of Cookies We Use
We use cookies and similar technologies for the following purposes:
|
Cookie Category |
Purpose |
Examples |
Duration |
Can You Opt Out? |
|
Strictly Necessary |
Essential for platform functionality, security, and authentication |
Session management, authentication tokens, security features |
Session or up to 1 year |
No — required for service |
|
Performance/Analytics |
Understand platform usage and improve educational experience |
Learning analytics (educational only), error reporting, performance monitoring |
Up to 2 years |
Yes — via settings |
|
Functional |
Remember your preferences and settings |
Language preference, accessibility settings, UI customization |
Up to 1 year |
Yes — but may impact experience |
|
Advertising |
We do NOT use advertising cookies for students |
N/A |
N/A |
N/A |
We limit third-party cookies to essential service providers.
Prohibited Third-Party Cookies
For K–12 users (grades 9–12):
We will notify you of material changes to our cookie practices:
For questions about cookies: [email protected]
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
Material Changes
For significant changes that substantially affect your privacy rights or how we handle personal information, we will provide 30 days advance notice through:
1. Email Notification
2. Platform Notification
3. Website Notice
4. Educational Institution Notice
Non-Material Changes
For minor updates (e.g., clarifications, updated contact information, formatting improvements) that do not substantively affect your rights:
Material changes include, but are not limited to:
If You Disagree With Changes
1. Review the Updated Policy:
2. Contact Us With Questions:
3. Exercise Your Rights:
4. Discontinue Service:
Continued Use Means Acceptance: If you continue to use our services after the effective date of the updated Privacy Policy, you accept the changes. For material changes, we may require explicit acknowledgment through the platform.
For services provided under contract with educational institutions:
In rare circumstances (e.g., security incident, legal requirement, regulatory order), we may need to update this policy on shorter notice:
Current Version: This Privacy Policy was last updated on February 12, 2026 and is effective as of that date.
Questions About Updates: Contact [email protected] with "Policy Update Question" in the subject line.
We are committed to addressing your privacy questions and concerns promptly and transparently.
Email: [email protected] (monitored daily)
Response Time: Within 10 business days for general inquiries; faster for urgent matters
For COPPA/Parental Rights:
Email: [email protected]
This section provides disclosures required by the California Consumer Privacy Act (CCPA) and related California privacy laws.
|
WE DO NOT SELL PERSONAL INFORMATION. WE DO NOT SHARE PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING. We do not sell or share the personal information of consumers we know to be under 16 years of age. Our services are designed for individuals aged 14 and older. For users aged 14–15 (in grades 9–10), we apply enhanced protections and do not sell or share their information. For children under 13, we comply with the Children’s Online Privacy Protection Act (COPPA) and collect personal information only with verified parental consent. See Section 11 for full details on our children’s privacy practices. For users aged 14–15, we apply enhanced protections and do not sell or share their information.. |
Privacy is not just a legal requirement for us—it is a core value that guides our business practices and product development.
1. Transparency
2. Data Minimization
3. Purpose Limitation
4. Security
5. Student-First Approach
6. Compliance
7. Accountability
We integrate privacy into our product development:
Privacy is an ongoing commitment:
We recognize that you trust us with sensitive information about learning and development. We take that trust seriously and work every day to earn and maintain it.
Our Promise
If you believe we are not living up to these commitments:
COPPA Complaints:
Parents may file COPPA complaints with the Federal Trade Commission (FTC):
We view complaints as opportunities to improve and will take every concern seriously.
Effective Date: May 18, 2026
Last Reviewed: May 18, 2026
This Privacy Policy supersedes all prior versions.
Version: 2.0