Shine Insight Mobile Privacy Policy

Last Updated: September 18, 2026

Shine Early Learning, Inc. (“Shine,” “we,” “us,” or “our”) is committed to protecting the privacy, confidentiality, and security of information collected, transmitted to, and maintained through the Shine Insight® platform mobile applications for iOS and Android that link to this Privacy Policy (collectively, the “Platform”).

The Shine Insight platform is a child and family data mobile application designed for use by Head Start and Early Head Start programs and other institutional program operators in the United States and Puerto Rico (“Agencies”, and each an “Agency”). Depending on the features enabled by an Agency, the Platform may support family applications, enrollment and attendance, family services and health, education screenings, disabilities and mental health services, in-kind contribution tracking, Child and Adult Food Program (“CACFP”) administration, billing, family communications, compliance reporting, and related program operations.

This Privacy Policy explains how Shine collects, uses, maintains, protects, and discloses information in connection with the Platform, including sensitive information about children and families.

This Privacy Policy does not apply to information Shine collects from its employees, contractors, or vendors in their capacities as such.

The Platform is intended for use through the Shine Insight platform mobile applications in the United States and Puerto Rico and is not intended for international use. The Platform is designed to support programs operating under applicable U.S. federal, state, local, and territorial requirements.

By accessing or using the Platform, you acknowledge the practices described in this Privacy Policy. If you do not wish to use the Platform subject to this Privacy Policy, do not access or use the Platform.

The Platform is not directed to children for their own independent use. Access is limited to Agency authorized personnel and, where enabled by an Agency, parents, guardians, or other authorized family representatives.

Agencies are responsible for determining what information is entered into the Platform, how the Platform is used for their program operations, and which authorized users may access information.

For most child and family information processed through the Platform:

Agencies are responsible for complying with laws and program requirements applicable to their collection, use, maintenance, disclosure, and retention of child and family information, including, where applicable, the Head Start Act and the Head Start Program Performance Standards, and, to the extent applicable, the Family Educational Rights and Privacy Act (“FERPA”), the Health Insurance Portability and Accountability Act (“HIPAA”), the Individuals with Disabilities Education Act (“IDEA”), state privacy laws, grant conditions, and local policies.

Depending on the Agency, the data submitted to the Platform, and the purposes for which the Platform is used, Shine may act as a service provider, contractor, business associate, subcontractor business associate, data processor, or similar service provider under applicable law. Shine’s obligations with respect to a particular Agency’s data may be further governed by a Business Associate Agreement, student data privacy agreement, data protection agreement, services agreement, Head Start data protection addendum, or other written agreement with that Agency. If this Privacy Policy conflicts with a written agreement between Shine and an Agency governing protected health information, education records, student data, child records, or other regulated information, the written agreement will control with respect to that Agency’s data.

Agencies are also responsible for:

To the extent Shine collects information directly from Platform users for Shine’s own purposes, such as account administration, support, security monitoring, billing support, or service communications, Shine may be responsible for that processing as provided by applicable law.

For purposes of this Privacy Policy, “Personal Information” means information that identifies, relates to, describes, or can reasonably be linked to an identified or identifiable individual. Personal Information may include information about children, parents, guardians, family members, Agency staff/personnel, payers, and other authorized users. Because Shine Insight is a Head Start/Early Head Start child data platform, the information processed through the Platform may include sensitive information, including child information, family information, income and eligibility information, health-related information, disability information, developmental information, mental health-related information, and financial or payment-related information (“Sensitive Information”).

The specific data collected or processed may vary depending on Agency configuration, program requirements, applicable law, and the modules or features enabled. The Platform may also collect or process photographs, documents, scans, forms, medical records, eligibility documentation, notes, attachments, and other content uploaded, submitted or stored by Agencies and authorized users.

The Platform may collect or process Head Start/Early Head Start application, enrollment, eligibility, and family information, including:

The Platform may support family services and case management functions, including the collection or processing of:

The Platform may collect or process health, developmental, disability, medical, dental, screening, and mental health-related information, including:

The Platform may collect or process information relating to nutrition services, the Child and Adult Care Food Program (“CACFP”), and in-kind contributions including:

Where billing, fee collection, subsidy tracking, or payment-related features are enabled, the Platform may collect or process billing, financial, and payment-related information, including:

Payments initiated through the Platform are processed by Stripe, a third-party payment processor. Stripe may collect payment card information, bank account information, billing information, device and transaction information, and other information necessary to process payments and prevent fraud.

Shine may receive limited payment and transaction information from Stripe, such as payment method type, payment status, payment confirmations, transaction identifiers, refunds, disputes, failed payments, or suspected fraud, but does not intend to store full payment card numbers or bank account credentials.

The Platform may collect, generate, maintain, or process information needed for federal Head Start compliance and reporting, including fields required for aggregate reporting to the Office of Head Start under the Head Start Program Information Report (“PIR”).

The Platform may collect or process information about authorized users and their use of the Platform, including:

We may also collect information when users, Agencies, parents/guardians, or other individuals contact Shine directly, including when they:

Such information may include name, contact information, Agency affiliation, role, communications content, and any other information provided to us.

We may use Personal Information and other information for the following purposes.

We use information to:

We use information to:

We use information to:

We use information to:

We may use information to:

Shine may use identifiable Agency data to provide, maintain, secure, support, troubleshoot, and improve the Platform only as permitted by the applicable agreement with the Agency and applicable law.

Shine may use de-identified, anonymized, or aggregated information for internal analytics, reporting, security, and product improvement if the information does not reasonably identify an individual and is created and used in accordance with applicable law and the applicable agreement with the Agency.

We may use contact information to:

Users may opt out of non-essential marketing communications, but Shine may continue to send transactional, administrative, security, or service-related communications.

Shine does not sell or trade Personal Information, or use or disclose child, family, or other Agency-controlled information for targeted advertising, cross-context behavioral advertising, or cross-app tracking.

Shine may share Personal Information only as described in this Privacy Policy, as directed or authorized by an Agency, as permitted by contract, or as required or permitted by applicable law.

Information entered into the Platform may be available to the relevant Agency and its authorized users according to that Agency’s configuration, permissions, role-based access controls, and policies.

Agencies are responsible for determining which users may access which information and for promptly removing or modifying access when users’ roles or employment change.

We may disclose information to service providers, vendors, and sub-processors that provide hosting, cloud infrastructure, data storage, security, analytics, customer support, communications, payment processing, identity management, logging, monitoring, and other services needed to operate the Platform. They may use Personal Information only to provide the contracted services or as otherwise permitted by applicable law and the applicable agreements.

Where required, Shine will require service providers, vendors, and sub-processors that create, receive, maintain, or transmit protected health information, education records, student data, child records, or other regulated information on Shine’s behalf to agree to appropriate contractual safeguards, including business associate, confidentiality, data protection, student data privacy, or similar terms.

We may share information with Shine’s affiliates and related entities involved in providing, supporting, administering, or securing the Platform, consistent with this Privacy Policy, applicable agreements, and applicable law.

We may share or disclose information at the direction of the relevant Agency, including for integrations, reporting, audits, program administration, compliance, or services requested by the Agency.

We may disclose information when we believe, in good faith, that disclosure is reasonably necessary to:

We may disclose or transfer information in connection with a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, receivership, or similar corporate transaction involving Shine or the Platform. We will use commercially reasonable efforts to provide notice of such transfer as appropriate and required by law or contract.

We may use and disclose de-identified, anonymized, or aggregated information that does not reasonably identify an individual for lawful internal reporting, analytics, security, program evaluation and product improvement purposes.

Where the underlying information is subject to HIPAA, FERPA, the Head Start Act, Head Start Program Performance Standards, IDEA, state student privacy laws, state health privacy laws, Puerto Rico privacy requirements, or other privacy or confidentiality requirements, Shine will de-identify, anonymize, aggregate, use, and disclose such information only as permitted by applicable law and the applicable agreement with the Agency.

Shine will not attempt to re-identify de-identified information except as permitted by applicable law and the applicable agreement with the Agency.

We and our service providers may use mobile software development kits, device identifiers, authentication tokens, logs, and similar technologies to operate, secure, support, and improve the Platform.

These technologies may be used to:

Users may manage available permissions and preferences through the Platform or their device settings. Disabling a permission may prevent the related mobile application feature from functioning.

The Platform consists of iOS and Android mobile applications. Shine and its service providers may collect device information, identifiers, app usage information, diagnostics, crash logs, authentication and session information, and other technical information needed to operate, secure, troubleshoot, and improve the applications. Depending on the features enabled by an Agency, the Platform may also process child, family, program, health, developmental, disability, billing, and other Agency-controlled information made available to authorized users.

When a user activates the “check-in” feature, the Platform may access the device’s precise location to determine whether the device is within the permitted range of the applicable center. The Platform will request permission through the device operating system. Users may deny or withdraw location permission through their device settings, but doing so may prevent the use of the “check in” feature. Shine does not use precise location for advertising or cross-app tracking.

The Platform may integrate with Stripe to process payments. In connection with a payment, Stripe may collect payment, billing, device, transaction, authentication, and fraud-prevention information through payment interfaces, or mobile software development kits. Shine may receive payment status, transaction identifiers, and other limited information from Stripe. Stripe processes information in accordance with its own privacy policy and applicable payment processing terms.

Shine provides the privacy and data safety disclosures required by applicable app distribution platforms.

Shine uses administrative, technical, and physical safeguards designed to protect Personal Information from unauthorized access, use, disclosure, alteration, or destruction.

These safeguards may include:

No method of transmission over the Internet and no method of electronic storage is completely secure. While Shine uses reasonable and appropriate safeguards, we cannot guarantee absolute security.

Agencies and users are responsible for maintaining the confidentiality of login credentials, using appropriate devices and networks, and promptly notifying Shine of suspected unauthorized access or account compromise.

Shine will notify affected Agencies of breaches, security incidents, or unauthorized disclosures involving Agency data of which Shine becomes aware, to the extent required by applicable law and the applicable agreement with the Agency. Applicable agreements may specify notice procedures, timelines, content, and cooperation obligations.

Shine retains Personal Information for as long as reasonably necessary to:

Retention periods for child, family, Agency, program, and compliance data may vary based on applicable law, Agency instructions, grant requirements, contract terms, and Platform configuration.

Upon termination of an Agency’s use of the Platform, or upon an Agency’s written request, Shine will take reasonable steps to return, make available for export, delete, archive, or otherwise handle Agency data in accordance with the applicable agreement and applicable law, subject to the technical and operational requirements of the Platform.

When Shine disposes of Personal Information, we use reasonable measures designed to prevent unauthorized access, disclosure, or misuse.

The Platform is designed to support Head Start/Early Head Start programs that serve children and families. Shine recognizes the importance of protecting children’s privacy and the sensitivity of child development, health, disability, education, eligibility, and family information.

The Platform is not intended for children to use independently, and Shine does not knowingly collect Personal Information directly from children through public-facing portions of the Platform.

Information about children is generally entered by Agencies, Agency staff, or other authorized users. Agencies are responsible for obtaining any required parental or guardian consent, providing any required notices, and complying with applicable laws and program requirements relating to child and family information.

Parents, guardians, or family members seeking access to, correction of, deletion of, or information about child or family data in the Platform should contact the relevant Agency. Shine will support Agencies in responding to such requests as required by applicable agreements and law.

The Platform may process information that is subject to special legal or contractual protections, depending on the Agency, program, data source, and use case. This may include:

Information processed through the Platform may be subject to HIPAA, FERPA, the Head Start Act, Head Start Program Performance Standards, IDEA, state student or health privacy laws, Puerto Rico requirements, grant conditions, or other confidentiality requirements, depending on the Agency, the information, its source, and its use. Shine will process such information in accordance with applicable law and the applicable agreement with the Agency.

Agencies are responsible for maintaining procedures required by the Head Start Act, Head Start Program Performance Standards, and applicable program requirements, including procedures regarding confidentiality of child records, parental notices, disclosures with or without parental consent, records of disclosures, and retention or destruction of child records. Shine will support Agencies in maintaining, protecting, and, where applicable, documenting access to and disclosure of child records through the Platform in accordance with applicable agreements and law.

Some Agencies may be HIPAA covered entities or business associates, and information they submit to the Platform may constitute protected health information or electronic protected health information under HIPAA. Where Shine creates, receives, maintains, or transmits protected health information on behalf of a covered entity or business associate, Shine will act as a business associate or subcontractor business associate, as applicable, and process such protected health information in accordance with HIPAA and the applicable Business Associate Agreement.

Shine will not use or disclose protected health information except as permitted by the applicable Business Associate Agreement, HIPAA, and other applicable law. Shine will maintain appropriate administrative, technical, and physical safeguards for electronic protected health information and will report security incidents and breaches as required by the applicable Business Associate Agreement and applicable law.

If this Privacy Policy conflicts with an applicable Business Associate Agreement with respect to protected health information, the Business Associate Agreement will control.

Some Agencies may be educational agencies or institutions subject to FERPA and its implementing regulations. This may include school districts, local educational agencies, or other FERPA-covered entities that use the Platform. Where an Agency provides Shine with personally identifiable information from education records, Shine will process that information as a contractor or service provider performing services for the Agency and, where applicable, as a school official with a legitimate educational interest under FERPA.

Shine will use education records and personally identifiable information from education records only to provide, support, secure, and maintain the Platform for the Agency, or as otherwise authorized by the Agency, FERPA, and applicable law.

Shine will not re-disclose personally identifiable information from education records except as permitted by FERPA, directed by the Agency, required by law, or permitted under the applicable written agreement with the Agency. Shine will use reasonable administrative, technical, and physical safeguards to protect education records and will support Agencies in responding to requests from parents, guardians, or eligible students, as applicable.

If this Privacy Policy conflicts with a written agreement with a FERPA-covered Agency regarding education records or personally identifiable information from education records, the written agreement will control.

Depending on applicable law and the nature of the information, individuals may have rights to access, correct, amend, delete, restrict, or object to certain uses of their Personal Information.

Where Shine processes information on behalf of an Agency, requests relating to protected health information, education records, child records, family records, program records, or other Agency-controlled data should generally be directed to the applicable Agency. Shine will not independently respond to requests to access, amend, correct, delete, restrict, disclose, or otherwise act on Agency-controlled records unless authorized or required by the Agency, the applicable agreement, or applicable law.

Where Shine controls the information directly, such as account contact information, support communications, billing support information, or communications preferences, users may contact Shine to request access, correction, deletion, or other action, subject to applicable limitations.

Users may opt out of non-essential marketing communications by following the “unsubscribe” instructions in those communications or by contacting Shine. Shine may continue to send transactional, administrative, security, legal, or service-related communications.

The Platform is intended for use in the United States and Puerto Rico. Additional federal, state, territorial, or local privacy, security, breach notification, student data, health data, child data, or recordkeeping requirements may apply based on the Agency, user, child, family or information involved.

Shine will work with Agencies to support compliance with applicable U.S. federal, state, local, and Puerto Rico privacy, security, confidentiality, recordkeeping, and program requirements. Agencies remain responsible for determining which laws apply to their operations and for providing legally required notices to families, staff, and other individuals.

If required by applicable law or contract, Shine may provide additional privacy notices or other supplemental terms. Those additional notices or terms will apply to the extent they are provided and are applicable to the relevant Agency, user, child, family, or data.

The Platform may integrate with third-party services selected by Shine or an Agency, including Stripe’s payment-processing services.

This Privacy Policy does not apply to third-party services that are not controlled by Shine. Shine is not responsible for the privacy, security, or data practices of those third parties. Agencies and users should review the applicable privacy policies and terms for third-party services they use.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date above.

If we make material changes, we will provide notice as required by law or contract, which may include notifying Agency contacts, displaying notice within the mobile applications, or using other reasonable means.

Continued use of the Platform after an updated Privacy Policy becomes effective means that the updated Privacy Policy applies to use of the Platform going forward.

If you have questions about this Privacy Policy or Shine’s privacy practices, please contact us at:

Shine Early Learning, Inc.

500 Seventh Avenue, 8th Floor

New York, NY 10018

Email: privacy@shineearly.com

Phone: (212) 289-2402

If you are a parent, guardian, family member, or Agency participant, please contact the relevant Agency first regarding child or family records maintained in the Platform. Shine may direct your request to the relevant Agency as appropriate.