Privacy Policy

June 9, 2026

Your privacy is important to Clad (“we”, “us”, “our”). This Privacy Policy (“Privacy Policy”) describes our privacy practices concerning information collected in connection with our websites at cladedu.com and any subdomains (the “Sites”) and the Clad mobile applications for iOS and Android (the “Apps”; together with the Sites, the “Services”), and sets forth our policies on how we collect, use, and disclose information collected through the Services. By accessing or using the Services, you are agreeing to the terms of this Privacy Policy.

We provide the Services to three categories of users: (a) School Users — staff or administrators of schools, childcare providers, or similar institutions that contract with Clad (“Schools”); (b) Guardians — parents, guardians, or other payers who use Clad to set up or pay a tuition or childcare payment plan; and (c) Clad Administrators — Clad employees and contractors who operate the Services. This Policy applies to all three categories.

Information We Collect

We and our affiliates and our third-party service providers may automatically collect and store certain information when you visit or use the Services, including information such as the Internet Protocol (IP) address of the device you use to connect to the Internet, browser type, device type, mobile device ID, screen size and resolution, Internet Service Provider (ISP), the page or screen you came from and exited to, operating system, user agent string, Internet connection type, links you click, date/time stamp, and pages visited. To obtain such information, we may use logs or applications that recognize your device and gather information about its online activity.

In addition, when you register for an account or use the payment features of the Services, we collect information you provide directly, including: full name, email address, phone number, and job title (School Users); billing address, payment method details, and bank account metadata for ACH debits (Guardians); and account credentials. Full payment card numbers and bank account numbers are submitted directly to our payment processor, Stripe, Inc. (“Stripe”), and are not stored on Clad’s servers. Stripe provides us only with tokenized payment references, card brand, last four digits, and expiry information.

We and our affiliates or third-party service providers may also collect information that you provide through account registration forms, support requests, in-app feedback, and other interactions with the Services. Some links within the Services will route you to third-party websites. The privacy policy for those websites will apply.

Schools may upload limited information about enrolled children — typically first name, last name, date of birth, and a school-assigned identifier — solely to enable tuition assignment. We treat this information as confidential student record data as described in the “Children’s Privacy and Student Data” section below.

Cookies And Other Technologies

We or our third-party service providers may place and read data stored (via session and/or persistent “cookies” or other device-specific storage capabilities) on the device you are using, and use other technologies such as web beacons (including clear GIFs, tracking pixels, JavaScript, and tags), when you visit or use our Sites. Cookies are small data files placed on your device for a variety of purposes, including to identify your device when you return to the Sites. A web beacon is an electronic file or code that usually consists of a single-pixel image or tag embedded on a website. We and our service providers may use web beacons and cookies to capture information such as the type of device, operating system, email program, and web browser used to view our Sites, the IP address from which you view our Sites, and whether you click on any links. The Apps do not use HTTP cookies but may use local secure storage for session tokens and preferences.

You can generally remove, block, or disable cookies by using the settings located in your browser. If you decide to remove or not accept cookies, some features and services on our Sites may not work properly. We do not use cookies or tracking technologies for cross-context behavioral advertising. We use PostHog, a first-party analytics tool, to measure usage and improve the Services. You may opt out of analytics by enabling a Global Privacy Control (GPC) signal in your browser.

How We Use The Information That We Collect

We or our third-party service providers may use the information collected for a variety of purposes, including to develop, offer, deliver and improve our Services, to process payments and reconcile payouts, to send transactional communications (receipts, payment reminders, account notices), to detect and prevent fraud and security incidents, to fulfill legal and regulatory requirements, and as otherwise permitted by applicable law. For example, we may use the information to:

• Operate and improve the Services;

• Authenticate users and secure accounts;

• Comply with legal or regulatory requirements; or

• Analyze usage patterns and feature interactions to improve the Services.

We do not use your information for cross-context behavioral advertising, and we do not sell your personal information for money.

Our Disclosure Of Your Information

We may share your information with other parties for a variety of purposes, as described below. 

Affiliates: We may disclose information to Clad’s affiliates for the purposes described in this Privacy Policy.

SMS and Mobile Information: If you provide your mobile phone number or consent to receive text messages from Clad, we will use that information to send you the messages you have agreed to receive, including transactional, customer care, account-related, or marketing messages, as applicable. We do not sell, rent, or share mobile phone numbers, text messaging opt-in data, or text messaging consent with third parties or affiliates for their own marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except as necessary to provide and support our text messaging services.

Service Providers and Business Partners: We may disclose information to our service providers and business partners who perform tasks on Clad’s behalf. Key service providers include: (a) Stripe, Inc. for payment processing, payouts, and fraud detection; (b) Supabase, Inc. for authentication and database hosting; (c) PostHog, Inc. for first-party product analytics; (d) Google Cloud for data warehousing and reporting; (e) Google Maps Platform for address autocomplete; (f) Apple Inc. and Google LLC for Sign-In with Apple and Sign-In with Google; and (g) Twilio / SendGrid for transactional SMS and email delivery. Our service providers are prohibited from using the information we provide to them for their own purposes or for the purposes of any other entity.

Between Schools and Guardians: Information you provide as a School (such as a tuition obligation or enrollment record) is shared with the Guardian responsible for that payment, and vice versa, to the extent necessary to complete the transaction.

Legal Purposes: We also may use or share your information with third parties when we believe, in our sole discretion, that doing so is necessary:

• to comply with applicable law or a court order, subpoena, or other legal process;

• to investigate, prevent, or take action regarding illegal activities, suspected fraud, violations of our terms and conditions, or situations involving threats to our property or the property or physical safety of any person or third party or for risk management purposes; or

• to establish, protect, or exercise our legal rights or defend against legal claims.

Aggregated or De-Identified Information: From time to time, we may share aggregated or de-identified information about users of the Services, such as sharing reports on usage for regulatory or analytics reporting.

Business Transfers: If Clad is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you (e.g., via email or in-app notice) before your information becomes subject to a different privacy policy.

Data Retention

We retain information for as long as we need it to provide the Services and to meet our legal, accounting, and reporting obligations. In general: account records are retained for the life of the account plus seven (7) years; payment and transaction records are retained for seven (7) years from the transaction date; support communications are retained for three (3) years; and analytics events are retained for twenty-four (24) months. Student and child data is subject to the same or shorter retention periods and will be returned or destroyed at the direction of the School following termination. 

When you delete your account, we will delete or anonymize your personal information within thirty (30) days, except where retention is required by law (e.g., tax and anti-money-laundering obligations) or to resolve pending disputes.

Reviewing And Updating Your Information

Unless prohibited by law, you have the right, upon reasonable notice, to view any Personal Information collected from you through your use of the Services, to make corrections to such information if necessary, or to request that such information be removed from our systems. You may do so by contacting us at the address indicated at the end of this Privacy Policy.

Your Rights As A U.S. Resident

If you are a California resident, under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), you have the right to: (a) know what personal information we collect, use, disclose, and sell or share; (b) access the specific pieces of personal information we have collected about you in the past twelve (12) months; (c) delete personal information we have collected, subject to exceptions; (d) correct inaccurate personal information; and (e) opt out of the “sale” or “sharing” of personal information. Clad does not sell personal information and does not share personal information for cross-context behavioral advertising.

If you are a resident of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another U.S. state with a comprehensive consumer privacy law, you have similar rights to access, deletion, correction, and opt-out. To exercise any of these rights, email privacy@cladpayments.com from the address associated with your account. We will verify your identity before responding and aim to respond within forty-five (45) days, or within the timeframe required by your state’s law.

If we decline your request in whole or in part, you may appeal by replying to our response with a written explanation of why you believe the denial was in error. We will reconsider and respond within sixty (60) days of receiving your appeal, as required by applicable state law. If your appeal is denied, you may contact your state’s attorney general for further assistance.

Our Sites recognize and honor the Global Privacy Control (GPC) signal as an opt-out of “sale” or “sharing” for residents of U.S. states whose laws give effect to such signals.

Security

In our information technology systems environment, Clad maintains commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information against loss or unauthorized access, use, modification, or deletion. These measures include TLS encryption for data in transit, encryption at rest for production databases and backups, and least-privilege access controls for employee access. However, no security program is foolproof, and thus we cannot guarantee the absolute security of your information. If we become aware of a security breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

Children’s Privacy And Student Data

Clad is designed for use by adults (Schools, Guardians, and Clad staff). Children under 13 do not interact with the Services directly. Clad does not knowingly collect personal information directly from children under 13, in compliance with the Children’s Online Privacy Protection Act (COPPA). Information about children is provided to us by Schools or Guardians solely to identify which tuition is owed for which child. We treat this information as confidential and: (a) do not use it for marketing; (b) do not sell or share it for cross-context behavioral advertising; (c) act as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, when handling student records on behalf of a School; and (d) maintain direct control by the School over student records, and will return or destroy them at the School’s direction following termination, subject to legal retention obligations.

If you believe a child under 13 has provided personal information to Clad directly, contact privacy@cladpayments.com and we will promptly delete it.

Changes To This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this Policy, post the new version on the Sites and in the Apps, and — where you have an account — ask you to re-accept via the in-app agreement flow before you continue using the Services. Older versions are available on request.

Contacting Us

If you have any questions or comments about this Policy, you are welcome to email us at privacy@cladpayments.com, or write to us at Clad Payments, Inc., 535 Mission St., 14th Floor, San Francisco, California 94105.

The effective date of this Privacy Policy is June 9, 2026. It replaces all prior privacy policies posted on the Sites and in the Apps. We reserve the right to change our Privacy Policy. Any changes to our Privacy Policy will be reflected in the updated version displayed on the Sites and in the Apps.