Privacy Policy

EnrichPoint (“we,” “us,” or “our”) operates the enrichpoint.com website and the epReviews, epSpeak, epRoundRobins, and epPassword mobile applications (collectively, the “Services”). This Privacy Policy explains how we collect, use, and protect your information when you use our Services. For epPassword-specific privacy details, please also see the epPassword Privacy Policy.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and authentication credentials. If you sign in with Google, we receive your name, email, and profile picture from Google.

User Content

We store content you create within our apps, including:

• Restaurant reviews (ratings, notes, food ordered, photos)
• Communication boards, icon sets, and usage data (epSpeak)
• Tournament schedules, scores, and participant information (epRoundRobins)
• Encrypted password vault entries, secure notes, Wi-Fi credentials, and medication details (epPassword)
• Wishlist entries, group memberships, and conversations
• Feedback messages

Photos

When you attach photos to reviews or content, we upload and store them using Firebase Cloud Storage. Photos are associated with your account and the specific content.

Location Data

With your permission, we access your device's location to show nearby restaurants on the map (epReviews). We do not track or store your location history. Restaurant addresses may be geocoded to display map pins.

Device Information

We collect basic device information for push notifications (FCM token) and crash reporting, including device type, operating system version, and app version.

2. How We Use Your Information

We use your information to:

• Provide and maintain our Services' features
• Send push notifications for group messages and activity
• Display your content to group members you choose to share with
• Track communication progress and generate analytics (epSpeak)
• Improve our Services and fix bugs
• Respond to your feedback and support requests

3. How We Share Your Information

We do not sell your personal information. Your information may be shared in these limited circumstances:

• With your groups: Content you share with a group is visible to all members of that group.
• Service providers: We use Firebase (Google Cloud) for authentication, database, storage, and push notifications. Google processes data according to their Firebase Privacy Policy.
• Advertising: If you have not purchased an ad-free subscription, we may display ads through Google AdMob, which may collect device identifiers and usage data.
• Legal requirements: We may disclose information if required by law or to protect rights and safety.

4. Data Storage and Security

Your data is stored in Google Firebase (Cloud Firestore and Cloud Storage). We use Firebase Authentication to secure your account. All data is transmitted over encrypted connections (HTTPS/TLS).

While we take reasonable measures to protect your data, no method of electronic storage is 100% secure.

5. Your Rights and Choices

• Access and edit: You can view and edit your content within each app at any time.
• Delete content: You can delete individual reviews, photos, boards, and other content.
• Delete account: You can request account deletion by contacting us at support@enrichpoint.com. We will delete your account and associated data within 30 days.
• Location: You can revoke location permission through your device settings.
• Notifications: You can disable push notifications through your device settings.

6. Children's Privacy (COPPA)

epSpeak is an augmentative and alternative communication tool, and many of the people who depend on it are children. We collect information about a child only as needed to provide the service to them, and never for advertising.

Where a family uses epSpeak, a parent or guardian creates the account and provides consent. They can review, export or delete their child's information at any time from My Account.

Where a school or district uses epSpeak, we rely on the school to provide consent on behalf of parents, as permitted under COPPA for services used for a school-authorised educational purpose. We collect only what is reasonably necessary for that purpose, we use it only to provide the service to that school, and we do not condition a child's participation on disclosing more than is necessary. Parents may ask their school to review or delete their child's information, and schools can act on that request directly.

What we collect about a student is limited: a display name, an email address only where one is supplied, which symbols and categories they selected and when, and the clinical records their own educators create. We do not collect a student's date of birth, home address, phone number, government identifiers, or photographs, and we do not record students' voices. Custom audio is recorded by adults, a caregiver or clinician recording their own voice so a symbol speaks in a familiar one.

If you believe a child has provided us with information without appropriate consent, contact us and we will delete it.

7. Schools and Districts (FERPA)

When a school or district uses epSpeak, the district is the controller of its students' records and EnrichPoint acts as a school official with a legitimate educational interest under FERPA, operating under the district's direct control. We use student data only to provide the service to that district. We do not sell it, we do not use it for advertising, and we do not use it to train machine-learning models.

Artificial intelligence. epSpeak can generate plain-language summaries of a student's communication activity, which sends that student's activity data to an external model provider. A district can turn this off for all of its students, and the rest of the service is unaffected. Our other AI features operate on content written by adults and do not process student records.

Retention and deletion. Raw interaction events are deleted automatically after 365 days. Goals, trials, notes and reports are kept while the account exists, because they are the educational record the district relies on. A district may request deletion of its student data at any time, including at the end of a contract, and can carry it out directly. A student whose family holds their own epSpeak account is released from the district rather than deleted, that account belongs to the family, and their data stays with them.

Parents exercise their FERPA rights through the district, which holds the educational record. We help districts respond to those requests, including producing a student's record in a portable format. All processing takes place in the United States.

8. Third-Party Services

We use the services below to operate ours. Which apply depends on which EnrichPoint product you use, so each is marked. All process data in the United States.

• Google Cloud / Firebase: authentication, database, storage, push notifications. All products.
• Stripe: subscription billing. We never store card details.All products.
• Resend and GoDaddy: sending email.All products.
• OpenAI, Anthropic, Google AI andAzure AI: generating symbols, categories and lesson content, moderating material submitted for publication, and producing activity summaries.epSpeak.
• Google Cloud Speech-to-Text: transcribing adult-recorded item audio so it can be checked before publication. epSpeak.
• Google Maps: map display and directions. epReviews.
• Google AdMob: advertising for non-subscribers.epNeuroball only. No advertising is shown in epSpeak, and no student or child data is ever used for advertising in any product.

Each service has its own privacy policy governing the data it handles. We will publish changes to this list, and give schools and districts notice before adding to it.

We have entered into a data processing agreement with every provider above that handles data on our behalfGoogle, Anthropic, Microsoft and OpenAI. Schools and districts can ask us for the current status at any time, and we will send it.

8a. Cookies and Analytics

This website uses Google Analytics 4 to understand which pages people find useful. It sets a cookie in your browser and records the pages you visit on this site, along with general information such as your approximate region, browser and device type.

It is off until you agree to it. The first time you visit we ask, and nothing is set or sent unless you say yes. If you decline, or simply ignore the question, no analytics cookie is set and no data is sent. The site works exactly the same either way. You can change your mind by clearing this site’s data in your browser, which brings the question back.

We do not use advertising cookies, advertising identifiers, tracking pixels, or cross-site tracking of any kind, and we do not sell or share this data. Advertising signals are permanently disabled rather than left to your choice, because nothing here advertises.

Our apps contain no analytics or tracking technologies at all. The usage information recorded inside epSpeak. Which symbols were chosen, and when. Is the service itself rather than tracking, is visible to the caregivers and practitioners who support that person, and never leaves our systems for advertising purposes.

8b. Students and Schools

When a school or district uses epSpeak, the district is the data controller and EnrichPoint acts as a school official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)(i)(B)), under the district’s direct control. The district decides the purposes for which student data is used; we do not.

We use student data only to provide the service to that district. We do not build advertising profiles from it, we do not sell it, we do not share it with anyone beyond the subprocessors listed above, and we do not use it to train machine-learning models.

About a student we hold: a display name, and an email address where the district provides one; which symbols and categories were selected, and when; clinical records created by the district’s own staff, IEP goals, trial data, notes and progress reports; and the device information needed to deliver notifications. We do not ask for date of birth, home address, phone number, government identifiers, disability category or grade level, and we do not collect location data.

We do not record students’ voices. Custom audio in epSpeak is recorded by adults, a caregiver or clinician recording their own voice so a symbol speaks in a familiar one.

COPPA. Students under 13 use epSpeak under the authority of their school. Where a district provides consent on behalf of parents for an educational service, as permitted under COPPA’s school-consent provision, we rely on that consent and collect only what is reasonably necessary to provide the service. We support districts that prefer to obtain direct parental consent instead.

Artificial intelligence. epSpeak can generate a plain-language summary of a student’s communication activity, which sends that activity data to an external model provider. A district can turn this off for all of its students in Organization → Settings, and the rest of the service is unaffected. Data sent for this purpose is not used to train models. Other AI features operate on material authored by adults and do not process student records.

Parent and district rights. Parents exercise FERPA rights, inspection, review and correction, through the district, which holds the educational record. We assist districts in responding, including producing a student’s complete record in a portable format. A district may request deletion of all of its student data at any time, including at contract termination. A student whose family holds their own epSpeak account is released from the district rather than deleted: that account belongs to the family, not the school.

9. Data Retention

We retain your data for as long as your account is active. When you delete content, it is removed from our database. When you delete your account, we delete your data from our live systems within 30 days.

Three things we would rather state than let you discover:

• Backups. Our backups cycle automatically and cannot be edited selectively, so a copy of deleted data can persist in backup for up to 90 days after it has gone from the live system. We do not use backups to bring back a deleted account.
• Shared records. Where a person’s record belongs to both a family and a school, a deletion requested by one does not destroy the other’s copy, because it is not theirs to delete. A school deleting its records removes the goals, trials, notes and reports it created.
• Evidence attached to a goal. In epSpeak, communication activity is normally erased automatically after 365 days. Where a specific moment has been cited as evidence for a therapy goal, it is kept for as long as that goal record is kept, a progress note whose evidence has been erased is not evidence. It is deleted when the goal record is.

10. International Users

Our Services are available internationally, but your data is processed and stored only in the United States: on Google Cloud servers in the us-central1 region. That is true of every product and every subprocessor listed above; none of them process your data elsewhere.

If you use our Services from outside the United States, your data is transferred to and held in the United States, and by using the Services you consent to that transfer. If we ever begin processing data in another region we will update this policy and tell schools and districts before we do it, not after.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by updating the effective date above. Continued use of our Services after changes constitutes acceptance.

12. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

EnrichPoint
Email: support@enrichpoint.com
Phone: +1 (801) 613-2171
Salt Lake City, Utah