Privacy Policy

This Privacy Policy describes how Be Belong Group Corp, a Delaware corporation with a principal place of business at 2980 NE 207 Street, Miami, FL 33180 ("Company," "we," "us"), processes personal information in connection with the CollegeGain.AI website, mobile application (where applicable), and related services (the "Service").

Capitalized terms used but not defined here have the meanings given in our Terms of Service. See also our Cookies Policy and Accessibility Statement.

• KYC and identity-verification data, including government-issued identification, date of birth, address, and, where applicable, a selfie/biometric liveness image and derived biometric identifiers used solely for identity verification. See Section 4 for biometric-specific disclosures.
• School and enrollment data: Institution name, enrollment status, expected graduation date, and (if collected) student ID number.
• Financial and tuition-credit data: linked bank account or card details (if applicable), transaction history, Credit balances, Tuition Credit disbursement/application records, and related nonpublic personal financial information within the meaning of the Gramm-Leach-Bliley Act (GLBA).
• Behavioral, engagement, and analytics data: app/web usage, session data, activity completions across all Earning Buckets, gameplay and promotional-mechanic data, mobile attribution/measurement data (if a mobile app exists), device identifiers, and IP address.
• Advertising, matching, and personalization data: ad interaction and brand-campaign engagement data used by the Company's AI matching/optimization features, including the earnings optimizer, brand-matching engine, predictive earnings dashboard, and AI shopping/lifestyle assistant.
• Institutional-source data: limited directory-type contact information (e.g., name, school email address) that an Institutional Partner may have provided to facilitate outreach to you (see Section 3).
• Referral and social data (if a referral program is offered).
• Communications data: your notification preferences, opt-ins/opt-outs, and message metadata.

Some Users may first learn about and be invited to CollegeGain.AI because an Institutional Partner has provided limited directory-type contact information (for example, name and school email address) to facilitate outreach. Where this occurs:

• The Institutional Partner (not the Company) is solely responsible for ensuring that any disclosure of student information to the Company complies with the Family Educational Rights and Privacy Act (FERPA) and the Partner's own FERPA-compliant policies — including, where applicable, treating any such disclosure as "directory information" under a FERPA-compliant public-notice-and-opt-out process, or, alternatively, ensuring the Company operates under a FERPA "school official" / legitimate-educational-interest arrangement pursuant to a separate written agreement. [COMPANY TO CONFIRM WITH COUNSEL — FERPA BASIS FOR INSTITUTIONAL DATA SHARING per Partner].
• The Company is not responsible for the Institutional Partner's own compliance with FERPA or other student-privacy law in connection with the Partner's decision to share directory-type data with the Company.
• Once you create your own CollegeGain.AI account, your ongoing relationship, consents, and data are governed directly by these Company documents — the Terms of Service and this Privacy Policy — independent of how you were first invited.

Certain state student-data-privacy statutes (including California's Student Online Personal Information Protection Act, or SOPIPA) are primarily K-12-facing. Their applicability to a postsecondary product like CollegeGain.AI, including in dual-enrollment contexts involving minors, is fact-specific. [COMPANY TO CONFIRM WITH COUNSEL].

Where KYC includes a selfie/biometric liveness check, the Company (directly or through an identity-verification vendor) collects a facial image and may derive a biometric identifier or biometric information (as those terms are defined by laws such as the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington's biometric statute).

• Purpose. Solely to verify your identity, confirm liveness, prevent fraud, and satisfy applicable KYC obligations.
• Retention and destruction. Biometric identifiers are retained only for as long as reasonably necessary for the initial and ongoing purpose above and, in any event, no longer than three (3) years after your last interaction with the Service or as otherwise required by law, and are then destroyed in accordance with our written retention schedule.
• No sale. The Company does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.
• Consent. Where required, we obtain your written release/consent prior to collection.
• Vendors. Where an identity-verification vendor processes biometric data on our behalf, it does so under contract and with equivalent restrictions.

• Provide the Service, including creating and maintaining your account, verifying identity and enrollment, and operating Earning Buckets and Tuition Credit disbursement.
• Prevent fraud, gaming of Earning Buckets, and misuse.
• Personalize offers and recommendations through the Company's AI matching and optimization features (see Section 8).
• Send transactional and (with your consent) marketing communications by email and SMS (see the Terms of Service, Section 9).
• Measure and improve the Service.
• Comply with legal, tax, accounting, and regulatory obligations.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract — to provide the Service you have requested.
• Consent — for marketing communications, non-essential cookies, and processing of biometric data as a special category under Article 9.
• Legal obligation — for KYC, financial-privacy, and tax obligations.
• Legitimate interests — to secure and improve the Service and prevent fraud, balanced against your rights.

International transfers of personal data out of the EEA or UK rely on approved mechanisms, including the European Commission's Standard Contractual Clauses and the UK IDTA/Addendum, as appropriate.

We share personal information only as necessary and with the following categories:

• Service providers: KYC/identity-verification vendors, payment processors, mobile analytics/attribution and email/SMS delivery vendors, hosting and security providers, tuition and loan servicers, and customer-support providers, each under contract and only for the purposes we specify.
• Brand partners: to deliver the Earning Bucket activity you chose to complete. Brand partners generally receive only the data needed to attribute your completion (for example, a pseudonymous identifier), not the full set of your personal information.
• Institutional Partners: where applicable, and consistent with your consent and any separate written agreement.
• The Company's Advertising Portal (DSP): for campaign targeting and measurement purposes, Advertisers and their Agencies receive only aggregated and/or pseudonymized data in the ordinary course, not raw Student PII. See the Company's separate DSP Privacy Policy.
• Legal and safety: where required by law, subpoena, or to protect rights, safety, or property.
• Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality safeguards.

GLBA financial privacy. Consistent with the Gramm-Leach-Bliley Act, we describe here the categories of nonpublic personal financial information we collect (Section 2), the categories of parties with whom we may share it (this Section), and your opt-out rights (Section 10) with respect to sharing with nonaffiliated third parties for purposes other than servicing your account. We maintain administrative, technical, and physical safeguards consistent with the GLBA Safeguards Rule.

No sale of student personal information. The Company does not sell Student personal information for monetary consideration.

The Service uses automated processing to personalize Earning Bucket recommendations and to detect fraud. The Company does not use solely-automated decision-making to make decisions that produce legal or similarly significant effects on you, except that KYC eligibility determinations may involve automated components. Where an automated KYC determination adversely affects you, you may request human review and appeal by contacting info@bebelong.life. Where applicable state law provides an opt-out from targeted advertising, profiling in furtherance of legally-significant decisions, or the sale/sharing of personal information, you may exercise those rights under Section 10.

We retain personal information for as long as your account is active and for such additional period as is necessary for legal, accounting, fraud-prevention, or dispute- resolution purposes. Biometric data has a separate retention schedule (Section 4). We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest. No system is perfectly secure; we cannot guarantee absolute security.

Depending on your jurisdiction, you may have rights to:

• Access, correct, or delete your personal information;
• Port a copy of your personal information;
• Opt out of the "sale" or "sharing" of personal information and of targeted advertising;
• Limit the use and disclosure of sensitive personal information (including biometric and financial data);
• Opt out of certain profiling;
• Non-discrimination for exercising your rights;
• Appeal a denial of a rights request;
• Authorize an agent to submit rights requests on your behalf;
• Have your Global Privacy Control (GPC) signal recognized as a valid opt-out where required.

These rights are provided as required by applicable law, including the CCPA/CPRA (California), the VCDPA (Virginia), the CPA (Colorado), the CTDPA (Connecticut), the UCPA (Utah), other enacted comprehensive state privacy laws, the Florida Digital Bill of Rights (FDBR), the GDPR/UK GDPR, and, where applicable, PIPEDA (Canada). To exercise your rights, use Section 15 below. We will verify your request and respond within the time period required by law.

KYC vendors used by the Company generally do not produce a "consumer report" as defined by the Fair Credit Reporting Act (FCRA), and the Company does not use KYC output to make employment, credit, insurance, or housing decisions covered by the FCRA. If a specific KYC component in the future could be construed as a consumer report, the Company will provide the required FCRA notices and obtain any required authorization. [COMPANY TO CONFIRM WITH COUNSEL].

CollegeGain.AI is not intended for and may not be used by anyone under 13. Consistent with the Children's Online Privacy Protection Act (COPPA), if we learn we have collected personal information from a child under 13 without verifiable parental consent, we will delete it and terminate the account. For dual-enrollment students who are minors but at least 13, use of the Service requires the verifiable parental-consent pathway described in Terms of Service, Section 4. [COMPANY TO CONFIRM MINIMUM AGE POLICY AND PARENTAL CONSENT MECHANISM].

If you transition out of qualifying student status, we may offer you the opportunity to continue engagement through the Company's separate RentGain product. Unless the Company specifies otherwise, RentGain requires fresh account creation and fresh consent under RentGain's own Terms of Service, Privacy Policy, License Agreement, Cookies Policy, and Accessibility Statement; CollegeGain.AI data will not automatically carry over. [COMPANY TO CONFIRM ACCOUNT TRANSITION MECHANICS]. CollegeGain.AI is part of the Company's broader platform ecosystem (which also includes Launchpad, POS, RentGain, and the DSP/Advertising Portal), each with its own consumer documentation.

We use cookies and similar technologies as described in our Cookies Policy, which includes information about categories, purposes, and how to manage your preferences (including via our consent banner and, in a mobile-app context, in-app tracking permission handling).

To exercise any of your rights or contact us with privacy questions:

• Email: info@bebelong.life [COMPANY TO CONFIRM EMAIL]
• Mail: Be Belong Group Corp, Attn: Privacy, 2980 NE 207 Street, Miami, FL 33180
• In-product: submit a rights request from Settings → Privacy.

Our EU/UK representative and data protection officer, if designated, are listed here: [COMPANY TO CONFIRM].

We will update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above and, for material changes, notify you by email, in-product banner, or other reasonable means. Where required by law, we will obtain your renewed consent before applying material changes to previously collected information.