IVY Club Privacy Policy

Version: 1.0 Last Updated: October 1, 2026 Effective Date: October 1, 2026

Table of Contents

1. Introduction
2. Information We Collect
3. How We Use Your Information
4. Storage and Protection of Information
5. Information Sharing and Disclosure
6. Your Rights
7. Cookies
8. Cross-Border Data Transfers
9. Protection of Minors' Information
10. Changes to This Policy
11. Contact Us

1. Introduction

Welcome to IVY Club (the "Platform"). The Platform is operated by ZYSPHERE Inc. (New York, USA) ("ZYSPHERE," "we," "us," or "our").

The Platform is not a service sold to the public. It is a supporting education management platform that ZYSPHERE provides free of charge for use by its students, parents (guardians) and authorized internal staff. Accounts are created and delivered by Platform staff, and the Platform is not open for public registration.

This Privacy Policy (this "Policy") explains how we collect, use, store, share and protect the personal information of you and your minor children on the Platform.

Important Notice When you sign in to the Platform for the first time, you will be asked to read and confirm your consent to this Policy and the Terms of Service. We record the time you confirm your consent, the version of the documents you consent to, your IP address and your browser information (user agent). If you do not agree to this Policy, please do not use the Platform, and contact the staff member serving you.

2. Information We Collect

Some of the information on the Platform is filled in by you or your guardian, and some is entered by the staff serving you based on what you provide.

2.1 Account Information (All Users)

• Name, English name / public-facing name
• Login ID, login email, personal email
• Phone number
• Date of birth
• Time zone
• Account role

2.2 Student Information

• Grade, current school, educational history
• Academic records: transcripts, GPA and ranking, standardized and language test scores, subject grades
• Activities and honors
• Application information: intended field of study and entry term, target schools and majors, school list, essays, recommender information, interviews and admission results
• Personal information required for applications: legal name, former names, gender, place of birth, nationality / citizenship, passport or ID number, visa type, native language, mailing address
• Courses and projects, study plans and progress records
• Q&A content and in-Platform messages
• Files you upload

2.3 Parent, Family and Contract Signing Information

• Parent names and contact details (phone, email)
• Family information: parents' names, educational background, occupations
• Appointment form information during the consultation stage: application tier, Chinese and English names of the student and parents, date of birth, gender, nationality, ethnicity (optional), phone number, email, WeChat ID, address, time zone, target countries / regions, target schools and majors, target entry term, academic background, test scores, experiences and consultation needs
• Contract signing information: names of the student and parents, ID type and ID number, mailing address, parent email and phone
• Contract and payment records: contract number, signing date, contract amount, signing method and signature status, signed contract files, payment amounts and dates

2.4 Third-Party Account Credentials

To support admissions services, you or the consultant serving you may enter the following accounts and passwords:

• University application system accounts
• School portal accounts
• Email accounts

These passwords are stored encrypted (AES-256-GCM), can be viewed only by authorized staff, and each viewing is logged.

2.5 Internal Staff Information

For internal staff, in addition to account information, we also process the following in connection with the employment or engagement relationship:

• Salary, bonus and deduction records
• Performance review and work records
• Expense reimbursement details and receipts
• Contract files
• Bank payment information (of which the bank account number, ID number and routing number are stored encrypted)

The processing of staff information is also governed by the relevant employment or engagement agreement.

2.6 Automatically Collected Information

• Sign-in times
• IP address: used for rate-limiting failed sign-in attempts (to prevent brute-force password attacks) and for security auditing
• Browser / device information (user agent): used to record consent to these documents and for security auditing
• Activity logs: such as the creation, modification and deletion of information
• Records of viewing sensitive information (such as third-party account passwords and ID numbers)
• Records of system emails sent

We do not perform geolocation based on IP addresses, do not use analytics or advertising cookies, and do not track your activity outside the Platform.

3. How We Use Your Information

3.1 Purposes of Use

• Providing education management services: planning, course and project scheduling, academic profiles, application management, Q&A, etc.
• Sharing information necessary to provide the services among the team serving you (consultants, mentors, operations, finance, administrators)
• Supporting consultation, contract signing and contract performance
• Account and security: account activation, password reset, login email change notifications, sign-in security protection, security auditing
• Sending important reminder emails: course reminders, application deadline reminders, financial notices, important announcements
• Handling HR and financial matters for internal staff, such as payroll, performance reviews and expense reimbursement
• Complying with laws and regulations, handling disputes, and protecting our lawful rights and interests

3.2 Emails

System emails are sent to the login email and personal email registered in your account (if the two are the same, only one email is sent). General in-Platform notifications are not sent by email.

3.3 We Will Not

• Sell your personal information
• Use your personal information for advertising
• Use your personal information for purposes unrelated to those described in this Policy

4. Storage and Protection of Information

4.1 Storage Location

Your information is stored in the Alibaba Cloud (Hong Kong) region:

• Elastic Compute Service (ECS): runs the Platform
• ApsaraDB RDS for PostgreSQL: stores Platform data
• Object Storage Service (OSS): stores the files you upload

4.2 Security Measures

• Data in transit is encrypted using HTTPS
• Sensitive fields are stored encrypted: third-party account passwords, contract signing ID numbers, and staff bank account numbers / ID numbers / routing numbers
• Role-based access control: each role can see only the information required for its responsibilities
• Viewing of sensitive information is logged, and important operations are recorded in audit logs
• Temporary lockout after too many failed sign-in attempts
• Uploaded files are downloaded through short-lived signed links after server-side permission checks
• Regular data backups

Please understand that no security measure can guarantee absolute security.

4.3 Retention Period

• We retain your information for as long as necessary to achieve the purposes described in this Policy, unless laws and regulations require a longer retention period
• After your account is terminated, we will delete or anonymize your personal information within a reasonable period; information that must be retained by law, or that is necessary to handle disputes, will be retained for the corresponding period

4.4 Security Incidents

If a personal information security incident occurs, we will handle it as required by applicable law and, where required by law, notify the regulatory authorities and affected users.

5. Information Sharing and Disclosure

5.1 Sharing Within the Platform (on a "Minimum Necessary" Basis)

• Students: can see their own information and the service content visible to students
• Parents: can see service-related information about their linked children
• Consultants: can see information about the students they are responsible for
• Mentors: receive only the necessary information related to the projects they are responsible for
• Operations, finance and IT support: access necessary information within the scope of their respective responsibilities (for example, finance handles contract signing and payments, and IT handles account support)
• Administrators: have the access needed for operational management. To resolve account issues, administrators may view the Platform from a user's perspective, with such access being logged

Staff and mentors are shown externally only with limited information, such as their public-facing names.

5.2 Service Providers

5.3 Other Disclosures

Except as described above, we disclose your personal information to third parties only in the following circumstances:

• With the consent of you (or your guardian), for example, providing materials to schools in order to submit applications
• When required by laws and regulations, or when lawfully required by a court, government agency or regulatory authority
• When necessary to protect the personal or property safety of you, other users or ZYSPHERE
• In the event of a merger, reorganization or business transfer, transfer to a successor, which must continue to be bound by this Policy

6. Your Rights

Subject to applicable law, you have the following rights with respect to your personal information:

• Access: view your information on the Platform
• Correction: some information can be edited yourself under "My Account"; for other information, please contact the staff member serving you or us
• Deletion: request deletion of your personal information, except where retention is required by laws and regulations
• Withdrawal of consent: withdraw consent you previously gave. Withdrawal does not affect processing carried out based on consent before the withdrawal; after withdrawal, we may be unable to continue providing Platform services to you
• Obtaining a copy: obtain a copy of your personal information to the extent provided by applicable law
• Complaints: lodge a complaint with us or with the relevant data protection authority

To exercise your rights, please email ivyclub@zysphere.org. To protect the security of your information, we will first verify your identity, and we will handle your request within the time period required by applicable law.

7. Cookies

The Platform uses only cookies that are strictly necessary for its operation:

We do not use analytics, advertising or third-party tracking cookies. Disabling the above cookies will prevent you from signing in to or using the Platform.

8. Cross-Border Data Transfers

Platform data is stored in Hong Kong, China. Our users and staff may be located in different countries / regions, such as mainland China and the United States, so your information may be stored and accessed outside the place where you are located.

We will handle cross-border transfers as required by applicable law, including obtaining your consent where required by law, and will apply the security measures described in Section 4 of this Policy.

9. Protection of Minors' Information

Users of the Platform include students under the age of 18. We comply with applicable laws on the protection of minors' personal information, including the U.S. Children's Online Privacy Protection Act (COPPA), the provisions on minors in China's Personal Information Protection Law, and, where applicable, the relevant provisions of the EU General Data Protection Regulation (GDPR).

• Student accounts are created by staff after consent from the student's parent or other legal guardian
• Minor students must obtain their guardian's consent to use the Platform; a guardian's consent to this Policy constitutes consent on behalf of the minor student
• Guardians can view information about their children through a parent account and may exercise the rights described in Section 6 on their children's behalf
• We process only the minors' information necessary to provide educational services

If you become aware that a child under the age of 13 has provided us with personal information without a guardian's consent, please contact ivyclub@zysphere.org, and we will delete it in accordance with law.

10. Changes to This Policy

• We may modify this Policy and will post the updated version on the Platform
• In the event of material changes, we will notify you through in-Platform notices, email or other means, and may ask you to confirm again
• If you do not agree to the modified Policy, please stop using the Platform and contact us

11. Contact Us

If you have any questions about this Policy or your personal information, please contact us at:

ZYSPHERE Inc. 418 Broadway Albany, NY 12207 United States

Email: ivyclub@zysphere.org Platform: myivyclub.com

© 2026 ZYSPHERE Inc. All rights reserved.