UFinLit LogoUFinLit
Log inSign up

Privacy Policy

Last updated: July 19, 2026

Financially Lit LLC ("UFinLit," "we," "us," or "our") operates the marketing website at u-finlit.com and the UFinLit financial-literacy application at app.u-finlit.com (together, the "Services"). This Privacy Policy explains what information we collect, how we use and share it, and the choices available to you.

If you use UFinLit through your school or university, please also see "Student Data and Our Role Under FERPA" below, which governs how we handle student records on your institution's behalf.

Who We Are

UFinLit is a product of Financially Lit LLC. Questions about this policy or your data can be directed to us through our contact page.

Student Data and Our Role Under FERPA

UFinLit is provided to colleges, universities, and schools to deliver financial-literacy education to their students. When we process student information on an institution's behalf, we act as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA, 34 CFR § 99.31(a)(1)), performing a service the institution would otherwise perform itself.

This means:

  • The institution remains the owner of student education records.
  • We use student data only to provide and support the Services.
  • We do not sell student data, use it for advertising, or repurpose it for anything other than the educational service.
  • Access, correction, export, and deletion of student records are directed by the institution. Students and parents should submit such requests to their institution, which we support as a service provider.

Information We Collect

Account information — name, email address, and a university-assigned identifier ("campusId"). University users sign in through their institution's single sign-on (Okta/SAML).

Learning and rewards information — lesson progress, quiz results, baseline assessment answers, "Campus Cash" balances, and redemption history.

Chatbot content — messages you send to the in-app AI tutor.

Technical and security information — your IP address at sign-in ("last login IP"), collected for security and audit purposes, and standard log data.

Analytics information — usage and interaction data collected through Google Analytics and Google Tag Manager (see "Cookies and Analytics").

Contact information — if you contact us through a form on our site, the name, email, and message you provide (processed via our form provider).

How We Use Information

We use the information above to:

  • Provide, personalize, and improve the Services and track learning progress;
  • Operate the Campus Cash rewards mechanic;
  • Provide the AI tutoring feature;
  • Secure the Services, detect and investigate abuse, and maintain audit records;
  • Respond to your inquiries; and
  • Comply with legal obligations.

How We Share Information

We share information only as needed to run the Services:

  • With your institution, which owns and directs the student records we process on its behalf.
  • With service providers (subprocessors) who process data under contract on our behalf:
    • Amazon Web Services (AWS) — hosting, authentication (Cognito), database and storage, and infrastructure security.
    • Okta — university single sign-on (identity federation).
    • Amazon Bedrock (AWS) — AI inference for the chatbot. Bedrock does not use your inputs to train foundation models.
    • Our form provider — contact-form delivery.
    • Google Analytics / Google Tag Manager — website and product analytics.
  • For legal reasons, if required by law or to protect the rights, safety, and security of our users, the institution, or UFinLit.
  • In a business transfer, subject to the protections in this policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Cookies and Analytics

We use cookies and similar technologies, including Google Analytics and Google Tag Manager, to understand how the site is used and to improve it. You can control cookies through your browser settings, and where required we present a cookie/consent notice. We enable IP anonymization for analytics. We do not use analytics to identify individual students.

AI Features

The in-app tutor sends your messages to Amazon Bedrock to generate responses. These messages are processed within AWS under our agreement and are not used to train foundation models. Please do not include sensitive personal information in chatbot messages.

Data Retention

  • Active student records are retained for the duration of the institution's engagement with UFinLit.
  • Login IP and security event data are retained for up to 12 months.
  • Redemption records are retained for the duration of the engagement plus any applicable audit period.
  • Upon an institution's directed deactivation, we export and then delete the applicable student data. Deleted data is removed from live systems promptly and ages out of encrypted backups on our standard backup retention schedule.

Data Security

We protect information using encryption in transit and at rest, least-privilege access controls, multi-factor authentication for administrators, web-application firewall protections, continuous security monitoring, and independent annual penetration testing. No system is perfectly secure, but we work to protect your information and to respond promptly to any security incident.

Your Rights and Choices

Students and parents: Rights to access, correct, export, or delete student education records are directed through your institution under FERPA. Please contact your institution, which we support as a service provider.

California residents: To the extent the CCPA/CPRA applies to non-student data we control, you may have rights to know, access, correct, and delete personal information, and to not be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under California law. Requests can be submitted through our contact page.

Children's Privacy

The Services are intended for high-school and college students and are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Where UFinLit is used with minors in a school setting, we rely on the institution's authorization consistent with applicable law. If you believe a child under 13 has provided us information, reach us through our contact page and we will delete it.

State Student-Data-Privacy Laws

We support institutions in meeting their obligations under state student-data-privacy laws.

Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date and, where appropriate, additional notice.

Contact Us

Financially Lit LLC — UFinLit
Reach us through our contact page.