Skip to content
Pacific Crest Institute logo

Privacy

Privacy policy

What this website collects and what we do with it.

Effective

Who we are

Pacific Crest Institute LLC (PCI) runs this website. We teach digital art and test prep in San Diego, on weekends and after school.

This page covers the whole site, including the contact form, applications, sign-in, the parent and student portals, and our store.

You can reach us about privacy, or anything on this page:

We work with High Bluff Academy (HBA), a private high school in Rancho Santa Fe. We’re separate schools with separate databases, but we share some systems. One of them is a Microsoft 365 system that HBA runs for both schools. See “PCI, HBA and Contemplanda Direct” below.

What we collect

When you contact us

Our contact form asks for a parent or guardian’s name, email address and phone number, the student’s name, your message, and whether you’d like a tour. You can also tell us how you heard about us. We save your message and send it to our office, and we email you to say we got it.

When you email us

If you email our office, or reply to one of our emails, we may save your email with your inquiry or application. That way our staff can see the whole conversation. We save our office’s replies there too.

When you apply

The application asks for:

  • the programs you want (courses, contest prep or tutoring, and how many hours) and when you’d like to start
  • each parent or guardian’s name, email address, phone numbers, relationship to the student and home address
  • for international students, a homestay contact and whether the student would like to live in a dorm
  • the student’s legal and preferred names, date of birth, gender, pronouns, birthplace, languages, English level, expected graduation year and home address
  • an email address for the student, where we send their school sign-in when they enroll (a parent’s email address is fine)
  • the student’s phone number, if they have one
  • the schools the student has attended, with any notes you add and any transcripts you upload
  • how you heard about PCI, and anything else you want us to know

As you type the first guardian’s email address, the form checks whether you already have a parent account with us. If you do, it can email you a sign-in link.

If you save your application to finish later, we store what you’ve entered and email you a link to come back to it. The link works for 30 days after you last save, and we may send you a few reminders in that time.

Until you save, your browser keeps a copy of the form on your device, so you don’t lose your work. We delete that copy when you save or submit. We stop using a copy that’s more than 30 days old, and delete it the next time you open the form.

When you submit, we set up a parent account for each guardian email address that’s new to us. That lets you sign in later and see your application.

If you pay when you apply, the payment goes through Stripe. We send Stripe the amount, a description with the student’s name, and the first guardian’s email address. Stripe emails you a receipt.

After you apply

Our office may email you a link to sign enrollment papers online. When you sign, we record the name you type and the consent wording you agreed to. We also record your IP address and browser, and your drawn signature if you add one. You can print, sign and upload the papers instead.

Our office may also email you a link to pay an invoice. You pay on our site through Stripe, without signing in.

Our staff may also send you a link to read or sign another document on our site. Each time you open a document to read, we record the time, your IP address and your browser. When you sign one, we record the name you type, your IP address and browser, and your drawn signature if you add one.

Signing in

Parents sign in with a link we email them. When you ask for one, we keep the email address you typed and your IP address. When you use the link, we note your IP address again. The link works once, for 15 minutes. If you ask on our sign-in page, the email also has a 6-digit code you can type there instead. The code works for the same 15 minutes, and using the link or the code ends both.

Students and staff sign in with a school Microsoft 365 account.

Once you’re signed in, a cookie keeps you signed in until you go 30 days without using the site. Staff are signed out 24 hours after they sign in.

When a student enrolls, we create a school Microsoft 365 account in their name, as part of the enrollment their parent asks for. Microsoft runs the account for us. What the student writes or saves in it, like email and files, stays in our Microsoft 365 system. We email the sign-in name and a first password to the student and to the parents. If our office resets the password, we email the new one the same way.

The first password works only once. The student has to choose a new one the first time they sign in, and then we clear the first one from the student’s record. To see when that happens, we check the student’s account in Microsoft 365. We keep a copy of the emails that carried the password, with the password taken out, and our mailbox keeps no copy of them (see “Emails from us”).

The parent portal

Once you’re signed in, you can see your student’s information and update some of it. You can keep your own contact details and email addresses up to date, and ask us to add another parent or guardian. The portal also lets you pay bills, message us, request a meeting, book parent-teacher conferences and add a child.

You can give us more information there too, such as:

  • health details: allergies, medications, conditions, diet, blood type, immunizations, the student’s doctor and health insurance
  • accommodations, including an IEP or 504 plan
  • a financial aid request
  • citizenship, visa, I-20 and passport details, for international students
  • documents you upload

We also keep the records our teachers and office make about a student’s classes, like schedules and grades. Parents can see many of them in the portal.

The student portal

Students sign in to our student portal with their school account. There they can:

  • see their schedule and grades
  • ask us to update their own details, or their parents’ contact details
  • request a meeting
  • do the work for any online course we’ve set up

We keep what they send us. In an online course, we also keep their answers, their progress and how much of each video they watch.

When you buy from our store

Ordering opens soon. This is how it will work.

Our store is the Books page. It sells books from Floating Island Productions, and you pick up your order at the Saturday Art Institute.

Before you pay, we confirm who’s buying:

  • If you’re signed in, we use your account.
  • If you enter a PCI school email address, you sign in with Microsoft 365.
  • For any other address, we email a link to it. The link works once, for 60 minutes. If the address is already on file with us, the email lets you pick who’s buying.
  • If we don’t know the address, or you pick “None of these is me” in that email, we set up a buyer account for it.

A buyer account holds the email address, a name and a note of how and when we confirmed the address. If you picked “None of these is me”, it notes that too. It holds a phone number only if you give one to our office. It has no password, can’t be used to sign in and has no portal, so keep your emailed receipts. It keeps your orders together.

If you buy in person, our staff can enter your email address and name so we can send you a receipt.

If you later become a PCI family, your earlier orders join your family account the next time you confirm the same email address at checkout and pick your own name. That only happens when the address belongs to just one person in our records. If more than one person uses it, our office can link the orders for you instead. Orders you made in person are linked only by our office. We never link orders just because an email address matches.

For each order we keep:

  • what you bought, the price, tax and any card fee, and how you paid
  • how we confirmed who you are
  • the pickup details you give us: the name of anyone picking up for you, their email address and any note
  • who collected the order, and which staff member recorded it

We email you a link to pay, a receipt, and a notice if we cancel or refund anything. We also email you when your order is ready, and once more if it isn’t picked up. If you gave us an email address for the person picking up, they get those two emails as well. Those emails show the pickup name but no payment details.

If you’re a PCI parent, your orders show in the parent portal. If a student buys while signed in, or picks their own name in our email, a parent who can see that student’s billing can see the order too. When HBA families buy our books, they buy as PCI customers, so those orders are only in our records.

Payments

Payments on this site go through Stripe, into our own Stripe account. Card and bank details you enter on our payment pages go straight to Stripe and never reach our servers. We send Stripe the amount and a description of what it’s for. For applications, invoices and automatic payments, we may also send your email address, so Stripe can email you a receipt.

We keep a record of each payment: the amount, what it paid for, the payer’s email address and Stripe’s reference number for it. For a payment our office records by hand, like a check, we keep the method and a reference. If you set up automatic payments, Stripe keeps your card or bank account on file under your name and email address. We keep Stripe’s reference numbers for them, the card brand or bank name and the last four digits.

Stripe may offer to save your payment details with Link, its own service. If you use it, Stripe handles that under its own privacy policy. For store orders, Stripe doesn’t send you its own receipt. We send the receipt.

Emails from us

We send email from our own PCI addresses through Microsoft 365. We keep a log of the emails we send: who they went to, the subject and whether they went through. For the automatic emails we send families, we also keep a copy of the email. We delete the log and those copies after one year. A copy of most emails we send also stays in the Microsoft 365 mailbox it was sent from, like any other sent email. An email that carries a password, a sign-in code or a private link keeps no copy there, and the copy we keep has that part taken out.

If an email to you bounces, we note it so we can fix the address. The emails this site sends don’t track whether you open them.

Our marketing emails have an unsubscribe link. Use it and we’ll stop sending them to you.

Jobs

Our jobs page has no form. If you apply by email or on Discord, we keep what you send us so we can consider you. It stays in our email or on Discord, like any other message.

When you visit our site

  • Our website host, Vercel, handles every visit. It sees your IP address, the page you asked for and your browser type. Vercel decides how long it keeps logs of these requests. These logs can also show an email address, for example when you email our office.
  • We use Vercel Web Analytics and Speed Insights to count page views and see how fast our pages load. Our site tells them which page you viewed. Vercel also records the page you came from, your device type, browser, operating system and general location. Vercel says it counts visitors without using cookies.
  • Our forms use Cloudflare Turnstile to check that a real person is filling them in. It looks at your browser and device to decide.
  • To stop spam and misuse, we count how often our forms are sent from each IP address and each email address. Most counts are saved along with the address itself. The counts behind sign-in hold a scrambled code in place of your email address.
  • If something on the site breaks, we log what went wrong, the page it happened on and which record it involved, so we can fix it.

How we use it

We use what we collect to:

  • answer your questions, and set up a tour if you ask for one
  • review applications and enroll students
  • set up students’ school accounts and run our classes
  • look after students’ health and safety, and support students who need accommodations
  • consider financial aid requests
  • bill you, take payments and have your orders ready for pickup
  • email you about applications, your student and your orders, and send news about our programs
  • keep financial records, and a record of what was signed and when
  • see which pages are used and how fast they load
  • keep the site working and stop spam and fraud

We don’t sell your information or share it for advertising, and we don’t give it to anyone for their own marketing.

Who else handles it

We use these services to run the site, and each one handles some of your information:

  • Vercel hosts the site and counts page views for us.
  • Supabase stores our database and the files you upload.
  • Microsoft 365 runs our email and students’ school accounts, and holds a copy of our weekly backups.
  • Stripe handles payments.
  • Cloudflare runs the check on our forms.
  • Discord is where the site posts error alerts for the people who keep it running.
  • Contemplanda makes the software this site runs on. Its one support account can sign in to fix problems, and our error reports go to its support team. For online courses that use Contemplanda’s lessons, its course tools can show our teachers each student’s name and progress.

Our accountants and lawyers see the records they need to help us run the business, like payment records, and keep them confidential.

We may also share information:

  • when the law requires it
  • to protect someone’s safety, like telling paramedics about a student’s allergy
  • with someone you choose, like the person picking up your order
  • with a new owner, if PCI is ever sold or merged

PCI, HBA and Contemplanda Direct

PCI and HBA are separate schools, and each keeps its own database. We share some information with HBA, and with Contemplanda Direct:

  • One Microsoft 365 setup. Our email, our students’ school accounts and a copy of our weekly backups are in the same Microsoft 365 setup as HBA’s. HBA runs it for both schools.
  • Checking for duplicates. Either school can ask the other, “Do you already know this family?” It asks when you submit an application, and again before a card is charged or a student’s school account is made. It sends the parents’ email addresses and phone numbers, and the student’s name, date of birth and email address. The answer says whether it knows your family and which detail matched, and gives the student’s existing school sign-in name if there is one. If the other school already knows your family, it may email you a link to sign in there. This keeps a student from ending up with two accounts.
  • HBA credit. Students can choose to earn high school credit through HBA for some of our courses, like the Art Institute. If a student does, we send HBA the course, term, grade and credits once the grade is final. We include the student’s school account ID so HBA can match the student. HBA then holds that credit under its own privacy policy.
  • Signing up through HBA. HBA’s application form can also sign a student up for our Art Institute. If you do, HBA sends us your application details for our program and the IP address you applied from. If you also sign up for HBA courses on the same form, HBA may send us the student’s HBA school sign-in name. You pay PCI directly.
  • Family contacts from HBA. For a student who studies with both schools, we may copy the family’s contact details from HBA’s records.
  • Contemplanda Direct. Contemplanda Direct is a private instruction program run by Contemplanda, the company that makes our software. It can ask us the same duplicate question. If a student studies with both of us, Direct can copy that family’s contact details from our records, including how each parent is linked to the student. That way Direct can email the family about that student’s classes. It can also look up a student by email address: their name, grade, graduation year, school account ID and whether they’re still enrolled. It can see which emails we’ve sent that family, and ask us to send one of them again. It doesn’t use our records for marketing.

These requests go straight between our servers and theirs. Each side only answers the ones it has approved in advance.

Cookies and your browser

If you only read the site, our site doesn’t set any cookies. We set cookies when you:

  • sign in: one keeps you signed in, and a few short-lived ones protect the sign-in itself
  • add something to your store cart: a cookie keeps your cart for 7 days after your last change
  • check out: a cookie keeps your checkout open until you pay, for 60 minutes at most
  • pick a view in the portal, like a schedule view, which we remember for up to 180 days

Our cookies only work on this site. You can block or clear cookies in your browser, but then you can’t sign in or check out.

Some things are kept only in your browser, on your device:

  • your light or dark setting
  • your application, until you save or submit it (see “When you apply”)
  • your progress in our Microsoft 365 setup guide
  • a signature while you’re drawing it

Stripe may set its own cookies on our application and payment pages. Cloudflare may do the same on pages with forms.

Tracking and Do Not Track

Other companies may collect information about your online activity over time and across different websites when you use our site. We don’t use advertising or ad-tracking tools. Some outside services can still see your visit:

  • Stripe and Cloudflare collect details about your browser and device to fight fraud and bots. They may use those details on other sites that use their tools too.
  • Stripe’s code can start loading as soon as you open our application page or a payment page, before you pay.
  • If you use Stripe’s Link, Stripe can recognize you when you pay on other sites that use it.
  • Our printable flyers page may connect your browser to Google’s font service, so Google may see your IP address.
  • Some lessons in our online courses may play videos from YouTube. When one loads or plays, YouTube can see your IP address and browser.

Other sites we link to, like YouTube, have their own privacy policies.

Some browsers send a “Do Not Track” signal. Our site doesn’t change anything when it gets one.

How long we keep it

  • Store orders, payments and refunds: kept, because they’re financial records. That includes buyer accounts and the pickup details on each order.
  • Applications, parent accounts and student records: kept. Once a student is enrolled and paid in full, the application becomes part of the student’s billing record.
  • Signed papers, and records of signing or of opening a shared document: kept.
  • Contact messages and unfinished applications: kept until our office deletes them. The link to finish an application stops working 30 days after you last save.
  • Emails between you and our office about an inquiry or application: kept with the inquiry or application.
  • Sign-in link requests, and the counts we use to stop spam on our forms: these hold email addresses and IP addresses. Right now we don’t delete them on a schedule. The counts behind sign-in hold a scrambled code in place of your email address, and we delete them within about 2 weeks.
  • Store carts: deleted after they expire, unless an order from the cart is still waiting on payment. The store’s emailed link is deleted with its cart. The counts behind the store’s emailed links and checkout are deleted within about 2 weeks, and they hold a scrambled code in place of your email address.
  • Our log of sent emails, and the copies kept with it: one year. The sent copies in our Microsoft 365 mailboxes are kept like any other email.
  • Error records: 180 days. We keep the few that flag a problem in our school records, so we can show it was checked. Alerts posted to Discord stay there until we delete them.
  • Records of changes our staff make: kept, so we can see who changed what.
  • Backups: we back up our database every week and keep each weekly copy for about 4 months. One copy stays with our database service and one goes to Microsoft 365. When we remove an old copy there, it can stay in the recycle bin for up to 93 more days. Our database service may also keep backups of its own. So something we delete can stay in a backup for up to about 7 months. It can also stay in any full copy of our records we export for safekeeping.

Children and parents

Math Kangaroo has levels from first grade up, and AMC 8 and MATHCOUNTS are middle school contests. We teach prep for all three, so some of our students may be under 13. Our forms are for parents and guardians, and every application needs at least one.

When a student enrolls, we create their school Microsoft 365 account as part of the enrollment their parent asks for (see “Signing in”). Students can also use our student portal (see “The student portal”). Students can’t post anything publicly on our site.

Our store is for parents and other adults, and for students 13 and older. A student under 13 can’t check out as themselves. A parent buys for them.

A parent can ask to see what we have about their child, ask us to delete it, or tell us to stop collecting more. Email info@pacificcrestinstitute.com. We keep the records we have to keep, like payments and final grades. Everything else about a child follows the times in “How long we keep it”.

If we learn that a child under 13 gave us personal information on this site without a parent, we’ll delete it. If it’s part of a record we have to keep, like a payment, we’ll take the child’s details off it.

How to see, fix or delete your information

Email info@pacificcrestinstitute.com or call (858) 888-3156 to ask what we have about you or your student. You can also ask us to fix something that’s wrong, or to delete something. We may need to check who you are first. If you have a parent account, you can update your own contact details and your student’s details yourself in the parent portal.

We can delete some things, like a contact message, or an application that has no payments or signed papers. Some things we keep even if you ask:

  • Orders, payments and refunds. These are financial records. If something on an order is wrong, our office fixes it. They can link or unlink your buyer account and your family account, swap an item, or cancel or refund the order. The order’s history stays on record.
  • Applications with payments or signed papers. They’re our record of what was paid and agreed to.
  • Student records. Schedules, grades and any credit we’ve already sent to HBA.
  • Records of changes our staff make. They show who changed what.
  • Backups. Something we delete can stay in a backup for up to about 7 months.

Other records follow the times in “How long we keep it”.

To stop marketing emails, use the unsubscribe link in any of them, or turn them off in the parent portal.

Security

Card and bank details go straight to Stripe, and files you upload are kept in private storage. Please don’t email us card numbers or passport scans, since email isn’t a safe way to send them.

Changes to this page

When we change this page, we post the new version here and update the date at the top. For a big change, we’ll also email current families.

If you have a question about this page, email info@pacificcrestinstitute.com.