Terms of Service

1. Definitions

In addition to terms defined elsewhere in this agreement:

• "Authorized Users" means individuals designated by Customer (typically district employees, administrators, and authorized contractors) who are permitted to access the Service.
• "Customer Data" means: (a) Scanned Content, (b) Customer's policy documents and configuration inputs, (c) Findings and reports generated from Customer's scans, and (d) Authorized User account information.
• "Documentation" means the user guides, support articles, and other materials published by SchoolScan describing the use and features of the Service.
• "Findings" means privacy compliance results generated by the Service, including severity ratings, locations, classifications, and recommended remediation guidance.
• "Order Form" means a written or electronic order, renewal, or statement of work that references these Terms and specifies the Service purchased, pricing, term, and other commercial details.
• "Scanned Content" means publicly accessible web content (including HTML pages, documents, images, spreadsheets, metadata, and similar materials) that Customer directs the Service to crawl and analyze.
• "Service" means the SchoolScan privacy compliance monitoring platform, including all features, APIs, dashboards, reports, and related services made available by SchoolScan under an Order Form.
• "Student Data" means personally identifiable information from student education records that is present in Scanned Content or Findings.

2. The Service

The Service enables Customers to monitor their publicly accessible web presence for privacy compliance issues affecting student information. Features include:

• Scheduled and on-demand crawling of Customer-designated public URLs
• AI-enhanced analysis of unstructured content (HTML, PDF, Word) and statistical analysis of tabular data (CSV, Excel)
• Policy-aware adjudication against Customer's uploaded privacy policies
• Expert review of critical and high-severity findings by SchoolScan privacy professionals
• Compliance dashboards, letter-grade scoring, prioritized review queues, and exportable reports

The Service is delivered over the internet as software-as-a-service. SchoolScan retains all rights not expressly granted in these Terms.

3. Accounts and Authorized Users

Customer is responsible for: (a) creating accounts only for Authorized Users who have a legitimate need to access the Service; (b) maintaining the confidentiality of login credentials; (c) promptly disabling accounts of personnel who no longer require access; and (d) all actions taken through Customer's accounts, whether or not authorized.

Customer must notify SchoolScan promptly at security@schoolscan.ai of any suspected unauthorized access to its account.

4. Access Rights and Restrictions

Subject to these Terms and payment of applicable fees, SchoolScan grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Service and Documentation during the subscription term, solely for Customer's internal educational and administrative operations.

Customer will not, and will not permit any third party to:

• Copy, modify, or create derivative works of the Service or Documentation
• Reverse engineer, decompile, or disassemble the Service, except as expressly permitted by applicable law
• Access or use the Service to build a competing product or to benchmark for competitive purposes
• Resell, rent, sublicense, or provide the Service as a service bureau to third parties outside the scope of Customer's educational mission
• Interfere with or disrupt the integrity or performance of the Service
• Circumvent any access controls, security features, or usage limits
• Scan any domain, property, or content that Customer does not own or is not otherwise authorized to scan

5. Acceptable Use

Customer will use the Service only for lawful purposes consistent with its educational mission. Customer will not use the Service to:

• Violate any law, regulation, or third-party right
• Target or scan websites, domains, or digital properties that Customer does not own or control, or for which Customer has not obtained all necessary authorizations
• Harass, surveil, or investigate individual students, families, staff, or other persons beyond what is necessary for legitimate privacy compliance purposes
• Use the Service in a manner that violates student privacy or civil rights
• Introduce malware, viruses, or other harmful code to the Service

SchoolScan reserves the right to investigate suspected violations of this Section and to take appropriate action, including suspension or termination.

6. Customer Data and Ownership

Customer owns Customer Data. Customer retains all right, title, and interest in and to Customer Data, including Findings generated from Customer's scans.

Customer grants SchoolScan a limited, non-exclusive, non-transferable, royalty-free license to access, process, store, transmit, display, and create derivative works of Customer Data solely as necessary to:

• Provide, maintain, support, and improve the Service for Customer
• Generate Findings and reports
• Comply with applicable law
• Enforce these Terms

This license terminates upon expiration or termination of Customer's subscription, except to the extent SchoolScan is legally required to retain certain records. SchoolScan will not use Customer Data for advertising, marketing to students, selling to third parties, or training of public or third-party AI models. See our Privacy Policy for details.

Customer represents that it has the necessary rights and authority to provide Customer Data to SchoolScan and to authorize the scanning of identified web properties, and that doing so will not violate applicable law or any third-party rights.

7. SchoolScan IP and License

SchoolScan and its licensors own and retain all right, title, and interest in and to the Service, the Documentation, all underlying software, algorithms, models, user interfaces, and all improvements, modifications, enhancements, and derivative works thereof (collectively, "SchoolScan IP"). No rights are granted to Customer other than those expressly set forth in these Terms.

SchoolScan may generate aggregated, de-identified, and anonymized data derived from use of the Service ("Service Analytics") that cannot reasonably be used to identify Customer, any Authorized User, or any student. SchoolScan may use Service Analytics to operate, secure, support, and improve its products and services.

8. Feedback

If Customer or its Authorized Users provide suggestions, comments, or ideas regarding the Service ("Feedback"), SchoolScan may use that Feedback without obligation or compensation. However, SchoolScan will not publicly attribute any Feedback to Customer or any individual without prior written consent.

9. Fees, Billing, and Taxes

Fees. Customer will pay the fees specified in the applicable Order Form. Except as expressly stated in these Terms or the Order Form, all fees are non-refundable.

Invoicing. Unless otherwise specified in an Order Form, SchoolScan will invoice annually in advance. Invoices are due within thirty (30) days of the invoice date.

Late Payment. Past-due amounts may accrue interest at the lesser of 1.0% per month or the maximum rate permitted by law. SchoolScan may suspend the Service for material non-payment after providing at least fifteen (15) days written notice.

Taxes. Fees are exclusive of applicable taxes (sales, use, VAT, and similar). Customer is responsible for all such taxes other than taxes based on SchoolScan's net income. Public school districts that are tax-exempt must provide valid exemption certification.

Disputes. If Customer disputes an invoice in good faith, Customer must notify SchoolScan within thirty (30) days of the invoice date. The parties will work together in good faith to resolve the dispute.

10. Term, Renewal, and Termination

Term. The subscription term is specified in the Order Form (typically annual). Unless either party provides written notice of non-renewal at least thirty (30) days before the end of the current term, the subscription will renew automatically for successive periods of equal length at SchoolScan's then-current rates.

Termination for Cause. Either party may terminate for material breach if the breach is not cured within thirty (30) days of written notice. Either party may terminate immediately upon the other party's insolvency, bankruptcy, or similar proceeding.

Termination for Convenience by Customer. Customer may terminate mid-term where required by public procurement law (including non-appropriation of funds by its governing body), provided Customer gives SchoolScan prompt written notice. Customer remains responsible for fees accrued through the effective date of termination.

Effect of Termination. Upon termination or expiration:

• Customer's right to access the Service ends
• Customer may export its Findings and reports for thirty (30) days following termination
• SchoolScan will delete Customer Data in accordance with its Privacy Policy and applicable agreements
• Each party will return or destroy the other party's Confidential Information upon request

Survival. The following sections survive termination: 6 (Customer Data and Ownership) to the extent applicable, 7 (SchoolScan IP), 9 (Fees) for amounts accrued, 17 (Confidentiality), 19 (Disclaimers), 20 (Indemnification), 21 (Limitation of Liability), 25 (Governing Law and Disputes), and 27 (General Provisions).

11. Suspension

SchoolScan may suspend Customer's access to the Service if: (a) Customer's use poses an imminent security risk to the Service or other customers; (b) Customer materially breaches these Terms and does not cure promptly after notice; or (c) Customer's account is more than thirty (30) days past due. SchoolScan will use reasonable efforts to notify Customer prior to suspension and will restore access promptly after the cause of suspension is resolved.

12. Privacy and Student Data

SchoolScan's handling of Customer Data, including Student Data, is governed by the SchoolScan Privacy Policy. Where Customer and SchoolScan have entered into a separate Data Privacy Agreement, Data Protection Addendum, or Student Data Protection Addendum (together, a "DPA"), the terms of that DPA control over any conflicting provisions of these Terms with respect to the handling of personal information.

In its capacity processing Student Data, SchoolScan acts as a "school official" with a "legitimate educational interest" under the Family Educational Rights and Privacy Act (FERPA), and complies with applicable state student privacy laws. SchoolScan will:

• Use Student Data only to provide the Service and only as authorized by Customer
• Not sell Student Data or use it for targeted advertising
• Not use Student Data to train public or third-party AI models
• Maintain reasonable security safeguards
• Return or destroy Student Data upon termination or Customer request

13. Security

SchoolScan maintains a written information security program that includes administrative, physical, and technical safeguards appropriate to the sensitivity of Customer Data. These safeguards include encryption in transit and at rest, access controls, least-privilege principles, personnel training, and incident response procedures. See the Security section of our Privacy Policy for additional detail.

Customer is responsible for security on its side of the connection, including protecting Authorized User credentials and managing access by its personnel.

14. Subprocessors

SchoolScan engages third-party subprocessors (such as cloud infrastructure providers and AI model providers) to deliver the Service. Each subprocessor is bound by a written agreement imposing data protection obligations that are, in the aggregate, no less protective than those in these Terms. A current list of subprocessors is available on request. Where required by an applicable DPA, SchoolScan will provide advance notice of new subprocessors.

15. Service Availability and Support

Availability. SchoolScan will use commercially reasonable efforts to make the Service available 24/7, excluding: (a) scheduled maintenance announced in advance; (b) emergency maintenance; and (c) downtime caused by factors outside SchoolScan's reasonable control. Where an Order Form specifies a service level agreement (SLA), that SLA controls.

Support. SchoolScan provides standard email support to Authorized Users during U.S. business hours. Premium support and dedicated privacy-professional engagement may be available under an Order Form.

16. Changes to the Service

SchoolScan continuously improves the Service. We may modify, add, or remove features during a subscription term. We will not materially reduce the core functionality of the Service during a subscription term without providing advance notice and, where such a reduction would materially diminish the value of the Service, offering Customer a pro-rata refund of prepaid fees for the affected period.

17. Confidentiality

"Confidential Information" means non-public information disclosed by one party to the other that is marked confidential or that would reasonably be understood to be confidential given its nature and the circumstances of disclosure. Customer Data is Confidential Information of Customer. The Service, Documentation, pricing, and non-public technical and business information about SchoolScan are Confidential Information of SchoolScan.

The receiving party will: (a) use Confidential Information only to perform its obligations and exercise its rights under these Terms; (b) protect Confidential Information using at least the same degree of care it uses to protect its own similar information, but no less than reasonable care; and (c) disclose Confidential Information only to employees, contractors, and advisors who have a need to know and who are bound by confidentiality obligations.

Confidential Information does not include information that: (i) is or becomes publicly available through no breach of these Terms; (ii) was known to the receiving party before disclosure; (iii) is independently developed without use of the other party's Confidential Information; or (iv) is rightfully received from a third party without a duty of confidentiality.

If the receiving party is legally compelled to disclose Confidential Information, it will provide prompt notice to the disclosing party (where legally permitted) so the disclosing party may seek a protective order.

18. Warranties

Mutual. Each party represents and warrants that: (a) it has the legal power and authority to enter into these Terms; and (b) its performance will comply with applicable laws.

By SchoolScan. SchoolScan warrants that the Service will perform materially in accordance with the Documentation. As Customer's exclusive remedy and SchoolScan's entire liability for breach of this warranty, SchoolScan will use commercially reasonable efforts to correct the non-conformity. If SchoolScan is unable to restore materially conforming performance within a reasonable time, Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees for the unused portion of the term.

By Customer. Customer represents and warrants that it owns or has the right to authorize scanning of all domains and properties submitted to the Service.

19. Disclaimers

SchoolScan does not warrant that:

• The Service will detect every privacy compliance issue, violation, or exposure
• Findings will be free from false positives or false negatives
• The Service's use will result in regulatory compliance or prevent enforcement action
• The Service will be uninterrupted or error-free

The Service is a compliance monitoring tool intended to support, not replace, Customer's own privacy program, staff training, legal counsel, and institutional judgment. Findings are informational and require review by Customer personnel. SchoolScan is not a law firm and does not provide legal advice.

20. Indemnification

By SchoolScan. SchoolScan will defend Customer against any third-party claim alleging that the Service, as provided by SchoolScan and used within the scope of these Terms, infringes a valid U.S. patent, copyright, trademark, or trade secret of a third party, and will pay any damages finally awarded against Customer or agreed in settlement approved by SchoolScan.

If the Service becomes, or SchoolScan reasonably believes it may become, the subject of such a claim, SchoolScan may, at its option: (a) procure the right for Customer to continue using the Service; (b) modify the Service to be non-infringing while maintaining materially equivalent functionality; or (c) terminate the affected portion of the Service and refund prepaid unused fees. SchoolScan has no obligation for claims arising from: (i) use of the Service in violation of these Terms; (ii) combination of the Service with non-SchoolScan products not contemplated by the Documentation; (iii) modifications to the Service not made by SchoolScan; or (iv) Customer Data or content not supplied by SchoolScan.

By Customer. To the extent permitted by applicable law (including restrictions that apply to public entities), Customer will defend SchoolScan against any third-party claim arising from: (a) Customer Data, including claims that Customer Data infringes or violates third-party rights; (b) Customer's breach of Section 4 (Access Rights and Restrictions), Section 5 (Acceptable Use), or Section 6 (Customer Data and Ownership) representations; or (c) Customer's use of the Service in violation of law. Customer will pay damages finally awarded against SchoolScan or agreed in settlement approved by Customer.

Procedure. The indemnifying party's obligations are conditioned on the indemnified party: (i) giving prompt written notice of the claim; (ii) giving the indemnifying party sole control of the defense and settlement (provided no settlement imposing obligations on the indemnified party may be entered without its consent, not to be unreasonably withheld); and (iii) providing reasonable cooperation at the indemnifying party's expense.

This Section 20 states each party's sole and exclusive remedy for third-party infringement claims.

21. Limitation of Liability

The limitations in this Section 21 apply to the maximum extent permitted by law and reflect an allocation of risk between the parties. Pricing and other terms would be materially different without these limitations.

22. Compliance with Laws

Each party will comply with applicable laws in performing its obligations. Without limiting the foregoing, SchoolScan will comply with applicable student privacy laws in its provision of the Service, and Customer will comply with applicable laws in its use of the Service and in its notifications to parents and eligible students under FERPA.

23. Publicity

Neither party may use the other party's name, logo, or trademarks in publicity, marketing, or press releases without the other party's prior written consent. Customer may identify SchoolScan as a vendor to its board, auditors, and authorized officials without such consent.

24. Export and Sanctions

The Service is provided from the United States. Each party will comply with applicable export controls and economic sanctions laws. Customer represents that it is not on any U.S. government list of prohibited parties and will not use the Service in any jurisdiction subject to comprehensive U.S. sanctions.

25. Governing Law and Disputes

Governing Law. These Terms are governed by the laws of the State of Delaware, excluding its conflict-of-laws rules, except that public-entity Customers (including public school districts) may require application of the law of their home state to the extent mandated by applicable public procurement law.

Informal Resolution. Before initiating any formal proceeding, the parties will attempt to resolve disputes in good faith through senior-level discussions for at least thirty (30) days.

Venue. Subject to the foregoing, the parties consent to the exclusive jurisdiction of the state and federal courts located in Delaware for any disputes arising out of or relating to these Terms, except that SchoolScan may bring an action in any court of competent jurisdiction to protect its intellectual property rights or enforce payment obligations. To the extent permitted by applicable law (and subject to any mandatory law applicable to public-entity Customers), the parties waive any right to a jury trial.

Injunctive Relief. Breach of confidentiality or intellectual property provisions may cause irreparable harm for which monetary damages are insufficient. A non-breaching party may seek injunctive relief in any court of competent jurisdiction without posting bond.

26. Changes to These Terms

SchoolScan may update these Terms from time to time. For material changes, SchoolScan will provide at least thirty (30) days advance notice by email to the Customer administrator and by posting a notice in the Service. If Customer objects to a material change that reduces Customer's rights, Customer may terminate the affected Order Form by written notice within thirty (30) days of the announcement and receive a pro-rata refund of prepaid fees for the unused portion of the term. Customer's continued use of the Service after the effective date of the change constitutes acceptance of the updated Terms.

Changes to these Terms will not apply retroactively to matters occurring before the change's effective date.

27. General Provisions

Entire Agreement; Order of Precedence. These Terms, together with any Order Form, DPA, and the Privacy Policy, constitute the entire agreement between the parties regarding the subject matter and supersede all prior agreements on that subject. In the event of conflict, the order of precedence is: (1) the applicable DPA (for privacy matters only), (2) the Order Form, (3) these Terms, (4) the Privacy Policy, (5) the Documentation.

Independent Contractors. The parties are independent contractors. No partnership, joint venture, employment, or agency relationship is created.

No Third-Party Beneficiaries. There are no third-party beneficiaries to these Terms.

Assignment. Neither party may assign these Terms without the other party's prior written consent, except that either party may assign to an affiliate or to a successor in connection with a merger, acquisition, or sale of substantially all assets, provided the assignee assumes the assigning party's obligations.

Notices. Notices to SchoolScan must be sent to legal@schoolscan.ai. Notices to Customer may be sent to the administrator email on record for the account. Notices are deemed given one business day after transmission (for email) or three business days after mailing (for physical mail).

Force Majeure. Neither party will be liable for delays or failures due to events beyond its reasonable control, including natural disasters, labor disputes, internet or power outages, governmental actions, pandemics, or acts of war. The affected party will use reasonable efforts to mitigate the impact.

Severability. If any provision is held unenforceable, the remaining provisions remain in full force, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.

Waiver. No waiver is effective unless in writing. A waiver of any breach is not a waiver of any subsequent breach.

Government Users. The Service is a "Commercial Item" as defined at 48 C.F.R. § 2.101, consisting of "Commercial Computer Software" and "Commercial Computer Software Documentation." Use by U.S. government users is subject only to the rights granted in these Terms.

Headings. Section headings are for convenience and do not affect interpretation.

28. Contact

SchoolScan, Inc.

• General: hello@schoolscan.ai
• Legal and contract matters: legal@schoolscan.ai
• Privacy inquiries: privacy@schoolscan.ai
• Security reports: security@schoolscan.ai