GRADEBOX, INC.

1.1 Parties

These Terms of Service (“Terms”) constitute a legally binding agreement between Gradebox, Inc. (“Gradebox,” “we,” “us,” or “our”), a corporation headquartered in Arizona, and the educational institution, school district, or authorized individual (collectively, “School” or “you”) accessing or using the Gradebox platform, website, and associated services (collectively, the “Platform”).

1.2 Acceptance

By creating an account, accessing the Platform, signing a Pilot Memorandum of Understanding (“Pilot MOU”), or otherwise using Gradebox services, you represent that you have read, understood, and agree to be bound by these Terms and our Privacy Policy, which is incorporated herein by reference. If you are accepting these Terms on behalf of a school, school district, or other organization, you represent and warrant that you have authority to bind that entity to these Terms.

1.3 Key Definitions

• “Platform” — The Gradebox web application, mobile application, APIs, scanning workflow tools, and all associated services available at gradebox.ai.
• “School” — The educational institution, school district, charter school, or other authorized educational organization that has entered into these Terms.
• “Authorized User” — Any teacher, administrator, or other school employee authorized by the School to access and use the Platform.
• “Student Data” — Any personally identifiable information (PII) related to a student that is submitted to, processed by, or stored within the Platform, including but not limited to names, student ID numbers, assignment work product, academic performance data, and accommodation information.
• “Accommodation Data” — Instructional accommodation requirements derived from a student's Individualized Education Program (IEP) or Section 504 Plan. See Section 5 for specific handling provisions.
• “De-identified Data” — Data from which all personally identifiable information has been removed such that there is no reasonable basis to believe that the information alone, or in combination with other reasonably available information, could be used to identify an individual student, consistent with the de-identification standard set forth in 34 C.F.R. § 99.31(b) of the Family Educational Rights and Privacy Act (FERPA).
• “Aggregate Data” — Statistical or summary information derived from De-identified Data across multiple students, schools, or cohorts, used for purposes including but not limited to product improvement, instructional research, and curriculum development.
• “Sub-Processor” — Any third-party service provider engaged by Gradebox to process Student Data on Gradebox's behalf in connection with delivering the Platform.

2.1 Platform Overview

Gradebox is an educational technology platform designed to help teachers and school administrators digitize physical student assignments, deliver standards-based instructional feedback, track student progress, and facilitate communication with parents and guardians. Core features include, but are not limited to:

• Physical assignment capture and digitization via scanning workflow
• QR-code-based student assignment matching
• Optical character recognition (OCR) and AI-assisted analysis of student work
• Standards-aligned feedback generation
• Teacher and administrator dashboard tools
• Secure, view-only parent and guardian access
• Integration with Student Information Systems (SIS) and Learning Management Systems (LMS)

2.2 Authorized Users

Access to the Platform is limited to Authorized Users who are 18 years of age or older and are employed by or acting on behalf of the School. Students do not create accounts or directly submit information to Gradebox. Student Data enters the Platform through SIS/LMS integration or through direct entry by Authorized Users acting in their professional capacity on behalf of the School.

2.3 Authorized Use

The Platform may be used solely for lawful educational and instructional purposes. Authorized Users agree not to:

• Use the Platform for any purpose other than the educational activities of the School
• Attempt to circumvent or reverse-engineer any aspect of the Platform
• Upload content that is unlawful, harmful, or unrelated to educational activities
• Share account credentials with unauthorized individuals
• Use the Platform in any manner that would violate applicable law, including FERPA, COPPA, IDEA, or applicable state student data privacy laws

3.1 School as Data Controller

The School is the data controller with respect to all Student Data submitted to the Platform. Gradebox acts solely as a data processor, processing Student Data only as directed by the School and as described in these Terms. The School retains ownership of and responsibility for all Student Data at all times.

3.2 School Representations and Warranties

By using the Platform, the School represents and warrants that it:

• Has full authority to provide Student Data to Gradebox for the purposes described in these Terms
• Has provided all required notices to parents, guardians, and students under applicable law, including FERPA
• Has obtained any affirmative consents required by applicable law prior to submitting Student Data, including any data subject to the Children's Online Privacy Protection Act (COPPA)
• Has designated authorized personnel with appropriate access levels within the Platform
• Will promptly notify Gradebox of any suspected unauthorized access to the Platform or Student Data
• Will ensure that Authorized Users comply with these Terms and applicable law

3.3 School's Obligation to Verify Accuracy

The School is responsible for the accuracy and completeness of all Student Data submitted to the Platform through SIS/LMS integration or manual entry. Gradebox is not responsible for errors arising from inaccurate data submitted by the School.

4.1 FERPA Compliance

Gradebox acknowledges that Student Data submitted to the Platform may constitute “education records” as defined by FERPA, 20 U.S.C. § 1232g. As a data processor acting on behalf of the School in its capacity as an authorized school official with a legitimate educational interest, Gradebox:

• Will access and process Student Data only as directed by the School and only to the extent necessary to provide the Platform services
• Will not disclose Student Data to any third party except as set forth in these Terms or as required by law
• Will maintain Student Data in a secure environment with access controls limiting access to personnel who have a need to access such data to fulfill Gradebox's obligations under these Terms
• Will support the School in fulfilling its obligations to respond to parent, guardian, and student requests for access to and correction of education records

4.2 COPPA

The Platform is not directed at children under 13 years of age, and children under 13 do not create accounts or directly interact with the Platform. Student Data pertaining to children under 13 is submitted to the Platform solely by Authorized Users acting on behalf of the School. The School, as the operator of the educational environment, is responsible for obtaining any parental consent required under COPPA prior to directing Gradebox to process data pertaining to students under 13. Gradebox does not use Student Data pertaining to children under 13 for any commercial purpose or for behavioral advertising.

4.3 IDEA and Section 504

Gradebox acknowledges that Student Data may include information derived from Individualized Education Programs (IEPs) or Section 504 Plans. The handling of such information is subject to the heightened protections described in Section 5 of these Terms and applicable provisions of the Individuals with Disabilities Education Act (IDEA), 20 U.S.C. § 1400 et seq., Section 504 of the Rehabilitation Act of 1973, and FERPA.

4.4 State Student Data Privacy Laws

Gradebox is designed to comply with applicable state student data privacy laws, including but not limited to the Student Online Personal Information Protection Act (SOPIPA) as adopted in applicable jurisdictions and Arizona Revised Statutes § 15-140. Where state law imposes obligations beyond those required by federal law, Gradebox will apply the more protective standard. Schools in states with additional or more restrictive requirements should contact Gradebox to discuss any applicable modifications to data handling practices.

4.5 Prohibition on Commercial Use of Student Data

Gradebox will not:

• Sell Student Data
• Use Student Data for targeted advertising or behavioral profiling of students
• Use Student Data to build profiles of students for purposes unrelated to the educational services described in these Terms
• Disclose Student Data to third parties for commercial purposes

5.1 Accommodation-Only Logging

Gradebox does not store or retain IEP or Section 504 source documents or records in any form. When a student's accommodation information is submitted to the Platform — whether through SIS/LMS integration or manual entry by an Authorized User — Gradebox ingests only the specific instructional accommodations applicable to that student (e.g., extended time, preferential seating, read-aloud requirements). The underlying source record or document is deleted immediately upon ingestion and is not retained in any Gradebox system, including backups, after the deletion process is complete.

5.2 Permissible Use of Accommodation Data

Accommodation Data logged within the Platform is used solely to:

• Inform AI-generated feedback so that it reflects the student's applicable instructional accommodations
• Assist Authorized Users in delivering appropriate, differentiated instruction
• Support compliance with the student's IEP or 504 Plan as implemented by the School

5.3 No Accommodation Data in Aggregate or De-identified Sets

Accommodation Data — even in de-identified or aggregated form — will not be used in Aggregate Data analysis, product training, or any external disclosure without explicit written consent from the School. Gradebox treats the existence of accommodation requirements as sensitive information and will not use it in any manner beyond the purposes described in Section 5.2.

5.4 School Responsibility for Accuracy

The School is responsible for ensuring that accommodation information entered into the Platform accurately reflects the student's current IEP or 504 Plan. Gradebox is not responsible for educational outcomes resulting from inaccurate accommodation data submitted by Authorized Users.

6.1 Permitted Use of Aggregate Data

Gradebox may use De-identified Data that meets the FERPA de-identification standard (34 C.F.R. § 99.31(b)) to generate Aggregate Data for the following purposes:

• Improving the accuracy and quality of the Platform's AI-generated feedback
• Developing and refining instructional strategies and curriculum recommendations
• Building and improving targeted intervention strategies for remediation and enrichment
• Research and analysis related to educational outcomes and instructional effectiveness
• Internal product development and quality assurance

6.2 De-identification Standard

Before any data is used for purposes described in Section 6.1, Gradebox applies the FERPA de-identification standard: Gradebox must have no reasonable basis to believe that the data, alone or in combination with other reasonably available information, could be used to identify an individual student. Gradebox maintains reasonable administrative, technical, and physical safeguards against the re-identification of De-identified Data.

6.3 No Individual Disclosure

Gradebox will not disclose individual Student Data — whether identified, partially de-identified, or pseudonymized — to any third party for any purpose other than as expressly set forth in these Terms or as required by applicable law.

6.4 Research Partnerships

If Gradebox enters into research partnerships or data-sharing arrangements with educational institutions, curriculum developers, or research organizations, any data shared will be in Aggregate Data form only, will comply with the de-identification standard described above, and will be disclosed only pursuant to a written agreement consistent with FERPA and applicable law. Individual schools will be notified of the general nature of any such arrangements upon request.

7.1 Default: Model Training Off

By default, Student Data submitted to the Platform is not used to train, fine-tune, or otherwise improve Gradebox's underlying AI models or any third-party AI models. This default applies unless the School expressly opts in to model training as described in Section 7.2.

7.2 Optional Opt-In

Schools and Authorized Users may choose to enable model training at the school or classroom level through the Platform's administrative settings. By enabling model training, the School:

• Expressly authorizes Gradebox to use Student Data submitted during the opted-in period as training data for the Platform's AI models
• Represents that it has the legal authority to grant this authorization under applicable law, including FERPA
• Acknowledges that data used for training will first be de-identified to the extent practicable before being incorporated into training pipelines

7.3 Withdrawal of Consent

A School or Authorized User may disable model training at any time through the Platform's administrative settings. Disabling model training will prevent future Student Data from being used for training purposes. Student Data already incorporated into a trained model cannot be retroactively removed from that model's weights; however, Gradebox will not use identifiable Student Data collected after consent is withdrawn for any new training activities.

7.4 Accommodation Data Excluded

Notwithstanding any opt-in election, Accommodation Data as defined in Section 1.3 and described in Section 5 is permanently excluded from model training activities and will not be used for AI training under any circumstances.

7.5 No Third-Party Model Training

Gradebox will not permit any third-party AI provider, sub-processor, or partner to use Student Data for the purpose of training their own AI models. Any AI model training described in this Section refers solely to Gradebox's own proprietary models and internal product development.

8.1 Integration Authorization

By connecting the Platform to a Student Information System (SIS) or Learning Management System (LMS), the School authorizes Gradebox to access and import the specific data fields necessary to operate the Platform, including student roster data, grade level, course enrollment, and accommodation flags as configured by the School.

8.2 Scope of Data Import

Gradebox will import only the data fields expressly authorized by the School's administrative configuration. The School controls the scope of data shared via integration. Gradebox will not access data fields beyond what is necessary for the Platform's educational functionality.

8.3 Data Freshness and Accuracy

Student Data imported through SIS/LMS integration reflects the state of the School's systems at the time of sync. The School is responsible for maintaining accurate records in its SIS/LMS. Gradebox will refresh integration data at the frequency configured by the School and is not responsible for discrepancies arising from delays in source system updates.

8.4 Manual Entry

In addition to automated integration, Authorized Users may manually enter or update Student Data, including accommodation information, directly within the Platform. Manually entered data is subject to all provisions of these Terms applicable to Student Data.

9.1 View-Only Access

Gradebox provides parents and guardians with secure, view-only access to their child's submitted assignments and associated feedback. Parents and guardians do not create Platform accounts. Access is provided through a secure link delivered to the parent or guardian by the School, combined with PIN-based or two-factor authentication (2FA) verification required at each access session.

9.2 Authentication

Each parent or guardian access session requires fresh authentication. Gradebox generates access credentials and delivers them in a manner configured by the School. Persistent authenticated sessions are not maintained for parent and guardian access. The School is responsible for delivering access credentials to the appropriate parent or guardian and ensuring that access is not extended to unauthorized individuals.

9.3 Scope of Parent Access

Parents and guardians may only view:

• Their own child's submitted assignments
• Feedback and scores associated with their own child's work
• Assignment-specific information provided by the teacher

Parents and guardians may not view other students' data, modify any records, download Platform content, or take any action other than viewing the information presented to them within their authenticated session.

9.4 FERPA Parent Rights

FERPA grants parents and eligible students the right to inspect and review education records. Parent access through the Platform is designed to support, not replace, the School's FERPA compliance obligations. Where a parent or guardian requests access to records beyond what is available through the Platform's view-only portal, such requests should be directed to the School, which retains primary responsibility for FERPA compliance.

10.1 Use of Sub-Processors

Gradebox engages third-party sub-processors to deliver certain components of the Platform. All sub-processors are contractually bound to process Student Data only as directed by Gradebox, maintain appropriate security measures, and comply with applicable data protection law. Gradebox remains responsible for the acts and omissions of its sub-processors with respect to Student Data processing.

10.2 Sub-Processor List

Gradebox maintains a current list of sub-processors that may process Student Data. The current sub-processors include, but are not limited to:

• Google Cloud Platform (including Google Cloud OCR and Gemini API) — AI processing, OCR, and infrastructure
• Firebase — Application data storage and authentication
• Netlify — Web hosting and delivery

Gradebox has executed a Data Processing Addendum with Google Cloud covering Google Cloud Platform services. Gradebox will maintain a current and complete sub-processor list and will make it available to Schools upon request. Schools may subscribe to receive notification of material changes to the sub-processor list.

10.3 New Sub-Processors

Gradebox will provide Schools with at least thirty (30) days' advance written notice before adding a new sub-processor that will process Student Data. If a School objects to a new sub-processor on reasonable data protection grounds, the parties will work in good faith to address the concern. If the concern cannot be resolved, the School may terminate these Terms without penalty upon written notice within the notice period.

10.4 No Sale to Sub-Processors

No sub-processor will receive Student Data for their own commercial purposes. Sub-processors receive Student Data only to the extent necessary to perform services for Gradebox in connection with the Platform.

11.1 Nature of AI-Generated Feedback

The Platform uses artificial intelligence, including large language models and optical character recognition, to analyze student work and generate instructional feedback. AI-generated feedback is intended to assist Authorized Users in their professional judgment — it is a support tool, not a definitive academic evaluation.

11.2 Human Review Responsibility

All final decisions regarding student grades, academic standing, disciplinary action, placement, or any determination that materially affects a student remain the sole responsibility of the School and its Authorized Users. Gradebox AI outputs are advisory only. No automated decision-making by Gradebox will have a legally significant effect on a student without human review by an Authorized User.

11.3 Accuracy Disclaimer

OCR and AI analysis of handwritten or printed student work may contain errors. The accuracy of AI-generated feedback depends on the quality of assignment capture, the legibility of student work, and the completeness of assignment context provided by the Authorized User. Gradebox does not warrant that AI-generated feedback is error-free, complete, or appropriate for every student or assignment type.

11.4 Accommodation-Aware Feedback

Where Accommodation Data is present in the Platform for a given student, the Platform's AI feedback generation will take applicable accommodations into account. The School remains responsible for verifying that accommodation-aware feedback is appropriate for each individual student.

12.1 Security Standards

Gradebox implements and maintains reasonable and appropriate administrative, technical, and physical security measures to protect Student Data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of Student Data in transit using TLS 1.2 or higher
• Encryption of Student Data at rest
• Role-based access controls limiting Platform access to Authorized Users and Gradebox personnel with a legitimate need
• Regular security assessments and vulnerability testing
• Access logging and audit trails

12.2 School Security Obligations

The School is responsible for maintaining the security of its account credentials and ensuring that access to the Platform is limited to Authorized Users. The School will promptly notify Gradebox at privacy@gradebox.ai if the School becomes aware of any unauthorized access to or use of Platform credentials or Student Data.

12.3 Security Incident Notification

In the event of a confirmed security incident involving unauthorized access to or disclosure of Student Data, Gradebox will:

• Notify the School without unreasonable delay and in any event within seventy-two (72) hours of confirming the incident
• Provide the School with reasonably available information about the nature, scope, and impact of the incident
• Cooperate with the School in its breach notification obligations under applicable law
• Take reasonable steps to contain and remediate the incident

The School retains primary responsibility for notifying parents, guardians, and regulators as required by applicable state and federal breach notification law.

13.1 Retention During Active Use

Gradebox retains Student Data for the duration of the School's active subscription or Pilot MOU. At the end of each academic year, Gradebox will provide Schools with the option to archive, export, or delete student records from the prior academic year consistent with the School's data governance policies.

13.2 Deletion Upon Termination

Upon termination or expiration of these Terms or a Pilot MOU, Gradebox will, within sixty (60) days, delete or return to the School all Student Data in Gradebox's possession, unless a longer retention period is required by applicable law. The School may request written confirmation of deletion upon completion of this process.

13.3 IEP/504 Source Record Deletion

As described in Section 5.1, IEP and Section 504 source records are deleted immediately upon ingestion. Accommodation Data logs are retained only as long as the student's record is active within the Platform and are deleted in accordance with Section 13.2 upon termination or upon the School's request.

13.4 Backup Retention

Gradebox maintains system backups for operational continuity. Student Data present in backups at the time of a deletion request will be purged from backup systems within ninety (90) days consistent with Gradebox's backup rotation schedule.

13.5 School-Initiated Deletion

The School may submit a written request to privacy@gradebox.ai to delete specific student records or all Student Data at any time. Gradebox will complete deletion of identified records within thirty (30) days of a verified request, except where retention is required by law.

13.6 Aggregate Data

De-identified Aggregate Data generated from Student Data prior to deletion is not subject to deletion obligations, provided it meets the de-identification standard described in Section 6.2 and cannot reasonably be reverse-engineered to identify individual students.

14.1 Student Work

Student work product uploaded to or captured by the Platform remains the property of the student and the School. Gradebox claims no ownership interest in student work product.

14.2 Teacher and School Content

Assignment rubrics, instructional prompts, grading criteria, and other content created by Authorized Users within the Platform remain the intellectual property of the creating Authorized User or the School, as determined by the School's employment policies. Gradebox is granted a limited, non-exclusive license to reproduce, process, and display such content solely to provide the Platform services to the School.

14.3 AI-Generated Feedback

Feedback generated by the Platform's AI in response to student work is provided to the School and Authorized Users for their educational use. The School retains the right to use, modify, and incorporate AI-generated feedback into its educational records and communications. Gradebox does not claim ownership of feedback content generated on behalf of the School.

14.4 Platform and Gradebox IP

The Platform, including all underlying software, algorithms, models, user interfaces, and Gradebox brand assets, is the exclusive property of Gradebox, Inc. Nothing in these Terms grants the School any ownership interest in the Platform or Gradebox's proprietary technology. The School receives a limited, non-exclusive, non-transferable license to access and use the Platform during the term of these Terms solely for the School's internal educational purposes.

14.5 No Use for AI Training Beyond These Terms

Gradebox will not use student work product or teacher-generated content to train any AI model except as expressly permitted under Section 7 of these Terms.

15.1 Subscription Terms

Access to the Platform is provided pursuant to a subscription agreement or Pilot MOU entered into between Gradebox and the School. Subscription fees, billing cycles, and renewal terms are set forth in the applicable order form or Pilot MOU. In the event of a conflict between these Terms and an order form or Pilot MOU regarding fees and access scope, the order form or Pilot MOU controls.

15.2 Pilot Programs

Schools participating in a Gradebox pilot program under a Pilot MOU receive access to the Platform subject to the scope and duration defined in the applicable Pilot MOU. All data handling, privacy, and security provisions of these Terms apply in full during any pilot period. The Pilot MOU will expressly incorporate these Terms by reference.

15.3 Access Upon Non-Payment

If a School's payment becomes overdue, Gradebox may, at its discretion, suspend access to the Platform after providing at least fourteen (14) days' written notice. Gradebox will not delete Student Data solely due to non-payment without providing the School with a reasonable opportunity to export its data. Student Data will be retained for a minimum of sixty (60) days following access suspension to allow the School to retrieve its data.

15.4 Refunds

Subscription fees are non-refundable except as required by applicable law or as expressly set forth in a written agreement between Gradebox and the School.

16.1 School Representations

The School represents and warrants that: (a) it has the legal authority to enter into and perform its obligations under these Terms; (b) it has obtained all required consents, authorizations, and approvals necessary to submit Student Data to Gradebox; (c) its use of the Platform will comply with applicable law; and (d) the information it provides to Gradebox is accurate and complete.

16.2 Gradebox Representations

Gradebox represents and warrants that: (a) it has the legal authority to enter into and perform its obligations under these Terms; (b) it will process Student Data only as described in these Terms; and (c) it will maintain security measures appropriate to the sensitivity of Student Data.

16.3 Disclaimer of Warranties

EXCEPT AS EXPRESSLY SET FORTH IN THESE TERMS, THE PLATFORM IS PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTY OF ANY KIND. GRADEBOX DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. GRADEBOX DOES NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE FROM SECURITY VULNERABILITIES.

16.4 Educational Outcomes

Gradebox does not warrant or guarantee any specific educational outcome, improvement in student performance, or instructional result from use of the Platform. The Platform is a tool to assist educational professionals — outcomes depend on how the Platform is used within the School's instructional environment.

17.1 Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, GRADEBOX'S TOTAL CUMULATIVE LIABILITY TO THE SCHOOL FOR ANY CLAIM ARISING OUT OF OR RELATED TO THESE TERMS OR THE PLATFORM WILL NOT EXCEED THE TOTAL FEES PAID BY THE SCHOOL TO GRADEBOX IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. IN NO EVENT WILL GRADEBOX BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS, LOSS OF DATA, OR LOSS OF GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

17.2 Indemnification by School

The School will defend, indemnify, and hold harmless Gradebox and its officers, directors, employees, and agents from and against any claims, damages, losses, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) the School's breach of these Terms; (b) the School's submission of Student Data to the Platform without required authorization, consent, or legal basis; (c) the School's violation of applicable law; or (d) the School's unauthorized use of the Platform.

17.3 Indemnification by Gradebox

Gradebox will defend, indemnify, and hold harmless the School and its officers, directors, employees, and agents from and against any claims, damages, losses, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) a confirmed security breach of Gradebox's systems resulting in unauthorized disclosure of Student Data attributable to Gradebox's failure to maintain required security measures; or (b) Gradebox's material breach of its data processing obligations under these Terms.

18.1 Term

These Terms are effective upon the School's acceptance and remain in effect for the duration of the School's active subscription, Pilot MOU, or continued use of the Platform, whichever is longest.

18.2 Termination for Cause

Either party may terminate these Terms immediately upon written notice if the other party: (a) materially breaches these Terms and fails to cure the breach within thirty (30) days of written notice; (b) becomes insolvent or files for bankruptcy protection; or (c) commits a material violation of applicable student data privacy law.

18.3 Termination for Convenience

The School may terminate these Terms for convenience upon thirty (30) days' written notice to Gradebox. Gradebox may terminate these Terms for convenience upon sixty (60) days' written notice to the School.

18.4 Effect of Termination

Upon termination: (a) all licenses granted to the School under these Terms immediately terminate; (b) the School will cease all use of the Platform; (c) Gradebox will retain and then delete Student Data as described in Section 13; and (d) provisions of these Terms that by their nature should survive termination will survive, including Sections 4, 5, 6, 7, 11, 14, 17, and 20.

19.1 Governing Law

These Terms are governed by the laws of the State of Arizona, without regard to its conflict of law principles. To the extent federal law governs any aspect of student data privacy (including FERPA, COPPA, or IDEA), federal law controls with respect to those matters.

19.2 Informal Resolution

Before initiating formal dispute resolution, the parties agree to attempt to resolve any dispute through good-faith negotiation. Either party may initiate informal resolution by providing written notice to the other party describing the dispute in reasonable detail. The parties will have thirty (30) days from the date of notice to attempt to resolve the dispute informally.

19.3 Binding Arbitration

If a dispute cannot be resolved informally, it will be resolved through binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules. The arbitration will be conducted in Maricopa County, Arizona, unless the parties agree otherwise. The arbitrator's decision will be final and binding and may be entered as a judgment in any court of competent jurisdiction.

19.4 Exceptions to Arbitration

Notwithstanding Section 19.3, either party may seek emergency injunctive or other equitable relief from a court of competent jurisdiction to prevent irreparable harm pending arbitration. Claims for injunctive relief related to unauthorized use of intellectual property or Student Data may be brought in court without first engaging in informal resolution.

19.5 Class Action Waiver

TO THE EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY WAIVES ANY RIGHT TO BRING OR PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR REPRESENTATIVE PROCEEDING. CLAIMS MAY ONLY BE BROUGHT ON AN INDIVIDUAL BASIS.

20.1 Amendments

Gradebox may update these Terms from time to time. For material changes, Gradebox will provide at least thirty (30) days' written notice to the School's account administrator via email or in-Platform notification before the changes take effect. The School's continued use of the Platform after the notice period constitutes acceptance of the updated Terms. If the School objects to a material change, it may terminate these Terms without penalty upon written notice within the notice period.

20.2 Entire Agreement

These Terms, together with the applicable order form, Pilot MOU, and Privacy Policy, constitute the entire agreement between the parties with respect to the subject matter herein and supersede all prior and contemporaneous agreements, representations, and understandings. In the event of a conflict between these Terms and a Pilot MOU with respect to data handling and privacy, these Terms control unless the Pilot MOU expressly specifies otherwise.

20.3 Severability

If any provision of these Terms is found to be unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will continue in full force and effect.

20.4 Waiver

A party's failure to enforce any provision of these Terms does not constitute a waiver of that party's right to enforce it in the future.

20.5 Assignment

The School may not assign these Terms or any rights hereunder without Gradebox's prior written consent. Gradebox may assign these Terms in connection with a merger, acquisition, or sale of substantially all of its assets, provided that the assignee agrees to be bound by these Terms and that Student Data continues to be protected in accordance with these Terms. Gradebox will notify the School of any such assignment.

20.6 Force Majeure

Neither party will be liable for any delay or failure to perform its obligations (other than payment obligations) due to circumstances beyond its reasonable control, including natural disasters, acts of government, widespread internet outages, or pandemic-related disruptions, provided that the affected party promptly notifies the other party and uses reasonable efforts to resume performance.

20.7 No Third-Party Beneficiaries

These Terms do not create any third-party beneficiary rights, except that parents and guardians of students whose data is processed under these Terms are intended third-party beneficiaries of the data protection provisions in Sections 4, 5, 6, and 12.

21.1 Privacy Contact

For questions about these Terms, Student Data handling, or privacy practices, contact Gradebox at:

21.2 Data Deletion and Access Requests

Schools may submit Student Data deletion or access requests to privacy@gradebox.ai. Parents and guardians seeking access to or correction of their child's education records should direct requests to the School, which is the FERPA-designated custodian of those records. Gradebox will cooperate with Schools in responding to verified parent and guardian requests.

21.3 Law Enforcement and Legal Process

If Gradebox receives a subpoena, court order, or other legal process requiring disclosure of Student Data, Gradebox will, to the extent permitted by law: (a) promptly notify the School before disclosing the data; (b) cooperate with the School in seeking a protective order or other appropriate relief; and (c) disclose only the minimum data required to comply with the legal process.

21.4 Regulatory Complaints

Schools or parents and guardians who believe that Gradebox has violated applicable student data privacy law may file a complaint with the appropriate regulatory authority, including the U.S. Department of Education's Student Privacy Policy Office (SPPO) with respect to FERPA matters.