Terms of Use

Product: CodaClass (by Codachord Inc.)

Parties: Codachord Inc. (“we,” “Codachord,” “us”) and the person or organization that creates or controls a CodaClass account (“you,” “Customer”)

Effective: when you create an account, click accept, or otherwise use CodaClass after these Terms are presented.

These Terms of Use (“Terms”) govern access to and use of CodaClass. By signing up or using the service, you agree to them. If you do not agree, do not use CodaClass.

Our Privacy Policy explains how Codachord handles personal information. Annex A (Data Processing and Education Records Terms) applies to Customer Data processed for every Customer under these Terms. The additional FERPA provisions in Annex A apply where the Customer is an educational agency or institution subject to FERPA and the information constitutes education records protected by FERPA. Other applicable school privacy requirements may also apply as specified in Annex A. The Privacy Policy provides information about processing practices and does not independently expand Codachord's contractual rights to use Customer Data.

1. Who these Terms cover

1.1 Customer. The organization or individual that establishes an authorized CodaClass subscription or trial for educational or childcare operations is the “Customer.” If an individual accepts these Terms on behalf of a center, school, district, or other organization, that individual represents that the individual has authority to bind the organization, and the organization is the Customer. An individual teacher or administrator may establish an account in an individual capacity only if authorized to do so and lawfully authorized to provide the associated information. An invited Parent or staff member does not become the Customer merely by activating an Authorized User account.

1.2 Authorized Users. Staff and other people you invite under your account (for example teachers, directors, co-teachers) are Authorized Users. You are responsible for their use of CodaClass under your account.

1.3 Parents and guardians. Parents and legal guardians invited by the Customer (“Parents”) are Authorized Users with access to information and features made available to them through the Customer's account, subject to the Customer's authorized access settings and applicable law. Parents accept the provisions of these Terms applicable to their individual use and acknowledge the Privacy Policy when activating their accounts. Parents do not thereby assume the Customer's subscription payment obligations, institutional representations, or indemnification obligations. The Customer is responsible for obtaining applicable family notices, permissions, and media authorizations associated with its educational or childcare activities. Codachord remains responsible for obligations imposed directly on Codachord by applicable law. Acceptance of these Terms or acknowledgment of the Privacy Policy does not, by itself, constitute verifiable parental consent under COPPA or a media release.

1.4 If a Parent contacts Codachord regarding access to, correction of, deletion of, or restrictions on further use of a child's Customer Data, Codachord will ordinarily refer the request to the Customer and reasonably assist the Customer in responding. Codachord will also respond directly where applicable law imposes an independent obligation on Codachord. The Customer's control over educational records does not eliminate any separate rights or obligations arising under applicable privacy law.

2. The service

2.1 CodaClass is a software service for early childhood programs. Features may include roster/profiles, observations (including photographs and videos where enabled), tagging, daily logs, family notes, parent messaging and check-in as available, CSV or other data upload to get started, staff-initiated speech-to-text transcription, and AI-assisted planning, drafting, and chat. Voice input is processed for staff-requested transcription only through a Codachord-operated speech-to-text model hosted on Amazon Web Services. The audio is deleted immediately after transcription and is not retained as an audio recording by CodaClass. CodaClass does not create voiceprints, biometric templates, or speaker identification profiles. Features may change over time.

2.2 We may offer free trials, beta features, and paid plans. Before a Customer purchases a paid plan, we will make the applicable price, billing frequency, trial conversion terms, renewal terms, material plan limitations, and cancellation method available for review. Paid use is governed by these Terms and the plan details affirmatively accepted by an authorized Customer representative at the time of purchase, unless a separate written order controls. Creation of a free trial does not, by itself, authorize charges that were not disclosed and accepted as part of the applicable purchase process.

2.3 CodaClass is provided as a multi-tenant service. You do not receive ownership of our software, models, or branding.

3. Accounts and access

3.1 You must provide accurate account information (including a working email) and keep it updated. Keep credentials confidential. Do not share login credentials across people; invite each person as their own user where the product allows.

3.2 You are responsible for activity under your account and for promptly removing access when someone leaves or should no longer have access.

3.3 We may suspend or limit access if we reasonably believe there is a security risk, misuse, non-payment (when fees apply), or a material breach of these Terms. We will try to notify you at the account email when practical.

4. Customer Data and roles

4.1 As between you and Codachord, you retain control of child, family, staff, and educational information submitted to or generated through your account, including associated AI prompts and outputs (“Customer Data”). Codachord processes Customer Data on your documented instructions and solely to provide the contracted services, administer authorized accounts, deliver requested AI assistance, maintain security, provide support, comply with applicable law, and perform other expressly authorized purposes consistent with Annex A. Codachord will not use Customer Data for independent advertising, marketing, model training, or product development unrelated to providing and maintaining the contracted services. Permitted service maintenance and improvement activities remain subject to the limitations in Annex A and Section 8.

4.2 You determine which children are rostered, which Parents are invited, which staff members receive access, and which educational records or communications are made available to each authorized role. You are responsible for notices, permissions, and consents required for your own educational or childcare activities and for providing instructions consistent with applicable law. Codachord does not undertake to independently verify each family's authorization for the Customer's activities, but remains responsible for its own legally required privacy disclosures, processing restrictions, security obligations, and consent obligations, if any. Where Codachord relies on an educational institution's authorization for processing subject to COPPA, such reliance must satisfy the conditions applicable to that authorization.

4.3 Parents’ in-product rights requests go to you; we assist reasonably (same as Section 1.4).

5. Acceptable use

5.1 Use CodaClass only for your own educational / childcare operations (or, if you are an individual teacher signing up, for the classrooms and children you are authorized to manage).

5.2 You will not: reverse engineer the service; probe or access other customers’ tenants or data; upload malware; scrape the service in a way that harms it; use CodaClass to violate law; or use it for clinical diagnosis, therapy, or as an IEP/eligibility system (see Section 9).

5.3 You will not upload data you are not allowed to share with a service provider /school official–type processor.

6. AI and subprocessors

6.1 AI processing. CodaClass uses authorized AI processing arrangements to process staff prompts and relevant classroom context and return generated drafts or assistance, including observation tagging, family communication drafts, lesson and activity planning, translation, and chat referencing program records. Microsoft Azure is a current third-party AI subprocessor. Codachord currently operates a self-hosted speech-to-text model using Amazon Web Services infrastructure, which is already an authorized hosting subprocessor, and may operate additional Codachord-controlled AI models on that infrastructure. Codachord may select or route between models operated through an already listed provider, or deploy Codachord-operated models on already listed infrastructure, without invoking the new-subprocessor notice procedure in Section 6.2, provided the conditions specified in that section are satisfied. A model arrangement involving a new third-party legal entity receiving Customer Data is subject to Section 6.2 and Annex A. All AI processing remains subject to the restrictions in Section 6.3, including the prohibition on model training and unrelated commercial use. Codachord does not intentionally submit stored photographs or videos to AI subprocessors through the AI features described here.

6.2 Subprocessor transparency and changes. Codachord will maintain an accessible, reasonably current register identifying third-party subprocessors receiving Customer Data for the contracted service and other providers handling account administration or payment information. The register will distinguish provider functions and relevant categories of information processed and will identify processing locations where available. Current service subprocessors include Microsoft Azure for staff-directed AI processing, Amazon Web Services for cloud hosting and infrastructure supporting Codachord's existing self-hosted speech-to-text model and any additional Codachord-operated AI models when deployed, and Resend for transactional email services involving user email addresses and account identifiers, including invitations and account recovery communications. Resend is not authorized to receive classroom records, photographs, videos, or child educational records through those transactional email functions. Stripe is separately identified as a billing and payment service provider handling subscription payment information, billing contact details, and related account administration information. Stripe is not engaged to process classroom or child records on the Customer's behalf.

Codachord may add or replace a third-party subprocessor legal entity receiving Customer Data where reasonably necessary to provide the service, provided the entity is bound by written data protection obligations appropriate to its processing activities and no less protective in material respects than the applicable commitments in these Terms and Annex A. Codachord will provide Customers at least 30 days' advance notice of a material addition or replacement of such an entity where practicable. A Customer may object within 15 days after notice on reasonable data protection or legal compliance grounds. Codachord will consider the objection in good faith and may provide an alternative, reasonable mitigation, or another mutually acceptable arrangement. If the objection cannot reasonably be resolved before the change takes effect, the Customer may terminate the affected paid service and receive a proportional refund of prepaid fees for the unused period. An urgent replacement reasonably required to address a security incident or service disruption may proceed sooner, with notice as soon as reasonably practicable.

Changing or routing between models within the same already listed and contracted provider legal entity, or operating Codachord-controlled models on already listed infrastructure, does not constitute adding or replacing a third-party subprocessor and does not trigger the preceding 30-day notice and 15-day objection procedure, provided that no new third-party entity receives Customer Data, no additional categories of Customer Data or processing purposes are introduced, no new processing location is used, and the change does not weaken applicable confidentiality, security, retention, no-training, or other data protection commitments. The register will accurately identify the relevant provider functions, including AI/model hosting on existing infrastructure. If these conditions are not satisfied, Codachord will provide any notice or obtain any authorization required by applicable law, Annex A, or the relevant Customer agreement; if a new third-party entity receives Customer Data, the addition or replacement procedure above applies. Additional requirements applicable to protected education records and other regulated information remain governed by Annex A and applicable law.

6.3 No model training, sale, or marketing use. Codachord will not use Customer Data, including prompts, outputs, uploads, photographs, videos, voice recordings, messages, and IEP or other educational information, to train, fine-tune, or improve foundation or generative AI models operated by Codachord or third parties. Codachord will not sell Customer Data, disclose it for targeted advertising, use it for marketing, or authorize third parties to use it for model training or independent commercial purposes. Codachord will impose corresponding restrictions on AI subprocessors by contract. Processing strictly necessary to provide the requested AI service, maintain service security, or comply with applicable legal obligations remains permitted only to the extent consistent with these restrictions, the applicable DPA, and law. The no-training commitment is not modified by a change in AI provider.

6.4 AI outputs and human review. AI-generated content is provided as draft assistance and may contain errors, omissions, misleading statements, or inaccurate translations. Authorized staff must meaningfully review and approve generated content before saving it to a child's record, communicating it to a family, or relying on it for instruction or other decisions affecting a child. AI outputs must not be used as the sole basis for clinical, developmental, disability, disciplinary, eligibility, or other consequential determinations. The Customer remains responsible for professional and educational decisions made by its authorized personnel. This allocation does not excuse Codachord from its own express contractual obligations, applicable data protection obligations, or responsibility for defects or misconduct attributable to Codachord under applicable law.

7. Fees

7.1 Some plans are free or promotional; others are paid. If an authorized Customer representative selects a paid plan, the Customer agrees to pay the disclosed subscription fees and applicable taxes. Before payment authorization, Codachord will disclose the billing interval, any recurring charges, the applicable renewal arrangement, material usage limits, and the available cancellation method. Codachord will provide or make available a record of the selected plan and material billing terms.

7.2 Except as required by applicable law, expressly provided in an accepted order, or stated in these Terms, subscription fees are nonrefundable for service periods already provided. The Customer remains entitled to a proportional refund of prepaid fees for the unused portion of an affected service period if Codachord terminates that service without Customer breach, if the Customer terminates under Section 6.2 because of an unresolved qualifying subprocessor objection, or if a refund is otherwise expressly required by these Terms or applicable law. Cancellation ordinarily stops future renewals rather than retroactively refunding completed service periods.

7.3 Codachord may change subscription pricing prospectively for a future renewal period by providing reasonable advance notice to the Customer's designated billing contact. The notice will identify the new price, effective renewal date, and cancellation method. A pricing change will not increase amounts already charged for the current paid period. Where applicable law or the agreed purchase process requires affirmative consent to a changed recurring charge, continued use alone will not substitute for that consent.

8. Retention and deletion

8.1 During the subscription. The Customer may request export, correction, or deletion of Customer Data subject to applicable law and verified authorization. Codachord will reasonably assist with such requests and provide available Customer Data in a commonly used, machine-readable format where technically practicable. Authorized requests will be processed without unreasonable delay, ordinarily targeting completion within 30 days after receipt of the information reasonably needed to act. Data deleted from active systems may remain temporarily in restricted routine backups solely until expiration of the documented backup deletion cycle, targeted within 30 additional days, or for a longer period strictly required by applicable law or a valid legal preservation obligation. Residual information will not be restored to ordinary service use or processed for independent purposes, and any restored backup will remain subject to applicable deletion requests. Codachord will identify material exceptions or delays to the Customer.

8.2 After account cancellation or termination. Except where the Customer has authorized temporary transition retention under Section 8.3, Codachord will delete Customer Data from active service systems without unreasonable delay, ordinarily targeting completion within 30 days following the effective termination date, subject to documented legal preservation obligations and the restricted backup procedures in Section 8.1. On request, Codachord will reasonably facilitate export before deletion where practicable and legally permitted. Parent and staff access associated with the terminated Customer account will cease in accordance with the applicable termination process. Codachord will not continue using retained Customer Data for independent product improvement after termination.

8.3 Optional temporary transition retention. Upon the Customer's written request, Codachord may retain Customer Data for a specified period not exceeding 90 days after termination solely to facilitate authorized export, transition assistance, restoration requested by the Customer, or another specifically documented Customer-directed purpose. Such retention does not authorize independent product improvement, general usage analysis, marketing, model training, or disclosure for unrelated purposes. Codachord will restrict access during the retention period and delete the retained Customer Data under Section 8.2 when the authorized period ends or earlier upon the Customer's lawful request, subject to applicable legal preservation requirements.

8.4 Codachord may retain statistics derived from Customer Data only where the resulting information has been deidentified or aggregated in accordance with applicable law and cannot reasonably identify, be linked to, or be used to reconstruct information about an individual child, family, staff member, or Customer. Codachord will maintain reasonable measures intended to prevent reidentification and will not attempt to reidentify such information except as permitted by law to test or verify the effectiveness of deidentification. This provision does not authorize retention of identifiable educational records or AI prompts for independent analytics.

9. IEP and special education content (assist only)

9.1 If authorized staff store IEP summaries, accommodations, disability-related information, or related educational notes in CodaClass, AI features may process relevant text and generate draft assistance for planning or documentation when the staff member affirmatively uses those features. Staff must determine whether the information may lawfully be submitted to the applicable AI function and must review resulting drafts before use. AI outputs do not establish whether a child qualifies for services, determine appropriate accommodations, or replace decisions made through authorized educational processes.

9.2 CodaClass is not an IEP team, evaluation, placement, or eligibility system. It does not create, amend, or replace an IEP or Section 504 plan. You and your staff remain responsible for compliance with IDEA/IEP and your policies. Do not treat AI text as legal or clinical advice.

10. Your representations (family notice / consent)

Before uploading real children’s data or inviting Parents, you represent that you:

10.1 Have obtained (or will obtain before upload/invite) all notices and consents required by law and your policy (including media/photo/voice where used), so that using CodaClass with those children and inviting Parents is lawful;

10.2 Will use any sample parent notice Codachord provides (or your own equivalent) and will handle opt-outs and parent questions yourself;

10.3 Are responsible for which children are rostered, which Parents are invited, and what staff are authorized to see;

10.4 Will not upload data you are not allowed to share with a service provider / school official–type processor.

The Customer will defend and indemnify Codachord against third-party claims to the extent directly resulting from the Customer's material failure to obtain notices or consents that the Customer was legally responsible for obtaining, except to the extent the claim results from Codachord's breach of these Terms, violation of applicable law, or independent processing decisions. Codachord will provide reasonably prompt notice of an indemnified claim and reasonable cooperation in its defense. The Customer may control the defense with qualified counsel, provided that no settlement imposing an admission, nonmonetary obligation, or continuing duty on Codachord may be entered without Codachord's prior written consent, not to be unreasonably withheld. Codachord may rely on the Customer's representations concerning notices and authorizations for the Customer's educational activities, except where Codachord has actual knowledge that the representation is inaccurate or applicable law independently requires action by Codachord. The Customer must maintain appropriate consent and authorization records for activities under its control. Codachord remains responsible for legally required notices, consent procedures, and processing restrictions that apply directly to Codachord. Acceptance of the product Terms or Privacy Policy is not a substitute for a separate permission required for a particular processing activity.

11. Security and confidentiality

11.1 Codachord will use reasonable administrative, technical, and organizational measures appropriate to the sensitivity of early childhood data (access controls, encryption in transit and at rest, tenant isolation for your account).

11.2 Codachord will notify the Customer without undue delay and, in any event, within 72 hours after determining that a security incident has resulted in unauthorized access to, acquisition of, or disclosure of Customer Data, unless a shorter period is required by applicable law or an agreed school-specific obligation. Codachord will provide information reasonably available concerning the nature of the incident, affected information, known or reasonably suspected impact, mitigation undertaken, and a contact for coordination, followed by material updates as appropriate. Codachord will reasonably assist the Customer with investigation, containment, and legally required notices. Codachord will require subprocessors to report relevant incidents to Codachord promptly enough to support these obligations. A preliminary notice need not include facts that are not yet reasonably available.

11.3 Each party will keep the other’s non-public business information confidential, except as needed to run the service or as required by law.

11.4 You are responsible for staff device security, password hygiene, and promptly removing access when someone leaves.

12. Feedback, publicity, warranty, liability

12.1 Feedback you give about CodaClass may be used freely by Codachord to improve the product (without identifying children/families).

12.2 Neither party will issue a public case study naming you or your organization without prior written approval. Aggregate language (for example that early childhood programs use CodaClass) without naming you is OK.

12.3 As-is service. CodaClass is provided “as is.” Codachord does not promise uninterrupted service or error-free AI output. To the extent allowed by law, we disclaim implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

12.4 To the extent permitted by law, each party's aggregate liability arising from or related to these Terms will not exceed the greater of fees paid or payable to Codachord for CodaClass during the 12 months preceding the event giving rise to the claim or USD $1,000. For a party's breach of confidentiality, applicable contractual data security obligations, or Section 6.3, the aggregate liability limit will instead be the greater of twice those fees or USD $10,000. Neither limit applies to fraud, willful misconduct, payment obligations, or liabilities that applicable law prohibits the parties from limiting. Neither party will be liable for indirect or consequential damages, except that reasonable investigation, restoration, and legally required notification expenses directly resulting from a breach of the foregoing protected obligations will not be excluded merely because they arise following an incident. The parties' rights and obligations concerning indemnity and statutorily required incident cost allocation remain subject to applicable law and any more specific provisions in Annex A.

13. Term and termination

13.1 These Terms start when you accept them or first use CodaClass and continue until your account is cancelled or terminated.

13.2 You may cancel by following in-product account cancellation (when available) or by written notice to Codachord (email is fine). We may terminate for material breach if not cured within a reasonable time after notice, or as described in Section 3.3.

13.3 On termination, Sections 4, 6.3, 8 through 12, 14, and Annex A survive to the extent necessary to enforce accrued rights and obligations and to protect, return, retain, or delete Customer Data. Obligations concerning Customer Data continue for as long as Codachord or an authorized subprocessor retains that information, subject to the applicable provisions of these Terms and law. Other provisions that by their nature should survive will also survive.

13.4 If you later enter a separate signed pilot agreement or order that expressly replaces these Terms for a period, that document controls for that period to the extent of conflict.

14. General

14.1 Governing law and disputes. These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-law rules. For disputes between Codachord and the Customer arising from the Customer's commercial subscription, the parties consent to the exclusive jurisdiction of state and federal courts located in Delaware, except where mandatory applicable law requires another forum. This provision does not require invited Parents or other Authorized Users, acting solely in their individual capacity, to litigate claims in Delaware when applicable law protects their right to another forum. Nothing in these Terms restricts a regulatory authority's lawful jurisdiction or waives rights that cannot lawfully be waived.

14.2 These Terms, Annex A, and any accepted order or plan details constitute the agreement governing the Customer's subscription. The Privacy Policy provides additional information concerning personal information practices and does not reduce the contractual protections in these Terms. The parties may agree to amendments through an authorized written or electronic acceptance process. Codachord may update these Terms prospectively by providing reasonable notice to the Customer. Material amendments affecting payment obligations, data processing rights, dispute procedures, or other substantive contractual rights will require any renewed affirmative acceptance mandated by applicable law or the agreed contracting process. Changes will not retroactively authorize materially different processing of Customer Data without a lawful basis and any required notice or consent.

14.3 If a provision is unenforceable, the rest remains in effect. Failure to enforce is not a waiver.

14.4 You may not assign these Terms without our consent, except to a successor in connection with a merger or sale of substantially all assets; we may assign to an affiliate or successor.

Annex A: Education records (FERPA) / data processing

This Annex A constitutes the Data Processing and Education Records Terms applicable to Customer Data processed for every Customer under the CodaClass Terms of Use. The general data protection obligations in this Annex apply whether or not the Customer is subject to FERPA. FERPA-specific requirements apply where the Customer is an educational agency or institution subject to FERPA and the information is protected education-record information. Additional provisions expressly identified as applicable under California, Oregon, or Illinois law apply where the relevant statutory conditions are satisfied. Where this Annex conflicts with the body of the Terms concerning protection, permissible use, disclosure, or return or deletion of Customer Data, this Annex controls to the extent of the conflict.

A.1 Roles and instructions

The Customer determines the purposes and permitted uses of Customer Data submitted for the contracted educational or childcare services, subject to applicable law. Codachord acts as the Customer's contracted service provider or processor for that information and will process it under the Customer's documented instructions and this Annex. Where the Customer is subject to FERPA and the school-official exception is lawfully available, Codachord performs an outsourced institutional service or function that the Customer would otherwise perform through its employees, is subject to the Customer's direct control regarding the use and maintenance of protected education records, and may access such records only for a legitimate educational interest connected to the contracted services. This designation does not, by itself, establish that every Customer is subject to FERPA or that every disclosure qualifies for a FERPA exception. Codachord will reasonably support the Customer's instruction and oversight rights, subject to appropriate security safeguards.

A.2 Purpose limitation

Codachord will process Customer Data solely for the specific contracted purposes of hosting classroom records, administering authorized accounts and role-based access, delivering Customer-requested classroom and AI assistance, enabling authorized family communications, maintaining security, providing support, and carrying out authorized export, correction, or deletion instructions. Processing for legally required preservation or disclosure is permitted only to the extent required by law, with notice to the Customer where legally permitted. Codachord will not sell or share Customer Data, use identifiable Customer Data for independent marketing or unrelated commercial profiling, combine it with independently obtained personal information for unrelated purposes, or use it for AI model training. For FERPA-protected education records, use and redisclosure are further restricted to the purposes for which the Customer lawfully disclosed the records, subject to 34 C.F.R. § 99.33(a). Any material additional purpose requires an applicable lawful basis and, where required, a separate Customer authorization and legally necessary consent.

A.3 Subprocessors and redisclosure

Codachord may engage third-party subprocessors receiving Customer Data only for authorized purposes described in this Annex and will maintain the provider register and change-notification procedure specified in Section 6.2. The register will distinguish service subprocessors processing Customer Data from providers handling Codachord's separate billing and account administration activities. Before a subprocessor receives Customer Data, Codachord will impose written confidentiality, processing-purpose, security, incident notification, assistance, and return or deletion obligations appropriate to the data and consistent with this Annex. Codachord remains responsible to the Customer for a subprocessor's performance of delegated contractual obligations. Subprocessors receiving FERPA-protected information must be subject to restrictions consistent with the Customer's direct control and the applicable limitations on use and redisclosure of education records.

Selecting or routing between models within the same already listed and contracted provider legal entity, or operating Codachord-controlled models on existing listed infrastructure, does not itself constitute adding or replacing a third-party subprocessor for purposes of the 30-day notice and 15-day objection procedure, provided all conditions in Section 6.2 are satisfied. Such changes must remain within the Customer's authorized processing purposes, data categories, processing locations, and contractual protections. No provider or model change may reduce the restrictions in Section 6.3 or authorize additional training, advertising, profiling, or other independent uses. The provider register must accurately reflect the functions performed by listed entities. Any independently applicable statutory or institutional notice, consent, direct-control, or redisclosure requirement remains enforceable notwithstanding this model-change exception. Material additions or replacements of third-party entities receiving Customer Data remain subject to Section 6.2, and any stricter applicable legal requirements prevail. Codachord will not otherwise redisclose protected Customer Data without the Customer's authorization or another lawful basis, subject to the more specific restrictions governing Illinois covered information in Section A.9.

A.4 Individual rights and assistance

The Customer ordinarily administers requests concerning access to, amendment of, or deletion of Customer-controlled child and education records, including rights arising under FERPA where applicable. Codachord will reasonably assist the Customer by providing available records, implementing authorized corrections or deletions, and supporting applicable response obligations. Codachord will not independently amend institutional education records contrary to lawful Customer instructions. Where COPPA or another applicable privacy law imposes an independent duty on Codachord to provide access, honor a request, or prevent further collection or use, Codachord will comply with that duty. Requests concerning personal information that Codachord controls independently, such as certain account or billing information, will be handled according to applicable law and the Privacy Policy.

A.5 Security, incidents, return, and deletion

Codachord will apply the administrative, technical, and organizational safeguards in Section 11 to Customer Data, taking account of the sensitivity of information concerning children. The notification and cooperation obligations in Section 11.2 apply to relevant incidents involving Codachord or its subprocessors, subject to any stricter applicable requirements. Upon an authorized Customer request or termination, Codachord will reasonably facilitate return or export and deletion under Section 8, except where applicable law requires limited preservation. Customer Data retained temporarily for lawful purposes remains subject to the restrictions of this Annex. Only information meeting the applicable legal requirements for deidentification or aggregation may be retained under Section 8.4. Codachord will not use post-termination identifiable education records for independent product improvement.

A.6 Customer responsibilities

The Customer remains responsible for determining whether FERPA applies to its institution and records, establishing authorized educational purposes, providing notices required of the institution, administering directory-information practices where applicable, authorizing staff and Parent access, and supplying lawful processing instructions. The Customer is responsible for any institutional consent or authorization on which it intends Codachord to rely. Codachord remains responsible for its own obligations under this Annex and applicable law. For FERPA-protected records, the Customer must determine whether the school-official exception or another permitted disclosure basis supports the proposed processing and whether relevant annual notification requirements have been satisfied.

A.7 Survival

This Annex survives for as long as Codachord retains education records / Customer Data under Section 8, and otherwise as Section 13.3.

A.8 California and Oregon processing provisions

Where the California Consumer Privacy Act applies to the Customer's disclosure of personal information to Codachord as a service provider or contractor, the parties intend this Annex to identify the limited and specified business purposes for processing. Codachord will not sell or share personal information received from the Customer and will not retain, use, disclose, or combine that information outside the purposes and restrictions permitted by applicable law. Codachord will comply with applicable CCPA requirements, provide the level of privacy protection required by law, reasonably assist the Customer with legally required consumer requests and relevant compliance inquiries, and permit the Customer to take reasonable and appropriate steps to verify compliance. Codachord will notify the Customer if it determines that it can no longer meet applicable obligations and will cooperate in reasonable steps to prevent or remediate unauthorized processing.

Where the Oregon Consumer Privacy Act applies and Codachord acts as processor, Codachord will process personal data on documented Customer instructions and provide reasonable assistance with applicable individual-rights requests, security obligations, and compliance assessments. The processing is limited to the duration of the contracted services and any authorized transition period, the purposes and categories of Customer Data identified in Sections 4 and 6 and this Annex, and the categories of affected children, families, staff, and other authorized users. Each person processing personal data will be subject to a duty of confidentiality concerning that information. Codachord will delete or return personal data at the Customer's direction or upon completion of the services, unless retention is required by law. Codachord will enter into written agreements requiring each subprocessor to satisfy the applicable processing obligations imposed on Codachord under this Annex.

Codachord will make available to the Customer, upon request, all information the Customer needs to verify Codachord's compliance with its obligations under ORS 646A.570 through 646A.589. Codachord will permit the Customer, its designee, or a qualified and independent person engaged by Codachord to assess Codachord's policies and technical and organizational measures for compliance with those obligations, in accordance with an appropriate and accepted control standard, framework, or procedure. Codachord will cooperate with such assessments and, at the Customer's request, report the results to the Customer.

A.9 Illinois school privacy provisions

Where Codachord qualifies as an operator subject to the Illinois Student Online Personal Protection Act in connection with a covered school or district, the applicable requirements of that Act govern its handling of covered information. For a school, school district, or State Board arrangement requiring a written agreement under 105 ILCS 85/15(4), these Terms and this Annex are intended to serve as that agreement, subject to confirmation that the actual services, information categories, and other required particulars are accurately identified.

The services consist of classroom record management, authorized family communications, and staff-directed educational assistance described in Section 2. Categories of covered information provided to Codachord may include student identifiers, educational and developmental records, attendance, observations, photographs, video, voice recordings, family communications, allergy or incident information, and special education information, to the extent actually supplied or generated for authorized school purposes.

For an agreement subject to 105 ILCS 85/15(4), Codachord acts as a school official with a legitimate educational interest pursuant to FERPA, performs an institutional service or function for which the school would otherwise use employees, and is subject to the school's direct control with respect to the use and maintenance of covered information. Codachord will use covered information only for authorized school purposes and will not redisclose that information to third parties or affiliates without the school's permission, pursuant to a court order, or as otherwise permitted under the Illinois Student Online Personal Protection Act. These restrictions control over any broader redisclosure authorization in Section A.3.

If a breach of covered information is attributable to Codachord or its subprocessors, Codachord will bear the reasonable, documented costs incurred by the school in investigating, containing, and remediating that breach to the extent attributable to Codachord or its subprocessors. These costs include legally required notifications to parents and regulators, reasonably necessary credit monitoring, reasonable legal and audit expenses, and lawfully allocable fines or other regulatory expenses resulting from the breach. The school will bear costs to the extent attributable to its own acts or omissions. Where both parties contribute to a breach, the relevant costs will be allocated in proportion to their respective causal responsibility, as agreed by the parties or determined through the applicable dispute resolution process. This allocation remains subject to Section 12.4 to the extent enforceable under applicable law and does not limit any liability or expense allocation that applicable law prohibits the parties from limiting.

Codachord will maintain reasonable security measures and will return or delete covered information when it is no longer necessary for the agreement's purposes, subject to applicable law and the periods specified in Section 8. Where 105 ILCS 85/15(4) applies, the school must publish the written agreement on its website or, if the school does not maintain a website, make it available for public inspection at its administrative office. The parties may agree to redactions only to the extent permitted by that statute, and the information required by Section 15(4)(A), (B), and (C) may not be redacted.

Where 105 ILCS 85/15(6) applies, Codachord will provide the school with a list of third parties and affiliates to which covered information is currently disclosed or has previously been disclosed and will update and provide that list at the beginning of each Illinois State fiscal year and each calendar year.

The written-agreement requirement under 105 ILCS 85/15(4) and the periodic disclosure-list requirement under Section 15(6) expressly except nonpublic schools. That exception does not, by itself, eliminate other obligations applicable to operators under the Act. All obligations in this Section remain conditional upon the applicable statutory definitions and circumstances of the Customer and the processing activity.

A.10 Additional statutory protections

Nothing in this Annex authorizes processing prohibited by applicable law or displaces mandatory protections for student or child information. Where a mandatory statutory requirement conflicts with a less protective provision of these Terms, the mandatory requirement controls. The parties will cooperate in documenting any additional information or contractual provisions required for a particular covered institution or legally regulated processing activity.