Terms of Service

1. Acceptance, contracting parties, and scope

These Terms of Service govern access to the edvance websites, hosted applications, administrative panels, interfaces, documentation, and related services, collectively the Service. The Service is offered under the trading name edvance, referred to as Company, we, us, or our. The responsible legal operator must be identified in the applicable Order or other contracting disclosure before acceptance where required. A trading name does not by itself represent incorporation in any jurisdiction. Customer means the individual or legal entity purchasing or administering a subscription. Authorized User means an individual permitted to use a Customer account. Where a signed order identifies a different edvance contracting entity, that entity is the provider for that order. These Terms take effect for a Customer when that Customer accepts them through an affirmative acceptance mechanism or signs an order incorporating them.

A person accepting for a school, group, employer, or other organization represents that they have authority to bind that organization. If they lack that authority, they must not accept or provision an account for it. Merely reading the Privacy Policy does not grant us ownership of personal information or waive statutory rights. Students and other users receive access under their school's or organization's authorization where applicable; the subscription purchaser remains responsible for contractual obligations allocated to Customer.

These Terms cover business and institutional subscriptions and individual subscriptions to the extent available. Mandatory consumer, child protection, education, employment, and privacy law overrides any conflicting term. References to rights being reserved or liability being excluded apply only to the maximum extent permitted by applicable law. No statement here represents that every product feature, regional deployment, certification, or enterprise service is included in every subscription.

2. Contract documents and precedence

An Order is an order form, accepted quotation, purchase confirmation, or similar document identifying the purchased Service, subscription term, fees, and Customer. A Data Processing Agreement, or DPA, is a separately agreed agreement addressing processing on behalf of Customer. A Service Level Agreement, or SLA, is a separately agreed availability or support commitment. These Terms, the applicable Order, any DPA, and any expressly incorporated schedules form the Agreement.

For conflicts concerning personal data processing, a mandatory transfer instrument controls first, followed by the DPA, then a signed privacy or security addendum, then these Terms. For other conflicts, a negotiated amendment signed by authorized representatives controls, followed by the Order, an applicable SLA, and these Terms. An Order overrides these Terms only to the extent it expressly identifies a different arrangement. The Privacy Policy explains processing; it does not enlarge an otherwise limited processing license.

Customer purchase orders, procurement portals, vendor onboarding forms, and invoice terms are administrative only and do not amend the Agreement unless edvance expressly signs the proposed amendment. References to a product roadmap, sales demonstration, estimated release date, or informal support discussion do not create a delivery commitment. Customer should purchase on the basis of expressly contracted, currently available functionality.

3. Definitions and interpretation

Customer Data means records, files, personal information, communications, assessment materials, administrative configurations, and other content submitted to or generated within the Service on Customer's behalf. Education Records means information relating to identifiable students that is protected as an education record under applicable law. Personal Data means information relating to an identified or identifiable person, including equivalent statutory categories such as personal information. Confidential Information includes nonpublic Customer Data and protected business information described below.

Service Data means operational information about delivery, security, usage, performance, account administration, and transactions. Service Data can contain Personal Data and remains subject to the Privacy Policy, applicable law, and any controlling DPA. Deidentified Data means information processed so that individuals are not reasonably identifiable, taking account of reasonably available means and applicable legal standards. Pseudonymous identifiers alone do not make information anonymous.

A Subprocessor is a service provider engaged to process Personal Data on our behalf in delivering contracted processing. A Security Incident means a confirmed compromise of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data under our control. Unsuccessful attacks, blocked login attempts, and ordinary service faults are not, by themselves, confirmed Security Incidents. Business Day excludes weekends and public holidays at the relevant contracting office.

4. Eligibility and institutional authorization

An individual purchaser must have legal capacity to enter the Agreement. An institution must appoint authorized administrators, identify its lawful basis for using the Service, and obtain approvals necessary for uploading and managing records. School users may include children only through an age-appropriate, authorized arrangement and the notices and permissions required by law. A child cannot bind a school to a commercial contract or provide institutional authorization merely by selecting an account type.

Customer must assess whether the Service and its selected features are appropriate for its jurisdiction, intended users, educational purpose, procurement rules, accessibility obligations, and recordkeeping duties. Customer must not submit restricted national security information, payment authentication secrets, genetic data, biometric templates, or regulated medical records unless edvance has expressly agreed in writing to support that category and the necessary safeguards. An ordinary student profile field does not authorize use as a clinical record system.

We may reasonably request evidence of organizational authority, identity, school status, guardian authorization, or a lawful instruction before enabling sensitive functions or releasing records. We may decline or restrict a request where authority cannot be verified. Verification requests will be proportionate to the information at risk, and do not authorize collection of unnecessary identity documents.

5. Account setup, tenant ownership, and administration

Customer must provide accurate account, organization, contact, and billing details and keep them current. A tenant is an organizational workspace and does not confer ownership of a domain, intellectual property right, or unrestricted entitlement to all data associated with a person. The account owner and authorized administrators may manage users, assign permissions, configure features, and issue instructions within their actual authority.

Customer is responsible for determining which persons may receive administrator, teacher, staff, student, parent, or guardian access. Access to one student's records must not be treated as access to another student's records or another tenant. When staff leave, roles change, guardianship changes, or a student becomes inactive, Customer must promptly update its permissions and notify us if assistance is required. We may enforce tenant, role, relationship, and account status controls in the Service.

In a genuine ownership dispute, we may restrict administrative changes, preserve relevant records, and request documentary evidence before transferring control. We are not required to resolve corporate, employment, family, or school governance disputes. We may follow a binding court order or lawful institutional instruction, subject to protection of other persons' rights and the applicable Agreement.

6. Invitation acceptance and assisted provisioning

Invitations must be issued to intended recipients for legitimate organizational purposes. Invitation links and account recovery credentials must be protected against disclosure and misuse. The recipient must review the account, organization, role, and applicable terms before accepting. Acceptance does not authorize access beyond the invitation's assigned scope or override a required parental or institutional approval.

Where an edvance operator, reseller, or institutional administrator assists with creation of a tenant or conversion of a prospective Customer, that operator may confirm acceptance on an owner's behalf only after obtaining actual authorization and acceptance of the applicable documents. An operator must not infer consent from a sales conversation, silence, payment alone, or a desire to complete onboarding. Customer must retain evidence of delegated authority and any notices or consents it is required to obtain.

Electronic acceptance evidence may include the document version, acceptance time, account identifier, method, and proportionate device or network information. The absence of a handwritten signature does not prevent an otherwise valid electronic agreement. We may request renewed acceptance for a material contractual change when required; a privacy acknowledgment is not a substitute for a legally required, specific consent to an optional processing purpose.

7. Access license and subscription boundaries

Subject to the Agreement, timely payment, and applicable law, we grant Customer a limited, nonexclusive, nontransferable right during the subscription term to allow Authorized Users to access the purchased Service for Customer's internal educational and administrative purposes. Rights are limited to the users, campuses, entities, storage, modules, usage volumes, and other entitlements described in the Order or plan.

Customer may not resell, sublicense, timeshare, white-label, or commercially provide the Service to third parties unless a written reseller, group, or managed service arrangement expressly permits it. A school group may administer multiple campuses only within its purchased scope and lawful authority. No access right includes our source code, infrastructure, internal tools, security materials, or proprietary model components.

We may use technical measures to enforce reasonable plan limits, prevent abuse, and protect shared capacity. Where practicable, we will notify Customer of material excess use and allow a reasonable opportunity to reduce usage or purchase additional capacity before imposing a nonurgent restriction. We may act immediately to contain a material security, legal, or service stability threat.

8. Customer responsibilities and record accuracy

Customer controls the content and educational use of its records. Customer must ensure that information is accurate enough for its intended purpose, lawfully obtained, relevant, and shared only with authorized persons. Customer must review imported records, grading structures, attendance entries, guardian relationships, identifiers, and generated reports before relying on them or disclosing them outside its organization.

The Service assists administration and professional judgment; it does not independently certify a student's eligibility, identity, safeguarding status, academic achievement, or entitlement to a benefit. Customer remains responsible for legally required registers, accreditation submissions, official transcripts, statutory returns, examination controls, and decisions affecting individuals unless the Order expressly allocates a defined task to us.

Customer must maintain any independent copies, approvals, audit procedures, or business continuity arrangements that its regulatory duties require. We are responsible for the security and processing obligations allocated to us; Customer's recordkeeping responsibility does not excuse our failure to perform an express contractual obligation. Customer must notify us promptly of a material error or suspected exposure that requires our assistance.

9. Acceptable use and prohibited conduct

Users must not access or attempt to access another tenant, bypass authorization, harvest credentials, exploit vulnerabilities, introduce malicious code, send unlawful bulk communications, or interfere with the integrity or availability of the Service. Users must not use the Service for stalking, harassment, discriminatory profiling, unlawful surveillance, exploitation of children, fraud, or infringement of intellectual property or privacy rights.

Customer must not upload content it has no right to process, publish confidential records to public channels, or use exported information to evade an individual's legal rights. Reverse engineering, systematic scraping, automated account creation, excessive load testing, or extraction of protected software components is prohibited except to the extent a nonwaivable law or our written permission permits the activity. Authorized interoperability rights remain subject to applicable law.

Security research must avoid access to live personal records and disruption. A researcher should stop when unintended access is discovered and report enough information for responsible investigation through support@edvance.space. This provision does not promise immunity for unauthorized activity or displace statutory reporting rights. We may investigate suspected misuse, preserve relevant evidence, and cooperate with lawful authorities under the limits in the Privacy Policy.

10. Credentials, devices, and organizational security

Each user must use an individually assigned account where the Service supports one, protect passwords and recovery methods, and promptly report suspected compromise. Customer must apply appropriate access approvals, least privilege, staff training, device controls, and secure handling of exports. Administrators should enable additional authentication controls when available and suitable to the deployment.

Customer is responsible for its networks, endpoints, browsers, email accounts, integrations, and local copies. We are responsible for maintaining reasonable safeguards for the systems we control. Neither party may use this allocation to avoid responsibility for harm caused by its own breach. Customer must not disable protective controls or ask support staff to disclose another person's password or bypass verification.

We may require credential rotation, revoke suspicious sessions, challenge unusual access, or temporarily restrict an account when reasonably necessary to protect users. Such measures may affect availability while a threat is investigated. We will seek to restore legitimate access after the risk is addressed and required verification is completed.

11. Customer Data ownership and limited processing license

As between the parties, Customer and the relevant rights holders retain their rights in Customer Data. No sale, transfer of title, or blanket assignment of education records or Personal Data occurs. Customer grants edvance and its authorized service providers a nonexclusive license during the permitted processing period to host, store, organize, reproduce, transmit, format, index, back up, retrieve, and otherwise process Customer Data only as needed to provide, maintain, secure, support, and lawfully administer the Service under the Agreement.

This license includes transformations required for imports, exports, search, reporting, troubleshooting, disaster recovery, and Customer-requested features. It permits processing necessary to investigate abuse, comply with binding legal requirements, and establish or defend legal claims to the extent legally permitted and consistent with a controlling DPA. It does not permit unrelated exploitation of identifiable student records, sale of Customer Personal Data, or unrestricted licensing of confidential content.

Customer represents that it has the necessary rights and lawful authority to issue these instructions and grant this license. If a third party asserts ownership or privacy rights, we may ask Customer to substantiate its authority, restrict disputed processing, or comply with a binding order. We will not treat Customer's claimed ownership as eliminating the independent rights of students, parents, employees, or other individuals.

12. Operational analytics and permitted product improvement

We may process operational measurements to monitor reliability, diagnose faults, allocate capacity, prevent fraud, improve usability, and evaluate delivery of the Service. Where these measurements contain Personal Data, processing remains purpose-limited, proportionate, and governed by the relevant controller or processor role. A commercial interest in improvement does not itself authorize using all Customer Data for any purpose.

We may create and use aggregated or deidentified statistics for legitimate business analysis, service improvement, research into service performance, and publication of nonidentifying trends where permitted by law and the DPA. We will not intentionally reidentify protected deidentified data or publish information reasonably likely to identify an individual or expose Customer's confidential records. Aggregation must be assessed for small groups and unusual attributes that could still reveal identity.

Identifiable school-authorized children's data and protected education records may be used only for the authorized educational service and legally permitted supporting purposes. Customer-specific confidential content will not be used to train a generally available AI model without a separate lawful arrangement expressly permitting that processing. Customer acceptance of these Terms does not supply parental consent for unrelated advertising or commercial model training.

13. Confidentiality and permitted disclosures

Each party must protect the other's Confidential Information using reasonable care and at least the care it uses for its own information of similar sensitivity. It may use that information only to perform or exercise rights under the Agreement and may disclose it only to personnel, advisers, and service providers with a legitimate need to know and appropriate confidentiality duties.

Confidential Information does not include information the receiving party can show was lawfully public, already known without a duty of confidence, independently developed without use of protected information, or lawfully obtained from a third party without restriction. These exceptions do not remove protections from Personal Data merely because one element appears in public. A combination of nonpublic records may remain confidential even when individual facts are public.

A party may disclose information to the extent legally compelled, after giving advance notice where lawful and reasonably practicable, and limiting disclosure to the legally required scope. Neither party must violate law, compromise an investigation, or endanger an individual to give notice. Confidentiality survives termination for as long as the information remains protected under applicable law or the Agreement.

14. Data protection roles and processing instructions

For school records processed to deliver the school-selected Service, Customer generally determines purposes and means and acts as controller or equivalent responsible institution, while edvance acts as processor or service provider. For our own account administration, security, invoicing, legal compliance, and direct business communications, we may act as an independent controller. Actual roles depend on facts and law; labels do not override substantive responsibilities.

Where processor terms are legally required, the parties must put an appropriate DPA in place before regulated processing requiring that agreement begins. These Terms do not replace mandatory contractual particulars, approved international transfer clauses, or a necessary school district agreement. Customer may request a DPA and information reasonably necessary to evaluate the proposed processing through support@edvance.space.

We will process Customer Personal Data under documented, lawful instructions within the Agreement, maintain personnel confidentiality, and provide reasonable cooperation with applicable data subject requests, risk assessments, regulator inquiries, and security obligations. If an instruction appears unlawful, we may notify Customer and suspend that instruction while the parties resolve it, unless law prohibits notice. Material assistance outside contracted services may be charged at reasonable agreed rates, except where law requires otherwise or it addresses our own breach.

15. Student records, schools, parents, and children

Customer must identify the lawful educational purpose and ensure that notices and authorizations accurately describe the Service. Where a school authorizes collection from children under an applicable school consent exception, that authorization is limited to the school-requested educational service. It does not authorize behavioral advertising, sale of student profiles, unrelated commercial profiling, or indefinite retention for speculative future use.

Where the United States Family Educational Rights and Privacy Act applies and the parties rely on the school official exception, processing must remain under the institution's legally required direct control for authorized institutional functions and applicable use and redisclosure limitations. Where the Children's Online Privacy Protection Act applies, the responsible party must satisfy applicable notice and verifiable parental or valid school authorization requirements. A teacher's personal acceptance does not automatically establish school-level authority.

Schools remain responsible for responding to educational record inspection, amendment, and access requests under the applicable legal framework, with our reasonable assistance for records we process on their behalf. A parent or student may contact us if they cannot identify the institution or believe data has been collected improperly. We may route the request to the school after appropriate verification while addressing any independent obligations we have.

16. Security program and shared safeguards

We will maintain technical and organizational measures designed to protect Customer Personal Data against unauthorized access, disclosure, alteration, and destruction, taking account of risk, sensitivity, state of the art, and the nature of processing. Appropriate measures may include access controls, secure communications, protected credentials, logging, vulnerability management, backup protection, and incident response procedures. Deployment-specific commitments must be described in an applicable security schedule.

These Terms do not claim that a particular certification, encryption configuration, penetration testing frequency, data residency arrangement, recovery objective, or dedicated infrastructure is available unless expressly agreed. Security is a continuing responsibility, and no internet service can guarantee the absence of every vulnerability or outage. We will not materially reduce agreed safeguards during an active Order without an appropriate contractual process.

Customer must report suspected incidents promptly and preserve relevant evidence without exposing additional records. We may need proportionate cooperation, affected identifiers, dates, and technical observations to investigate. Customer must not publish live credentials, private student records, or exploit details in a public issue tracker when seeking support.

17. Security incidents and notification

On becoming aware of a Security Incident affecting Customer Personal Data, we will investigate, take reasonable containment and remediation measures, and notify Customer without undue delay and within any deadline imposed by applicable law or the DPA. Initial notification may be provided before all facts are known, with material updates as the investigation progresses. Notice is not an admission of liability or a final determination of cause.

To the extent available and legally permissible, information will address the nature of the incident, categories of affected records, likely consequences, mitigation measures, and a contact route. We may withhold information that would expose another Customer, compromise security, waive legal privilege, or violate law, while supplying sufficient information to support Customer's legal obligations.

Customer is generally responsible for communications to its own users and regulators where it is the controller, except where law imposes an independent duty on us or the parties agree otherwise. The parties will coordinate reasonably and will not knowingly make materially misleading public statements. No provision authorizes delaying a legally required notification while awaiting commercial approval.

18. Hosting, subprocessors, and international transfers

We may engage qualified infrastructure, communications, support, security, and other service providers to deliver the Service. Where they process Customer Personal Data for us, we will impose appropriate written duties, limit access to the required purpose, and remain responsible for our processor obligations under the Agreement. A selected integration independently contracted by Customer may instead be Customer's own provider.

Hosting, support, and backup locations depend on the deployment and agreed arrangements. No local hosting, exclusive residency, or country-specific support commitment is implied by a Customer's address or a sales contact's location. Customer must obtain confirmation of any mandatory residency requirement before uploading regulated records. We will respect an expressly agreed location restriction.

Where an international transfer requires a legal mechanism, the parties must implement the applicable safeguard, such as an adequacy basis or approved contractual clauses, and any necessary supplementary measures. Acceptance of these Terms alone is not a substitute for mandatory transfer safeguards. Information about relevant subprocessors and material changes can be requested through support@edvance.space, subject to the DPA's notice and objection procedure.

19. Storage, records management, and retention

We may store Customer Data in active systems, indexes, replicas, caches, and protected backups as reasonably needed to deliver the Service and meet authorized retention requirements. Customer remains responsible for choosing its legally required educational record retention periods and issuing permitted configuration or deletion instructions. Storage entitlements are subject to the purchased plan and any agreed archival schedule.

We may retain account, transaction, security, consent, dispute, and compliance records for the specific period reasonably necessary for their purpose, mandatory retention duties, limitation periods, and narrowly scoped legal holds. We will limit retained information, restrict its use and access, and delete or deidentify it when the justification ends. We do not acquire a right to retain all student records forever because they might later be useful.

Deletion from production systems may precede expiry from backup rotations. During that interval, backup data will remain protected and unavailable for ordinary processing; if restored for recovery, applicable deletion instructions must be reapplied. A binding retention schedule, deletion deadline, or recovery commitment must be specified in the DPA or Order where required. Customer should request those particulars before relying on a specific archival or recovery period.

20. Export, return, deletion, and legal holds

Customer should export records it needs while its subscription and authorization remain active. Available exports may depend on feature support, volume, format, and the rights of affected individuals. We do not guarantee that exports will recreate proprietary workflows, software, analytics logic, third-party formats, or deleted information. Reasonable custom migration assistance may require a separate scope and fee.

After termination, we will handle return or deletion of processor-held Customer Personal Data according to the DPA, lawful instructions, and applicable law. Customer should contact support promptly to arrange a transition; these Terms alone do not promise a fixed post-termination access window. Retention exceptions must be limited to information and periods required by law or another legitimate and compatible purpose permitted by the applicable role.

A legal hold may temporarily override routine deletion only to the extent necessary to preserve relevant evidence. Access will be restricted to the hold's purpose, and the hold will be reviewed and released when no longer justified. Deletion of a tenant does not necessarily require deletion of a legally required invoice or a minimal record of contractual acceptance, but it does not authorize continued use of the tenant's teaching records for unrelated purposes.

21. Artificial intelligence, automation, and human review

If an AI or automated feature is offered, its availability and scope are determined by the current product and Order. Generated summaries, suggestions, assessment materials, classifications, and predictions may be incomplete, inaccurate, biased, or unsuitable for a particular curriculum. They require qualified human review before use in teaching or decisions affecting a person's rights, opportunities, health, safety, or academic record.

Customer must not rely solely on automated output for admissions, discipline, grading, safeguarding, disability support, or similarly consequential decisions where human judgment or law requires more. Customer must verify factual claims, citations, age suitability, permissions, and confidential information in generated content. We do not represent that an output is unique, copyrightable, free of all third-party claims, or validated for a regulated decision.

AI processing of Customer Data must stay within documented instructions and agreed provider restrictions. We will not treat activation of an ordinary account as authorization to send all records to an unspecified model provider. Customer should assess any feature-specific disclosure and approval process before enabling AI on sensitive records. Optional features that require additional consent or contractual safeguards must satisfy those requirements independently.

22. Integrations, messaging, and external services

Customer may choose to connect external identity, email, payment, communication, storage, or other services where integrations are available. Customer authorizes only the transfers and actions necessary for its selected integration and must ensure that it has the right to disclose the relevant information. Third-party services have their own terms and privacy notices, and we do not control their independent processing.

We may change or discontinue an integration when an external provider changes its interface, terms, security posture, or availability. We will use reasonable efforts to communicate a material impact, but cannot guarantee continued compatibility with every external service. Customer must not share more student or staff information with an integration than its purpose requires.

Message delivery depends on valid addresses, provider policies, networks, and recipient settings. The Service is not an emergency communication or safeguarding response system. Customer must maintain appropriate channels for urgent matters and lawful approvals for communications to parents, students, and staff, including any applicable marketing or telecommunication consent.

23. Fees, billing, taxes, and payment authorization

Customer must pay the fees and charges in its Order or purchase confirmation in the stated currency and payment schedule. Fees may be based on subscription tier, user or campus counts, usage, storage, or separately purchased services. Customer authorizes the payment method and recurring charges expressly disclosed at purchase. We may use a payment provider or merchant of record; the relevant checkout identifies the entity collecting payment and applicable payment terms.

Unless the Order states otherwise, fees exclude applicable taxes, duties, and levies. Customer must provide accurate tax and billing information and is responsible for taxes it is legally required to pay, excluding taxes on our net income. Where withholding is legally required, Customer must provide appropriate evidence and cooperate with lawful treaty or exemption procedures; any gross-up obligation must be stated in the Order.

An unpaid charge does not authorize deletion or disclosure contrary to law. We may issue reminders, restrict paid features, or suspend service for material nonpayment after appropriate notice where practicable. Customer must notify us promptly of a genuine billing dispute and pay undisputed amounts. Charges, interest, or recovery costs apply only if disclosed in the Order or permitted by applicable law.

24. Subscription term, renewal, changes, and refunds

The subscription term and renewal mechanism are those disclosed in the Order or checkout. Automatic renewal applies only where clearly agreed and legally permitted, with required notices and cancellation methods. Customer must cancel through the stated channel before the applicable renewal deadline to prevent the next agreed renewal. Cancelling renewal generally does not end access to an already paid term unless the parties agree otherwise.

Changes to plans, seats, campuses, or usage may produce prorated charges or different entitlements only as disclosed at the time of change or in the Order. We may update prices for a future renewal after the notice required by the Agreement and law. A material price change does not retroactively alter an already committed fixed-price term.

Fees are nonrefundable to the extent permitted by law, except for an express refund commitment, an applicable statutory cancellation right, or a remedy stated in the Agreement. Consumer cooling-off rights and mandatory refund rights remain intact. A free trial may convert to a paid subscription only under the conversion terms and authorizations actually presented to Customer.

25. Availability, maintenance, support, and service changes

We will use reasonable skill and care to operate the contracted Service. Availability depends on maintenance, networks, security measures, and external providers. Any guaranteed uptime, response time, support hours, service credit, recovery point, or recovery time must be set out in an SLA or Order. General descriptions of reliability do not create an unqualified uninterrupted availability warranty.

We may maintain and improve the Service, correct defects, and change interfaces and implementation details. We will use reasonable efforts to notify Customer of planned maintenance or material changes affecting contracted workflows. During an active paid term, we will not intentionally remove a core contracted capability without a commercially reasonable alternative, transition arrangement, or other remedy required by the Agreement or law.

Trials, previews, experimental features, and beta functionality may be changed or withdrawn and may have additional limitations disclosed at access. They must not be used as the sole repository for critical records unless expressly approved. Beta status does not remove our mandatory privacy, confidentiality, or security obligations for information we receive.

26. Intellectual property, content, and feedback

edvance and its licensors retain all rights in the Service, software, designs, documentation, interfaces, methods, and related technology. Except for the limited access right and rights expressly granted in an Order, no intellectual property license is implied. Customer retains its own content rights, subject to lawful third-party rights and the limited processing license above.

Customer may voluntarily provide suggestions and feedback. We may use that feedback without payment or attribution to improve our products, provided we do not disclose Customer Confidential Information or process Personal Data beyond the permitted purposes. A feedback license does not transfer ownership of student records, confidential assessment materials, or Customer trademarks.

Neither party may use the other's name, logo, or identifiable customer story in public marketing without prior permission, except for a factual disclosure required by law or an express publicity permission in the Order. We may identify the Service provider in ordinary product interfaces. Customer may not remove proprietary notices or misrepresent the source of the Service.

27. Suspension, protective action, and restoration

We may suspend an affected account, feature, or tenant where reasonably necessary to address a material security threat, unlawful use, a binding legal requirement, material breach, or significant unpaid charges. We will tailor the restriction to the issue where practicable and provide notice and an opportunity to cure unless urgency, law, or the risk of harm prevents it.

Suspension is not a transfer of Customer Data ownership and does not eliminate applicable return, confidentiality, or retention obligations. Where safe and legally required, the parties will cooperate on access to essential records or permitted exports. We may require remediation, payment of undisputed overdue fees, or verification before restoring access.

Customer remains responsible for its own statutory duties during suspension and should maintain appropriate continuity arrangements. We are not required to continue unsafe or unlawful processing to avoid inconvenience, but will not use a routine billing dispute to impose disproportionate restrictions on rights guaranteed by law.

28. Termination and consequences

Either party may terminate for a material breach that remains uncured thirty days after written notice specifying the breach, unless a shorter period is legally required or the breach cannot reasonably be cured. A party may terminate immediately where continued performance would be unlawful, a serious security or abuse risk cannot be managed, or the other party ceases business in circumstances materially preventing performance, subject to applicable insolvency law.

On termination or expiry, access rights end except for an expressly agreed transition. Customer must stop using protected software and pay accrued, undisputed charges. Any prepaid refund or remaining committed fees will be determined by the Order, the cause of termination, and mandatory law; termination does not automatically create an entitlement to a full refund or accelerate fees beyond what the Agreement permits.

Provisions intended to survive include accrued payment obligations, intellectual property, confidentiality, permitted retention, deletion and return, liability limitations, dispute resolution, and statutory rights. We will not continue processor use of Customer Data merely because a general survival clause exists. Post-termination processing must have its own lawful and contractual justification.

29. Warranties and disclaimers

Each party represents that it has authority to enter the Agreement and will comply with laws applicable to its own performance. We will provide the contracted Service with reasonable skill and care and materially in accordance with the applicable Order and documentation. Customer must notify us of a material nonconformity with enough detail for investigation, and we will have a reasonable opportunity to correct it or provide the remedy required by the Agreement.

Except for express warranties and nonwaivable legal obligations, the Service and outputs are provided as available. We disclaim implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, title, and noninfringement to the extent law permits. We do not guarantee that every error will be corrected, that every threat will be prevented, or that a user will achieve a particular educational, financial, accreditation, or operational outcome.

These disclaimers do not exclude obligations explicitly undertaken in a DPA, an SLA, or a signed security addendum. They do not limit mandatory consumer guarantees or excuse fraud, deliberate misconduct, or another liability that cannot lawfully be excluded. Customer should obtain any required regulated assurance through a negotiated written commitment.

30. Liability allocation and limitations

To the maximum extent permitted by law, neither party is liable to the other for indirect, incidental, special, exemplary, punitive, or consequential loss, or loss of anticipated profits, business opportunities, goodwill, or expected savings arising from the Agreement. Characterization of a loss depends on applicable law; a contractual label does not automatically convert direct remediation costs into excluded indirect loss.

Subject to the exceptions below and any different signed allocation, each party's aggregate liability arising out of or relating to the Agreement in any twelve-month period will not exceed the fees paid or payable by Customer for the affected Service during the twelve months preceding the event first giving rise to the claim. Related events form one claim for the applicable cap and cannot be multiplied by bringing claims through different theories or users.

The cap does not limit Customer's obligation to pay properly due fees, either party's fraud or deliberate misconduct, or liability that applicable law prohibits limiting, including death or personal injury caused by negligence where applicable. Mandatory statutory compensation rights remain intact. Any higher security, privacy, confidentiality, or indemnity cap must be agreed in the Order or DPA; this clause cannot override a controlling mandatory transfer instrument.

31. Customer indemnity and third-party claims

For business and institutional Customers, Customer will defend edvance against a third-party claim arising from Customer Data that infringes a third party's intellectual property rights, Customer's unlawful instructions, or Customer's knowing misuse of the Service, and pay damages and reasonable settlement amounts finally awarded or approved under this clause. This obligation applies only to the extent the claim was caused by Customer's breach or conduct, and not by edvance's own breach, negligence, or unauthorized processing.

We must promptly notify Customer of the claim where lawful, allow Customer reasonable control of the defense using competent counsel, and provide reasonable cooperation at Customer's expense. Customer must not agree to a settlement imposing an admission, payment, nonmonetary obligation, or restriction on edvance without our prior written approval, which will not be unreasonably withheld. We may participate with our own counsel at our own expense.

This indemnity does not impose an unrestricted defense obligation on a child, ordinary Authorized User, or consumer where prohibited. edvance intellectual property indemnities, if purchased, are governed by the applicable enterprise Order or negotiated addendum. Neither party may recover the same loss twice under different provisions.

32. Claims, governing law, and dispute resolution

The parties will first attempt in good faith to resolve a commercial dispute through their designated contacts. A party should send a written description of the issue, relevant dates, and requested resolution to the other party's contractual contact, with notices to edvance routed through support@edvance.space for the legal team. This process does not prevent urgent protective relief, statutory complaints, or filing needed to preserve a limitation period.

The applicable Order may specify governing law and a competent forum where legally permitted. If it does not, governing law and jurisdiction are determined under applicable legal rules. No country of incorporation or exclusive foreign forum is implied by the trading name. Any contractual choice remains subject to mandatory consumer, employee, student, privacy, and other protected-person rights and legally required local forums.

These Terms do not impose mandatory arbitration or a waiver of nonwaivable collective, representative, regulator, or complaint rights. A DPA or mandatory international transfer instrument may provide additional rights or forums for affected individuals. Applicable statutory limitation periods control unless a valid signed enterprise agreement provides otherwise.

33. Notices, modifications, and renewed acceptance

We may send service and contractual notices to the administrator or billing contact in the account, through the Service, or by another agreed channel. Customer must keep those contacts current and designate a person who can receive security and privacy notices. Legally formal notices must satisfy the Order and applicable service rules; an in-product message does not replace mandatory legal service where a different method is required.

We may propose updated Terms to reflect changes in law, security, products, or commercial arrangements. Material changes will be communicated with reasonable advance notice where practicable and will take effect for an existing committed term only as permitted by the Agreement and law. A change requiring affirmative acceptance will not be treated as accepted solely because a user failed to find a notice.

Privacy changes requiring a new legal basis, renewed parental authorization, or a revised DPA must complete that process before the affected new processing begins. We will maintain a document version identifier and preserve acceptance evidence where required. Customer may reject a material change according to its contractual termination or nonrenewal rights; it may not continue using a materially different service without the necessary agreement.

34. Assignment, force majeure, and general provisions

Customer may not assign the Agreement without our prior written consent, not to be unreasonably withheld for a legitimate internal restructuring that does not increase risk or reduce payment security. We may assign the Agreement to an affiliate or a successor in a merger, reorganization, or sale of the relevant business, provided that the successor assumes our obligations and any required privacy, notice, or consent rules are satisfied. A business transfer does not extinguish data protection restrictions.

Neither party is responsible for delay caused by events beyond its reasonable control, such as natural disasters, widespread network failures, war, civil disorder, or government action, to the extent the event actually prevents performance and reasonable mitigation is undertaken. This does not excuse accrued payment, confidentiality, reasonable incident response, or legal obligations that remain performable. If an event materially prevents the Service for a prolonged period, the parties will discuss a reasonable transition or termination arrangement.

The parties are independent contractors. No partnership, employment, fiduciary, or agency relationship is created merely by the Agreement. Failure to enforce a term is not a waiver. If a provision is invalid, the remaining provisions continue to the extent they can operate lawfully, and the invalid provision will be limited only as necessary. The Agreement constitutes the parties' complete agreement on its subject, without excluding liability for fraudulent statements or mandatory precontractual rights.

35. Enterprise schedule: processing particulars and procurement

Before deploying sensitive institutional workloads, Customer should obtain an Order and DPA identifying the subject matter and duration of processing, nature and purposes, categories of individuals and data, authorized instructions, locations, security measures, subprocessors, assistance duties, and return or deletion arrangements. Typical school workloads may involve student and guardian profiles, attendance, coursework, grades, staff information, communications, and audit records; the actual authorized scope is the scope agreed for that Customer.

Customer must not infer a certification, regulatory approval, public sector procurement qualification, or completed impact assessment from the word enterprise or from these Terms. Where audit rights apply, the parties may use reasonable assurance materials, questionnaires, or proportionate inspections subject to confidentiality, security, and protection of other Customers. A mandatory audit right cannot be made ineffective by unreasonable cost or access conditions.

Additional commitments on disaster recovery, accessibility, insurance, escrow, special category data, professional services, data residency, and transition support require an appropriate written schedule. Until agreed, Customer should not rely on them as purchased entitlements. This schedule identifies contracting requirements and does not replace the required completed particulars.

36. Enterprise schedule: record lifecycle and permitted residual records

Customer should distinguish active educational records from archival records, security logs, commercial transaction records, support materials, and consent evidence. Different purposes may require different retention periods and access groups. An administrator's ability to view a record is not sufficient justification for indefinite retention or unrestricted disclosure. Retention decisions should account for legal duties, safeguarding needs, ongoing disputes, and the individual's interests.

Permitted residual records may include a minimal invoice, tax evidence, fraud prevention marker, documented consent event, correspondence needed to resolve a complaint, or relevant evidence under a lawful hold. We may use those records for the retained purpose and authorized legal defense, but not to rebuild deleted student profiles or resume unrelated marketing. Any lawful refusal to delete must identify the applicable reason at an appropriate level of detail.

Customer requests to restore deleted or expired records may be impossible or may require a separately agreed recovery service. Neither a subscription payment nor a prior upload guarantees perpetual recoverability. We will handle restoration in a way designed to preserve current access restrictions and avoid reintroducing records already subject to valid deletion instructions.

37. Contact and document administration

Questions about the Agreement, enterprise schedules, contracting details, or formal notice routing should be sent to support@edvance.space with the subject Legal. Privacy requests should be sent to privacy@edvance.space. Do not include passwords, complete student records, identity documents, or payment credentials in an initial message; we will arrange an appropriate channel if additional verification is necessary.

The current public Terms are available at https://edvance.space/terms-of-service and the Privacy Policy at https://edvance.space/privacy-policy. The applicable contracting entity and any legally required postal notice details must be identified in the Customer's Order or supplied through the contact route before contracting where required. A public page does not amend a negotiated enterprise Order beyond the change process that Order permits.