Commercial Terms and Conditions of Sale

In addition to the data rights and obligations described in Clause 10 (Data Protection, Use of Data, Security, and Accessibility) of the Agreement, the following terms in this Clause A2 apply specifically to public-sector Customers in the United States and Canada.

A2.1 Legal Compliance with Privacy Laws

LuxAI complies with applicable student and data privacy laws in the United States and Canada, including, where applicable:

• U.S.: The Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act (COPPA), the Protection of Pupil Rights Amendment (PPRA), and relevant state-specific student data privacy laws; and
• Canada: The Personal Information Protection and Electronic Documents Act (PIPEDA) and relevant provincial privacy laws.

A2.2 Student Data Rights

This clause is intended to satisfy FERPA’s written agreement requirement for third-party school officials and applies equally to Student Data processed under Canadian law, subject to any more stringent provincial requirements.

A list of applicable privacy laws and compliance frameworks, including state- and province-specific obligations, is provided in Sections A2.3 (United States) and A2.4 (Canada).

“Student Data” means any information that:

• is directly related to an individual student, and
• is accessed, collected, generated, maintained, or processed by LuxAI on behalf of a public educational institution or public body, including where such information pertains to a minor or child participating in a legally authorized program or service.

This includes, but is not limited to:

• “Education records” as defined by the U.S. Family Educational Rights and Privacy Act (FERPA);
• Personally identifiable information (PII) as defined by applicable U.S. state student privacy laws (e.g., SOPIPA, NY Ed Law 2-d, TX HB 2087); and
• Personal information under applicable Canadian federal and provincial privacy laws (e.g., FIPPA, MFIPPA, FOIP) when such information pertains to students.
• System-generated logs, metadata, or usage analytics to the extent that such data is reasonably capable of being linked to a specific student, either directly or indirectly, by the Customer or LuxAI.

Student Data does not include:

• De-identified or aggregated data, provided that: (i) the data cannot reasonably be used to identify an individual student, whether alone or in combination with other available information or through reasonably foreseeable methods; (ii) the data is not used for targeted advertising or behavioral pro-filing, and is not disclosed to third parties for such purposes; and (iii) the de-identification process complies with the definitions and standards of “de-identified” data under FERPA, COPPA, and applicable Canadian federal or provincial privacy laws; and
• Metadata, diagnostic, or technical information generated by LuxAI’s systems in the ordinary course of operating, maintaining, or supporting the Services, to the extent that such information: (i) is not reasonably capable of being associated with or used to identify a specific student; and (ii) is used solely for service delivery, maintenance, security, or analytics.

The Customer remains the custodian or controller of Student Data under applicable law, and LuxAI acts solely as a data processor or service provider on the Customer’s behalf.

LuxAI shall:

• Be deemed a “School Official” (or equivalent under applicable law) with a legitimate educational interest;
• Process Student Data solely to provide, maintain, or improve the Services, under the documented instructions of the Customer;
• Collect personal information only as necessary to perform the Services and, unless expressly authorized by the Customer, only directly from the individual to whom it relates, not from third parties or automated tracking systems.
• Not disclose Student Data to third parties except as permitted by this Agreement, required by law, or with the Customer’s prior written consent; and shall promptly notify the Customer of any such request or anticipated legal obligation to disclose, unless legally prohibited or otherwise expressly agreed. If prohibited by law, LuxAI shall use reasonable efforts to obtain a waiver of the prohibi-tion to permit notification and shall limit the disclosure to the minimum required by law;
• Implement administrative, technical, and physical safeguards to protect the confidentiality and integrity of Student Data;
• Support the Customer in fulfilling its legal obligations related to access, correction, deletion, or, where applicable, portability of Student Data, consistent with applicable laws; and shall not independently respond to any parent or student request without the Customer’s express written instruction, except where required by law.

Student Data Retention:

Following termination or expiration of the Agreement, LuxAI shall securely delete or, where requested, return all applicable Student Data from its production systems, unless retention is required by applicable law or reasonably necessary to establish, exercise, or defend legal claims.

If the Customer submits a written request for deletion of Student Data, LuxAI shall securely delete or, where requested, return the specified Student Data within thirty (30) days of receiving such request, unless continued retention is required by applicable law or reasonably necessary to perform contractual obligations.

In the absence of such a request, LuxAI may retain Student Data for up to one hundred eighty (180) days after service termination to support potential license reactivation, account restoration, audit assistance, or other legitimate administrative continuity needs.
Backup copies of Student Data may persist for up to sixty (60) days following deletion from production systems, solely for disaster recovery, security, or compliance purposes, and shall not be used for any other purpose. All such backup data shall remain subject to LuxAI’s confidentiality, security, and data protection obligations under this Agreement.

If any applicable law, binding procurement agreement, or Customer-provided written data-sharing policy imposes stricter requirements regarding data retention or deletion, such stricter requirement shall take precedence over this Section to the extent of any conflict.
LuxAI shall maintain verifiable internal logs of Student Data deletion or return actions under this Section for audit, transparency, and compliance purposes.

Refer to Section A2.7 (Compliance and Audit Support) for information about metadata, logs, and system records associated with Student Data.
Advertising Limitations:
LuxAI shall not use Student Data for commercial purposes, including behavioral profiling, targeted advertising, or direct marketing to students or their families. This restriction does not limit LuxAI’s ability to:

• Use Student Data to provide adaptive learning, individualized educational support, or personalized content recommendations as part of the Services;
• Generate and present content recommendations or product suggestions to authorized educators or administrators, provided such communications relate to educational use or institutional improvement;
• Communicate with educator or administrative account holders about new features, updates, or improvements to the Services, where such communications are relevant to their role or use of the platform; or
• Use Student Data in any other way that is explicitly permitted under this Agreement or required to deliver the contracted Services in accordance with applicable law.

De-Identified Data

LuxAI may use De-Identified Student Data, which is excluded from the definition of Student Data, only to the extent permitted under applicable law and not objected to in writing by the Customer, in accordance with their institutional data use policies. LuxAI acknowledges that certain public-sector customers, including school boards in Canada and certain U.S. jurisdictions, may prohibit the compilation or generation of any data pertaining to students or users unless explicitly authorized. LuxAI shall not compile or generate such data unless and to the extent expressly permitted by the Customer.

LuxAI shall not attempt to re-identify De-Identified Student Data under any circumstances.
Such data may be used solely for the following limited purposes, and only to the extent permitted by applicable law:

• To support the Customer or publicly funded educational or research institutions in conducting educational, assistive, or health-related program evaluations, research, or service optimization, where such use is permitted by applicable law and institutional policy;
• To improve, test, or develop LuxAI’s educational products and services;
• To demonstrate the effectiveness of the Services or to support adaptive learning functionality, so long as such use does not involve any form of advertising or profiling.
  These permitted uses may continue after the termination of this Agreement, provided the data remains de-identified and is not re-identified or linked to any individual or institution.

LuxAI shall not use De-Identified Student Data for targeted advertising, behavioral profiling, or any activity intended to infer characteristics or preferences of individual users or groups for marketing purposes.

LuxAI shall not publish, present, or disseminate any report or material derived from De-Identified Student Data that references the Customer by name or allows the Customer to be reasonably identified, without the Customer’s prior written approval of both the content and the context.

If LuxAI shares De-Identified Student Data with any third party (e.g., publicly funded educational or research institutions), it shall ensure that the recipient is contractually bound not to attempt re-identification or use the data for any purpose beyond those permitted by this Agreement.

A2.3 User Data Rights

User Data means any personal information (as defined under applicable law) that pertains to a teacher, administrator, staff member, or other non-student user authorized by the Customer to access or interact with the Services. This also includes system-generated logs, metadata, or usage analytics to the extent that such data is reasonably capable of being linked to named or identifiable individuals, either directly or indirectly, by the Customer or LuxAI.

The Customer remains the custodian or controller of User Data, and LuxAI acts solely as a data processor or service provider on the Customer’s behalf. LuxAI shall treat User Data and de-identified User Data with the same level of protection and contractual restrictions as Student Data, as set out in Section A2.2, unless otherwise instructed by the Customer or permitted by applicable law.

A2.4 U.S. State-Specific Student Privacy Laws

LuxAI acknowledges that many U.S. states have enacted student data privacy laws that impose specific contractual, technical, and operational requirements on vendors providing services to public educational institutions. LuxAI is committed to supporting compliance with these laws in addition to its obligations under federal privacy statutes such as the Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act (COPPA), and the Protection of Pupil Rights Amendment (PPRA).

Upon request, LuxAI will provide a supplemental state-specific addendum or policy alignment statement tailored to applicable state laws and institutional requirements. These laws include, but are not limited to:

• California: Education Code § 49073.1 (commonly known as SOPIPA), and related provisions under the California Consumer Privacy Act (CCPA), where applicable to education technology providers;
• New York: Education Law § 2-d and the Parents’ Bill of Rights for Data Privacy and Security, including requirements for breach notification, encryption, and data security;
• Texas: House Bill 2087, relating to digital tool usage, parental consent, and data security in K–12 settings;
• Maryland: Student Data Privacy Act of 2015 (Md. Education Code § 4-131), governing limitations on data use, targeted advertising, and vendor contract terms;
• Colorado: Student Data Transparency and Security Act (C.R.S. § 22-16-101 et seq.), which includes breach response timelines and mandated contract language;
• Illinois: Student Online Personal Protection Act (SOPPA, 105 ILCS 85), including requirements for breach notification within 30 days, data transparency, and written agreements;
• Connecticut: Public Act 16-189, mandating specific contract terms, parent rights to access, and breach response provisions;
• Nevada: NRS § 388.121–388.145, imposing data retention, breach notice, and security obligations on education vendors;
• Utah: Student Data Protection Act (Utah Code § 53E-9-301 et seq.), requiring data governance plans and vendor transparency;
• Other States: Any additional U.S. state statutes, regulations, or district-specific contractual requirements governing student data privacy, technology use, data sharing, or breach reporting.

Where required under applicable U.S. federal or state law, LuxAI shall not collect, compile, generate, use, or retain any data derived from or pertaining to identifiable or de-identified Student interactions, usage metadata, or system activity, except as necessary to deliver the Services under this Agreement, or as otherwise authorized by the Customer in accordance with applicable law.

District-Specific SDPA Templates and Procurement Support
To further support compliance at the state and district level, LuxAI offers district-specific Student Data Privacy Agreements (SDPAs) that incorporate mandatory contractual terms and legal obligations under applicable U.S. state student privacy laws.

As a member of the Access 4 Learning (A4L) Community and an active participant in the Student Data Privacy Consortium (SDPC), LuxAI provides state-aligned SDPA templates, compliance checklists, and supporting documentation upon request. LuxAI also actively supports institutional and district-led vendor vetting processes and will collaborate with education agencies to facilitate SDPC-aligned privacy compliance reviews and approvals.

A2.5 Canadian Provincial Student Privacy Laws

LuxAI acknowledges that Canadian public educational institutions are subject to both federal and provincial privacy laws. Upon request, LuxAI will provide a supplemental addendum addressing applicable Canadian legal and regulatory frameworks, including but not limited to:

• Canada: Personal Information Protection and Electronic Documents Act (PIPEDA);
• Ontario: Education Act, R.S.O. 1990, c. E.2; Municipal Freedom of Information and Protection of Privacy Act (MFIPPA); and the Ontario Student Record (OSR) Guidelines issued by the Ontario Ministry of Education, where applicable;
• British Columbia: Freedom of Information and Protection of Privacy Act (FIPPA), and relevant guidance from the British Columbia Ministry of Education regarding the use of digital tools and student data;
• Alberta: Education Act and Freedom of Information and Protection of Privacy Act (FOIP Act), along with any applicable policies or administrative procedures issued by Alberta Education or local school jurisdictions;
• Manitoba: The Public Schools Act, The Education Administration Act, and The Freedom of Information and Protection of Privacy Act (FIPPA – Manitoba), as well as guidance from Manitoba Education and Early Childhood Learning regarding data privacy and educational technology;
• Saskatchewan: The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP), and any relevant directives from the Saskatchewan Ministry of Education or school boards concerning privacy compliance for service providers.

LuxAI acknowledges that, under applicable Canadian data protection laws, including provincial privacy statutes and, where applicable, PIPEDA, the school board or public body remains the data custodian or controller of Student Data, and LuxAI acts solely as a service provider on its behalf.

Where required under applicable provincial laws or institutional policy, LuxAI shall not collect, compile, generate, use, or retain any data derived from or pertaining to identifiable or de-identified Student or User interactions, metadata, or system usage, except as explicitly authorized in writing by the Customer, or as necessary to deliver the Services in accordance with applicable law and the Customer’s lawful instructions or statutory mandate.

LuxAI applies the student data protections described in Section A2.2 to Canadian Student Data, except where provincial law imposes stricter requirements.

This clause is intended to support compliance with applicable Canadian data protection laws, including provincial statutes and relevant Ministry guidelines, in addition to any federal obligations under PIPEDA.

For language limitations applicable to Canadian public-sector customers, see Clause A1.

A2.6 Student Data Hosting Location

Student Data is hosted in Microsoft Azure data centers located in the United States for U.S.-based Customers, and in Canada for Canada-based Customers. Azure, acting as a subprocessor of LuxAI, provides the physical infrastructure, redundancy, and compliance certifications necessary to support secure and lawful educational data hosting in accordance with applicable U.S. and Canadian privacy laws.
LuxAI may permit remote access to Student Data by authorized personnel solely for the purpose of providing technical support, diagnostics, or service security, and only in compliance with applicable privacy laws and subject to appropriate contractual, technical, and organizational safeguards.
Support services are provided in-house by the LuxAI entity that serves as the contracting party and may also involve personnel from other entities within the LuxAI group, including LuxAI S.A., LuxAI Inc., and LuxAI Ltd. These entities operate under the direct control and data protection policies of the contracting LuxAI entity, which retains full responsibility for all support and service activities described in this clause.

LuxAI shall not otherwise permit access to Student Data from outside the United States or Canada unless required by law or with the Customer’s prior written consent.
For a description of LuxAI’s general data residency and hosting practices, see Clause 10.5 of the Terms and Conditions.

A2.7 Compliance and Audit Support

LuxAI shall retain compliance records, including access logs and system-generated metadata associated with Student Data or User Data, for a period of at least one (1) year following service termination, or longer if required by applicable law.
LuxAI shall also retain a record of any access, correction, or deletion requests received from the Customer regarding Student Data or User Data, along with the actions taken to fulfill such requests, for audit and compliance purposes, for a period of at least one (1) year following service termination, or longer if re-quired by applicable law.
Upon reasonable written request, LuxAI shall provide information regarding its data protection practices to support the Customer’s compliance obligations, including privacy impact assessments (PIAs), risk evaluations, and regulatory or institutional reviews.
The Customer may request a formal audit of LuxAI’s data protection practices no more than once per calendar year, unless otherwise required by applicable law or a material incident occurs. Any such audit shall:

• Be subject to at least thirty (30) days’ advance written notice;
• Be conducted during regular business hours and in a manner designed to minimize disruption to LuxAI’s operations;
• Be limited to information reasonably necessary to verify compliance with this Agreement;
• Be subject to confidentiality obligations, including a mutually agreed non-disclosure agreement; and
• Be performed by the Customer or an independent third-party auditor reasonably acceptable to LuxAI.

LuxAI reserves the right to redact information that implicates third-party confidentiality or platform security and may propose alternate documentation or responses in lieu of on-site inspections, provided such alternatives reasonably satisfy the Customer’s legal or compliance requirements.

LuxAI shall promptly notify the Customer if it determines that it can no longer meet its obligations under applicable data protection laws.

A2.8 Subprocessors

LuxAI may engage subprocessors to support the delivery of its Services, including cloud hosting and technical support. A current list of subprocessors that may process Customer Data is available at https://luxai.com/subprocessors/ and will be updated as required by applicable law.

All subprocessors are subject to written agreements that impose confidentiality, security, and data protection obligations substantially equivalent to those in this Agreement. LuxAI shall not redisclose Student Data to any third party except as permitted by this Agreement or as required by law, and shall require sub-processors to adhere to the same restrictions.

LuxAI remains responsible for ensuring that its subprocessors comply with the terms applicable to them under this Agreement.
Where required by law, LuxAI will provide at least fifteen (15) days’ prior notice— or longer if required by applicable law— of material changes to its subprocessors via email or its customer portal. Customers may raise material objections in writing during this period. A material objection is a good-faith concern that the subprocessor poses a significant risk to the security, confidentiality, or lawful processing of Student Data.

LuxAI will make reasonable efforts to resolve such concerns. If no resolution is reached, the Customer may terminate the affected Services and receive a pro-rata refund of any prepaid, unused service fees.

A2.9 Security Measures

LuxAI implements commercially reasonable administrative, technical, and physical safeguards to protect Student Data and User Data against unauthorized access, disclosure, alteration, and destruction. These safeguards are implemented in accordance with applicable law and recognized industry standards.
LuxAI’s security program is aligned with the CIS Controls, formerly known as the CIS Top 20, a widely adopted cybersecurity framework recognized across K–12 and public-sector environments in the United States and Canada. The CIS Controls have been mapped to the NIST SP 800-53 framework through a crosswalk published by the Center for Internet Security, supporting alignment with public-sector cybersecurity standards.

A.2.10 Breach Response and Indemnity

A2.10.1 Notification and Cooperation

In the event of a data breach, LuxAI shall notify affected Customers in accordance with applicable law and provide sufficient information to support the Customer’s compliance with any notice, reporting, or mitigation obligations and cooperate with reasonable investigation and remediation efforts.
For breaches involving Student Data, LuxAI will provide such notice without unreasonable delay and, in any case, no later than seventy-two (72) hours after confirming the breach, or within any shorter timeframe required by law (e.g., forty-eight (48) hours under certain U.S. state statutes), unless a delay is legally permitted.

A2.10.2 Customer Notification of Unauthorized Access

The Customer shall promptly notify LuxAI upon becoming aware of any known or suspected unauthorized access, disclosure, or compromise of credentials that may affect the security of the Services or hosted Student Data.

A2.10.3 Indemnity for Breach Caused by Gross Negligence or Misconduct

LuxAI shall defend and indemnify the Customer against third-party claims, regulatory actions, or fines arising directly from a personal data breach caused by LuxAI’s gross negligence or willful misconduct in violation of applicable data protection laws, including FERPA, COPPA, or PIPEDA. This indemnity:

• Applies only to personal data processed under the Agreement;
• Excludes breaches caused by the Customer, third-party systems, or shared environments; and
• Is subject to the aggregate liability cap set forth in Clause 7.3 of the Agreement.

Nothing in this clause shall waive or limit any statutory rights of the Customer under applicable law.

A2.11 Complaints, Investigations, and Post-Termination Confidentiality

LuxAI shall notify the Customer within seventy-two (72) hours of receiving any formal complaint, regulatory inquiry, or legal investigation under applicable privacy or access-to-information laws that materially relates to the Services or to the Customer’s Data. LuxAI shall keep the Customer reasonably informed of material developments and outcomes.

LuxAI shall provide access to relevant records and data to authorized privacy oversight authorities, where required by applicable law, for the purpose of investigating compliance with access-to-information or privacy legislation.

LuxAI shall continue to protect all personal information and maintain applicable confidentiality and security obligations after the termination or expiration of this Agreement, in accordance with its contractual and legal obligations.

A2.12 Accessibility and Disability Compliance

LuxAI acknowledges that public educational institutions and other public-sector entities are subject to accessibility laws, procurement requirements, and internal policies. LuxAI designs and maintains its services in alignment with recognized digital accessibility standards, including the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, to support compatibility with assistive technologies and equitable access.

LuxAI makes reasonable efforts to comply with applicable accessibility laws and digital standards in the United States and Canada, including:

• The Americans with Disabilities Act (ADA),
• Section 504 of the Rehabilitation Act (U.S.),
• Relevant U.S. state-level accessibility laws (e.g., California, Texas),
• The Accessible Canada Act,
• The Accessibility for Ontarians with Disabilities Act (AODA),
• The Accessible British Columbia Act

LuxAI maintains a current Voluntary Product Accessibility Template (VPAT) or equivalent accessibility conformance report, based on WCAG 2.1 Level AA and Section 508 standards, and reviews it periodically or following material updates to its Services.

Upon reasonable request, LuxAI will provide:

• Information on accessibility features and assistive technology compatibility,
• Known limitations and improvement plans, and
• Alternate formats of relevant documentation or content to support equitable access.

Where required by law or institutional procurement, LuxAI will cooperate with the Customer’s accessibility compliance efforts, including responding to accessibility questionnaires or participating in accessibility assessments or reviews.

Confidentiality notices displayed on application screens, landing pages, and front pages of reports containing institutional or student data are presented in accessible formats and in a legible font size of at least 12px, in accordance with applicable accessibility laws and procurement guidance.