California Addendum to the Student Data Privacy Agreement

This California Addendum supplements the Student Data Privacy Agreement ("DPA") between Evrica Technologies Inc. (the "Provider") and the California local education agency ("LEA") that has accepted the General Offer of Privacy Terms. If any term of this Addendum conflicts with the DPA, this Addendum controls for California LEAs.

1. AB 1584 — California Education Code § 49073.1 Compliance

The Provider expressly affirms the following with respect to Pupil Records collected, accessed, or used under the DPA:

1. Pupil Records Ownership. Pupil Records continue to be the property of and under the control of the LEA.
2. Parent / Pupil Access. The LEA may permit a parent, legal guardian, or eligible pupil to review, correct, or delete Pupil Records, and the Provider will cooperate by making the relevant data available to the LEA within thirty (30) days of a request.
3. Unauthorized Disclosure. Procedures for notifying affected parents, legal guardians, or eligible pupils in the event of an unauthorized disclosure are described in Section 5 of the Security and Data Protection Plan and in Article V of the DPA. Notice will be provided to the LEA within seventy-two (72) hours of discovery.
4. No Use for Other Purposes. The Provider will not use any Pupil Records for any purpose other than those required or specifically permitted by the DPA.
5. Right to Challenge Accuracy. A parent, legal guardian, or eligible pupil may challenge the accuracy of Pupil Records by contacting the LEA, which will forward the request to the Provider; the Provider will respond within thirty (30) days.
6. Data Storage Location. Pupil Records are stored within the United States on infrastructure operated by the subprocessors listed in Exhibit D.
7. Data Security. The Provider will maintain administrative, technical, and physical safeguards as described in the Security and Data Protection Plan.

2. SOPIPA — CA Business & Professions Code §§ 22584–22585 Compliance

As a covered operator of a website, online service, or mobile application designed and marketed for K–12 school purposes, the Provider affirms that it will not:

• Engage in targeted advertising on its service, or on any other site, service, or application, when the targeting is based on any information acquired because of the use of Oscar.
• Use information, including Covered Information and persistent unique identifiers, created or gathered through Oscar to amass a profile of a K–12 student, except in furtherance of K–12 school purposes.
• Sell or rent a student's information, including Covered Information.
• Disclose Covered Information unless the disclosure is made (a) in furtherance of K–12 school purposes; (b) to ensure legal and regulatory compliance; (c) to respond to or participate in a judicial process; (d) to protect the safety of users or the security of the service; or (e) to a service provider, provided that the operator contractually prohibits the service provider from using Covered Information for any purpose other than providing the contracted service.

The Provider further affirms that it will:

• Implement and maintain reasonable security procedures and practices appropriate to the nature of the Covered Information, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Delete a student's Covered Information within a reasonable time period (and in any event within forty-five (45) days) of an LEA request, unless a parent has consented to the maintenance of the Covered Information.

3. California Consumer Privacy Act ("CCPA") / California Privacy Rights Act ("CPRA")

While information collected from K–12 students under this DPA is generally exempt from the CCPA under § 1798.145(j) when collected at the direction of an LEA, the Provider nonetheless commits to the substance of the CCPA/CPRA requirements regarding security, deletion, and prohibition on the sale of personal information, as set forth in this DPA.

4. AB 2273 — Age-Appropriate Design Code (anticipatory compliance)

The Provider designs Oscar in accordance with the spirit of the California Age-Appropriate Design Code Act, including: defaulting privacy settings to the highest level, minimizing data collection, providing prominent reporting tools, presenting information in age-appropriate language, and avoiding design patterns that encourage children to provide additional personal information beyond what is necessary.

5. Local Control Accountability Plan ("LCAP") Alignment

The Provider supports LEA reporting under the LCAP by providing aggregated, de-identified engagement and progress metrics relevant to (a) English Learner reclassification progress, (b) student engagement of low-income and foster-youth populations, and (c) social-emotional indicators aligned to the CASEL framework. These reports are available to the LEA at no additional cost.

6. Compliance with CA ELD Standards and Standards Alignment

Oscar's bilingual scaffolding is aligned to the California English Language Development Standards (CA ELD) and the WIDA framework. See the full Standards Alignment Statement.

7. Mandated Reporter Cooperation

The Provider's safety system will notify a designated school official ("Designated Recipient") at the LEA in the event Oscar detects content reasonably indicating suspected child abuse, neglect, self-harm, or risk to the safety of the student or another person. The LEA will identify the Designated Recipient and the notification channel in writing prior to the start of Services.

8. Signatures

Provider: Evrica Technologies Inc.
By: Anna M. Sarkisyan, Chief Executive Officer
Date: May 29, 2026

LEA: __________________________
By: __________________________
Title: __________________________
Date: __________________________