Student Data Privacy Agreement

Preamble

This Student Data Privacy Agreement (the "DPA") is entered into between Evrica Technologies Inc. (the "Provider"), publisher of the Oscar learning application, and the local education agency that executes this DPA (the "LEA"). The DPA governs the privacy and security obligations of the Provider with respect to Student Data shared by the LEA in connection with the use of Oscar.

This DPA is offered as a General Offer of Privacy Terms pursuant to Article VII below. Any LEA may accept this General Offer by signing Exhibit E without further negotiation, and the terms will apply between the LEA and the Provider as if separately executed.

Article I — Purpose and Scope

1. Purpose. The Provider provides the Oscar service to the LEA solely to deliver age-appropriate, standards-aligned tutoring, social-emotional support, and learning-progress reporting to students enrolled with the LEA.
2. Data Sharing. The LEA discloses Student Data to the Provider only as reasonably necessary for the Services described in Exhibit A.
3. Definitions. Capitalized terms have the meanings set forth in Exhibit C.

Article II — Data Ownership and Authorized Access

1. Student Data Property of LEA. All Student Data transmitted to the Provider pursuant to this DPA is and will continue to be the property of and under the control of the LEA. The Provider acts as a school official with a legitimate educational interest under FERPA (20 U.S.C. § 1232g; 34 C.F.R. § 99.31(a)(1)(i)(B)).
2. Parent Access. The LEA will provide a parent, legal guardian, or eligible student a means to review and correct Personally Identifiable Information ("PII"). The Provider will cooperate with such requests by making the relevant data available through the LEA within thirty (30) days.
3. Third-Party Requests. The Provider will not respond to any third-party request for Student Data, other than as required by law. The Provider will notify the LEA of any subpoena or court order within five (5) business days, except where prohibited by law.
4. Subprocessors. The Provider will use only the subprocessors listed in Exhibit D. The Provider will notify the LEA in writing at least thirty (30) days before adding or replacing any subprocessor.

Article III — Duties of the LEA

1. The LEA will provide data in compliance with FERPA, COPPA, the IDEA, and other applicable laws.
2. The LEA will obtain any required parental consents and post the Provider's Privacy Policy and this DPA in a publicly accessible location.
3. The LEA will only request data necessary to fulfill the purpose of the Services.

Article IV — Duties of the Provider

1. Privacy Compliance. The Provider will comply with all applicable federal, state, and local laws, rules, and regulations pertaining to Student Data privacy and security, including FERPA, COPPA, PPRA, IDEA, CIPA, CA Education Code § 49073.1 (AB 1584), CA Business and Professions Code §§ 22584–22585 (SOPIPA), NY Education Law § 2-d, and applicable parts of the GDPR-K framework.
2. Authorized Use. The Provider will use Student Data only to (a) provide and improve the Services to the LEA; (b) maintain, develop, support, and improve the Services; (c) respond to LEA or student support requests; and (d) comply with legal obligations.
3. No Sale of Data. The Provider will not sell Student Data under any circumstances.
4. No Targeted Advertising. The Provider will not use Student Data, or any information derived from Student Data, for any targeted advertising, behavioral advertising, or any commercial purpose other than providing the Services.
5. No Profiling. The Provider will not amass a profile of a student except in furtherance of K–12 school purposes.
6. De-identified Data. The Provider may use de-identified Student Data for product improvement, research and development, and demonstration purposes, provided that the de-identification is consistent with FERPA and the Provider does not attempt to re-identify the data.
7. Disposition of Data. Upon written request from the LEA, the Provider will dispose of all Student Data within forty-five (45) days using NIST SP 800-88 Rev. 1 sanitization methods, and will certify the disposition in writing.

Article V — Data Provisions

1. Data Security. The Provider will implement and maintain reasonable administrative, technical, and physical safeguards aligned with the NIST Cybersecurity Framework v1.1 and described in the Security and Data Protection Plan (Exhibit F).
2. Encryption. Student Data will be encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent.
3. Data Breach. The Provider will promptly notify the LEA, and in no event later than seventy-two (72) hours after discovery, of any unauthorized access, disclosure, or acquisition of Student Data. The notice will include the categories of data affected, the LEA's affected individuals, mitigation steps, and a point of contact. The Provider will reasonably cooperate with the LEA and law enforcement in any investigation and will bear the costs of remediation to the extent the breach is attributable to the Provider.
4. Audit Rights. Upon reasonable notice, the LEA may audit the Provider's records and practices related to Student Data. Audits may be conducted no more than once per twelve-month period absent cause.
5. Retention. The Provider will retain Student Data only as long as necessary to provide the Services, subject to the Data Disposition provisions of Article IV.

Article VI — General Offer of Privacy Terms

The Provider, by executing Exhibit E ("Form of General Offer"), offers this DPA to all LEAs subject to the terms herein. Any LEA may accept the General Offer by countersigning Exhibit E. Upon countersignature, this DPA, as accepted, will be binding between the Provider and the accepting LEA as of the date of countersignature.

Article VII — Miscellaneous

1. Term. This DPA will commence on the Effective Date and remain in effect until terminated by either party with thirty (30) days' written notice or until all Student Data has been returned or destroyed.
2. Notice. All notices to the Provider will be sent to schools@evrica.ai with a copy to legal@evrica.ai.
3. Severability. If any provision of this DPA is held invalid, the remaining provisions will continue in full force.
4. Governing Law. This DPA is governed by the laws of the State in which the LEA is located, without regard to its conflict-of-laws principles.
5. Order of Precedence. If this DPA conflicts with the Provider's Terms of Service or Privacy Policy, this DPA controls.

Exhibit A — Description of Services

Oscar is a probabilistic-intelligence learning companion that provides individualized tutoring, social-emotional check-ins, homework guidance (without providing finished answers), and standards-aligned progress reporting to PreK–12 students.

Exhibit B — Schedule of Data

The Provider collects and processes the following categories of Student Data:

• Identifier: first name, district-issued email (used as Provider account identifier), optional player code.
• Demographic (optional, learner-supplied): age, home language, English-proficiency level.
• Educational: grade or program, study focus, learning-style preferences, uploaded assignment images, chat content.
• Engagement signals: session timestamps, message counts, time-on-task, mood selections.
• Derived: per-topic progress, English-language growth indicators, engagement trend.
• The Provider does not collect: Social Security numbers, biometric identifiers, geolocation more precise than city, financial information, health records, or criminal records.

Exhibit C — Definitions

"Student Data" means PII relating to a student, regardless of medium. "De-identified Data" means data from which all direct and indirect identifiers have been removed in accordance with FERPA. "PII" has the meaning set forth in 34 C.F.R. § 99.3.

Exhibit D — Subprocessors

The Provider maintains a current list at evrica.ai/legal/subprocessors.

Exhibit E — Form of General Offer

Provider: Evrica Technologies Inc.
By: Anna M. Sarkisyan, Chief Executive Officer
Date: May 29, 2026

By countersigning below, the LEA accepts the General Offer of Privacy Terms set forth in this DPA.

LEA: __________________________
By: __________________________
Title: __________________________
Date: __________________________

Exhibit F — Security and Data Protection Plan

See /legal/security.

Exhibit G — Supplemental State Terms

California LEAs: see California Addendum. New York LEAs: see New York Addendum.