The agreement governing your use of EdCertly.

Institutions accessing EdCertly must register as a School Partner. The authorized representative is responsible for: (a) ensuring the accuracy of registration information; (b) maintaining login credentials confidentiality; (c) managing user access; and (d) promptly notifying EdCertly of any unauthorized access or security incident.

EdCertly does not own, claim ownership of, or assert any proprietary interest in any data uploaded to or processed through the Platform by a School Partner or by individuals acting on behalf of a School Partner. This includes, without limitation:

• Teacher names, contact information, employment data, and credential information
• Certification status, expiration dates, pathway progress, and assessment scores
• Documents, transcripts, test scores, verification forms, and supporting materials uploaded to the Platform
• Performance review data and any other employment-related information
• Aggregated reports, dashboards, and analytics generated from the School Partner's data

All such data remains the sole property of the School Partner that uploaded it or, where applicable, the CMO that uploaded data on behalf of its affiliated schools. The School Partner is at all times the data controller. EdCertly is, and acts solely as, a data processor — handling the data only on the instructions of the School Partner and only as necessary to deliver the contracted services.

EdCertly does not independently access, query, scrape, or pull data from any state teacher certification system (including but not limited to the New York State Education Department's TEACH system, or any equivalent system in other states), and EdCertly does not independently obtain certification data from any third-party source.

All certification data within the Platform is provided to EdCertly by the School Partner, by the individual teacher through the Teacher Portal, or — where the School Partner explicitly enables and authorizes such an integration in writing — through an authorized API connection that the School Partner has independently established with a state certification system or HRIS provider. In all such cases, EdCertly acts only at the School Partner's direction and processes only the data the School Partner has authorized.

If a School Partner requests assistance facilitating an integration with a state certification system in the future, that integration will be subject to a separate written authorization signed by the School Partner, with the integration controlled by the School Partner's credentials and consent.

EdCertly provides the technology and tools that enable School Partners to track, manage, analyze, and share their certification data. The School Partner — not EdCertly — is responsible for:

• Determining what data is uploaded to the Platform
• Verifying the accuracy and currency of all data within their account
• Configuring access permissions for their staff and teachers
• Determining when and how data is shared with their HRIS, recruitment, or compliance systems
• Responding to any record access, correction, or deletion requests from teachers or other individuals
• Ensuring their use of the Platform complies with applicable federal, state, and local laws

EdCertly acts only on the School Partner's instructions with respect to their data, and exercises no independent judgment over what data should be processed, retained, or shared, except as necessary to maintain the security, integrity, and operation of the Platform.

School Partners grant EdCertly a limited, non-exclusive, non-transferable license to host, store, process, and display School Partner data solely as necessary to provide the contracted Platform services. This license terminates automatically upon expiration or termination of the subscription, after which EdCertly will return or destroy all data in accordance with Section 10.

EdCertly may use data that has been irreversibly aggregated and de-identified — from which all personally identifiable information has been permanently removed — solely for the purposes of platform improvement, internal analytics, and product development. Such aggregated data shall not be attributable to any specific School Partner, teacher, or individual, and shall not be sold, licensed, or shared with any third party for commercial purposes.

EdCertly does not access, share, sell, license, transfer, or otherwise disclose any School Partner data to any third party, except as expressly permitted in this Section 5. EdCertly will never use School Partner data for advertising, marketing, behavioral profiling, commercial profiling, training of AI models for general use, or any purpose other than providing the contracted services to the School Partner.

EdCertly may share data only under the following narrow and operationally necessary circumstances:

(a) Service-Delivery Subcontractors. EdCertly may engage subcontractors strictly to support the delivery of the Platform — such as cloud infrastructure providers (e.g., SOC 2-compliant hosting), security monitoring services, and PCI-compliant payment processors. All such subcontractors are bound by written agreements imposing data protection obligations that are materially equivalent to, and no less protective than, the obligations EdCertly owes to the School Partner under these Terms and applicable law (including NY Ed Law §2-d). Subcontractors are strictly prohibited from using School Partner data for any purpose other than providing services to EdCertly. A current list of subcontractors is available to School Partners on request.

(b) School Partner-Authorized Integrations. Where a School Partner explicitly authorizes EdCertly to transmit data to a third-party system the School Partner has selected (such as the School Partner's HRIS, EIS, payroll provider, or state certification system), EdCertly will transmit data solely as directed by that authorization. The third-party integration partner is selected by the School Partner, and the School Partner is responsible for ensuring that partner's compliance with applicable data privacy requirements.

(c) Legally Compelled Disclosure. EdCertly may disclose data only when compelled to do so by a legally binding order from a court of competent jurisdiction, a valid subpoena, a lawfully issued government request, or as otherwise required by applicable law. In any such circumstance, EdCertly will:

• Promptly notify the affected School Partner of the request or order in writing, unless legally prohibited from doing so
• Disclose only the minimum data required to comply with the order or request
• Cooperate with the School Partner in seeking, where appropriate, a protective order or other legal mechanism to limit disclosure
• Provide the School Partner with a full account of what was disclosed, to whom, and on what basis, as soon as legally permissible

(d) Business Transfers. In the event of a merger, acquisition, restructuring, or sale of substantially all assets involving A12 Labs LLC, School Partner data may be transferred to the successor entity. Any such successor will be bound by these Terms and the Privacy Policy. EdCertly will provide School Partners with at least sixty (60) days' advance notice of any such transfer and the opportunity to export their data and terminate the subscription before the transfer takes effect.

EdCertly does not and will not sell, rent, trade, or monetize any School Partner data — including teacher data, certification data, document content, or any other information uploaded to the Platform — under any circumstances. This commitment is binding regardless of any change in EdCertly's ownership or corporate structure.

Consistent with NY Education Law §2-d, California SOPIPA, and equivalent state laws, EdCertly will not use any School Partner data — including teacher data, student data (where applicable), or any individual's personal information — for targeted advertising, marketing, behavioral profiling, or to create profiles for any non-educational purpose.

• EdCertly will not sell protected data under any circumstances
• EdCertly will not use protected data for advertising or marketing, or to create profiles for non-educational purposes
• EdCertly will not disclose protected data to any subcontractor unless that subcontractor is bound by materially equivalent protections
• EdCertly will return or destroy all protected data upon termination
• EdCertly will maintain a Data Security and Privacy Plan (DSPP) consistent with Part 121.3

EdCertly will provide each School Partner with the supplemental information required to be included in the School Partner's Parents' Bill of Rights for Data Privacy and Security.

EdCertly will notify the affected School Partner within seven (7) calendar days of discovery of any unauthorized release of protected data, consistent with Ed Law §2-d. EdCertly will cooperate fully with the School Partner and the New York State Education Department in any investigation, and will reimburse the School Partner for reasonable costs of notifying affected individuals.

EdCertly implements security measures consistent with the NIST Cybersecurity Framework as required by Part 121, including AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access controls, multi-factor authentication, and regular security audits.

Subscription fees are governed by the pricing plan selected at registration and any applicable Service Agreement. Current pricing is at edcertly.com/pricing.

Subscriptions are billed monthly or annually. Annual subscriptions receive a 15% discount. One-time onboarding fees are due at commencement. Fees are non-refundable except as expressly stated.

Invoices unpaid after thirty (30) days may accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law. EdCertly may suspend access to overdue accounts following reasonable notice.

EdCertly will provide at least sixty (60) days' written notice of any pricing changes. Changes take effect at the next renewal.

EdCertly will work with School Partners to align billing and contract terms with school fiscal years (typically July–June) where operationally practicable.