School Data Addendum

Effective October 15, 2026. Brigade Management, Inc., a Texas corporation ("Baccare," "we," "us").

1. Scope and order of precedence

What this Addendum covers

This School Data Addendum (the "Addendum") applies when a School uses any of these Baccare features (the "School Features"):

• Classrooms and caseloads. Groups that an Authorized User creates in Baccare for a School, which families join with a six-letter code.
• The Baccare tool in Canvas. The LTI 1.3 tool that a School adds to its Canvas learning management system, so students and teachers can open Baccare activities from a course and scores can return to the Canvas gradebook.

Section 6.3 also describes, for the School's information, what Baccare receives when a parent connects the parent's own Canvas observer account. That connection is a family feature, not a School Feature.

Tutoring groups that independent tutors run for families are not School Features unless a School arranges the tutoring and tells us so in writing.

How it takes effect

This Addendum is part of our Terms of Service for School use. It applies from the first time an Authorized User uses a School Feature for a School, or a School adds the Baccare tool to its Canvas. A School may also sign it, or ask us to sign a copy.

Order of precedence

If documents conflict on how Student Data is handled, they control in this order:

1. A written student data privacy agreement that the School and Baccare have both signed, such as the Texas Student Privacy Alliance's data privacy agreement (the TX-NDPA). If a signed agreement covers a subject, this Addendum yields to it.
2. This Addendum.
3. Our Terms of Service, Privacy Policy, and Children's Privacy Notice.

The Privacy Policy and the Children's Privacy Notice continue to govern Family Records (defined below), because those records belong to families, not to the School.

Texas districts and the TX-NDPA

If a Texas district asks us to sign the TX-NDPA, we will review it with the district in good faith. Some of its terms assume features described in section 15 as not yet built. We will say which ones in the agreement's exhibits rather than sign a promise we cannot keep.

2. Definitions

• School means a public or private elementary or secondary school, school district, charter school, or other educational agency or institution that uses a School Feature, acting through its Authorized Users.
• Authorized User means an adult who uses a School Feature for a School, with the School's permission. For classrooms and caseloads, that is a teacher or specialist who has applied in Baccare's Settings and been approved by Baccare. For the Canvas tool, it includes the School's Canvas administrators and the teachers who place Baccare activities in a course.
• Student means a child who is enrolled at the School and whose information reaches Baccare through a School Feature.
• Parent means a Student's parent or legal guardian.
• Student Data means information that identifies a Student, or is linked to information that does, and that Baccare receives from the School or its Authorized Users, or creates for the School, through a School Feature. It includes the classroom and caseload records in section 6.1 while they identify a Student, and the Canvas tool records in section 6.2. Student Data does not include Family Records or De-identified Data.
• Family Records means the records a Parent creates or keeps in the Parent's own Baccare account: the learner record and its practice results, the learner card, learning preferences and planner, Ask Bacc and Notes Studio work, anything a Parent brings in through the Parent's own Canvas observer account or school calendar feed, and Canvas tool results that a Parent has chosen to copy into the family's records (section 6.2).
• Education Records has the meaning given in the Family Educational Rights and Privacy Act ("FERPA") and its regulations.
• De-identified Data means information from which all direct and indirect identifiers have been removed, so that a Student cannot reasonably be identified from it.
• Subprocessor means a service provider that stores or processes Student Data on Baccare's behalf (section 10).
• Security Incident means unauthorized access to, or acquisition, use, or disclosure of, Student Data that compromises its security, confidentiality, or integrity.

3. FERPA: Baccare as a school official

To the extent Student Data includes Education Records, the School designates Baccare as a school official with a legitimate educational interest under 34 CFR 99.31(a)(1)(i)(B), and Baccare agrees to each condition of that designation:

1. Institutional service. Baccare performs a service the School would otherwise use its own employees for: assigning and tracking practice tied to the Texas Essential Knowledge and Skills, and returning scores to the School's gradebook.
2. Direct control. Baccare is under the School's direct control with respect to the use and maintenance of Education Records. The School exercises that control through this Addendum (or a signed agreement), through its Authorized Users' controls in Baccare (creating, ending and deleting classrooms and caseloads, and removing Students), through its control of the Canvas tool in its own Canvas, and through written instructions sent under section 21.
3. Use and redisclosure limits. Baccare uses Education Records only for the purposes for which the School disclosed them and does not redisclose personally identifiable information from them to any other party except as 34 CFR 99.33(a) and (b) permit: with the consent FERPA requires, or, under 34 CFR 99.33(b), on the School's behalf to a party the School could itself disclose to under a FERPA exception, as the School directs in writing and records as FERPA requires.

The School is responsible for including, in its annual notification of FERPA rights, the criteria for determining who is a school official and what constitutes a legitimate educational interest, so that they cover contractors such as Baccare (34 CFR 99.7(a)(3)(iii)).

FERPA's redisclosure limits apply to records a School discloses. Family Records come from Parents, who may share their own child's information. We protect Family Records under the Privacy Policy and the Children's Privacy Notice, not under this section.

4. State student privacy laws

Texas Education Code chapter 32, subchapter D

Baccare treats the School Features as covered by Texas Education Code chapter 32, subchapter D, which governs operators of websites, online services and applications designed and marketed for school purposes (see the definition of "operator" in section 32.151 and the prohibitions in section 32.152). Without conceding that the subchapter reaches Baccare's family features, Baccare agrees to the following for Student Data:

• No targeted advertising. We do not engage in targeted advertising based on information acquired through the School Features. We show no advertising at all.
• No profiles except for school purposes. We do not use Student Data to build a profile of a Student except to provide the School Features for the School's purpose.
• No sale. We do not sell or rent Student Data.
• Limited disclosure. We disclose Student Data only as section 9 allows, which stays within section 32.153.
• Reasonable security. We implement and maintain reasonable procedures and practices designed to protect Student Data from unauthorized access, deletion, use, modification or disclosure, as section 32.155(a) requires, and as section 11 describes.
• Deletion. On a district's request, we delete a Student's Student Data under the district's control within 60 days, as subchapter D provides and section 13 describes, unless the Student or Parent consents to keeping it.

As section 32.154 permits, we may use De-identified Data, and aggregate information that identifies no Student, to improve Baccare's educational activities. We will not try to re-identify it.

Parental consent and assessments

For classrooms and caseloads, Baccare collects a Parent's direct consent before any teacher or specialist sees a child (section 7). For the Canvas tool, the School decides whether to use it and is responsible for any parental consent its own policies or the state's standards require. Baccare runs no mental-health or other non-curricular assessments of Students.

Surveys and marketing

Baccare does not survey Students on any topic protected by the federal Protection of Pupil Rights Amendment, such as political affiliation, mental or psychological problems, sex behavior, illegal behavior, income, or religion. Learning preferences are entered by Parents, never asked of Students. We do not use Student Data to market anything to Students or Parents.

Other states

For a California School, we make the same commitments for Student Data under California Business and Professions Code section 22584. Many other states have their own student privacy laws. A School outside Texas should tell us which law applies to it, and we will review whether we can meet it before the School uses the School Features.

5. Ownership and Baccare's limited license

• As between the School and Baccare, the School owns Student Data and keeps control of it. Students and Parents keep every right the law gives them in it.
• Family Records belong to the family. A Parent controls them under our Privacy Policy, including exporting and deleting them.
• The School grants Baccare a limited, non-exclusive, non-transferable license to use Student Data only to provide the School Features to the School while this Addendum is in effect, to meet our duties under this Addendum, and as the law requires. Baccare gets no other right in Student Data.
• Class documents, assignment notes and other material an Authorized User posts remain the property of the Authorized User or the School. Baccare's activities, software and other content remain Baccare's.

6. What Baccare receives through each School Feature

6.1 Classrooms and caseloads

From the Authorized User. The group's name, grade, subject, school name, and term; its six-letter code; assignments (the Baccare activity, a title, a note, and a due date); class calendar events; and class documents (text, a link, or pages the Authorized User uploads). We also hold the Authorized User's own account details under the Privacy Policy.

From the School: nothing. Baccare receives no roster, enrollment list, or Student record from the School for a classroom or caseload.

About each child, only after the Parent joins. A child appears in a group only after the child's Parent enters the code, sees the group first, and agrees (section 7). The Authorized User then sees:

• the child's first name, grade and on-screen buddy, and the dates the child joined and leaves the group;
• whether the child has done each assigned activity;
• a mastery summary and a count of the past week's practice, only if the Parent turns progress sharing on; and
• in a specialist caseload, which learning supports the Parent has switched on (for example, read aloud or one step at a time).

An Authorized User never sees the child's Ask Bacc conversations, Notes Studio work, learner card or planner, or the Parent's name or email address. The child's practice results themselves are Family Records kept in the Parent's account; the group shows a view of them.

Into Ask Bacc. When a child in a group uses Ask Bacc at home, the assignments, class calendar for the last 2 and next 14 days, up to six recent class documents (shortened and screened), and the Authorized User's display name are sent to our AI provider with the child's question, so Bacc can help with that work (section 10).

Ending. A child leaves a group on the end date (June 30 unless the Parent picks another), when the Parent removes the child, or when the Authorized User removes the child. After that, the Authorized User no longer sees the child.

6.2 The Baccare tool in Canvas

A School's Canvas administrator adds the tool to the School's Canvas, and Baccare registers that Canvas for it. When a Student or teacher opens a Baccare activity from a course, Canvas sends, and Baccare keeps:

• a Canvas user identifier (a code Canvas assigns, not a name);
• the person's given name, or if none is sent, the first word of the name Canvas sends;
• whether the person is a student or an instructor;
• for that visit, which lasts up to 8 hours: the course's Canvas identifier, title and course code, the activity link, and the gradebook address Canvas provides; and
• for each activity a Student finishes: the score, the number of questions, the questions missed, the time taken, and whether the score reached the gradebook.

Score passback. Where a teacher sets the activity up for grading, Baccare sends the score to the School's Canvas gradebook as a percentage.

No Baccare account and no AI. A Student who opens Baccare from Canvas has no Baccare account and does not use Ask Bacc or Notes Studio. Canvas tool records are not sent to our AI provider.

Parent pairing. The Student's Baccare screen in Canvas shows a six-character pairing code with a note inviting Parents to see the work at home. If an adult with a Baccare family account enters that code for one of the family's learners, the Student's past and future Baccare results from Canvas are copied into that family's records, where they become Family Records. The Parent can disconnect at any time; copies already made stay with the family. A Parent who has paired may also turn on the Student's learning supports in Canvas. Five supports from the family's account (read-aloud, step-by-step instructions, untimed games, larger buttons and reduced motion) then change how Baccare activities appear on that Student's screen. They are Family Records: they are not sent to Canvas or to the School, nothing else from the family's account goes with them, the activity's questions and length do not change, and the setting ends when the pairing ends. A School that does not want the code shown to its Students should tell us before using the tool, and we will tell the School whether we can turn it off for its Canvas.

6.3 A Parent's own Canvas observer connection (family feature)

A Parent who has a Canvas observer account may connect it to Baccare. Baccare then reads, for the child the Parent observes: courses, assignments, scores, and announcements, and the name Canvas shows for the child (often the full name). The Canvas sign-in token is kept in encrypted secret storage. A Parent may also connect a school calendar feed. These are Family Records that the Parent obtains with the Parent's own access, and the Privacy Policy governs them. Canvas scores that appear in the family's calendar can be sent to our AI provider when the child uses Ask Bacc; Canvas announcements are not. A School controls what observers can reach through its own Canvas settings.

7. Parent consent comes first

• Before any child's information is collected, a Parent reads our Children's Privacy Notice and agrees, and the agreement is recorded. No learner can be added without it.
• Before anything about a child is sent to an outside company (Ask Bacc and Notes Studio, which use our AI provider, and the microphone, which uses the browser's speech service), a Parent must also verify that consent, by a real card charge or a signed consent form, as the Children's Privacy Notice describes. Until then, the classroom content in section 6.1 is not sent to our AI provider for that child.
• A teacher or specialist sees a child only after the Parent enters the group's six-letter code, sees the group (its name, the teacher or specialist, the school, and how many children have joined) before agreeing, and agrees.
• The Parent chooses whether to share progress. The default is only whether assigned work is done.
• The Parent can remove the child or change the end date at any time.

For classrooms and caseloads, Baccare does not rely on the School to consent for Parents. A family that joins Baccare with an access code from a School, a co-op or a Texas Education Freedom Account program gives and verifies consent in the same way as every other family: a code is not consent.

8. Children under 13 (COPPA)

Baccare obtains parental consent directly from Parents, under the Children's Online Privacy Protection Rule (16 CFR part 312), for every child who has a learner record, and verifies it (16 CFR 312.5(b)(2)(i) and (ii)) before any of the child's information is sent to an outside company. Classrooms and caseloads work only through that consent. Baccare does not treat a School's authorization, or an access code a School provides, as a substitute for a Parent's consent for any child who has a learner record.

The Canvas tool is different: a Student opens it from the School's Canvas without a Parent account, so the School, not a Parent, decides that the Student will use it. The Federal Trade Commission has said in guidance, not in the rule's text, that a school may authorize an operator to collect a student's personal information in place of the parent where the information is used only for the school's educational purpose and for no other commercial purpose. When it amended the rule in 2025 (90 Fed. Reg. 16918), the FTC did not add a school-authorization exception to the rule's text. Accordingly:

• Baccare uses Canvas tool records only to provide the tool to the School and for no other commercial purpose.
• The School decides whether to enable the tool for Students under 13. If it does, it authorizes the collection described in section 6.2 for its educational purpose, and it is responsible for any notice to Parents its own policies require. On request, we will give the School a written description of what the tool collects, for that notice.
• A Parent may ask the School to review or delete the Parent's child's Canvas tool records, and we will act on the School's direction under sections 13 and 14.

We do not represent that a School's authorization satisfies COPPA in every case. A School that is unsure should not enable the tool for Students under 13 until it has obtained Parents' consent through its own process.

9. How we use and disclose Student Data

We use Student Data only to provide, secure and support the School Features for the School, to meet our duties under this Addendum, and as the law requires. We do not use Student Data to train artificial intelligence models, and our AI provider's commercial terms provide that it does not train its models on what we send it.

We disclose Student Data only:

• to the School and its Authorized Users, as section 6 describes;
• to a Parent, as section 6.2 describes for pairing, or as the School directs;
• to our Subprocessors, to provide the School Features (section 10);
• as the School directs in writing; and
• as the law requires, such as under a subpoena or court order. Unless the law forbids it, we will tell the School first so it can seek protection.

Our own staff access Student Data only for support the School or a Parent asks for, for safety review, and to meet legal obligations.

10. Subprocessors

Our Subprocessors are the providers listed in our Privacy Policy. Those that can receive Student Data are:

• Supabase (database, sign-in, file storage, and encrypted secret storage), which stores Baccare's database and files in the United States (Amazon Web Services, us-east-1). All Student Data is stored here.
• Cloudflare (website and app hosting, DNS, and bot checks). Student Data passes through its network on the way to and from Baccare.
• Anthropic (the AI model behind Ask Bacc), which receives the classroom content described in section 6.1 when a child in a group uses Ask Bacc. Anthropic's commercial terms provide that it does not train its models on what we send it and deletes it within 30 days, except content its safety systems flag, which it may keep for up to two years.
• IONOS and Microsoft 365 (email and business correspondence), only for what a School or Authorized User writes to us; IONOS also delivers the app's emails, only as the next paragraph describes.
• Once that program launches, Twilio (text messages), only as the next paragraph describes.

jsDelivr and cdnjs deliver script libraries to the browser and receive nothing about Students beyond the browser's request for the file. Stripe (payments) and Google (optional sign-in for adults) do not receive Student Data. IONOS (email delivery) and, once that program launches, Twilio (text messages) can receive the title and date of a class assignment, and the child's first name, in a reminder a Parent turns on for the Parent's own email or phone. The speech recognition built into a browser (Google, Microsoft or Apple) receives a child's voice only if the child uses the microphone in the family's own app, after the Parent has verified consent; it is the family's browser service, not our Subprocessor, and it is never used in the Canvas tool. Instructure is the School's own Canvas provider, not our Subprocessor.

Written terms. Each Subprocessor handles data under its own written terms of service or data processing terms, which we review before it receives Student Data. We have not negotiated separate agreements with them.

Changes. We will update the list in the Privacy Policy before a new Subprocessor receives Student Data. A School that gives us a contact under section 21 for this purpose will also receive notice at least 30 days before the change, unless an urgent security or continuity need requires a faster change, in which case we will give notice as soon as we can. A School that objects may stop using the School Features and have its Student Data deleted under section 13.

11. Security

We maintain a written information security program, including a written children's personal information security program as 16 CFR 312.8 requires. A designated security coordinator is responsible for it, assesses risks at least once a year, and reviews the program at least once a year. Its measures include:

• encryption of all traffic to and from Baccare (TLS, with HTTP Strict Transport Security), and encryption of stored data by our hosting providers;
• row-level security in the database, which keeps each family's records apart and limits each Authorized User to the Authorized User's own groups, and only while Baccare's approval of the Authorized User's role remains in place;
• private file storage, encrypted storage for Canvas sign-in tokens and other secrets, and privileged keys kept on the server, never in a browser;
• limits on repeated wrong codes, and bot checks on sign-in pages;
• monthly automated checks of security headers, encryption settings, and our database provider's security advisories; and
• a written incident response plan.

We intend to align this program with the NIST Cybersecurity Framework. We have not completed that work and will tell a School that asks how far it has progressed. Section 15 lists security measures we do not yet have. Baccare holds no security certification or third-party audit report.

12. Security incidents

• Notice to the School. We will notify the School within 72 hours after we confirm a Security Incident affecting its Student Data. We will not wait to finish our investigation before giving that notice.
• What the notice says. What happened and when, so far as we know; the kinds of Student Data involved; the Students affected, if known; what we have done and are doing to contain it; and how to reach us. We will update the School as we learn more.
• Cooperation. We will cooperate with the School's own investigation and its notices to Parents, Students, and authorities.
• Legal notices. Where a law places a duty to notify individuals or a government agency on Baccare, such as Texas Business and Commerce Code section 521.053, we will give that notice within the time the law requires, coordinating its content with the School where we can. Where a law places that duty on the School, we will give the School what it needs to meet it.

13. Return and deletion

What a School can do now

• An Authorized User can delete a classroom or caseload at any time. That removes the group, its memberships, assignments, class calendar, and class documents from our live database at once.
• An Authorized User can remove a Student from a group at any time.
• When an Authorized User's Baccare account is deleted, the groups that Authorized User created are deleted with it.

What we do on request

Within 60 days after the School's written request, or after the School tells us in writing that it has stopped using the School Features, we will:

1. if the School asks first, give it a copy of its Student Data that we hold (its groups' records and its Canvas tool records) in a common electronic format;
2. delete the classrooms and caseloads the School identifies, if they still exist;
3. delete the Canvas tool records for the School's Canvas (the user records, visits, and results) and turn off the School's Canvas registration; and
4. confirm the deletion to the School in writing, if it asks.

A School may also ask us to delete one Student's Student Data, and we will do so within the same 60 days.

Limits

• Family Records stay with the family. Deleting a group or a School's Canvas tool records does not delete Family Records, including Canvas tool results a Parent has already copied into the family's records. Those belong to the family, which may keep or delete them under the Privacy Policy.
• No School-level tools yet. We identify a School's records by the groups its Authorized Users name and by its Canvas registration. Returns and deletions beyond deleting a group are done by us, by hand, on request.
• Backups. Deleted records leave our live database at once. Copies in our provider's backups are overwritten on the provider's schedule and are never used to restore deleted data except to recover from a disaster. If a disaster recovery ever brings deleted Student Data back, we will delete it again.

14. Requests from Students and Parents

A Parent or eligible Student who wants to see, correct, or delete Student Data should ask the School, which decides under its own FERPA procedures. If a Parent or Student asks us directly about Student Data, we will refer the request to the School and tell the School promptly, unless the law requires us to respond directly. We will help the School answer a request within a reasonable time, and in time for the School to meet a legal deadline it tells us about.

Requests about Family Records go to us, under the Privacy Policy and the Children's Privacy Notice.

15. What does not exist yet

So that a School can decide with accurate information, these are things Baccare does not have today:

• No School or district account. There is no verified School entity in Baccare that owns groups. The school name on a group is text the Authorized User types.
• No School-level export or bulk delete. Deletions are by group, or by us on request (section 13).
• No access log. Baccare does not record which person viewed which child's records. We can describe who is able to see what, but not who looked.
• Administrator multi-factor authentication is not enforced by the system.
• Backup timing is not yet confirmed. How often our database provider takes backups, and how long it keeps them, have not yet been confirmed and written down.
• Canvas tool records are not deleted on a schedule. They are kept until the School asks us to delete them under section 13.
• No negotiated Subprocessor agreements (section 10).

We will update this section as these change.

16. Audits and assurances

Once a year, and after any Security Incident affecting the School's Student Data, we will reasonably cooperate with a School's review of how we protect its Student Data. We will answer a written security questionnaire, describe our information security program, and meet by video to discuss it. A School pays its own costs of a review. Because no access log exists (section 15), we cannot report which person viewed particular records. We do not offer on-site audits of our providers, which run their own facilities under their own terms.

17. Accessibility

We aim to conform to the Web Content Accessibility Guidelines (WCAG) 2.2 at Level AA, which includes WCAG 2.1 Level AA. Our Accessibility Statement describes what works and what does not yet. We will provide our accessibility conformance report to a School on request and work with it on any barrier it reports. We do not promise that Baccare meets any accessibility law on a School's behalf.

18. Responsibilities of the School and its Authorized Users

• Use the School Features only for the School's educational purposes, and follow the School's own policies.
• Do not put Students' personal information in group names, assignment notes, class calendar events, or class documents. Those are visible to every family in the group and are sent to our AI provider when a child uses Ask Bacc.
• Use a child's information only for the group's purpose, and contact a child only in ways the child's Parent has arranged.
• Keep sign-in details secure, and tell us promptly through the contact form if an account may have been misused.
• Tell us when an Authorized User should no longer act for the School, so we can end the Authorized User's teacher or specialist role. When the role ends, the Authorized User can no longer see any group.
• Decide whether to enable the Canvas tool for Students under 13 (section 8), and keep the School's FERPA notice current (section 3).

19. Term, termination, changes, and survival

• Term. This Addendum lasts as long as the School uses a School Feature or we hold its Student Data.
• Ending. A School may stop using the School Features at any time by written notice. We may stop offering a School Feature with at least 30 days' written notice, except where we must act sooner for security or legal reasons. Either way, section 13 applies.
• Changes. We may update this Addendum for the future by posting the new version at least 30 days before it takes effect. A change never reduces the protection of Student Data we already hold without the School's written agreement. A change to a signed agreement requires both parties' signatures.
• Survival. Sections 3 to 5, 9 to 14, 16, and 20 continue for as long as we hold any of the School's Student Data.

20. Liability and governing law

THE DISCLAIMERS AND LIMITATIONS OF LIABILITY IN OUR TERMS OF SERVICE APPLY TO SCHOOL USE, EXCEPT TO THE EXTENT A SIGNED AGREEMENT WITH THE SCHOOL PROVIDES OTHERWISE. THEY DO NOT LIMIT ANY RIGHT OF A STUDENT OR PARENT UNDER FERPA, COPPA, OR STATE LAW, OR ANY LIABILITY THAT THE LAW DOES NOT ALLOW TO BE LIMITED.

Nothing in this Addendum asks a public School to indemnify Baccare or to waive any immunity it has under law. The arbitration and class-action waiver provisions of the Terms of Service do not apply between Baccare and a public School unless the School agrees in writing. This Addendum is governed by the laws of the State of Texas, except that for a public School outside Texas, the laws of the School's state govern it.

21. Notices and contact

Schools and Authorized Users may reach us through the contact form (choose "Classroom or co-op pricing"), or by mail at Brigade Management, Inc., 3400 Coit Rd. #262084, Plano, TX 75026. Formal written notices under this Addendum, including deletion requests, should go by mail, or through the contact form with a copy by mail. A School can give us the name of a role and a contact address for notices to it; until it does, we will send notices to the Authorized User's account email.

Related documents: Privacy Policy, Children's Privacy Notice, Terms of Service, AI disclosure, Safety, and Accessibility Statement.