User Agreement and Data Protection Policy — Agentic Learning

Agentic Learning Holding Company

User Agreement

Version1.0
Effective dateJuly 2026
Applies toAll users of the Services

1. Definitions

“Agreement” means this User Agreement together with each Order Form and any Data Protection Agreement executed by the parties.

“Agentic Learning Algo” means the proprietary reasoning, orchestration, validation, and scoring methodology underlying the Services, including all models, prompts, agent definitions, rule sets, weightings, thresholds, sequencing, and processes, whether or not separately identified and whether or not observable in Output.

“Competing Product” means any product or service that performs, or is intended to perform, functions materially similar to the Services, including the automated or assisted generation, validation, or compliance review of special education documentation.

“Customer” means the organization or individual that has accepted this Agreement.

“Customer Data” means data submitted to the Services by or on behalf of the Customer.

“Data Protection Agreement” means a student data privacy agreement or comparable instrument executed between the parties governing the handling of education records, including any instrument issued by the Student Data Privacy Consortium or adopted by the Customer’s jurisdiction.

“Documentation” means the then-current user and administrative documentation Agentic Learning makes available for the Services.

“Model Provider” means a third party that supplies foundation model or other machine learning inference services used in the Services.

“Order Form” means the ordering document identifying the modules licensed, the fees, the term, and any service level commitment.

“Output” means documentation generated by the Services in response to Customer Data.

“Platform IP” means the Services, the Agentic Learning Algo, and all software, models, prompts, agent architectures, templates, structures, rule libraries, goal and objective architectures, validation logic, taxonomies, workflows, user interfaces, methodologies, know-how, trademarks, and Documentation used to deliver the Services, together with all intellectual property rights in them and all modifications, enhancements, and derivative works of them.

“Proceeding” means an evaluation dispute, mediation, administrative complaint, due process hearing, monitoring review, corrective action process, or civil action concerning the identification, evaluation, placement, or provision of a free appropriate public education to a student of the Customer.

“Services” means Agentic IEP, the Agentic Intelligence Management System, and any module, interface, or associated Documentation identified in an Order Form.

“Student Record” means an individualized education program or other education record of the Customer that the Customer has adopted, in the form adopted.

“Team” means the admission, review, and dismissal committee, individualized education program team, or equivalent body constituted under applicable law.

2. Construction

2.1Headings are for convenience only and do not affect interpretation. “Including” means including without limitation. The singular includes the plural and the plural the singular. A reference to a statute or regulation includes any amendment or successor provision.
2.2This Agreement is the product of negotiation between commercially sophisticated parties. No rule of construction requiring interpretation against the drafting party applies.
2.3Where a provision conflicts with a mandatory requirement of law applicable to the Customer, that requirement prevails and the provision is read as modified to the minimum extent necessary.

3. Agreement and Order of Precedence

3.1This Agreement governs access to and use of the Services. By executing an Order Form that references this Agreement, by creating an account, or by using the Services, the Customer accepts these terms. A person accepting on behalf of an organization represents that they hold authority to bind it and, where the organization is a governmental body, that acceptance has been authorized in the manner its governing law requires.
3.2In the event of conflict, the order of precedence is: the Data Protection Agreement; the Order Form; this Agreement. Agentic Learning acknowledges that a Data Protection Agreement may take precedence as to the handling of education records and does not contest that precedence. No Data Protection Agreement conveys any right in Platform IP.
3.3Agentic Learning will not condition provision of the Services on any waiver by the Customer of a right conferred by the Data Protection Agreement.

4. The Services

4.1Agentic Learning provides Agentic IEP, a multi-agent workflow system that assists qualified personnel in preparing, reviewing, and validating special education documentation, and the Agentic Intelligence Management System, through which the Customer administers tenancy, user roles, provisioning, audit, and export.
4.2Agentic Learning grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Services during the term of the Order Form, solely for the Customer’s own internal educational purposes and solely for the number of students and modules stated in the Order Form.
4.3Agentic Learning may modify the Services provided it does not materially degrade core functionality during a paid term. Material adverse changes are notified at least sixty (60) days in advance, and where a change materially and adversely affects the Customer’s use, the Customer may terminate the affected module on notice given within thirty (30) days and receive a pro-rata refund of prepaid unused fees.
4.4A feature identified as pilot, beta, or pre-release is provided as is, without warranty or service commitment, and may be withdrawn at any time. Such a feature may not be used to produce documentation entered into a Student Record.

5. Implementation, Training, and Support

5.1Implementation proceeds through configuration of tenancy, definition of roles and scope, integration and field mapping, validation against Customer data structures, and phased deployment. Scope and timeline are stated in the Order Form.
5.2Agentic Learning provides role-based training as stated in the Order Form. Training materials are Platform IP, are licensed for the Customer’s internal use during the term, and may not be reproduced for any other purpose.
5.3Support is provided during the coverage window and to the response targets stated in the Order Form.
5.4Professional services beyond the scope of the Order Form are provided under a separate statement of work. Deliverables of such services are Platform IP unless the statement of work expressly provides otherwise.

6. Service Availability and Continuity

6.1Agentic Learning uses commercially reasonable efforts to make the Services available, excluding scheduled maintenance, emergency maintenance, and events beyond its reasonable control. Scheduled maintenance is notified in advance and, where practicable, performed outside instructional hours.
6.2Where an Order Form states a service level commitment, that commitment and any associated remedy apply and are the Customer’s exclusive remedy for unavailability.
6.3Agentic Learning maintains a business continuity and disaster recovery capability, tests restoration periodically, and furnishes a summary of its recovery objectives on request.
6.4Agentic Learning will not degrade or withhold the Customer’s access to Customer Data during a bona fide dispute, other than a suspension permitted by Section 10.5.
6.5Source code escrow is not provided under this Agreement. Where a Customer requires escrow, it is available only under a separate agreement on Agentic Learning’s form, under which any release is limited to object code necessary for continuity of the Customer’s own internal use and conveys no right in the Agentic Learning Algo.

7. Nature of the Services and Decision Authority

7.1The Services are decision-support software. They assemble, draft, and validate documentation from data the Customer supplies. They produce draft work product for professional review and render no determination regarding any student.
7.2All eligibility, evaluation, placement, service, methodology, and least restrictive environment decisions are made by the Team in accordance with applicable law. Agentic Learning is not a member of any Team, participates in no meeting of a Team, and makes no determination regarding any student. This allocation reflects the statutory assignment of decision-making authority under the Individuals with Disabilities Education Act and is not a matter of configuration.
7.3Agentic Learning will not configure, and will not permit configuration of, the Services to adopt, finalize, or transmit documentation into a Student Record without review by the Customer’s personnel.
7.4The Customer will ensure that Output is reviewed and verified by personnel qualified under applicable law before it is adopted, distributed, or entered into a Student Record. Output that has not been reviewed is a draft.
7.5Output does not constitute legal, medical, psychological, diagnostic, or educational advice, and no attorney-client, clinician-patient, or evaluator-examinee relationship arises from its use.
7.6Use of the Services does not reduce or discharge the Customer’s obligations under the Individuals with Disabilities Education Act, Section 504 of the Rehabilitation Act, the Americans with Disabilities Act, or applicable jurisdictional law, including any obligation to provide a free appropriate public education. The Customer remains the entity legally responsible for the content of each individualized education program it adopts.

8. Independent Professional Judgment

8.1The Customer acknowledges that it retains and exercises independent professional judgment in evaluating Output, and does not rely on the Services as a substitute for the professional judgment of its qualified personnel or for the deliberation of the Team.
8.2The Customer acknowledges that Output may contain errors, omissions, or content inappropriate for a particular student, that identifying such content is the purpose of the review required by Section 7.4, and that the Services are designed on the assumption that such review occurs.

9. Customer Responsibilities

9.1The Customer will submit only data it holds the authority and lawful basis to submit, and will maintain the parental consent, notice, and procedural safeguard obligations that remain its own.
9.2The Customer will administer user roles and access scope in accordance with its determination of legitimate educational interest, and will review role assignments at least annually.
9.3The Customer will ensure that personnel with access receive training on the confidentiality obligations applicable to education records.
9.4The Customer will designate the officials to whom security notices and confidentiality matters are directed, including the official designated under 34 CFR § 300.623(c) where applicable.
9.5The Customer is responsible for the accuracy and completeness of the data it submits and for its own network, devices, and identity infrastructure.
9.6The Customer is responsible for the acts and omissions of each person to whom it grants access, as though they were its own.

10. Accounts, Access, and Security

10.1The Customer is responsible for activity occurring under credentials issued to it, for keeping credentials confidential, and for ensuring credentials are not shared.
10.2The Customer will remove or request removal of access promptly when a person leaves the organization or changes role.
10.3The Customer will notify Agentic Learning without undue delay of any suspected unauthorized access to the Services or to Customer Data, and of any unauthorized use or disclosure of Platform IP.
10.4Agentic Learning may suspend access where it reasonably believes continued access presents a security risk to Customer Data or to the Services, or that Platform IP is being used in breach of Section 20. Suspension is limited to the scope and duration reasonably necessary, and the Customer is notified promptly.
10.5Agentic Learning may suspend access for non-payment of undisputed amounts more than thirty (30) days overdue, following written notice and a further ten (10) days to cure. Suspension under this Section does not relieve Agentic Learning of its obligations under Sections 12, 15, and 16.

11. Customer Data and Ownership

11.1The Customer owns and retains all right, title, and interest in Customer Data. Agentic Learning acquires no ownership interest in it. Education records remain the property of the educational agency at all times.
11.2Agentic Learning holds a limited licence to host, process, transmit, and display Customer Data solely to provide the Services, maintain their security, and comply with law. That licence terminates on deletion of the data or termination of this Agreement, whichever is earlier.
11.3Agentic Learning does not sell, rent, or license Customer Data, does not use it for advertising, and does not create commercial profiles of students. These commitments survive termination and are not subject to the limitation of liability in Section 32.
11.4Agentic Learning asserts no lien, security interest, or right of retention over Customer Data, including for unpaid fees.

12. Data Protection and Privacy

12.1Agentic Learning performs the Services as a school official with a legitimate educational interest under 34 CFR § 99.31(a)(1)(i)(B), under the direct control of the Customer with respect to the use and maintenance of education records, and subject to 34 CFR § 99.33(a) governing use and redisclosure.
12.2Because the records processed are special education records, Agentic Learning also operates to the confidentiality requirements at 34 CFR §§ 300.610 through 300.627, and applies the more protective requirement where those provisions exceed the Family Educational Rights and Privacy Act. Agentic Learning maintains a current listing of personnel who may access personally identifiable information in support of the Customer’s obligation under 34 CFR § 300.612.
12.3Agentic Learning complies with student data privacy law in the Customer’s jurisdiction and executes the data privacy agreement required in that jurisdiction, including supplemental state terms issued for it.
12.4Agentic Learning maintains administrative, physical, and technical safeguards appropriate to the sensitivity of the data, as described in its Data Protection Policy, which is incorporated by reference and which Agentic Learning will not amend in a manner that materially reduces protection during a paid term.
12.5Agentic Learning maintains a current register of sub-processors, enters into written agreements binding each of them no less strictly than it is bound, and notifies the Customer at least thirty (30) days in advance of a material addition affecting the processing of personally identifiable information. The Customer may object on reasonable data protection grounds, and if the objection is not resolved, may terminate the affected module and receive a pro-rata refund of prepaid unused fees.
12.6Agentic Learning notifies the Customer of any confirmed incident involving unauthorized access to or disclosure of Customer Data within the period stated in the Data Protection Agreement and, absent such a provision, within seventy-two (72) hours of confirmation, and provides the information the Customer requires to identify affected individuals and discharge its own notification obligations.
12.7Agentic Learning will notify the Customer before any compelled disclosure of Customer Data to a governmental or law enforcement authority, unless lawfully directed not to, and will disclose no more than the minimum the process requires.

13. Artificial Intelligence and Model Processing

13.1The Services use large language models within a multi-agent workflow system. Discrete agents perform bounded tasks and pass structured results forward, which permits the data transmitted for any single task to be limited to the fields that task requires.
13.2Customer Data is not used to train, fine-tune, or otherwise develop or improve any foundation model. Agentic Learning contracts with each Model Provider on terms prohibiting such use. This is a contractual commitment and not a configuration setting, and it applies to identified and de-identified Customer Data alike.
13.3Each Model Provider is identified in the sub-processor register and is subject to Section 12.5. Agentic Learning will not substitute or add a Model Provider without notice given in accordance with that Section.
13.4Agentic Learning minimizes Model Provider retention of transmitted content to the extent the Model Provider’s commercial terms allow, and will disclose its then-current retention position on request.
13.5The Customer acknowledges that generative systems are non-deterministic. Identical inputs may produce differing Output on separate occasions. Agentic Learning does not represent that Output is reproducible, and the review required by Section 7.4 applies to each instance of Output.
13.6Output is validated against regulatory and internal rule sets before presentation to the Customer’s personnel. Automated validation does not replace human review and is not represented as a determination of legal compliance.
13.7The Services may not be used to make an automated decision producing a legal or similarly significant effect concerning a student, and Agentic Learning will not enable such use.
13.8Where Agentic Learning materially changes the model architecture underlying a licensed module, it will notify the Customer and, on request, describe the change at a level sufficient for the Customer to assess its own compliance obligations. Nothing in this Section requires disclosure of the Agentic Learning Algo, and any description provided is Agentic Learning’s confidential information.

14. Aggregate and De-Identified Data

14.1Agentic Learning may generate and use aggregated, de-identified data for service improvement and to demonstrate the effectiveness of the Services, provided the data cannot reasonably identify any student, user, or institution and is de-identified consistent with 34 CFR § 99.31(b).
14.2Agentic Learning will not attempt to re-identify de-identified data or permit others to do so, will not transfer it to any party other than a sub-processor without the Customer’s prior written consent, and will obtain the Customer’s written approval before publishing any document that identifies the Customer explicitly or by reasonable inference.
14.3Section 13.2 applies to de-identified data. Nothing in this Section permits use of de-identified Customer Data for model training.
14.4Where a Data Protection Agreement restricts the use of de-identified data more narrowly, that restriction controls.

15. Records, Audit Trail, and Evidentiary Support

15.1Agentic Learning maintains an append-only record of access to each Student Record, capturing the identity of the actor, the record, the time, and the action taken. The record is not alterable through the application.
15.2Assertions within Output are attributable to the source instrument or data point from which they derive, so that the Customer may evidence the basis of any statement.
15.3Documentation is version-tracked rather than overwritten, so that the Customer may establish the content of a record as it existed at a given time and may discharge its obligations under 34 CFR §§ 300.618 through 300.621.
15.4Agentic Learning preserves all data points supplied by the Customer and does not discard data in order to resolve apparent inconsistency. Data points bearing different dates are retained as longitudinal evidence.
15.5On the Customer’s written request, Agentic Learning furnishes the audit and disclosure record for the Customer’s tenant in a form suitable for production to a parent, a hearing officer, or an agency exercising monitoring authority.

16. Support in Proceedings

16.1Where the Customer is party to a Proceeding in which documentation prepared with assistance of the Services is at issue, Agentic Learning will, on reasonable notice and at no charge for the first instance in any twelve-month period:
  1. preserve the relevant tenant records, audit trail, and version history against ordinary deletion for the duration of the Proceeding, on written notice from the Customer identifying the students concerned;
  2. produce a certified export of the audit trail, version history, and validation results for the records at issue; and
  3. provide a written declaration of business records sufficient to support admission of those records under the applicable rules of evidence.
16.2Additional support, including testimony, technical explanation of the workflow, or expert analysis, is available under a separate statement of work at Agentic Learning’s then-current rates.
16.3Nothing in this Section makes Agentic Learning a party to a Proceeding, a member of a Team, or the author of a determination. Agentic Learning does not represent the Customer and provides no legal advice.
16.4Agentic Learning will not decline to preserve or produce records under this Section on the basis of a fee dispute.
16.5Protection of proprietary information in a Proceeding. Nothing in this Section requires disclosure of the Agentic Learning Algo, of source code, of model weights, or of prompts or agent definitions. Where such disclosure is sought, Agentic Learning will cooperate with the Customer to resist it, or to obtain a protective order or an in camera arrangement adequate to preserve trade secret status. The Customer will give Agentic Learning prompt notice of any request or order seeking such disclosure and reasonable opportunity to intervene.

17. Regulatory Change

17.1The parties acknowledge that the Individuals with Disabilities Education Act, the Family Educational Rights and Privacy Act, and jurisdictional requirements applicable to special education documentation are subject to amendment.
17.2Agentic Learning will update the validation rule sets applied by the Services to reflect changes in federal law and in the law of each jurisdiction in which it has an active Customer, within a period reasonable in the circumstances, at no additional charge. Such updates are Platform IP.
17.3Where a regulatory change requires a material redevelopment of a licensed module, the parties will negotiate the scope and cost in good faith, and either may terminate the affected module if they do not reach agreement within sixty (60) days.

18. Ownership of the Platform

18.1Reservation of rights. Agentic Learning and its licensors own all right, title, and interest in the Platform IP. This Agreement grants only the limited right of access stated in Section 4.2. All rights not expressly granted are reserved. No right is granted by implication, estoppel, exhaustion, or otherwise.
18.2Trade secret. The Agentic Learning Algo constitutes trade secret under applicable law, derives independent economic value from not being generally known, and is the subject of reasonable measures to maintain secrecy. The Customer will not disclose any information about its internal structure, components, prompts, agent definitions, rule libraries, weightings, or operation that it may observe, infer, or derive.
18.3No derivation from observation. Access to the Services necessarily exposes the Customer to Output and to interface behaviour. The Customer will not use that exposure to derive, reconstruct, approximate, or document the Agentic Learning Algo, and will not record, catalogue, or systematically analyse Output or system behaviour for that purpose.
18.4Configurations and contributions. Where the Customer configures rule sets, templates, goal libraries, or comparable elements within the Services, or contributes content that is incorporated into the Services, the Customer grants Agentic Learning a perpetual, irrevocable, worldwide, royalty-free licence to use, reproduce, modify, and distribute that configuration or contribution as part of the Services. This does not apply to Customer Data or to a Student Record.
18.5Feedback. Suggestions, enhancement requests, and other feedback, however communicated, may be used by Agentic Learning without restriction or obligation. Feedback must not include Customer Data.
18.6No adverse assertion. The Customer will not apply for, register, or assert any patent, copyright, trademark, or other right in or to the Platform IP or in any element of it, and will not assist another to do so.
18.7Marks. No right is granted in Agentic Learning’s names, marks, or trade dress, including “Agentic Learning,” “Agentic IEP,” and “Agentic Intelligence Management System.”

19. Output — Rights and Restrictions

19.1Student Records belong to the Customer. The Customer owns each Student Record it adopts, as a record of the educational agency. Agentic Learning claims no ownership in any Student Record and will not assert any right that would impede the Customer’s use of its own education records for the education of its students or for compliance with law.
19.2Platform IP within Output is retained. Ownership of a Student Record does not convey any right in the Platform IP embodied in or expressed through it, including the templates, structures, rule libraries, goal and objective architectures, validation logic, sequencing, taxonomies, and the Agentic Learning Algo. Ownership of a record does not convey rights in the machinery that produced it.
19.3Permitted use of Output. The Customer may use Output for its own internal educational purposes and to discharge its legal obligations, including production to a parent, to a Team, to a hearing officer, or to an agency exercising oversight or monitoring authority. Production compelled by law is permitted and is not a breach of this Section.
19.4Restrictions on Output. The Customer will not, and will not permit any person to:
  1. use Output, whether individually or in aggregate, to train, fine-tune, evaluate, benchmark, or otherwise develop any machine learning model or other automated system;
  2. compile Output into a corpus, dataset, library, or template collection for distribution, licensing, publication, or transfer to a third party;
  3. use Output to derive, reconstruct, approximate, or document the Agentic Learning Algo, or to develop or assist in the development of a Competing Product;
  4. supply Output to a developer of a Competing Product, or to any third party for any purpose described in this Section; or
  5. remove or obscure any notice of proprietary rights appearing in Output or in the Services.
19.5Redaction does not remove restrictions. De-identification, redaction of student identifiers, or paraphrase does not remove Output from the restrictions in Section 19.4.
19.6Survival. Section 19 survives termination and applies to Output in the Customer’s possession after termination.

20. Restrictions on Use

The Customer and its users will not:

  • use the Services other than for the Customer’s own internal educational purposes;
  • submit data they do not have authority or a lawful basis to submit;
  • adopt or enter into a Student Record any Output that has not been reviewed as required by Section 7.4;
  • reverse engineer, decompile, disassemble, or attempt to derive the source code, models, prompts, agent definitions, rule sets, or methodologies of the Services, except to the extent this restriction is unenforceable under applicable law and then only after written notice to Agentic Learning;
  • develop, or assist any person to develop, a Competing Product, whether using the Services, Output, or information derived from either;
  • permit access to the Services by a developer of a Competing Product, or by any person for the purpose of evaluating the Services for competitive development;
  • benchmark, test, or evaluate the Services for publication or disclosure to a third party without prior written consent;
  • systematically extract, scrape, harvest, or automate retrieval of Output, Documentation, or interface content, or exceed usage limits stated in the Order Form;
  • copy, frame, mirror, or reproduce any part of the Services or Documentation other than as necessary for permitted internal use;
  • attempt to access data belonging to another customer, or circumvent access controls, tenant boundaries, licence restrictions, or usage limits;
  • introduce malicious code, or conduct penetration testing or vulnerability scanning without prior written authorization;
  • use the Services to make an automated decision affecting a student’s rights, services, or placement; or
  • resell, sublicense, rent, lease, timeshare, or provide the Services to a third party, or use them in a service bureau capacity, except as an Order Form expressly permits.

21. Protection of Proprietary Information

21.1Non-use covenant. The Customer will use Agentic Learning’s confidential information and Platform IP only to exercise its rights under this Agreement, and for no other purpose. The obligation of non-use is independent of the obligation of non-disclosure and is not satisfied by maintaining secrecy alone.
21.2No residuals. No provision of this Agreement grants the Customer a right to use information retained in the unaided memory of its personnel. Any residuals doctrine is expressly disclaimed.
21.3Competitive isolation. The Customer will not permit any person engaged in the development of a Competing Product to access the Services, Output, Documentation, or Agentic Learning’s confidential information, and will inform Agentic Learning promptly if it becomes aware that such a person has obtained access.
21.4Personnel and contractors. The Customer will bind each person to whom it grants access to obligations at least as protective as those in this Agreement, and remains responsible for their compliance.
21.5Trade secret duration. Obligations with respect to the Agentic Learning Algo and other trade secrets continue for so long as the information retains trade secret status, without limitation to any period stated for confidential information generally.

22. Verification of Compliance

22.1Where Agentic Learning has a reasonable, good-faith basis to believe the Services or Output are being used in breach of Sections 19, 20, or 21, it may request written confirmation of compliance, and the Customer will respond within thirty (30) days.
22.2Where the response does not resolve the concern, Agentic Learning may, on thirty (30) days’ notice and not more than once in any twelve-month period, engage an independent auditor bound to confidentiality to verify compliance. The audit will be conducted during business hours, will not unreasonably interfere with the Customer’s operations, will not require access to student personally identifiable information, and will be at Agentic Learning’s expense unless material non-compliance is found.
22.3This Section does not apply to a governmental Customer to the extent its governing law restricts such access, and in that case the Customer will provide written certification of compliance by an authorized official in lieu of audit.

23. Third-Party Services and Integrations

23.1Where the Customer elects to integrate the Services with a student information system or other third-party service, the Customer authorizes transmission of the data necessary for that integration and is responsible for its own agreement with that provider.
23.2Agentic Learning is not responsible for the availability, performance, or data handling practices of a third-party service the Customer directs it to connect to. Agentic Learning remains responsible for its own handling of Customer Data received through that connection.
23.3The Customer will not use an integration to transmit Output or Platform IP to a third party for a purpose restricted by Section 19.4 or Section 20.

24. Fees, Invoicing, and Taxes

24.1Fees, billing frequency, and any multi-year discount are stated in the Order Form. Institutional pricing is generally assessed per enrolled student receiving services, by module.
24.2Undisputed invoices are payable within thirty (30) days of receipt, except that where the Customer is a governmental entity subject to a prompt payment statute, the statutory terms apply.
24.3Fees exclude taxes. A Customer holding an exemption may furnish a certificate.
24.4Where the Customer is a governmental entity, payment obligations beyond the current fiscal year are subject to appropriation, and non-appropriation permits termination without penalty on written notice.
24.5The Customer will notify Agentic Learning of a good-faith dispute within twenty (20) days of the invoice date, and the parties will work to resolve it promptly. Undisputed amounts remain payable.
24.6Use exceeding the student count or module scope stated in the Order Form is chargeable at Agentic Learning’s then-current rates for the period of the excess.

25. Term, Renewal, and Termination

25.1The term is stated in the Order Form. Unless the Order Form provides otherwise, the term renews for successive periods equal to the initial term unless either party gives written notice of non-renewal at least sixty (60) days before the end of the then-current term.
25.2Fees for a renewal term are those stated in the Order Form or, where none are stated, Agentic Learning’s then-current rates, notified at least ninety (90) days before renewal.
25.3Either party may terminate for a material breach that is not cured within thirty (30) days of written notice.
25.4The Customer may terminate immediately on written notice for a breach by Agentic Learning of Section 11.3, Section 12, or Section 13.2.
25.5Agentic Learning may terminate immediately on written notice for a breach by the Customer of Section 18, Section 19.4, Section 20, or Section 21, which the parties agree is a material breach not susceptible of cure by the passage of time alone.
25.6Either party may terminate immediately on written notice if the other becomes insolvent, makes an assignment for the benefit of creditors, or has a receiver appointed.

26. Effect of Termination and Transition

26.1On termination, the Customer’s right to access the Services ends, and Agentic Learning returns Customer Data in a usable, machine-readable format and then destroys it, or destroys it directly at the Customer’s election, with written certification of destruction.
26.2Data held in backups is destroyed on expiry of the backup cycle.
26.3On request made before termination takes effect, Agentic Learning provides transition assistance for up to ninety (90) days, including export of Customer Data and of the audit and version history, and reasonable cooperation with a successor provider, at its then-current professional services rates unless the Order Form provides otherwise. Export of Customer Data and of the audit record is provided at no charge. Transition assistance does not include disclosure of Platform IP or assistance in replicating the Services.
26.4On termination the Customer will cease all use of the Services and Documentation, and will destroy or return all copies of Documentation, training materials, and other Platform IP in its possession, other than Student Records and Output retained in accordance with Section 19.3. An officer will certify compliance on request.
26.5Sections 1, 2, 7, 8, 11, 12, 13.2, 14, 15, 16, 18, 19, 20, 21, 22, 26, 27, 28, 30, 31, 32, and 36 through 43 survive termination.

27. Confidentiality

27.1Each party will protect the other’s confidential information with at least reasonable care and will disclose it only to personnel and advisers who need it and who are bound by comparable obligations.
27.2Confidential information does not include information that is public without breach, independently developed without use of or reference to the disclosing party’s confidential information, or lawfully received from a third party without restriction. The party asserting an exception bears the burden of establishing it by contemporaneous written evidence.
27.3Where the Customer is a governmental body subject to public records law, disclosure required by that law is not a breach. Agentic Learning will mark trade secret and commercially sensitive material, and the Customer will give notice sufficient to permit Agentic Learning to assert any available exception and to seek protective relief before disclosure. Agentic Learning acknowledges that the Customer cannot contract away its statutory disclosure obligations.
27.4Customer Data is the Customer’s confidential information regardless of marking. The Platform IP is Agentic Learning’s confidential information regardless of marking.

28. Non-Solicitation

28.1During the term and for twelve (12) months after it, neither party will knowingly solicit for employment any employee of the other who was materially involved in the performance of this Agreement, without the other’s written consent. This does not restrict general advertising not targeted at such persons, or the hiring of a person who responds to it.

29. Representations and Warranties

29.1Each party represents that it holds the authority to enter into this Agreement and that doing so does not conflict with any other obligation.
29.2Agentic Learning warrants that the Services will perform materially in accordance with the Documentation and that it will provide them in a professional and workmanlike manner. The Customer’s exclusive remedy for breach of this warranty is correction or, if correction is not achieved within a reasonable period, termination and a pro-rata refund of prepaid unused fees.
29.3Agentic Learning warrants that it will not knowingly introduce malicious code into the Services and that it holds the rights necessary to grant the access granted under this Agreement.
29.4Agentic Learning warrants that it is not debarred or suspended from contracting with a governmental entity and will notify the Customer promptly if that changes.
29.5The Customer represents that it is not, and is not acting on behalf of, a developer of a Competing Product.

30. Disclaimers

Output is generated in part by probabilistic models. Agentic Learning does not warrant that Output will be accurate, complete, current, free of error, or appropriate for any particular student, and does not warrant any outcome in any Proceeding. The review obligation in Section 7.4 exists because Output requires verification.

Except as expressly stated in Section 29, the Services are provided “as is” and “as available,” and Agentic Learning disclaims all other warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement.

31. Indemnification

31.1Agentic Learning will defend and indemnify the Customer against third-party claims alleging that the Services, provided and used in accordance with this Agreement, infringe a United States patent, copyright, trademark, or trade secret, and against claims arising from Agentic Learning’s breach of Section 11.3, Section 12, or Section 13.2, and will pay damages and costs finally awarded or agreed in settlement.
31.2Section 31.1 does not apply to a claim arising from use of the Services in breach of this Agreement, from modification of the Services by any person other than Agentic Learning, from combination with materials not supplied by Agentic Learning where the claim would not have arisen but for the combination, or from continued use after notice of an alleged infringement.
31.3If the Services become, or Agentic Learning reasonably believes they may become, the subject of an infringement claim, Agentic Learning may procure the right to continue use, modify the Services to be non-infringing without material loss of function, or terminate the affected Services and refund prepaid unused fees. This states Agentic Learning’s entire liability for infringement.
31.4The Customer will defend and indemnify Agentic Learning against third-party claims arising from data it had no authority to submit, from use of Output contrary to Section 7.4, from unauthorized access occurring through credentials issued to it, and from violation of Sections 19, 20, or 21. Where the Customer is a governmental entity whose authority to indemnify is limited by law, this Section applies only to the extent the law permits, and the Customer instead remains responsible for its own acts and omissions to the extent permitted by applicable law.
31.5Indemnification is conditioned on prompt written notice, sole control of the defence by the indemnifying party, and reasonable cooperation at the indemnifying party’s expense. Neither party will settle in a manner imposing liability, obligation, or admission on the other without consent, not unreasonably withheld.

32. Limitation of Liability

Neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, or data, however caused and on any theory of liability, even if advised of the possibility.

Subject to the following Sections, each party’s aggregate liability arising out of or relating to this Agreement is limited to the fees paid or payable by the Customer in the twelve (12) months preceding the event giving rise to the claim.

32.3Enhanced limit for data protection claims. For claims arising from Agentic Learning’s breach of Section 11.3, Section 12, or Section 13.2, the aggregate limit is the greater of three times the fees paid or payable in the twelve months preceding the event, or the amount stated in the Order Form. Agentic Learning maintains cyber liability insurance intended to respond to claims of this nature.
32.4Matters outside any limit. No limit applies to a party’s indemnification obligations, breach of confidentiality, breach by the Customer of Sections 18, 19, 20, or 21, an obligation assumed under an executed Data Protection Agreement, gross negligence or wilful misconduct, or the Customer’s payment obligations.
32.5The limitations in this Section are an agreed allocation of risk between commercially sophisticated parties, are reflected in the fees, and apply notwithstanding the failure of any limited remedy of its essential purpose.

33. Insurance

33.1Agentic Learning maintains commercial general liability, technology errors and omissions, and cyber liability insurance in amounts consistent with industry practice for services of this type, and furnishes certificates of insurance, and additional insured or waiver of subrogation endorsements where required, on request.
33.2Agentic Learning will notify the Customer of cancellation or material reduction of the cyber liability coverage during the term.

34. Compliance with Laws

34.1Each party will comply with the laws applicable to its performance, including export control, economic sanctions, and anti-corruption requirements. The Customer will not export or re-export the Services in violation of applicable law.
34.2Where required for a governmental Customer, Agentic Learning will furnish the certifications and verifications that jurisdiction requires of its contractors.
34.3Agentic Learning maintains policies prohibiting bribery, kickbacks, and improper payments, and requires its personnel and subcontractors to observe them.

35. Accessibility

35.1Agentic Learning designs and tests the Services with reference to the Web Content Accessibility Guidelines and furnishes a current accessibility conformance report on request.
35.2Agentic Learning acknowledges the Customer’s obligations under Section 504 of the Rehabilitation Act and Title II of the Americans with Disabilities Act, and will work with the Customer to remediate reported accessibility barriers within a period reasonable to the severity of the barrier.

36. Change of Control

36.1Agentic Learning will notify the Customer of a merger, acquisition, consolidation, reorganization, or sale of all or substantially all of its assets within sixty (60) days of closing, with written assurance that the successor assumes the obligations of this Agreement and of any Data Protection Agreement.
36.2Where a Data Protection Agreement confers a termination right on the Customer in respect of a successor, that right is preserved and this Section does not limit it.
36.3Where the Customer undergoes a change of control resulting in control by a developer of a Competing Product, Agentic Learning may terminate this Agreement on thirty (30) days’ notice and refund prepaid unused fees.

37. Publicity and References

37.1Neither party will use the other’s name, logo, or marks in publicity without prior written consent. Agentic Learning may identify the Customer in a customer list unless the Customer notifies it otherwise.
37.2Neither party will characterize the terms of this Agreement publicly without the other’s consent.

38. Equitable Relief

38.1The Customer acknowledges that a breach of Sections 18, 19, 20, 21, or 27 would cause Agentic Learning irreparable harm for which monetary damages would be an inadequate remedy.
38.2Each party may seek injunctive and other equitable relief without posting bond and without proof of actual damages in respect of a breach of confidentiality or of intellectual property rights. Remedies under this Agreement are cumulative and not exclusive.

39. Dispute Resolution

39.1Before initiating proceedings, the parties will attempt in good faith to resolve any dispute through escalation to senior representatives for thirty (30) days, except where injunctive relief is sought under Section 38.
39.2This Agreement is governed by the law of the State of Texas without regard to conflict of laws principles. Where the Customer is a governmental entity, the law and venue of the Customer’s jurisdiction apply.

40. Notices

40.1Notices are given in writing to the addresses stated in the Order Form, by personal delivery, recognized overnight courier, certified mail, or electronic mail with confirmation of receipt, and are effective on receipt. Notices of breach, termination, or indemnification must be given by a means other than electronic mail alone.

41. Government Customers

41.1Where the Customer is a governmental entity, no provision is intended to require it to waive sovereign or governmental immunity, to indemnify beyond the limits of its authority, to submit to arbitration where not permitted, or to create a debt in violation of its constitutional or statutory limits. Any such provision is read as modified to the extent necessary and does not affect the remainder.
41.2Nothing in Section 41.1 diminishes the Customer’s obligations under Sections 18 through 22, which the parties agree are within the authority of a governmental Customer to accept.

42. General Provisions

42.1Assignment. Neither party may assign this Agreement without consent, except to a successor in a merger or sale of substantially all assets, on notice, and subject to Section 36. Any purported assignment in breach of this Section is void.
42.2Independent contractors. The parties are independent contractors. Nothing creates a partnership, joint venture, agency, or employment relationship.
42.3Subcontractors. Agentic Learning may engage subcontractors and remains responsible for their performance and for their compliance with this Agreement.
42.4Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control, excluding payment obligations. A party relying on this Section will notify the other and resume performance as soon as practicable.
42.5Severability. If a provision is unenforceable it is modified to the minimum extent necessary and the remainder continues in effect.
42.6Waiver. No delay or omission in exercising a right operates as a waiver, and no single or partial exercise precludes further exercise.
42.7No third-party beneficiaries. This Agreement confers no rights on any person who is not a party. The rights of students and parents arise under applicable law and are enforced against the educational agency.
42.8Entire agreement. This Agreement, together with each Order Form and any executed Data Protection Agreement, is the entire agreement between the parties and supersedes prior understandings relating to its subject matter.
42.9Amendment. Agentic Learning may amend this Agreement on notice. For a Customer under an active Order Form, amendments take effect at renewal unless the Customer agrees earlier, and no amendment reducing the protections of Sections 11, 12, 13, 15, or 16 applies during a paid term without the Customer’s written agreement. No amendment binds a governmental Customer that requires amendments to be executed in writing.
42.10Counterparts. An Order Form may be executed in counterparts and by electronic signature, each of which is an original and together one instrument.

43. Contact

Questions regarding this Agreement may be directed to Agentic Learning at the address stated in the Order Form.

Agentic Learning Holding Company

Data Protection Policy

Version1.0
Effective dateJuly 2026
Policy ownerChief Executive Officer
Approved byChief Executive Officer
Review cycleAnnually, or on material change
ClassificationConfidential — may be shared with customers and partners

1. Purpose

1.1This policy establishes the requirements governing the protection of data entrusted to Agentic Learning Holding Company by educational agencies, partners, and other customers.
1.2Agentic Learning processes special education records, which include information concerning student disability, eligibility, evaluation, and services. These are among the most sensitive categories of information a school district maintains. This policy is written for that sensitivity and is not a general-purpose information security statement.
1.3This policy states requirements. Where a requirement is expressed as an obligation, compliance is mandatory and is not subject to individual discretion.

2. Scope

2.1This policy applies to all personnel, officers, contractors, and temporary staff of Agentic Learning, and to any person granted access to Agentic Learning systems or to Customer Data.
2.2This policy applies to all systems, environments, and services that process, store, or transmit Customer Data, including Agentic IEP, the Agentic Intelligence Management System, supporting infrastructure, administrative tooling, and monitoring systems.
2.3This policy applies to Customer Data in every state, including data in transit, at rest, in backup, in logs, in error traces, and in transient processing.

3. Definitions

“Customer” means an educational agency, partner, or other organization that has contracted for the Services.

“Customer Data” means data submitted to the Services by or on behalf of a Customer, together with documentation the Services generate concerning that Customer’s students.

“Education Record” has the meaning given at 34 CFR § 99.3.

“Personally Identifiable Information” means information as defined at 34 CFR §§ 99.3 and 300.32, including information that alone or in combination is linkable to a specific student.

“Personnel” means employees, officers, contractors, and temporary staff of Agentic Learning.

“Security Incident” means an event that compromises or may compromise the confidentiality, integrity, or availability of Customer Data or of the systems that process it.

“Sub-Processor” means a third party engaged by Agentic Learning that has access to Customer Data.

4. Governance and Accountability

4.1The Chief Executive Officer owns this policy, approves it, and is accountable for the protection of Personally Identifiable Information across the organization.
4.2The Chief Technology Officer is responsible for the design, implementation, and operation of the technical controls required by this policy, serves as the point of contact for Customer data security enquiries, and holds incident command.
4.3Contact details for each role are provided to Customers and partners in the applicable agreement and are supplied on request.
4.4Compliance with this policy is a condition of employment and of engagement as a contractor. Violation may result in withdrawal of access, disciplinary action, termination, and referral to authorities where the conduct warrants it.
4.5No exception to this policy takes effect unless approved in writing by the Chief Executive Officer, recorded with a stated rationale, scope, and expiry date, and reviewed at expiry.

5. Data Classification

5.1Data within Agentic Learning systems is classified as follows, and controls are applied according to classification.
ClassificationDescriptionHandling
Restricted Personally Identifiable Information from education records, including disability status, eligibility, evaluation data, and individualized education program content Encrypted in transit and at rest. Access by role and scope grant only. All access logged. Never used in non-production environments.
Confidential Educator identity and access records, parent and guardian contact information, Customer configuration, audit logs Encrypted in transit and at rest. Access limited to operational need. Access logged.
Internal Agentic Learning business information, proprietary methodology, source code Access limited to personnel with a business need. Subject to confidentiality obligations.
Public Published documentation and marketing material No restriction.
5.2Where data of differing classifications is combined, the resulting set is handled at the highest applicable classification.

6. Data Processed

6.1Agentic Learning processes only the data categories identified in the schedule of data appended to each Customer’s data protection agreement. Data outside that schedule shall not be requested, ingested, or retained.
6.2Categories processed generally include student identity and enrolment information; disability and eligibility information; evaluation and assessment data; individualized education program content including present levels, goals, objectives, specially designed instruction, accommodations, service minutes, and least restrictive environment determinations; parent and guardian contact information; and educator identity and access records.
6.3Agentic Learning does not process financial account information, payment card data, or Social Security numbers.
6.4Where a Customer transmits a data element not identified in its schedule of data, Agentic Learning shall notify the Customer and shall not retain the element unless the schedule is amended.

7. Lawful Basis and Regulatory Framework

7.1Agentic Learning acts as a school official with a legitimate educational interest under 34 CFR § 99.31(a)(1)(i)(B), performing an institutional service the agency would otherwise perform using its own employees, under the direct control of the agency with respect to the use and maintenance of education records, and subject to 34 CFR § 99.33(a) governing use and redisclosure.
7.2Because the records are special education records, Agentic Learning operates additionally to the confidentiality requirements at 34 CFR §§ 300.610 through 300.627. Where those provisions are more protective than the Family Educational Rights and Privacy Act, the more protective provision applies.
7.3Agentic Learning maintains a current listing of Personnel who may access Personally Identifiable Information, in support of the agency’s obligation under 34 CFR § 300.612, and furnishes it to the agency on request.
7.4Agentic Learning complies with student data privacy law applicable in each jurisdiction it serves, including the operator duties at Texas Education Code Chapter 32, Subchapter D and the biometric identifier provisions at Texas Government Code Chapter 560 for Texas deployments, and executes the data privacy agreement required in that jurisdiction, including supplemental state terms issued for it.
7.5The Services are educator-facing. Students do not hold accounts and do not interact with the Services directly. Collection therefore proceeds under school authorization rather than direct parental consent.
7.6Records for students served under Section 504 of the Rehabilitation Act receive the same confidentiality treatment as records governed by the Individuals with Disabilities Education Act.

8. Data Ownership and Customer Control

8.1The educational agency owns its data and the documentation generated for its students. Agentic Learning holds that data solely to provide the contracted services.
8.2The agency determines which records enter the Services, which personnel may access them, and when they are destroyed. Agentic Learning does not alter that determination.
8.3Agentic Learning does not redisclose Customer Data except as the agency directs in writing, as required by law, or to Sub-Processors bound by written agreements no less strict than those Agentic Learning owes the agency.
8.4Agentic Learning asserts no lien, security interest, or right of retention over Customer Data, including for unpaid fees.

9. Purpose Limitation and Prohibited Uses

9.1Customer Data shall be used only to provide the contracted services, to maintain their security, and to comply with law.
9.2Agentic Learning shall not:
  • sell, rent, or license Customer Data;
  • use Customer Data to inform, influence, or enable advertising of any kind;
  • create a profile of a student, parent, guardian, or family for any purpose other than providing the service;
  • use Customer Data to train, fine-tune, or otherwise develop or improve any foundation model or other machine learning model;
  • attempt to re-identify data that has been de-identified, or permit any other party to do so; or
  • transfer Customer Data outside the United States without the agency’s written direction.
9.3These prohibitions survive termination of the applicable agreement.
9.4Where aggregated, de-identified data is used for service improvement, it shall be de-identified consistent with 34 CFR § 99.31(b), shall not be transferred to a third party other than a Sub-Processor without the agency’s prior written consent, and shall not be used for model training. No document identifying an agency, explicitly or by reasonable inference, shall be published without that agency’s written approval.

10. Data Minimization

10.1Systems shall collect and retain the minimum data necessary for the function performed.
10.2Data transmitted for any single processing task shall be limited to the fields that task requires.
10.3Diagnostic output, error traces, and telemetry shall be configured to exclude Personally Identifiable Information wherever technically feasible, and shall be treated at the classification of the data they may contain.

11. Tenant Isolation

11.1Each educational agency shall be provisioned as a discrete tenant. Customer Data shall be scoped to the tenant at the data layer.
11.2No application path shall permit a session authenticated to one tenant to retrieve records belonging to another tenant.
11.3The automated test suite shall include negative assertions confirming that cross-tenant access fails. Such tests shall be executed as part of the release process and a release shall not proceed where they fail.

12. Access Control

12.1Access to Customer Data shall operate under least privilege and default deny. Access requires an affirmative role grant and a scope grant. Membership in a tenant is not itself sufficient to view a student record.
12.2Agencies administer their own role and scope assignments, consistent with their determination of who holds a legitimate educational interest. Agentic Learning shall not grant access within a Customer tenant except at that Customer’s direction or as permitted by Section 14.
12.3Access by Agentic Learning Personnel to production data shall be limited to those with a demonstrated operational need, shall be logged, and shall be reviewed not less than quarterly.
12.4Access rights shall be reviewed on any change of role and revoked on separation.

13. Authentication and Identity Lifecycle

13.1Account provisioning, role assignment, and deprovisioning shall be administered through the Agentic Intelligence Management System and shall be auditable.
13.2Deprovisioning on separation or role change is initiated by the agency and executed by the platform. Dormant accounts shall be surfaced for agency action on a defined review cycle.
13.3Administrative and privileged accounts shall require multi-factor authentication. Shared or generic accounts shall not be used for administrative access.
13.4Credentials shall not be shared. Personnel shall not disclose credentials to any person, including other Personnel.

14. Privileged and Administrative Access

14.1Administrative support access to a Customer tenant is a governed capability and shall be restricted to named Personnel whose authorization is recorded and reviewable.
14.2Initiation of a support session shall require a recorded justification referencing the supporting request or ticket.
14.3Support sessions shall be time-bounded and shall terminate automatically rather than persisting until manually closed.
14.4Every action taken under administrative access shall be logged and shall be distinguishable in the audit record from action taken by a Customer user. An action taken under administrative access shall never be recorded as though performed by a Customer user.
14.5Emergency access shall follow a distinct and more heavily logged path than routine support, and shall be reviewed after the fact.
14.6A Customer may request a record of administrative sessions opened against its tenant, and Agentic Learning shall provide it.

15. Encryption and Key Management

15.1Customer Data shall be encrypted in transit using current, non-deprecated protocols, and at rest using industry-standard algorithms.
15.2Encryption keys shall be managed through a managed key service, shall be rotated on a defined cycle, and shall not be stored alongside the data they protect.
15.3Credentials, application secrets, and API keys shall be held in a managed secrets store. Secrets shall not be committed to source control, embedded in application code, or stored in configuration panels accessible to unauthorized Personnel.
15.4Backups shall be encrypted.

16. Infrastructure and Network Security

16.1Customer Data shall be stored within the United States. A list of storage locations shall be furnished to a Customer on request.
16.2Production environments shall be logically separated from development, testing, and staging environments.
16.3Production Customer Data shall not be used in non-production environments. Where representative data is required for development or testing, synthetic or de-identified data shall be used.
16.4Administrative interfaces shall not be exposed to the public internet without access restriction.
16.5Infrastructure configuration shall be managed as code where practicable, so that configuration is reviewable and reproducible.

17. Endpoint and Workstation Security

17.1Devices used to access production systems or Customer Data shall employ full-disk encryption, automatic screen lock, and current operating system and security patches.
17.2Customer Data shall not be stored on local devices or removable media except where necessary for a defined task, and shall be deleted on completion.
17.3Customer Data shall not be transmitted through personal email accounts, personal file-sharing services, or unmanaged messaging applications.

18. Secure Development and Change Management

18.1Changes to production shall follow a defined change management process with peer review before merge and documented rollback capability.
18.2The regression suite shall include tests asserting tenant scoping, access control behaviour, and audit logging.
18.3Dependencies and infrastructure shall be scanned on a regular cadence, and identified vulnerabilities shall be remediated on a timescale proportionate to severity.
18.4Emergency changes shall be documented and reviewed after deployment.

19. Logging, Monitoring, and Audit

19.1Every access to a student record shall be logged with the identity of the actor, the record accessed, the time, and the action taken.
19.2Audit logs shall be append-only and shall not be alterable through the application. Log integrity shall be protected against modification by platform administrators.
19.3Audit records shall be available to an agency for its own tenant and shall be producible in a form suitable for use as evidence before a hearing officer or a monitoring authority.
19.4Direct query access to student records, including administrative search functions, shall be logged with actor, subject, and timestamp.
19.5Audit logs shall be retained for a period longer than the underlying record data, because the record of a disclosure must outlast the disclosure. Retention periods are stated in each Customer’s data protection agreement.
19.6Systems shall be monitored for anomalous access patterns, including bulk retrieval, off-hours access, and access outside assigned scope, and identified anomalies shall be investigated.

20. Artificial Intelligence and Model Processing

20.1The Services use large language models within a multi-agent workflow system. Discrete agents perform bounded tasks, which permits the data transmitted for any single task to be limited to what that task requires.
20.2Customer Data shall not be used to train, fine-tune, or otherwise develop or improve any foundation model. Agentic Learning shall contract with each model provider on terms prohibiting such use. This requirement applies to identified and de-identified Customer Data alike, and is a contractual commitment rather than a configuration setting.
20.3Each model provider shall be identified in the sub-processor register and shall be subject to the requirements of Section 21.
20.4Provider-side retention of transmitted content shall be minimized to the extent the provider’s commercial terms allow. The then-current retention position shall be disclosed to a Customer on request.
20.5Where prompt caching is used, cached content shall be limited to non-identifying instructional scaffolding wherever technically feasible.
20.6Generated documentation shall be validated against regulatory and internal rule sets before presentation to an educator, and shall be treated as a draft until reviewed by qualified personnel.
20.7The Services shall not be configured to render a determination concerning a student, or to adopt or finalize documentation into a student record without human review.
20.8Assertions within generated documentation shall be attributable to the source instrument or data point from which they derive.
20.9All data points supplied by a Customer shall be preserved. Data shall not be discarded to resolve apparent inconsistency, and data points bearing different dates shall be retained as longitudinal evidence.

21. Sub-Processor Management

21.1A current register of Sub-Processors shall be maintained and made available to Customers.
21.2No Sub-Processor shall be engaged without a written agreement requiring protection of Customer Data on terms no less strict than those Agentic Learning owes its Customers, including the prohibition on model training.
21.3Sub-Processors shall be assessed before engagement and reassessed periodically, with regard to their security posture, their assurance position, and their own sub-processing.
21.4Material additions to the register affecting the processing of Personally Identifiable Information shall be notified to affected Customers in advance, and an agency may object on reasonable data protection grounds.
21.5Sub-Processor access shall be limited to the data and duration necessary for the function performed.

22. Personnel Security

22.1Personnel and contractors with access to Customer Data shall be screened before access is granted.
22.2All such Personnel shall execute confidentiality agreements before access is granted.
22.3All such Personnel shall complete training on the confidentiality requirements of the Family Educational Rights and Privacy Act and the Individuals with Disabilities Education Act before access is granted, and annually thereafter. Completion shall be recorded.
22.4Access shall be removed promptly on separation or change of role, and returned assets shall be accounted for.
22.5Personnel shall report suspected Security Incidents without delay and without fear of reprisal for good-faith reporting.

23. Physical and Asset Security

23.1Production infrastructure is operated in facilities maintained by the hosting provider, subject to that provider’s physical security controls and third-party assurance.
23.2Agentic Learning maintains an inventory of devices with access to production systems or Customer Data.
23.3Devices and media shall be securely wiped or destroyed before disposal, reassignment, or return.

24. Backup, Recovery, and Continuity

24.1Customer Data shall be backed up on a defined schedule. Backups shall be encrypted and access-controlled to the same standard as production data.
24.2Restoration shall be tested periodically, and the results of testing shall be recorded.
24.3Agentic Learning maintains a business continuity and disaster recovery capability with defined recovery time and recovery point objectives, and furnishes a summary of those objectives to a Customer on request.
24.4Continuity arrangements shall be reviewed at least annually.

25. Vulnerability and Risk Management

25.1A risk assessment covering the processing of Customer Data shall be conducted at least annually and on material change to the Services, the infrastructure, or the Sub-Processor register.
25.2Identified risks shall be recorded with an owner, a treatment decision, and a review date.
25.3Vulnerabilities shall be remediated on a timescale proportionate to severity and exploitability, and material delays shall be recorded with a compensating control.
25.4Reports of vulnerabilities from external parties shall be acknowledged and investigated.

26. Incident Response and Breach Notification

26.1Agentic Learning maintains a written incident response plan reflecting industry practice and applicable federal and jurisdictional law. A summary shall be furnished to a Customer on request. Incident command rests with the Chief Technology Officer.
26.2Any suspected exposure of Personally Identifiable Information shall be classified as high severity by default.
26.3The response sequence is: detect and classify; contain, including revocation of credentials or sessions; notify; investigate scope, affected individuals, and root cause using the audit record; remediate; and report.
26.4On confirming a Security Incident involving unauthorized access to or disclosure of Customer Data, Agentic Learning shall notify the agency’s designated security contact and its special education confidentiality official within seventy-two (72) hours, or within any shorter period stated in the applicable data protection agreement, unless notification would disrupt a law enforcement investigation, in which case notice shall follow as soon as reasonably possible.
26.5Notification shall include, to the extent known and as it becomes available, the reporting contact, the categories of Personally Identifiable Information involved, the date or estimated date range of the incident, whether notification was delayed for law enforcement reasons, and a description of the incident.
26.6Agentic Learning shall provide the information the agency requires to identify affected individuals and to discharge its own notification obligations, shall cooperate in the agency’s investigation, and shall deliver a written post-incident report including root cause and corrective actions.
26.7The agency, as owner of the education record, gives notice to parents, guardians, and regulators.
26.8The incident response plan shall be exercised periodically, and lessons identified shall be recorded and actioned.

27. Retention, Return, and Destruction

27.1Retention follows the agency’s records schedule. Customer Data shall not be retained longer than the agency directs.
27.2On written request, Agentic Learning shall delete Customer Data or provide a transfer mechanism within sixty (60) days, or within any shorter period stated in the applicable data protection agreement, and shall issue written certification of destruction.
27.3Deletion of an individual student’s records shall be supported at the agency’s direction, consistent with 34 CFR § 300.624 and the agency’s own permanent record obligations.
27.4On termination, Customer Data shall be returned in a usable, machine-readable format and then destroyed, or destroyed directly at the agency’s election, with written certification.
27.5Data held in backups is deleted on expiry of the backup cycle. The backup retention window shall be disclosed to a Customer on request.
27.6Audit logs are retained beyond record data in accordance with Section 19.5.

28. Individual Rights

28.1Requests from parents, guardians, or eligible students are handled by the educational agency, which owns the record. Agentic Learning shall refer any individual who contacts it directly to the agency.
28.2Agentic Learning shall support the agency in responding to requests to inspect and review records under 34 CFR § 300.613, including where records must be produced before a meeting of the admission, review, and dismissal committee, and shall respond within the period the agency is required to meet and in no event later than forty-five (45) days.
28.3Agentic Learning shall support amendment of records under 34 CFR §§ 300.618 through 300.621. Records shall be version-tracked rather than overwritten, so that an agency can evidence a record as it existed at a given time.
28.4Agentic Learning shall support destruction of information at parental request under 34 CFR § 300.624, at the agency’s direction.

29. Compliance, Assurance, and Audit

29.1Agentic Learning shall respond to Customer and partner security questionnaires and shall make its control documentation available under an appropriate agreement.
29.2A Customer may audit the security and privacy measures protecting its own data once annually, and additionally following any unauthorized access, on not less than ten (10) business days’ written notice and subject to an appropriate confidentiality agreement. Agentic Learning shall cooperate reasonably with the Customer and with any authority holding oversight jurisdiction.
29.3Agentic Learning shall implement its security programme against a recognized cybersecurity framework, identified in each Customer’s data protection agreement.
29.4The current third-party assurance position shall be provided to Customers and partners on request, and shall be stated accurately, including where a control is designed but not yet independently attested.
29.5Compliance with this policy shall be reviewed internally at least annually, and material findings shall be reported to the Chief Executive Officer with a remediation plan.

30. Policy Governance

30.1This policy shall be reviewed at least annually and whenever there is a material change to the Services, to the Sub-Processor register, to the infrastructure, or to applicable law.
30.2Material changes shall be communicated to Customers. This policy shall not be amended during a Customer’s paid term in a manner that materially reduces the protection afforded to that Customer’s data.
30.3Superseded versions shall be retained so that the policy applicable at any past date can be established.
30.4Questions about this policy may be directed to Agentic Learning at the address stated in the applicable agreement.

Agentic IEP and the Agentic Intelligence Management System are products of Agentic Learning Holding Company. The Agentic Learning Algo and associated methodologies are proprietary and constitute trade secret.