HanziTales — School and Educator Addendum

Status: prepared, not yet in force. HanziTales does not currently offer School accounts. This addendum takes effect for a School only when Rifta Studio LLC and that School sign or electronically accept it together with an order form. Until then, consumer Terms of Service apply and accounts require users to be 13 or older.

Version: 1.0 · Prepared: 22 September 2026

This Addendum is between Rifta Studio LLC, a Washington limited liability company ("Rifta Studio", "we"), and the school, school district, tutoring organisation or other educational institution named on the order form ("School"). It governs the School's use of HanziTales for its learners ("Students") and supplements the Terms of Service, prevailing over them and over the Privacy Policy where they conflict, for School accounts only.

1. Roles of the parties

The School is the controller of Student personal information (and, in US terms, the educational agency or institution and the owner of student data). Rifta Studio is a processor / service provider / school official acting only on the School's documented instructions, which are these terms and the order form.

We do not sell, rent or share Student personal information, do not use it for advertising or for any commercial purpose of our own, do not build advertising profiles, and do not use it to train artificial intelligence models.

2. Children under 13 — COPPA

The School may create accounts for Students under 13. In doing so:

• The School provides consent on behalf of parents under the COPPA school-consent mechanism, and confirms that it is authorised to do so under its own policies and applicable law, having given parents notice of the categories of information collected, the purposes, and their right to review and request deletion of their child's information.
• We collect from Students only what is needed to deliver the educational service, and only for educational purposes — no advertising, no behavioural profiling outside learning adaptation, no sale.
• On request, we provide the School with a copy of a Student's data, and delete a Student's data, within 30 days.
• We will provide the School, on request, the information it needs to give parents the direct notice COPPA requires.

Rifta Studio does not seek to obtain parental consent directly, and relies on the School's confirmation.

3. Student records — FERPA

Where Student data constitutes an education record, Rifta Studio acts as a "school official" with a legitimate educational interest under 34 CFR § 99.31(a)(1). We:

• are under the School's direct control regarding the use and maintenance of the data;
• use education records only to perform the service;
• do not redisclose them except as permitted in writing by the School or required by law;
• will refer any request from a parent or eligible student for access, amendment, or a copy of records to the School, and assist the School in responding.

4. State student privacy laws

We comply with applicable state student data privacy laws, including California's SOPIPA and AB 1584, New York Education Law § 2-d, Illinois SOPPA, and Washington's student data provisions. In particular we do not use Student data for targeted advertising, do not create non-educational profiles, do not sell Student data, maintain reasonable security, and delete Student data on request or at the end of the agreement. Where a state requires a specific rider or data privacy agreement, and the School provides it, we will negotiate and execute it, and it prevails over this Addendum to the extent of any conflict.

5. Student accounts and purchasing

Accounts created by a School:

• have no purchasing ability — no subscriptions, no credit top-ups, no store links, no promotional offers are shown to Students;
• have no access to redemption of codes or to any payment interface;
• are provisioned and removed by the School's teachers or administrators;
• are governed by the usage allowances on the School's order form rather than the consumer plans.

The School pays by invoice or by the method stated on the order form. The Subscription, Credits and Refund Terms do not apply to School accounts except where the order form adopts them.

6. Content standards in the classroom

Content generated in School accounts is held to a classroom-appropriate standard, stricter than the consumer Acceptable Use and Content Policy, with tighter automated filtering on generation and a teacher-visible review of what Students produce and read. Teachers may restrict which books Students can access and may remove content from their class.

Generated content can still contain errors or unexpected material; teachers should treat it as a draft teaching resource, not as vetted curriculum, and supervise its use.

7. Ownership of generated content in Schools

For School accounts, this section replaces section 7 of the Terms of Service. Student records, and the books and other Generated Output created in a School account, remain the property of the School — or of the Student who created them, where the School's policies or applicable law so provide. Students retain control of content they create: the School may export it for them at any time, and we delete it on the School's request under section 10.

Rifta Studio receives only a limited, non-exclusive licence to host, process, reproduce and display that material for the sole purpose of providing the Service to the School, ending when the data is deleted.

We will not publish books generated in a School account, and we will not use Student prompts or Student-generated text in any commercial publication.

8. Security and incidents

We maintain the technical and organisational measures described in the Privacy Policy, including encryption in transit and at rest, row-level access control, least-privilege administrative access and secret management. We will notify the School without undue delay, and in any case within 72 hours, of a personal data breach affecting Student data, with the information the School needs to meet its own notification duties, and will cooperate with its response.

9. Subprocessors

We use the subprocessors listed in Subprocessors, each under contract. We will give the School at least 30 days' notice by email before adding a subprocessor that processes Student data, and the School may object on reasonable data-protection grounds, in which case we will propose an alternative or the School may terminate the affected service without penalty for the unused period.

AI and speech providers receive text content only, never Student names, emails or account identifiers, and are contractually barred from training on it.

10. Data retention, return and deletion

During the agreement, the School may export or request Student data at any time. Within 30 days of the end of the agreement, or of a School request, we delete Student personal information, save for backups that age out on the normal rolling window and any records we must retain by law, which remain subject to these obligations while held.

We never retain Student data for our own purposes, including after termination.

11. GDPR and UK GDPR terms

Where the School is subject to the GDPR or UK GDPR, this Addendum is the Article 28 processing agreement between us. Subject matter: provision of the HanziTales language-learning service. Duration: the term of the agreement. Nature and purpose: hosting, generation of learning material, synthesis of audio, progress tracking. Types of personal data: account identifiers, display names, school-assigned identifiers, learning activity and content written by Students. Categories of data subjects: Students and teaching staff.

We will: process only on documented instructions, including for international transfers; ensure persons authorised to process are bound by confidentiality; implement Article 32 measures; engage subprocessors only under section 9 with equivalent obligations; assist the School with data subject requests and with Articles 32–36; delete or return data under section 10; and make available the information needed to demonstrate compliance, allowing for audits under section 12.

Transfers outside the EEA or UK rely on the Standard Contractual Clauses and UK Addendum, incorporated by reference, with Rifta Studio as data importer.

12. Audit and assurance

On reasonable written notice, no more than once a year unless required by a regulator or following a breach, we will respond to a security questionnaire and provide the documentation reasonably needed for the School to verify compliance. On-site audits are by agreement, at the School's cost, without disrupting our service to other customers.

13. Liability and term

The liability provisions of the Terms of Service apply, except that the cap is the greater of the fees paid by the School in the 12 months preceding the claim, or USD 1,000. The arbitration and class-action provisions do not apply to a School that is a public entity, where its law forbids them; disputes with such a School are subject to the courts in section 17 of the Terms of Service.

The term, fees and Student numbers are on the order form. Either party may terminate for material breach not cured within 30 days.

14. Contact

Rifta Studio LLC · support@hanzitales.com (subject: "Schools") · legal notices: legal@hanzitales.com