SENBOX Terms of Use and Product Licence

Revision prepared: 30 October 2026 Effective date: To be set by SENBOX following legal review and required notice.

Draft for legal review. This revision addresses U.S. and EU requirements where applicable. Applicability depends on customers, processing activities, product classification and jurisdiction. It does not certify compliance. Before publication, confirm the Privacy Policy, security practices, processing agreements and company details against actual operations.

THIS LEGAL AGREEMENT BETWEEN YOU AND EDUCATION SEN PLUS COMPANY LIMITED(“SENBOX,” “we,” “us,” or “our”) GOVERNS YOUR USE OF THE SENBOX FRAMEWORK, INCLUDING ALL TOOLS, RESOURCES, APPLICATIONS, WEBSITES, SOFTWARE, PRODUCTS, AND ANY OTHER PLATFORMS OR SERVICES OPERATED BY OR ON BEHALF OF SENBOX (COLLECTIVELY REFERRED TO AS THE “SERVICE”). IT IS IMPORTANT THAT YOU READ AND UNDERSTAND THE FOLLOWING TERMS. BY CLICKING “AGREE,” OR BY ACCESSING OR USING THE SERVICE, YOU ARE AGREEING THAT THESE TERMS WILL APPLY.

Plain-language summary (non-binding): SENBOX provides educational tools and a communication platform for schools, teachers, therapists, parents, and students. You are responsible for lawful use, protecting children’s rights and privacy, and following our rules. We may update the Service and these Terms. Some features may be paid. Liability is limited as allowed by law.

I. INTRODUCTION

1. The SENBOX Framework aims to support educators and parents in the care and education of their children. By accessing or using any part of the SENBOX Framework, you agree to comply with these Terms and acknowledge that you do so at your own risk. 2. If you do not agree to these Terms, you must not use the Service. 3. Eligibility: By using our Service, you confirm that you are a parent or guardian with lawful authority, an authorized professional, or a duly authorized representative of an Organization. Children may use age-appropriate features under lawful adult authorization and supervision.

II. REQUIREMENTS FOR USE

A. Age and Capacity. You must be legally capable of entering into this Agreement under applicable law. Where consent or parental authorization is required, the responsible party must obtain and document it as described in Section VI; each party remains responsible for its own statutory duties.

B. Accounts and Roles. Use of the Services requires an Account and may require Internet access and compatible devices. Organizational administrators are responsible for configuring roles and permissions (e.g., teacher, therapist, staff, parent/guardian) and ensuring only authorized personnel can access sensitive information.

C. Compliance. You agree to use the Services only as permitted by this Agreement and applicable law (including but not limited to child protection, privacy/data protection, educational, disability, and intellectual‑property laws). You may not use the Services where prohibited by law.

D. Updates & Software. The Services may require periodic updates that can affect functionality and performance. You consent to receiving and installing updates.

III. LIMITATIONS ON USE & ACCEPTABLE CONDUCT

You agree not to use the Services to:

Violate child protection laws, exploit or harm children, share child sexual abuse/exploitation material (CSAM/CSEM), or otherwise endanger minors. - Upload or share unlawful, harassing, defamatory, obscene, hateful, or discriminatory content. - Infringe intellectual‑property or confidentiality rights (including uploading content you do not own or lack permission to use). - Interfere with or disrupt the Services, including via malware, automated scraping, or excessive bandwidth/storage consumption. - Collect personal data from minors without verifiable consent from a parent/guardian or the minor’s lawful representative, where required. - Circumvent access controls, share credentials, or allow unauthorized access to Accounts. - Plan or engage in illegal activity, or violate others’ rights.

We may take reasonable steps to protect the Services and users (including rate‑limiting, content moderation, feature limits, suspension, or termination). Repeated or serious violations may lead to permanent account termination.

IV. FEATURES & SERVICE DESCRIPTION

A. Progress Tracking & Records. SENBOX enables tracking of educational goals, observations, and interventions; storage of reports; and data visualization for authorized users. Organizations remain responsible for the accuracy of records and access permissions.

B. Messaging & Parent Communication. The Services may include messaging, notes, photo/video sharing, and announcements among authorized teams and families. Do not transmit medical advice, diagnoses, or emergency communications through SENBOX. For emergencies, use local emergency services.

C. Media, Photos & Videos. Uploading a Child’s media requires appropriate consent as per applicable law and your Organization’s policy. Shared albums/links may be accessible by anyone with the link; exercise caution when sharing externally.

D. File Storage & Sharing. Files stored or shared via the Services may be downloaded or copied by recipients. Revoking access does not delete copies previously saved by others.

E. Scheduling & Timetables. The Services may include calendars, schedules, attendance, and activity workflows. Always verify critical details offline.

F. Third‑Party Integrations. You may connect third‑party tools (e.g., Google Sheets, Microsoft Excel, cloud storage). Data shared with third parties is governed by their terms and privacy policies. You are responsible for reviewing and complying with those terms.

G. Web‑Only Access. If you sign up from a non‑compatible device, you may have limited functionality.

H. Organizational Administration. Organization administrators can configure user roles, approve invitations, manage groups/classes, and define retention/export settings. Administrators are responsible for off‑boarding users when employment or engagement ends.

I. Beta Features. We may offer beta features “as is” for testing and feedback and may modify or discontinue them at any time.

V. AVAILABILITY, CHANGES & SUPPORT

A. Availability. The Services or specific features may not be available in all languages or regions and may change over time. We strive to use reasonable skill and due care but cannot guarantee uninterrupted or error‑free operation.

B. Changes to Services/Terms. We may modify the Services or this Agreement. For material adverse changes to paid Services, we will provide advance notice where reasonable. If you do not agree to updated terms, you must stop using the Services and, if applicable, may be eligible for a pro‑rata refund per Section VII (Payments & Subscriptions).

C. Support. Standard support channels are provided as described on our website or within the app. Response times are not guaranteed unless expressly stated in a separate written agreement.

VI. PRIVACY, DATA PROTECTION & SAFEGUARDS

A. Applicable laws and responsibilities. Each party must comply with the privacy and cybersecurity laws applicable to its own activities. These include, where applicable, the EU General Data Protection Regulation (GDPR), national ePrivacy laws, U.S. COPPA and its amended Rule, FERPA, the California Consumer Privacy Act as amended by the CPRA, other applicable state privacy, student-data, consumer-health-data and breach-notification laws, and applicable Vietnamese law. References to a law do not mean that every provision applies to every user or product. Mandatory rights prevail over these Terms.

B. Privacy notice and roles. The SENBOX Privacy Policy must identify processing purposes, data categories, legal bases where required, recipients, retention criteria, international transfers and rights contacts. Accepting these Terms is not blanket consent to data processing. An Organization generally determines the purposes of its educational records; SENBOX processes those records on its documented instructions where acting as processor or service provider. SENBOX may act as an independent controller for its own account administration and security activities, as explained in the Privacy Policy. Roles depend on actual activities. Where required, the parties must enter into a compliant data processing agreement, including GDPR Article 28 terms, before processing begins. These Terms do not replace that agreement.

C. Children and parental authorization. Provide age-appropriate notices and obtain verifiable parental consent before collecting personal information from children under 13 where COPPA requires it, subject to lawful exceptions. The amended COPPA Rule generally required compliance by 22 April 2026. Where required, obtain separate verifiable parental consent for disclosures to third parties that are not integral to the service, including targeted advertising. Do not condition participation on unnecessary data collection. Provide applicable parental review, deletion and withdrawal options and comply with the Rule's security and retention requirements. School authorization may be relied upon only within its legally permitted educational scope; it does not transfer SENBOX's own legal duties to the school.

For GDPR processing based on consent in connection with an information-society service offered directly to a child, Article 8 generally sets age 16, subject to national reductions to no lower than 13. Below the applicable age, obtain or verify authorization from the holder of parental responsibility. This rule is not a universal minimum age for every educational activity. Other lawful bases may apply where legally appropriate.

D. Sensitive and educational information. Disability, developmental, behavioural and therapy records may reveal health or other sensitive information even when labelled educational. Apply an appropriate lawful basis and, where required, a separate condition for special-category data. Collect only necessary information and limit access. Do not upload HIPAA-regulated protected health information unless SENBOX has expressly agreed to the deployment and the required business associate agreement and safeguards are in place. An educational label does not itself exempt data from healthcare or consumer-health laws.

Where FERPA applies, the institution must establish a lawful disclosure basis. If relying on the school-official exception, SENBOX must satisfy its conditions, including institutional direct control over use and maintenance of records and applicable limits on use and redisclosure. Parents and eligible students retain their statutory rights.

E. Individual rights. SENBOX and Organizations will handle applicable requests for access, correction, deletion, restriction, portability, objection, consent withdrawal and appeals within statutory time limits, subject to lawful exceptions and proportionate identity verification. Applicable U.S. state rights may include opting out of sale, sharing, targeted advertising or certain profiling, and limiting specified sensitive-data uses. Honor legally required opt-out preference signals. Do not retaliate for exercising protected rights. Requests may be submitted using Section XV; processor-held requests may be referred to the responsible Organization with appropriate assistance. Individuals retain the right to complain to competent regulators.

F. Security and incident response. Each party must implement safeguards appropriate to its role and risk, including access management, secure authentication, appropriate encryption, vulnerability management, recovery arrangements and incident-response procedures. No system guarantees absolute security. Users must promptly report suspected compromise through Section XV. Where SENBOX is a GDPR processor, it must notify the controller without undue delay after becoming aware of a personal-data breach. A controller must notify the competent authority within 72 hours where feasible unless the breach is unlikely to risk individuals' rights and freedoms, and notify affected individuals without undue delay when required for high-risk breaches. Other applicable reporting regimes and deadlines remain independently applicable.

G. Retention, deletion and transfers. Retain personal information only for the period necessary for the stated lawful purposes or required by law; implement documented retention and deletion arrangements, including for backups. A user's backup obligations do not remove SENBOX's duties. International transfers, including access from Vietnam, must use a valid legal mechanism where required, such as applicable standard contractual clauses with necessary assessments and supplementary safeguards. Acceptance of these Terms alone does not authorize an otherwise unlawful transfer.

H. Cybersecurity legislation. Where SENBOX or a deployment falls within national laws implementing NIS2 (Directive (EU) 2022/2555), the responsible entity must meet the applicable risk-management, governance and incident-reporting requirements. NIS2 does not automatically cover every educational website. Where a SENBOX product falls within the Cyber Resilience Act (Regulation (EU) 2024/2847), SENBOX must meet the duties applicable to its economic-operator role and relevant dates: Article 14 reporting obligations apply from 11 September 2026; the main product requirements apply from 11 December 2027. Coverage must be assessed for the particular software or hardware, including relevant remote processing; a standalone website is not automatically covered. No CE conformity or certification is represented by these Terms.

California's additional CCPA regulations became effective on 1 January 2026, with phased compliance dates for certain obligations. Risk assessments, cybersecurity audits and automated-decisionmaking requirements apply only where their scope, thresholds and deadlines are met. These Terms do not represent that SENBOX has completed any particular audit.

I. Cookies and AI-enabled features. Obtain consent for nonessential cookies or similar technologies where required and provide effective choices. If AI features are offered, identify AI interaction where required, provide appropriate human oversight, and assess obligations under the EU AI Act and applicable U.S. law for the actual use case and applicable implementation date. Do not use outputs as the sole basis for significant decisions about a child without the safeguards required by law. An education-related feature is not automatically classified as high-risk AI.

VII. PAYMENTS, SUBSCRIPTIONS & TRIALS

A. Plans. Certain features are offered on a subscription basis (e.g., organization seats, storage tiers, advanced analytics). Pricing and plan details are shown in‑app or on our website and may vary by region.

B. Billing. By upgrading to a paid plan, you authorize recurring charges to your selected payment method, including taxes. You can change or cancel your plan as described in the billing interface. Upgrades take effect immediately; downgrades/cancellations typically take effect at the end of the current billing period.

C. Trials & Refunds. Where offered, free trials convert to paid subscriptions unless cancelled before the trial ends. Except where required by law or expressly stated, fees are non‑refundable. For material adverse changes to paid Services that you reasonably cannot accept, you may contact us for a pro‑rata refund of the unused portion of your current term.

D. Delinquency. If payment fails, we may limit features, restrict access to stored content, or suspend/terminate the Account after notice where required.

VIII. INTELLECTUAL PROPERTY & FEEDBACK

A. Ownership. SENBOX or its licensors retain all applicable intellectual-property rights in the Services and products, including software, original interfaces, illustrations, videos, manuals, teaching resources, activity cards, communication boards, worksheets, product artwork, packaging designs, names and logos (“SENBOX Materials”). Ownership of a physical product does not transfer intellectual-property rights in its content or design.

B. Limited permission to use. Subject to your purchased plan and any written product licence, SENBOX grants a limited, non-exclusive licence to use SENBOX Materials for the authorized household or Organization and its authorized users. You may print, download, adapt or share materials only to the extent expressly permitted by the product instructions, licence, written authorization or applicable law. An available download or screenshot function does not grant redistribution or commercial reproduction rights.

C. No unauthorized copying or reproduction. These restrictions apply to parents, guardians, teachers, therapists, Organizations and all other users. Except as authorized above or protected under paragraph F, you must not copy, scan, photograph, screen-record, reproduce, translate, adapt, publish, upload, distribute, sell, rent, sublicense or commercially exploit SENBOX Materials, in whole or in a protected substantial part. This includes making duplicate teaching kits or cards, distributing digital copies in parent groups, uploading paid resources to shared drives, or using a third party or AI tool to reproduce protected content. Educational, personal or nonprofit intent does not itself supply permission.

D. No infringing imitation or cloning. You must not reproduce protected elements to manufacture or distribute unauthorized replicas, create infringing derivative products, misappropriate confidential know-how, or use SENBOX branding or confusingly similar branding to imply affiliation or approval. Minor changes to colours, wording, dimensions or branding do not authorize an otherwise infringing copy. These Terms do not claim exclusive ownership of general educational ideas, facts, methods or independently developed, non-infringing products.

E. Software and access protections. You must not unlawfully bypass licence checks or access controls, remove rights notices, extract proprietary code or databases, or reverse engineer, decompile or disassemble software except as permitted by applicable law or written authorization. Do not use shared credentials to evade purchased seat limits.

F. Legal exceptions and user records. Nothing in this Section excludes rights or exceptions that applicable law does not permit us to restrict, including qualifying lawful software backup, observation or interoperability activities. Applicable copyright exceptions, including fair use where available, remain subject to their legal conditions. Open-source and third-party materials remain subject to their own licences. These restrictions do not prevent lawful access to, export of, or copying of your own content or a child's records, or lawful disclosures to advisers, authorities or courts. SENBOX's underlying materials remain protected to the extent allowed by law.

G. Your content. You retain your rights in content you submit. You grant SENBOX only the non-exclusive rights necessary to host, process, transmit and display that content to provide the Services as instructed and permitted by applicable law and the governing processing agreement. This licence does not authorize sale of personal information, unrelated advertising or general-purpose AI training on children's records. You must have the necessary rights and lawful authority to submit content.

H. Feedback. You grant SENBOX a worldwide, royalty-free licence to use voluntary product suggestions without attribution or payment, excluding personal data, confidential records and third-party material you lack authority to license.

I. Permissions and enforcement. Request written reproduction permission or report suspected infringement using Section XV, identifying the materials and intended use or alleged infringement. Silence is not permission. SENBOX may investigate, request cessation and removal of unauthorized copies, suspend access proportionately under Section IX, and seek remedies available under applicable law. This does not impose automatic penalties or eliminate procedural, consumer or data-protection rights.

IX. SUSPENSION, TERMINATION & DATA EFFECTS

A. By You. You may stop using the Services at any time. Organization administrators may request account closure per our off‑boarding process. Some actions may be irreversible.

B. By SENBOX. We may suspend or terminate Accounts, with or without notice where permitted by law, for: (i) breaches of this Agreement or applicable law; (ii) security risks or technical issues; (iii) non‑payment; (iv) requests by authorities; or (v) discontinuation of the Services.

C. Effects. Upon termination, access to the Services and Content may cease. We may delete data after a retention period consistent with our Privacy Policy and legal obligations. Organizations are responsible for exporting data before termination where feasible.

X. DISCLAIMERS; LIMITATION OF LIABILITY; INDEMNITY

A. Educational Use; No Clinical Advice. The Services support educational practice and family-school collaboration. They are not a substitute for professional medical advice, diagnosis, or emergency services.

B. Provided “As Is”. To the maximum extent permitted by law, the Services are provided “as is” and “as available,” without warranties of any kind, express or implied.

C. Limitation of Liability. SENBOX shall not be liable for indirect, incidental, or consequential damages. Liability is capped at fees paid in the six months before the claim.

D. Indemnity. You agree to defend and hold SENBOX harmless from claims arising from your Content, misuse, violations, or disputes with third parties.

E. Mandatory rights. The exclusions, liability cap and indemnity above apply only to the extent lawful. They do not exclude non-excludable liability, statutory data-protection remedies or mandatory consumer guarantees. Consumer users have no indemnity obligation to the extent prohibited or unfair under applicable law. Nothing limits liability for fraud, wilful misconduct or other matters that cannot lawfully be limited.

XI. EXPORT, SANCTIONS & COMPLIANCE

You agree to comply with applicable export control and sanctions laws and not to export, re-export, or provide access to the Services in violation of such laws.

XII. GOVERNING LAW & DISPUTE RESOLUTION

This Agreement is governed by the laws of the Socialist Republic of Vietnam. You agree to the exclusive jurisdiction of the courts of Ho Chi Minh City, Vietnam, subject to mandatory consumer-protection rights in your jurisdiction.

XIII. NOTICES; ELECTRONIC COMMUNICATIONS

We may provide notices via email, in-app messages, or postings within the Services. By using the Services, you consent to electronic communications and agree that electronic records satisfy legal requirements for written notices.

XIV. GENERAL TERMS

If any provision of this Agreement is held invalid, the remainder will remain in effect. Our failure to enforce rights is not a waiver. There are no third-party beneficiaries unless expressly stated. This Agreement is the entire agreement between you and SENBOX.

XV. CONTACT & NOTICES

Entity: SENBOX Framework is operated by Education Sen Plus Company Limited.

• Registered Address: No. 8, Street No. 56, Tan Phong Ward, District 7, Ho Chi Minh City, Vietnam.

• Company Registration Number: 0315961864.

• VAT Number: 0315961864.

Address: Số 8, Đường 56, Khu Định Cư Tân Quy Đông, Quận 7, Ho Chi Minh City, Vietnam

Email: mueller@senbox.org

Website: https://www.senbox.org (https://www.senbox.org)

ANNEX A – SERVICE-SPECIFIC RULES

Photo/Video Usage: Obtain guardian consent before capturing or sharing a Child’s images. Remove access promptly upon consent withdrawal. Avoid public links unless necessary and approved.

Observation & Reports: Use professional, respectful language. Do not include unverified diagnoses or stigmatizing labels. Separate educational records from clinical/medical records.

Device Security: Enable passcodes/biometrics; do not store credentials in plain text; promptly report lost/stolen devices.

Data Retention: Default retention periods align with organizational policy and applicable law. Upon request and subject to law, we can assist Organizations in exports.

Emergency Use: Do not use SENBOX for urgent safety issues. Contact local emergency services.

ANNEX B – ORGANIZATION ADMIN ADDENDUM

Role Management: Assign least-privilege permissions; review access quarterly; promptly remove access for departing staff.

Consent Management: Maintain written consent records; provide templates and renewal reminders; honor revocations.

Breach Response: Maintain an incident-response plan; notify SENBOX of suspected breaches; cooperate in investigations and notifications required by law.

Training: Provide periodic staff training on safeguarding, data privacy, and acceptable use tailored to SENBOX workflows.