Supervised Minor Access Policy

Exhibit C to the BoodleBox Master SaaS and Services Agreement · Incorporated into the BoodleBox Terms of Service

Preamble

BoodleBox is committed to expanding AI literacy and equitable access to collaborative AI tools across the full educational continuum. Recognizing that secondary-level students and young learners can meaningfully benefit from AI-powered collaboration tools when used responsibly, BoodleBox establishes this Supervised Minor Access Policy ("Policy") as a limited, structured exception to the general 18-year age minimum set forth in Section 3.2 of the BoodleBox Terms of Service.

This Policy governs access to BoodleBox by individuals who are at least 13 years of age but under 18 years of age ("Minor User"), provided that such access is established, controlled, and supervised by an eligible adult who has accepted full legal responsibility for the Minor's use of the platform.

No individual under the age of 13 may use BoodleBox under any circumstances, in compliance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq.

1 Definitions

1.1 "Minor User" Any individual who is at least 13 years of age and under 18 years of age at the time of account creation and throughout the period of use.

1.2 "Supervising Adult" A natural person who is at least 18 years of age who establishes a Minor User's Supervised Account and assumes full legal responsibility for the Minor's use of BoodleBox. A Supervising Adult may be a parent, legal guardian, educator, school administrator, or other adult with lawful authority to authorize use of online services on behalf of the Minor. The applicable consent and responsibility requirements vary depending on which of the three Deployment Pathways described in Section 3 applies.

1.3 "Supervised Account" A BoodleBox account created by and registered under a Supervising Adult's credentials through which a Minor User is granted access, and which remains under the Supervising Adult's continuous oversight and legal control.

1.4 "Institutional Deployment" Access to BoodleBox by Minor Users under a valid Master Service Agreement (MSA) and Data Processing Agreement (DPA) executed between BoodleBox and an educational institution or school district. Under an Institutional Deployment, the institution assumes supervisory responsibility and authorization is governed by the institution's existing technology consent framework rather than individual parental consent for each student.

1.5 "Individual Educator Deployment" Access to BoodleBox by Minor Users facilitated by an individual educator, teacher, or program administrator who registers independently — without an executed institutional MSA — and acts as the Supervising Adult for their students.

1.6 "Direct Consumer Deployment" Access to BoodleBox by a Minor User where the Minor's parent or legal guardian personally creates and controls the Supervised Account. In this pathway, the parent or guardian is simultaneously the account holder and the consenting party.

1.7 "Data Processing Agreement (DPA)" A written agreement between BoodleBox and an educational institution governing the collection, processing, storage, and protection of student personal data, as required by FERPA and applicable state student data privacy laws.

1.8 "Acceptable Use Policy (AUP)" A technology use policy adopted by a school or district — typically acknowledged annually by students and parents — that authorizes student use of district-approved digital tools and platforms, including those provided by third-party vendors under institutional agreements.

2 Eligibility and Scope

2.1 Eligible Minor Users. A Minor User is eligible to access BoodleBox under this Policy only if all of the following conditions are continuously satisfied:

• The Minor User is at least 13 years of age and under 18 years of age;
• A Supervising Adult has created and controls a Supervised Account on the Minor User's behalf;
• The applicable authorization requirements for the relevant Deployment Pathway (Section 3) have been fully satisfied; and
• Use is consistent with BoodleBox's educational or enterprise mission, including formal coursework, institutional AI literacy programs, supervised extracurricular activities, or adult-supervised professional development.

2.2 Excluded Users. The following individuals are expressly excluded from eligibility under this Policy, regardless of claimed consent or supervisory arrangements:

• Any individual under the age of 13, without exception;
• Any Minor User whose Supervising Adult is not independently eligible to hold a BoodleBox account;
• Any Minor User accessing BoodleBox without the knowledge or active oversight of their designated Supervising Adult; and
• Any Minor User accessing BoodleBox through any pathway other than a properly established Supervised Account.

3 Deployment Pathways and Authorization Requirements

BoodleBox recognizes three distinct pathways through which Minor Users may access the platform. The authorization requirements, consent obligations, and allocation of responsibility differ materially across these pathways. Supervising Adults and institutions must identify the applicable pathway and comply with the corresponding requirements.

3.1 Pathway One: Institutional Deployment.

Authorization Standard: Institution-Level — Individual Parental Consent Generally Not Required. Where BoodleBox is deployed under a signed MSA and DPA, the institution's existing technology consent framework (e.g., AUP or enrollment consent) satisfies the authorization requirement. No additional per-student parental consent form is required.

3.1(a) How Institutional Authorization Works

Under FERPA's school official exception (34 CFR § 99.31(a)(1)), an educational institution may authorize a third-party vendor to access and process student data — and may permit students to use that vendor's platform — without obtaining individual parental consent for each student, provided that:

• BoodleBox is designated as a "school official" acting under the direct control of the institution with a legitimate educational interest;
• The institution and BoodleBox have executed a Data Processing Agreement (DPA) restricting BoodleBox's use of student data to educational purposes; and
• The institution has an existing technology consent mechanism — such as an Acceptable Use Policy or annual enrollment consent — that covers district-approved third-party educational platforms.

This is the same authorization model used by Google Workspace for Education, Microsoft 365 Education, Canvas, Turnitin, and the majority of enterprise edtech platforms. Once BoodleBox completes the institution's software review and approval process, parental permission slips are not required.

3.1(b) Required Documentation

To qualify as an Institutional Deployment, the following must be in place:

• A fully executed BoodleBox Master Service Agreement (MSA) or Enterprise License Agreement with the institution or district;
• A fully executed BoodleBox Data Processing Agreement (DPA); and
• An institutional software approval — through whatever review process the district or institution employs — prior to granting Minor Users access.

BoodleBox maintains a standard DPA template available upon request. Many states require a signed DPA before any school procurement approval can proceed. Contact info@boodle.ai to initiate DPA execution.

3.1(c) State-Specific Vendor Registry Requirements

Certain states impose additional requirements before a vendor may be used in a school setting, including mandatory registration on state-maintained vendor lists. Examples include:

• New York: Ed Law 2-d vendor registration and data security and privacy agreement;
• California: Compliance with the California Student Privacy Alliance (CSPA) framework and the Student Online Personal Information Protection Act (SOPIPA);
• Colorado: Compliance with Colorado's Student Data Transparency and Security Act (C.R.S. § 22-16-101 et seq.);
• Connecticut: Compliance with Connecticut's Act Concerning Student Privacy (Conn. Gen. Stat. § 10-234aa et seq.), including its student data contract requirements; and
• Illinois: Compliance with the Student Online Personal Protection Act (SOPPA).

Institutions are responsible for confirming applicable state requirements. BoodleBox will cooperate with all reasonable compliance requests and provide required documentation.

3.1(d) Institutional Administrator Responsibilities

Under an Institutional Deployment, the institution must:

• Designate one or more Institutional Administrators responsible for overseeing BoodleBox use within the institution;
• Ensure that Minor Users access BoodleBox only within the scope of the institution's managed environment;
• Provide appropriate training or guidance to educators supervising Minor User access; and
• Notify BoodleBox promptly upon any change to the institution's AUP, enrollment consent practices, or software approval status that could affect Minor User access.

3.2 Pathway Two: Individual Educator Deployment.

Authorization Standard: Individual — Written Parental or Guardian Consent Required Per Student. Where an educator registers independently without an executed institutional MSA, the FERPA school official umbrella does not apply. The educator must obtain documented written consent from each Minor User's parent or legal guardian before granting access.

3.2(a) Applicability

This Pathway applies when an individual educator, instructor, coach, or program facilitator creates a BoodleBox account independently — outside of any institutional agreement — and grants or facilitates access by Minor Users. Common scenarios include:

• A teacher who discovers BoodleBox independently and subscribes using a personal or departmental credit card;
• A club advisor or extracurricular program coordinator facilitating student use outside of official school channels; and
• A private tutor or independent educator using BoodleBox with students who are minors.

3.2(b) Required Parental Consent

Before granting any Minor User access under this Pathway, the educator must obtain written consent from the Minor User's parent or legal guardian. Such consent must:

• Be in writing (electronic or physical);
• Identify the Minor User by full name and date of birth;
• Identify the educator and describe the educational context for BoodleBox use;
• Describe the type of data BoodleBox will collect and how it will be used, consistent with BoodleBox's Privacy Policy;
• Acknowledge that AI-generated content may be imperfect, probabilistic, and subject to the limitations disclosed in the BoodleBox Terms of Service; and
• Be retained by the educator for a minimum of three (3) years following the Minor User's last use of BoodleBox.

BoodleBox provides a model parental consent form at boodlebox.ai/policies for educator convenience. Use of the model form is encouraged but not required, provided that all required elements above are present.

3.2(c) Educator Responsibilities as Supervising Adult

An educator operating under this Pathway bears all Supervising Adult responsibilities set forth in Section 5, including active supervision of Minor User activity, content oversight, and full indemnification obligations with respect to the Minor User's use of BoodleBox.

3.2(d) Transition to Institutional Deployment

BoodleBox strongly encourages educators operating under this Pathway to work with their institution to execute an MSA and DPA, which would transition their deployment to Pathway One and eliminate the need for individual per-student parental consent forms. Contact info@boodle.ai or your BoodleBox account representative for assistance with this process.

3.3 Pathway Three: Direct Consumer Deployment.

Authorization Standard: Parent or Guardian IS the Consenting Party — Consent Embedded in Account Registration. Where a parent or legal guardian personally creates and controls the Supervised Account, they are simultaneously the account holder and the consenting party. Consent is established through acceptance of this Policy and the BoodleBox Terms of Service at registration.

3.3(a) Applicability

This Pathway applies when a parent or legal guardian creates a BoodleBox account to enable their own child's use of the platform outside of any school or institutional context. Examples include:

• A parent subscribing to BoodleBox to support a child's independent learning or homework;
• A guardian creating an account for a homeschooled student; and
• A parent facilitating a child's participation in a BoodleBox-based learning program offered by a non-institutional third party.

3.3(b) Registration Requirements

Under this Pathway, the parent or guardian must:

• Register using their own verified identity and email address;
• Affirmatively indicate during registration that the account will be used by a Minor User;
• Provide and verify the Minor User's date of birth to confirm eligibility; and
• Affirmatively accept this Policy and the BoodleBox Terms of Service, which constitutes legally binding consent on behalf of both themselves and the Minor User.

3.3(c) No Additional Consent Documentation Required

Because the parent or guardian is the account holder and consenting party, no separate written consent form or third-party authorization is required. All parental consent is established through the registration process itself.

4 Account Creation Requirements (All Pathways)

Regardless of Deployment Pathway, all Supervised Accounts must satisfy the following requirements:

4.1 Adult-Initiated Account Creation. All Supervised Accounts must be created by the Supervising Adult or Institutional Administrator. Minor Users may not self-register for BoodleBox. During registration, the responsible adult must:

• Register using the adult's or institution's own verified credentials;
• Affirmatively disclose that the account will be used, in whole or in part, by a Minor User between the ages of 13 and 17; and
• Confirm the Minor User's date of birth to establish eligibility.

4.2 Credential Control. All login credentials for a Supervised Account must be created by and remain in the control of the Supervising Adult or Institutional Administrator. Minor Users may not independently establish, modify, or control their own login credentials without the affirmative authorization of the Supervising Adult.

4.3 Revocation of Consent or Authorization. A parent or legal guardian may revoke consent for a Minor User's access at any time by providing written notice to the Supervising Adult or Institutional Administrator. The Supervising Adult or Institutional Administrator must promptly close or disable the Minor User's access upon receiving such notice. Parents and guardians may also contact BoodleBox directly at info@boodle.ai to request termination of a Minor User's account.

5 Supervising Adult Responsibilities

5.1 Oversight Obligations. The Supervising Adult (or designated Institutional Administrator) accepts full responsibility for all activity conducted through the Supervised Account, including all activity initiated by the Minor User. The Supervising Adult agrees to:

• Actively monitor and supervise the Minor User's use of BoodleBox on a regular and ongoing basis;
• Ensure the Minor User uses BoodleBox solely for appropriate educational or supervised purposes;
• Review AI-generated outputs and assist the Minor User in critically evaluating the accuracy, appropriateness, and limitations of such outputs;
• Ensure the Minor User understands and complies with the BoodleBox Acceptable Use Policy and Terms of Service;
• Prevent the Minor User from sharing or distributing AI-generated content in any manner that could cause harm; and
• Promptly report any suspected unauthorized access, inappropriate use, or safety concern to BoodleBox at info@boodle.ai.

5.2 Content Supervision. The Supervising Adult acknowledges that BoodleBox uses large language models that generate probabilistic outputs, which may in limited circumstances produce content that is unexpected, inaccurate, or contextually inappropriate. The Supervising Adult agrees to implement appropriate pre-use and post-use review of AI-generated content produced by or for the Minor User.

5.3 Legal Responsibility and Indemnification. This Section 5.3 applies only to Individual Educator Deployments (Section 3.2) and Direct Consumer Deployments (Section 3.3). For Institutional Deployments, allocation of responsibility, liability, and indemnification is governed exclusively by the Master Service Agreement and Data Processing Agreement between BoodleBox and the institution, and nothing in this Policy imposes any indemnification obligation on the institution or its personnel. The Supervising Adult agrees to indemnify, defend, and hold harmless boodle, Inc. and its officers, directors, employees, agents, and affiliates from any claims, liabilities, damages, losses, or costs (including reasonable attorneys' fees) arising from:

• The Minor User's use of or access to BoodleBox;
• The Supervising Adult's breach of this Policy or the BoodleBox Terms of Service;
• Any false or inaccurate representations made at registration; or
• Any violation of applicable law arising from the Minor User's use of BoodleBox.

6 Data Privacy and Protection

6.1 COPPA Compliance. BoodleBox does not permit children under the age of 13 to use the platform under any circumstances. This Policy is structured in compliance with the Children's Online Privacy Protection Act, 15 U.S.C. § 6501 et seq. BoodleBox does not knowingly collect personal information from children under 13. If BoodleBox discovers that a user under 13 has accessed the platform, the relevant account will be immediately suspended and all associated personal information deleted.

6.2 Minor User Data Protections. BoodleBox commits to the following with respect to all Minor User data, regardless of Deployment Pathway:

• Minor User data will not be used for advertising or marketing purposes;
• BoodleBox will not sell, rent, or transfer personal information attributable to a Minor User to any third party for commercial purposes;
• Minor User data will be processed exclusively to provide the BoodleBox platform, maintain platform security, and fulfill legal obligations; and
• Supervising Adults, parents, and guardians may request access to, correction of, or deletion of a Minor User's personal data by contacting info@boodle.ai.

6.3 FERPA Compliance (Institutional Deployments). For Institutional Deployments, BoodleBox operates as a "school official" under FERPA (20 U.S.C. § 1232g) and processes student education records solely to provide services to the applicable institution. BoodleBox will not disclose student education records except as permitted under FERPA and the institution's DPA with BoodleBox.

6.4 State Law Compliance. Certain states impose additional data privacy requirements applicable to minor users of online services. BoodleBox will make commercially reasonable efforts to comply with applicable state law. Institutional Administrators are responsible for ensuring their deployment satisfies any additional state or local requirements applicable in their jurisdiction.

7 Acceptable Use by Minor Users

7.1 Permitted Use. Minor Users are permitted to use BoodleBox for educational, academic, and supervised professional development purposes, including:

• Completing coursework, research, and writing assignments under educator supervision;
• Participating in AI literacy programs, workshops, or certification courses;
• Collaborative learning activities with peers under adult supervision; and
• Developing creative or analytical projects with Supervising Adult oversight.

7.2 Prohibited Conduct. Minor Users may not, under any circumstances:

• Create an independent BoodleBox account not established by a Supervising Adult;
• Share their login credentials with any other individual;
• Submit, generate, or share content that is sexually explicit, harassing, threatening, defamatory, or otherwise harmful;
• Attempt to circumvent content moderation features or acceptable use restrictions;
• Disclose personal information in a manner that could create a safety or privacy risk; or
• Use BoodleBox for commercial purposes without the express written consent of the Supervising Adult and BoodleBox.

8 Enforcement and Termination

8.1 BoodleBox Right to Investigate. BoodleBox reserves the right to investigate any suspected violation of this Policy and to take any action it deems appropriate, including suspension or termination of a Supervised Account. BoodleBox may request documentation from the Supervising Adult to verify compliance at any time.

8.2 Suspension and Termination. BoodleBox may immediately suspend or terminate a Supervised Account if BoodleBox reasonably determines that the Minor User is under 13; the account was created without required authorization; the Minor User or Supervising Adult has materially violated this Policy; or continued access poses a safety, privacy, or legal risk.

8.3 Transition to Adult Account. Upon a Minor User reaching the age of 18, the Supervising Adult and former Minor User should contact info@boodle.ai to transition the account to an independent adult account under the standard BoodleBox Terms of Service. BoodleBox will make commercially reasonable efforts to preserve User Content through such a transition.

9 Relationship to Terms of Service

9.1 Incorporation. This Policy is incorporated by reference into the BoodleBox Terms of Service. All provisions of the Terms of Service apply to Supervised Accounts and Minor Users, as modified and supplemented by this Policy. In the event of a conflict between this Policy and the Terms of Service, this Policy controls with respect to Minor User access. In the event of a conflict between this Policy and a negotiated agreement between BoodleBox and a customer or institution (including any Master Service Agreement, Data Processing Agreement, or Statement of Work), the negotiated agreement controls.

9.2 Age Restriction Exception. This Policy constitutes a limited, structured exception to Section 3.2 of the BoodleBox Terms of Service, which otherwise requires users to be at least 18 years of age. This exception applies solely to Minor Users accessing BoodleBox through a properly established Supervised Account in full compliance with all requirements of this Policy.

9.3 Governing Law. This Policy is governed by and construed in accordance with the laws of the Commonwealth of Virginia, consistent with Section 15.2 of the BoodleBox Terms of Service, without giving effect to its conflicts of laws principles. Where this Policy accompanies a negotiated agreement between BoodleBox and a customer or institution, the governing law of that agreement controls with respect to that deployment.

10 Policy Updates

10.1 Right to Modify. BoodleBox reserves the right to modify this Policy at any time. Material changes will be communicated to Supervising Adults and Institutional Administrators no fewer than fourteen (14) days before taking effect. Continued use of BoodleBox following the effective date of any modification constitutes acceptance of the updated Policy.

11 Contact Information

Questions, parental consent requests, data rights requests, DPA inquiries, or reports of suspected Policy violations should be directed to:

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.boodle, Inc. — BoodleBox Legal Department

Email: info@boodle.ai

Mail: 11590 Ridgeline Dr., Ste 130 #169, Colorado Springs, CO 80921

Website: boodlebox.ai/policies

Supervising Adult Acknowledgment

By creating a Supervised Account for a Minor User, the Supervising Adult or Institutional Administrator acknowledges that they have read and accepted this Policy in its entirety; that they have the legal authority to consent to online services on behalf of the Minor User; that they accept full legal responsibility for all activity conducted through the Supervised Account; and that they will maintain active supervision of the Minor User's use of BoodleBox.

© boodle, Inc. All Rights Reserved. · boodlebox.ai/policies