Policies & Legal Documents

1. Acceptance of Terms

By accessing or using Merit ("the Platform"), you agree to be bound by these Terms of Service ("Terms"). If you do not agree, you may not access or use the Platform. These Terms constitute a legally binding agreement between you and Eduverse, Ltd ("Company," "we," "us," or "our").

The Platform is intended for use by K–12 educational institutions and their authorized staff and students. Use by individuals outside of an authorized institution is prohibited without prior written consent from Eduverse, Ltd.

2. Description of Service

Merit is a web-based Positive Behavioral Interventions and Supports (PBIS) management platform developed and operated by Eduverse, Ltd. The Platform enables educational institutions to recognize and reinforce positive student behaviors through a structured point-based system, manage school and classroom reward stores, generate recognition reports, and administer automated report delivery. Merit is operated as a software-as-a-service (SaaS) platform delivered under a contractual agreement with each participating educational institution and is designed for use on laptop and desktop devices through a web browser.

3. Account Registration and Authorized Access

Access to Merit is provisioned exclusively by authorized institutional administrators. Individual users — including teachers, staff, and students — do not self-register and may only access the Platform under credentials issued by the Institution.

The Institution is responsible for: (a) the accuracy and completeness of all account information it provides to Eduverse, Ltd; (b) ensuring that all provisioned users are authorized to access the Platform in their designated role; and (c) promptly removing or deactivating access for any individual whose authorization has ended, including staff departures, student transfers, or role changes. The Institution accepts responsibility for all activity conducted through accounts it creates and maintains.

You are responsible for maintaining the confidentiality of your credentials. You must notify your administrator immediately if you believe your account has been compromised.

4. FERPA Compliance and Institutional Responsibility

The educational institution ("Institution") entering into a service agreement with Eduverse, Ltd retains ownership and control of all student education records, as defined under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. Eduverse, Ltd accesses student education records solely in its capacity as a "school official" with a "legitimate educational interest," as those terms are defined under FERPA, and only for the purpose of providing and improving the Merit platform under the Institution's direction.

The Institution is solely responsible for ensuring that its use of Merit complies with FERPA, including obtaining any parental or eligible student consent required before sharing education records with Eduverse, Ltd. Eduverse, Ltd will not disclose student education records to any third party except as directed in writing by the Institution, as required by applicable law, or as otherwise permitted under FERPA.

5. COPPA — Children's Online Privacy Protection

Merit may be used by students under the age of 13. Where applicable, the Institution operates as the operator's agent under the school consent exception to the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq., and is responsible for obtaining any verifiable parental consent required under COPPA before authorizing students under 13 to access the Platform.

Eduverse, Ltd collects personal information from students solely at the direction of and under the authority of the Institution. Eduverse, Ltd does not use student personal information for advertising, does not build commercial profiles of students, and does not disclose student information collected through Merit for any purpose unrelated to providing the educational service contracted by the Institution.

6. Student Data Protection

Eduverse, Ltd will not sell, rent, trade, or otherwise disclose student data to any third party for commercial purposes. Student data will not be used to target students with advertising, develop commercial products, or build profiles for purposes unrelated to the educational service provided under this agreement.

Student data collected through Merit is used solely to operate, maintain, and improve the Platform for the benefit of the contracting Institution and its students. Eduverse, Ltd acknowledges that applicable state student privacy laws — including but not limited to California's Student Online Personal Information Protection Act (SOPIPA), New York Education Law § 2-d, and similar statutes — may impose additional obligations, and agrees to comply with those obligations to the extent applicable to its role as a service provider to educational institutions.

7. Data Ownership

The Institution retains full ownership of all student data, staff data, behavioral recognition records, and any other institutional content entered into or generated through the Platform. Eduverse, Ltd claims no ownership interest in any institutional data or student education records.

Eduverse, Ltd's right to access and process institutional data is limited to what is necessary to provide the Platform under the terms of the service agreement. Upon contract termination or written request from an authorized institutional representative, Eduverse, Ltd will delete institutional data from active production systems in accordance with the data retention terms set forth in our Privacy Policy, subject to any legal obligations requiring retention.

8. Acceptable Use — Educational Purpose Limitation

The Platform may only be used for lawful K–12 educational purposes consistent with the institution's behavioral support, recognition, and reporting objectives. Users may not:

• Attempt to access, view, or modify data beyond their authorized role within the Platform
• Use the Platform to harass, bully, intimidate, or harm any student, staff member, or other individual
• Upload, transmit, or store content that is unlawful, offensive, or unrelated to the educational purpose of the Platform
• Attempt to reverse engineer, decompile, or extract source code from the Platform
• Introduce malicious code, viruses, or any content designed to disrupt or damage the Platform or its users
• Use the Platform to collect or process personal data beyond what is authorized by the Institution and consistent with these Terms
• Use the Platform in any manner that could violate FERPA, COPPA, or other applicable laws

The Institution is responsible for communicating these acceptable use requirements to its authorized users and for taking appropriate action when violations occur.

9. Pilot Program Terms

Eduverse, Ltd offers a 6-Month Pilot program at a flat rate per school building, as described in the applicable pricing documentation. The Pilot is a time-limited trial of the Platform and is governed by these Terms of Service except where Pilot-specific terms are expressly stated.

At the conclusion of the Pilot period, access to the Platform will be suspended and a lockout screen will be presented to all users in the Institution. Institutional data will be preserved for a reasonable period following Pilot expiration to allow the Institution time to transition to a standard annual agreement or request data deletion. The Pilot does not obligate the Institution to enter into a standard annual agreement, and Eduverse, Ltd makes no representations regarding the continuation of pricing, features, or terms beyond the Pilot period.

To convert a Pilot to a standard annual deployment, the Institution should contact Eduverse, Ltd at getmerit@meritk12.com prior to the Pilot end date.

10. Data Breach Notification

In the event of a security incident that results in unauthorized access to, disclosure of, or acquisition of personal information stored or processed through the Platform, Eduverse, Ltd will notify the affected Institution within 72 hours of confirming that a breach has occurred. Notification will include a description of the incident, the categories and approximate number of individuals and records affected, steps Eduverse, Ltd has taken or is taking to address the breach, and contact information for Eduverse, Ltd's designated incident response contact.

The Institution — as the data controller under applicable education privacy law — is responsible for notifying affected students, families, and regulatory authorities as required by FERPA and applicable state breach notification statutes. Eduverse, Ltd will cooperate fully with the Institution to support its notification obligations and will provide all information reasonably necessary for the Institution to carry out those obligations.

Security incidents should be reported to Eduverse, Ltd immediately at legal@meritk12.com.

11. Intellectual Property

The Platform and its content, features, and functionality are owned by Eduverse, Ltd and are protected by copyright, trademark, and other intellectual property laws. Nothing in these Terms grants you ownership of any part of the Platform.

Institution data — including student records, behavior configurations, and transaction history — remains the property of the institution, as set forth in Section 7 above.

12. No Warranty

THE SERVICE IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. USE OF THE SERVICE IS AT YOUR OWN RISK. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICE IS PROVIDED WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

WITHOUT LIMITING THE FOREGOING, EDUVERSE, LTD, ITS SUBSIDIARIES, AFFILIATES, AND LICENSORS DO NOT WARRANT THAT: (A) THE CONTENT IS ACCURATE, RELIABLE, OR CORRECT; (B) THE SERVICE WILL MEET YOUR REQUIREMENTS; (C) THE SERVICE WILL BE AVAILABLE AT ANY PARTICULAR TIME OR LOCATION, UNINTERRUPTED, OR SECURE; (D) ANY DEFECTS OR ERRORS WILL BE CORRECTED; OR (E) THE SERVICE IS FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS.

ANY CONTENT DOWNLOADED OR OTHERWISE OBTAINED THROUGH THE USE OF THE SERVICE IS ACCESSED AT YOUR OWN RISK. EDUVERSE, LTD DOES NOT WARRANT, ENDORSE, GUARANTEE, OR ASSUME RESPONSIBILITY FOR ANY PRODUCT OR SERVICE ADVERTISED OR OFFERED BY A THIRD PARTY THROUGH THE SERVICE OR ANY HYPERLINKED WEBSITE, AND WILL NOT BE A PARTY TO OR IN ANY WAY MONITOR ANY TRANSACTION BETWEEN YOU AND THIRD-PARTY PROVIDERS.

Some states do not allow the exclusion of implied warranties, so the above exclusions may not apply to you. This agreement gives you specific legal rights, and you may also have other rights which vary from state to state. The disclaimers and exclusions under this agreement will not apply to the extent prohibited by applicable law.

13. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL EDUVERSE, LTD, ITS AFFILIATES, AGENTS, DIRECTORS, EMPLOYEES, SUPPLIERS, OR LICENSORS BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING WITHOUT LIMITATION DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR RELATING TO THE USE OF, OR INABILITY TO USE, THE SERVICE.

UNDER NO CIRCUMSTANCES WILL EDUVERSE, LTD BE RESPONSIBLE FOR ANY DAMAGE, LOSS, OR INJURY RESULTING FROM HACKING, TAMPERING, OR OTHER UNAUTHORIZED ACCESS TO OR USE OF THE SERVICE OR YOUR ACCOUNT OR THE INFORMATION CONTAINED THEREIN. EDUVERSE, LTD ASSUMES NO LIABILITY OR RESPONSIBILITY FOR ANY: (I) ERRORS, MISTAKES, OR INACCURACIES OF CONTENT; (II) PERSONAL INJURY OR PROPERTY DAMAGE OF ANY NATURE WHATSOEVER RESULTING FROM YOUR ACCESS TO OR USE OF THE SERVICE; (III) UNAUTHORIZED ACCESS TO OR USE OF OUR SECURE SERVERS AND/OR ANY PERSONAL INFORMATION STORED THEREIN; (IV) INTERRUPTION OR CESSATION OF TRANSMISSION TO OR FROM THE SERVICE; (V) BUGS, VIRUSES, TROJAN HORSES, OR THE LIKE TRANSMITTED TO OR THROUGH THE SERVICE BY ANY THIRD PARTY; OR (VI) ERRORS OR OMISSIONS IN ANY CONTENT OR FOR ANY LOSS OR DAMAGE INCURRED AS A RESULT OF THE USE OF ANY CONTENT POSTED, TRANSMITTED, OR OTHERWISE MADE AVAILABLE THROUGH THE SERVICE.

NOTWITHSTANDING ANYTHING TO THE CONTRARY, EDUVERSE, LTD'S TOTAL LIABILITY TO ANY INSTITUTION OR USER FOR ANY CAUSE WHATSOEVER, REGARDLESS OF THE FORM OF THE ACTION, SHALL AT ALL TIMES BE LIMITED TO THE TOTAL FEES PAID BY THE INSTITUTION TO EDUVERSE, LTD IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

This limitation of liability applies whether the alleged liability is based on contract, tort, negligence, strict liability, or any other basis, even if Eduverse, Ltd has been advised of the possibility of such damage. Some states do not allow the exclusion or limitation of incidental or consequential damages, so the above limitations may not apply to you.

Nothing in this section limits Eduverse, Ltd's liability for damages arising from its own gross negligence, willful misconduct, or intentional breach of its obligations under applicable student data protection laws, including FERPA and COPPA.

14. Indemnity

You agree to defend, indemnify, and hold harmless Eduverse, Ltd and its subsidiaries, agents, managers, and other affiliated companies, and their employees, contractors, agents, officers, and directors, from and against any and all claims, damages, obligations, losses, liabilities, costs or debt, and expenses (including but not limited to attorney's fees) arising out of or related to:

• (i) your use of and access to the Service, including any data or content transmitted or received by you;
• (ii) your violation of any term of this Agreement, including without limitation your breach of any of the representations and warranties herein;
• (iii) your violation of any third-party right, including without limitation any right of privacy or intellectual property rights;
• (iv) your violation of any applicable law, rule, or regulation;
• (v) any content or information submitted via your account, including without limitation misleading, false, or inaccurate information; or
• (vi) your negligent or willful misconduct.

Notwithstanding the foregoing, this indemnification obligation shall not apply to claims arising solely from Eduverse, Ltd's own gross negligence, willful misconduct, or intentional breach of its obligations under applicable law. Eduverse, Ltd reserves the right, at your expense, to assume exclusive defense and control of any matter subject to indemnification by you, and you agree to cooperate with that defense.

15. Modifications to Terms

We may update these Terms from time to time. We will notify institutions of material changes via email to the administrator of record at least 30 days before the changes take effect. Continued use of the Platform after changes become effective constitutes acceptance of the updated Terms.

16. Governing Law

You agree that: (i) the Service shall be deemed solely based in the State of Ohio, USA; and (ii) the Service shall be deemed a passive one that does not give rise to personal jurisdiction over Eduverse, Ltd, either specific or general, in jurisdictions other than the State of Ohio. This Agreement shall be governed by the internal substantive laws of the State of Ohio, without respect to its conflict of laws principles.

The parties acknowledge that this Agreement evidences a transaction involving interstate commerce. Notwithstanding the preceding sentences with respect to substantive law, any arbitration conducted pursuant to the terms of this Agreement shall be governed by the Federal Arbitration Act (9 U.S.C. §§ 1–16). The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded.

You agree to submit to the personal jurisdiction of the federal and state courts located in Ohio for any actions for which Eduverse, Ltd retains the right to seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation, or violation of our copyrights, trademarks, trade secrets, patents, or other intellectual property or proprietary rights, as set forth in the Arbitration provision below.

17. Arbitration

READ THIS SECTION CAREFULLY BECAUSE IT REQUIRES THE PARTIES TO ARBITRATE THEIR DISPUTES AND LIMITS THE MANNER IN WHICH YOU CAN SEEK RELIEF FROM EDUVERSE, LTD.

In the unlikely event that Eduverse, Ltd has not been able to resolve a dispute with you after sixty (60) days, we each agree to resolve any claim, dispute, or controversy (excluding any Eduverse, Ltd claims for injunctive or other equitable relief) arising out of or in connection with or relating to these Terms of Service, or the breach or alleged breach thereof (collectively, "Claims"), by binding arbitration by the Judicial Mediation and Arbitration Services ("JAMS") under the Optional Expedited Arbitration Procedures then in effect for JAMS, except as provided herein.

The arbitration will be conducted in the State of Ohio, USA, unless you and Eduverse, Ltd agree otherwise. Each party will be responsible for paying any JAMS filing, administrative, and arbitrator fees in accordance with JAMS rules. The award rendered by the arbitrator shall include costs of arbitration, reasonable attorneys' fees, and reasonable costs for expert and other witnesses, and any judgment on the award rendered by the arbitrator may be entered in any court of competent jurisdiction.

Nothing in this Section shall be deemed to prevent Eduverse, Ltd from seeking injunctive or other equitable relief from the courts as necessary to protect any of Eduverse, Ltd's proprietary interests.

ALL CLAIMS MUST BE BROUGHT IN THE PARTIES' INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS ACTION, COLLECTIVE ACTION, PRIVATE ATTORNEY GENERAL ACTION, OR OTHER REPRESENTATIVE PROCEEDING. THIS WAIVER APPLIES TO CLASS ARBITRATION, AND, UNLESS THE PARTIES AGREE OTHERWISE, THE ARBITRATOR MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS. YOU AGREE THAT, BY ENTERING INTO THESE TERMS OF SERVICE, YOU AND EDUVERSE, LTD ARE EACH WAIVING THE RIGHT TO A TRIAL BY JURY OR TO PARTICIPATE IN A CLASS ACTION, COLLECTIVE ACTION, PRIVATE ATTORNEY GENERAL ACTION, OR OTHER REPRESENTATIVE PROCEEDING OF ANY KIND.

18. Contact

For questions about these Terms, contact us at legal@meritk12.com.

Key Terminology

This reference guide defines key terms used across Merit's Privacy Policy, Terms of Service, Cookies Policy, and Data Breach Policy. These definitions are provided for clarity and are consistent with applicable law.

Privacy & Data Terms

Legal & Regulatory Terms

Platform & Service Terms

Security & Breach Terms

1. Purpose and Scope

This Data Breach Response Policy describes how Eduverse, Ltd ("Eduverse, Ltd") identifies, responds to, and reports security incidents that may involve unauthorized access to, disclosure of, or acquisition of personal information stored on or processed through Merit.

This policy applies to all Eduverse, Ltd employees, contractors, and third-party service providers who handle personal information on behalf of Eduverse, Ltd or its institutional customers.

2. What Constitutes a Data Breach

A data breach occurs when there is unauthorized access to, use, disclosure, modification, or destruction of personal information — or a failure of safeguards that makes such access reasonably likely. This includes:

• Unauthorized access to systems containing student or staff personal information
• Theft or loss of devices or credentials that provide access to personal information
• Accidental disclosure of personal information to unauthorized parties
• Malware, ransomware, or other attacks that compromise data integrity or confidentiality

3. Detection and Internal Response

When a potential breach is identified by any Eduverse, Ltd employee or system:

1. Immediate containment. The affected system or access path is isolated as quickly as possible to prevent further unauthorized access or data loss.
2. Internal escalation. The incident is reported to the Eduverse, Ltd security and legal team within 2 hours of discovery.
3. Assessment. We determine the nature and scope of the breach — what data was affected, how many individuals are impacted, and how the breach occurred.
4. Remediation. We take steps to address the root cause, patch vulnerabilities, and restore secure operation.

4. Notification to Institutions

In the event of a security incident that results in unauthorized access to, disclosure of, or acquisition of personal information stored or processed through the Platform, Eduverse, Ltd will notify the affected Institution within 72 hours of confirming that a breach has occurred. Notification will include:

• A description of the incident, including the date of the breach and the date of discovery
• The categories and approximate number of individuals and records affected
• Steps Eduverse, Ltd has taken or is taking to address the breach
• Steps the Institution may wish to take to protect affected individuals
• Contact information for Eduverse, Ltd's designated incident response contact

Notification will be delivered to the Institution's primary administrator contact by email, and by phone if the breach is assessed as severe.

The Institution — as the data controller under applicable education privacy law — is responsible for notifying affected students, families, and regulatory authorities as required by FERPA and applicable state breach notification statutes. Eduverse, Ltd will cooperate fully with the Institution to support its notification obligations and will provide all information reasonably necessary for the Institution to carry out those obligations.

Security incidents should be reported to Eduverse, Ltd immediately at legal@meritk12.com.

5. Notification to Individuals

In many K–12 contexts, the educational institution — as the data controller — is responsible for notifying affected students and families, consistent with FERPA and applicable state breach notification laws. Eduverse, Ltd will cooperate fully with institutions to support this process and will provide all information institutions need to carry out their obligations.

Where Eduverse, Ltd is independently required by law to notify individuals directly, we will do so in accordance with applicable requirements.

6. Regulatory Reporting

Where a breach triggers regulatory reporting obligations under applicable law (including state breach notification statutes), Eduverse, Ltd will make required filings within the legally prescribed timeframes. We will inform affected institutions of any regulatory filings that reference their data.

7. Post-Incident Review

Following the resolution of any security incident, Eduverse, Ltd conducts a post-incident review to identify contributing factors, assess the effectiveness of our response, and implement changes to reduce the likelihood of recurrence. Findings are documented internally and, where material, shared with affected institutions.

8. Contact

To report a suspected security incident or breach, contact legal@meritk12.com immediately. For technical security concerns, you may also contact support@meritk12.com.

1. Overview

This Cookies Policy explains how Eduverse, Ltd uses cookies and similar technologies in connection with the Merit platform (app.meritk12.com) and the Merit marketing website (meritk12.com). We use cookies minimally and only where necessary for the platform to function.

We do not use cookies for advertising, behavioral profiling, or cross-site tracking. We do not sell or share cookie data with third parties for marketing purposes.

2. What Is a Cookie?

A cookie is a small text file placed on your device by a website or web application when you visit it. Cookies allow the site to remember information about your visit — such as whether you are logged in — so you don't have to re-enter information each time you navigate between pages.

Cookies can be session cookies (deleted when you close your browser) or persistent cookies (stored on your device for a set period). They can be set by the site you are visiting (first-party cookies) or by third-party services embedded in that site (third-party cookies).

3. Cookies We Use

The Merit Platform (app.meritk12.com)

The Merit application uses one category of cookies: strictly necessary session cookies. These cookies are set when you log in and are used solely to authenticate your identity and maintain your session while you use the platform. Without them, you would be required to log in again on every page you visit.

• Type: First-party, session cookie
• Purpose: Authentication and session management
• Duration: Deleted when you close your browser or log out
• Data stored: A secure session identifier — not your name, email, or any personal information

No persistent cookies, advertising cookies, analytics cookies, or third-party tracking cookies are set by the Merit application.

The Merit Website (meritk12.com)

The meritk12.com marketing website does not set any cookies. It does not use analytics platforms, advertising networks, or tracking tools of any kind.

The website loads web fonts from Google Fonts (fonts.googleapis.com). When your browser requests a font file from Google's servers, Google receives standard browser request data including your IP address. This interaction is governed by Google's Privacy Policy. No cookies are set by Google Fonts in this context.

4. What We Do Not Use

Merit does not use, and has no plans to use, any of the following:

• Advertising or targeting cookies
• Third-party analytics cookies (e.g., Google Analytics, Mixpanel, Hotjar)
• Social media tracking pixels (e.g., Facebook Pixel, LinkedIn Insight Tag)
• Web beacons or tracking pixels of any kind
• Browser fingerprinting
• Cross-site tracking technologies
• Persistent cookies on the marketing website

5. Student Data and Cookies

Student accounts in Merit are subject to heightened protections under FERPA and COPPA. The session cookie used for student authentication serves no purpose other than keeping the student logged in during their active session. No student behavioral data, point history, or personally identifiable information is stored in or transmitted via cookies.

6. Managing Cookies

Because Merit uses only strictly necessary session cookies, there is no cookie consent mechanism — these cookies are required for the platform to function and are automatically deleted when your session ends.

You may configure your browser to block or delete cookies at any time. However, blocking session cookies will prevent you from logging in to the Merit platform. Instructions for managing cookies vary by browser:

• Google Chrome: Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Apple Safari: Preferences → Privacy → Manage Website Data
• Microsoft Edge: Settings → Cookies and site permissions → Cookies and site data

Clearing cookies will log you out of the Merit platform. Your account data, point history, and platform settings are stored server-side and are not affected by clearing browser cookies.

7. Changes to This Policy

If Eduverse, Ltd introduces new cookies or tracking technologies in the future, this policy will be updated prior to their use, and institutions will be notified in accordance with our Terms of Service update notification process. We are committed to not introducing advertising or behavioral tracking technologies into the Merit platform.

8. Contact

Questions about this Cookies Policy or Merit's data practices may be directed to legal@meritk12.com.