MUUD Terms of Service

Last updated: September 24, 2026. Effective date: October 26, 2026 for existing Institutional Customers and users; for new users and new Orders, on acceptance.

These Terms of Service (the "Terms") are a legally binding agreement between MUUD SpA, a company organized under the laws of Chile, Chilean tax ID (RUT) 77.634.166-5, with its registered office at Av. Presidente Kennedy 5600, Of. 507, Vitacura, Santiago, Chile ("MUUD", "we", "us" or "our"), and the person or organization accessing or using the Services ("you").

MUUD operates the website https://muud.app (the "Site"), the MUUD applications for phone, tablet and web, including the school platform (school.muud.app) and the workplace platform (business.muud.app) (together, the "App"), and related products and services that reference these Terms (collectively, the "Services"). The Services are a wellbeing and early-alert platform through which schools and other organizations enable students, educators and team members to complete emotional check-ins, including through a conversational check-in assistant, access wellbeing content, and give designated staff visibility of aggregated indicators and early alerts so that trained adults can offer timely human support.

IMPORTANT: The Services are provided primarily to schools and other organizations under a written subscription agreement. Students and other minors may only use the Services through an educational institution that has contracted with MUUD, in accordance with Section 3. Children may not create accounts outside a school deployment. The Services are not a medical, clinical, diagnostic or emergency service (Section 16).

Summary of Key Points

This summary is provided for convenience only and does not replace the full Terms.

Schools and other Institutional Customers own and control the data of their users. MUUD processes it only to provide the Services, under the customer's instructions and a Data Processing Addendum.
MUUD does not sell personal data, does not show advertising in the Services, and never uses Student Data for advertising, marketing or profiling unrelated to the Services.
What a student writes in free text is never shown to school staff. Staff see only indicators and alerts derived from check-ins, so that a trained adult can follow up.
All personal data processed through the Services is hosted in the United States.
Minors access the Services only through their school, with the notices and consents required by the law of their country.
MUUD has appointed DataRep as its representative in the EU/EEA, the United Kingdom and Switzerland for data protection, and as its legal representative in the EU under the Digital Services Act.
You can contact us and exercise your privacy rights using the details in Section 26.

Definitions
Structure of the Agreement; Who These Terms Apply To
Eligibility; Use by Children and Adolescents
Privacy and Data Protection
Ownership and Use of Customer Data and Student Data
FERPA, COPPA and U.S. Student Privacy
Accounts and Registration
Subscriptions, Fees and Payment
License to Use the Services; Restrictions
Acceptable Use
User Content
Intellectual Property
Third-Party Services and Links
Content Moderation, Notices of Illegal Content and Points of Contact (EU Digital Services Act)
AI-Assisted Features
Wellbeing Disclaimer; Not a Medical or Emergency Service
Term, Suspension and Termination; Data Return and Deletion
Warranties and Disclaimers
Limitation of Liability
Indemnification
Changes to the Services and to These Terms
Governing Law and Dispute Resolution
Jurisdiction-Specific Terms
Electronic Communications
General Provisions
Contact

1. Definitions

"Institutional Customer" (or "Customer") means the school, school district, school owner (sostenedor), network of schools, company, non-profit or other organization that has entered into a subscription agreement, order form, purchase order or contract with MUUD, or with an Authorized Distributor, for the provision of the Services (each, an "Order").

"Authorized Distributor" means a company authorized by MUUD to market and resell the Services in a given territory.

"Authorized User" means an individual authorized by an Institutional Customer to use the Services under the Customer's subscription, including students, teachers, school counselors and convivencia staff, school leadership, employees and team members of workplace customers and, where enabled by the Customer, parents or legal guardians.

"Individual User" means a natural person of legal age who uses the Services in their own capacity and not through an Institutional Customer.

"Student Data" means personal data of a student processed through the Services under an Institutional Customer's subscription, including check-in responses, conversations with the check-in assistant, free-text entries, indicators and alerts. Student Data includes "education records" under FERPA and "personal data" under the GDPR, the LGPD, Chilean Law No. 19.628 and Law No. 21.719, the Mexican LFPDPPP and equivalent concepts under other Applicable Data Protection Laws.

"Customer Data" means all data, including Student Data and personal data of other Authorized Users, submitted to the Services by or on behalf of an Institutional Customer or its Authorized Users.

"Applicable Data Protection Laws" means all data protection and privacy laws that apply to the processing of personal data under these Terms, including, as applicable: Regulation (EU) 2016/679 ("GDPR"); the UK GDPR and the Data Protection Act 2018; the Swiss Federal Act on Data Protection ("FADP"); Spanish Organic Law 3/2018 ("LOPDGDD"); Brazilian Law No. 13.709/2018 ("LGPD") and Law No. 15.211/2025 ("ECA Digital"); Chilean Law No. 19.628 and, from December 1, 2026, Law No. 21.719; the Mexican Federal Law on the Protection of Personal Data Held by Private Parties of March 20, 2025 ("LFPDPPP"); the U.S. Family Educational Rights and Privacy Act ("FERPA"), the Children's Online Privacy Protection Act and its implementing rule ("COPPA"), the Protection of Pupil Rights Amendment ("PPRA") and applicable U.S. state student privacy and consumer privacy laws; Argentine Law No. 25.326; Colombian Law 1581 of 2012; and Peruvian Law No. 29733.

"DPA" means the Data Processing Addendum between MUUD and an Institutional Customer, published at https://muud.app/dpa, or the data processing agreement signed between them, which forms part of the agreement between them.

"Privacy Policy" means MUUD's Privacy Policy published at https://muud.app/politica-de-privacidad.

2. Structure of the Agreement; Who These Terms Apply To

2.1 Institutional Customers. If you are an Institutional Customer, your use of the Services is governed by (in order of precedence in case of conflict): (a) your Order; (b) the DPA; and (c) these Terms. The person accepting these Terms on behalf of an organization represents that they have authority to bind that organization.

2.2 Orders through Authorized Distributors. If you purchased the Services through an Authorized Distributor, price, invoicing and payment are governed by your agreement with that distributor. The Services themselves, the DPA and these Terms are provided by MUUD, and MUUD remains responsible to you for the processing of Customer Data. Authorized Distributors do not receive access to Customer Data through the Services unless you authorize it in writing, in which case the distributor acts as MUUD's subprocessor under a written data processing agreement.

2.3 MUUD affiliates. Orders with Institutional Customers in the United States are entered into by MUUD Inc., a Delaware corporation wholly owned by MUUD SpA, and references to "MUUD" in these Terms refer to MUUD Inc. for those Orders. MUUD SpA operates and supports the Services on behalf of MUUD Inc. as its subprocessor, under a written intercompany agreement with the same data protection obligations as the DPA.

2.4 Authorized Users. If you use the Services through an Institutional Customer, these Terms govern your access to and use of the Services. The processing of your personal data is governed by the agreement between MUUD and your organization and by the Privacy Policy. Your organization, not MUUD, decides which features are enabled for you and controls your account. Where the Institutional Customer creates accounts for its Authorized Users, the Customer accepts these Terms on their behalf to the extent permitted by law, and is responsible for making these Terms and the Privacy Policy available to them, and to the parents or guardians of students, before their first use of the Services.

2.5 Individual Users. If you use the Services as an Individual User, these Terms and the Privacy Policy govern your use directly. Individual accounts are available only to persons who have reached the age of majority in their jurisdiction.

2.6 Parents and guardians. Where a school enables guardian access, or where a parent or guardian provides or confirms consent for a child's use of the Services, the parent or guardian accepts these Terms on their own behalf and, to the extent permitted by law, on behalf of the child.

2.7 Healthcare providers. Deployments of MUUD by healthcare providers in the United States are offered only under a separate written agreement that includes a Business Associate Agreement under HIPAA, run on separate infrastructure, and are not governed by the school and workplace provisions of these Terms except where that agreement incorporates them.

2.8 Mandatory rights. Nothing in these Terms limits any right that an Authorized User, student, parent or consumer has under mandatory applicable law, including consumer protection law and Applicable Data Protection Laws. If any provision of these Terms conflicts with such a right, the mandatory right prevails for that user.

3. Eligibility; Use by Children and Adolescents

3.1 Student accounts only through a school. Children may not register for the Services outside a school deployment. Student accounts are created under the Institutional Customer's subscription in one of two ways: by bulk provisioning from the roster the school provides, or by the student registering with a course code that the school gives them.

3.2 Age thresholds. For purposes of these Terms, a "child" is any user below the age at which the user can validly consent to the processing of their personal data under the law of their jurisdiction, including: under 13 in the United States (COPPA) and the United Kingdom; under 14 in Spain (LOPDGDD, Art. 7) and in Chile (Law No. 21.719, which additionally requires parental consent for sensitive data of adolescents under 16); under 16 in EU member states that keep the GDPR default (GDPR, Art. 8), or the lower age set by the member state; under 12 in Brazil, where adolescents from 12 to 17 are also protected under LGPD Art. 14 and the ECA Digital; the age of majority (18) in Mexico and other jurisdictions where local law does not set a lower age; and, in Switzerland, any user who lacks the capacity of judgment required by Swiss law.

3.3 Consent for children's use. Where the personal data of a child will be processed through the Services: (a) the Institutional Customer, as controller, is responsible for providing all legally required notices to parents and guardians and for obtaining, documenting and maintaining any legally required consents or authorizations, or for confirming that it may authorize on the parents' behalf where the law permits (for example, school authorization under COPPA for use limited to the educational context); (b) when a student registers with a course code, the App asks for the student's express consent to the processing of sensitive data before the first check-in, and this consent complements, but does not replace, the consent of parents or guardians that the law requires for children below the applicable age; (c) when the Customer creates accounts by bulk provisioning, the Customer must verify that the required consents have been obtained before providing the roster to MUUD; and (d) MUUD will provide the Customer with the information and template notices reasonably necessary to give those notices and obtain those consents.

3.4 Correction mechanism. MUUD relies on the Institutional Customer's representation that all required notices, consents and authorizations have been obtained. If MUUD becomes aware that a child's personal data has been collected without them, MUUD will suspend processing of that data, notify the Customer and delete the data without undue delay unless the Customer remedies the situation or a legal retention obligation applies.

3.5 Adolescents and adult users. Users who have reached the applicable consent age but are still minors must have the permission of a parent or guardian where local law requires it. All other users must have full legal capacity.

4. Privacy and Data Protection

4.1 Privacy Policy. The Privacy Policy describes what personal data we process, why, on what legal basis, for how long, with whom we share it and how data subjects can exercise their rights. It is incorporated into these Terms by reference. In case of conflict regarding the processing of personal data, the DPA and the Privacy Policy prevail over these Terms.

4.2 Roles. For Customer Data, including Student Data, the Institutional Customer is the controller (or the equivalent: "responsable del tratamiento", "controlador", or the educational agency or institution under FERPA) and MUUD acts as processor ("encargado del tratamiento", "operador") on the Customer's documented instructions and under the DPA. MUUD is the controller for Individual Users and for account administration, billing, support, security, website and business-contact data.

4.3 Our commitments regarding Student Data. In every jurisdiction, MUUD: (a) processes Student Data only to provide, maintain, secure and support the Services for the Customer; (b) does not sell, rent or trade Student Data or any Customer personal data; (c) does not display advertising in the Services and does not use Student Data for advertising, marketing or behavioral targeting; (d) does not build profiles of students except as necessary to provide the contracted Services, and never for advertising; (e) does not use Student Data to train artificial intelligence models, and contractually prohibits its AI providers from doing so; (f) collects only data that is adequate, relevant and limited to what is necessary; and (g) applies appropriate technical and organizational security measures, including encryption in transit and at rest, access restricted to a small number of authorized personnel, logging and regular review.

4.4 Free text and sensitive data. Free-text entries written by students, and the early-alert records derived from check-ins, are treated as sensitive personal data (special category data under GDPR Art. 9, "dados pessoais sensíveis" under the LGPD, "datos sensibles" under Chilean and Mexican law) and receive heightened confidentiality and access controls. The content of a student's free-text entries is never displayed to any school profile: school staff see only indicators and the alerts derived from them. MUUD does not use biometric data, such as facial images, voice or physiological signals, to infer emotions; emotional information in the Services comes from what users choose to report.

4.5 Hosting and subprocessors. All personal data processed through the Services is hosted in data centers located in the United States. MUUD SpA is established in Chile, and its authorized personnel access the data remotely from Chile. MUUD uses vetted service providers (subprocessors) for hosting, transactional email and AI-assisted features. The current list is published in the Privacy Policy and, for Institutional Customers, is governed by the DPA, including advance notice of changes and the right to object.

4.6 International transfers. Where personal data is transferred from its country of origin to the United States or accessed from Chile, MUUD implements the safeguards required by Applicable Data Protection Laws, including the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments where applicable) and transfer impact assessments; the ANPD standard contractual clauses for transfers from Brazil (LGPD Arts. 33 to 36); the transfer rules of Chilean Law No. 21.719; and the rules on transfers and communications to processors under the Mexican LFPDPPP. MUUD does not rely on "continued use" of the Services as consent for international transfers.

4.7 Data subject rights. Data subjects, including students and parents or guardians acting on behalf of their children, may exercise their rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, and the ARCO rights recognized in Latin American jurisdictions, as described in the Privacy Policy. For Customer Data, requests are fulfilled in coordination with and at the direction of the Institutional Customer, which remains the point of contact for parents under FERPA and equivalent frameworks. MUUD provides the Customer with reasonable assistance to review, correct, export and delete Customer Data.

4.8 Security incidents. MUUD will notify the affected Institutional Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Data, with the information required by Applicable Data Protection Laws so that the Customer can meet its own notification obligations. Where MUUD is the controller, MUUD will notify the competent authority and affected individuals as required by law.

4.9 Data protection contacts. Privacy questions and requests can be sent to soporte@muud.app or through the data request form linked in the Site footer ("Delete account"). MUUD has not appointed a data protection officer, because it is not required to do so under GDPR Art. 37 or LOPDGDD Art. 34; data protection matters are handled internally by MUUD's Privacy Officer. MUUD's representative in the EU/EEA, the United Kingdom and Switzerland is Data Protection Representative Limited (trading as DataRep), whose contact details appear in Section 23.1 and in the Privacy Policy.

5. Ownership and Use of Customer Data and Student Data

5.1 Customer ownership. As between MUUD and the Institutional Customer, the Customer owns and retains all right, title and interest in and to Customer Data, including Student Data. Students, and their parents or guardians, retain all rights in the content they create, subject to the school's rights under applicable education law.

5.2 Limited license to MUUD. The Customer grants MUUD a limited, non-exclusive, non-transferable (except to subprocessors under the DPA), revocable license to host, process, transmit, display and back up Customer Data solely as necessary to (a) provide, secure and support the Services, (b) follow the Customer's instructions, and (c) comply with applicable law. This license ends when the data is deleted under Section 17. MUUD claims no ownership of, and takes no perpetual or irrevocable license to, any Customer Data.

5.3 De-identified and aggregated data. MUUD may create de-identified and aggregated data from Customer Data and use it to evaluate and improve the Services and to report on wellbeing trends, provided that the data cannot reasonably be used to identify any individual or any specific Institutional Customer, that MUUD does not attempt to re-identify it, and that any recipient is contractually prohibited from re-identifying it. De-identified data is never used to train third-party AI models. Where applicable law treats de-identified student data more strictly, MUUD complies with the stricter standard.

5.4 No mining for advertising. MUUD will not mine, scan or analyze Customer Data for advertising purposes or to build advertising profiles, and will not permit any third party to do so.

6. FERPA, COPPA and U.S. Student Privacy

6.1 School official. Where the Services are used by an educational agency or institution subject to FERPA, MUUD acts as a "school official" with a "legitimate educational interest" under 34 CFR 99.31(a)(1). MUUD (a) performs an institutional service or function for which the institution would otherwise use employees; (b) is under the direct control of the institution with respect to the use and maintenance of education records; (c) uses education records only for authorized purposes; and (d) does not re-disclose personal information from education records except as directed by the institution or as permitted by FERPA.

6.2 Parental rights. The institution remains responsible for responding to parents' requests to inspect, review and amend education records. MUUD will make Student Data available to the institution so that it can comply.

6.3 COPPA. For students under 13 in the United States, MUUD relies on the school's authorization, as permitted by FTC guidance, for the collection of students' personal information solely for the use and benefit of the school and for no other commercial purpose. MUUD provides schools with the direct notice information they need to inform parents, maintains the written data retention and information security programs required by the COPPA Rule, and allows parents to review and request deletion of their child's information through the school.

6.4 PPRA. Check-in questions are designed for the school's wellbeing program. Where a check-in could be considered a survey covered by the PPRA, the school is responsible for providing the required notices and opt-out opportunities, and MUUD will enable the school to exclude a student from check-ins on request.

6.5 State student privacy laws. MUUD complies with applicable U.S. state student data privacy laws, including California's Student Online Personal Information Protection Act (SOPIPA) and Education Code Section 49073.1, the Illinois Student Online Personal Protection Act (SOPPA) and Washington's student user privacy law (RCW 28A.604), and will sign the state-required or consortium data privacy agreements where an Order so requires.

7. Accounts and Registration

7.1 You agree to provide accurate, current and complete registration information. Accounts are personal. You are responsible for keeping your credentials confidential and for activity under your account, except where the activity results from MUUD's failure to maintain reasonable security or where mandatory law provides otherwise.

7.2 Notify us promptly at soporte@muud.app of any unauthorized use of your account. Institutional Customers are responsible for keeping their Authorized User lists up to date, including requesting the deactivation of users who leave the organization.

7.3 Where a school sends MUUD a student roster to create accounts, MUUD uses it only to validate its format and create the accounts, keeps it in restricted storage accessible only to the personnel who perform that task, and keeps it for the duration of the subscription, after which it is deleted together with the rest of the Customer Data under Section 17.4.

8. Subscriptions, Fees and Payment

8.1 Institutional subscriptions. Fees, subscription periods, user counts, renewal and payment terms for Institutional Customers are set out in the applicable Order. Unless the Order states otherwise, fees are stated exclusive of taxes, and each party bears the taxes for which it is legally responsible.

8.2 Individual purchases. Where individual paid plans are offered, prices, currency and applicable taxes are displayed before you confirm the purchase. Purchases made through the Apple App Store or Google Play are also subject to the store's terms, including its billing and cancellation mechanisms. We may change prices for future periods with prior notice; changes do not affect the current paid period.

8.3 Refunds and withdrawal rights. Except where the Order provides otherwise, fees are non-refundable to the extent permitted by law. Nothing in these Terms excludes statutory withdrawal, cooling-off or refund rights that cannot be waived, including those of consumers in the EU and the United Kingdom, under Chilean Law No. 19.496, under the Brazilian Consumer Defense Code (Art. 49), under the Mexican Federal Consumer Protection Law, and under other applicable consumer protection laws.

8.4 Late payment. If undisputed fees remain unpaid after written notice and a cure period of at least 15 days, MUUD may suspend the affected subscription until payment is received. MUUD will not delete Customer Data because of late payment before the periods in Section 17.4 have elapsed.

9. License to Use the Services; Restrictions

9.1 License. Subject to these Terms and, for Institutional Customers, the applicable Order, MUUD grants you a limited, non-exclusive, non-transferable, revocable license to access and use the Services, and to install and use the App on devices you own or control, for their intended purposes: internal educational and organizational use for Institutional Customers and Authorized Users, and personal, non-commercial use for Individual Users.

9.2 Restrictions. Except as permitted by mandatory law, you must not: (a) copy, modify, translate or create derivative works of the Services; (b) reverse engineer, decompile or disassemble the Services; (c) rent, lease, sell, sublicense or otherwise make the Services available to third parties outside your organization; (d) remove or alter proprietary notices; (e) use the Services to build a competing product; (f) access the Services by automated means (bots, scraping) without our written permission; or (g) circumvent security or usage limits.

9.3 App store terms. These Terms are also the end user license agreement for the App when it is downloaded from the Apple App Store or Google Play, and the applicable store terms also apply. For the App downloaded from the Apple App Store: (a) these Terms are concluded between you and MUUD only, not with Apple, and MUUD, not Apple, is solely responsible for the App and its content; (b) your license is a non-transferable license to use the App on Apple-branded products you own or control, as permitted by the Usage Rules in the Apple Media Services Terms and Conditions, including through Family Sharing or volume purchasing where applicable; (c) MUUD is solely responsible for maintenance and support of the App, and Apple has no obligation to provide them; (d) if the App fails to conform to any applicable warranty, you may notify Apple, and Apple will refund the purchase price, if any; to the maximum extent permitted by law, Apple has no other warranty obligation with respect to the App; (e) MUUD, not Apple, is responsible for addressing any claims relating to the App or its use, including product liability claims, claims that the App fails to conform to legal or regulatory requirements, and claims under consumer protection, privacy or similar legislation; (f) MUUD, not Apple, is responsible for the investigation, defense, settlement and discharge of any third-party claim that the App infringes intellectual property rights; (g) you represent that you are not located in a country subject to a U.S. Government embargo or designated as a "terrorist supporting" country, and that you are not listed on any U.S. Government list of prohibited or restricted parties; (h) questions, complaints or claims about the App can be sent to MUUD using the details in Section 26; (i) you must comply with applicable third-party terms, such as your mobile data agreement, when using the App; and (j) Apple and its subsidiaries are third-party beneficiaries of these Terms and, upon your acceptance, have the right to enforce them against you as a third-party beneficiary.

10. Acceptable Use

10.1 You agree to use the Services only for their intended purposes and in compliance with applicable law. You must not: use the Services to harass, bully, threaten, defame or harm any person; upload content that is illegal, discriminatory, sexually explicit or violent, in particular content harmful to minors; impersonate any person; upload malware or interfere with the Services; attempt unauthorized access to accounts, systems or data; collect other users' personal data without authorization; send spam through the Services; or use the Services in violation of export control or sanctions laws.

10.2 Institutional Customers are responsible for communicating acceptable use rules to their Authorized Users and for addressing misconduct by their users under their own policies, in coordination with MUUD where needed.

10.3 We may investigate suspected violations and take proportionate measures in accordance with Section 14.

11. User Content

11.1 Your content. "User Content" means content that users create in the Services, such as check-in responses, messages to the check-in assistant and free-text entries, including text dictated by voice. MUUD receives only the text of a dictation, never the audio. You (or, for Student Data, the student and the Institutional Customer as applicable) retain all rights in User Content. MUUD claims no ownership of User Content.

11.2 License to operate the Services. You grant MUUD a limited, non-exclusive, worldwide, royalty-free license to host, store, reproduce, transmit, display to the persons entitled to see it, and back up User Content solely as necessary to operate, provide, secure and support the Services. This license ends when the User Content is deleted in accordance with these Terms and the DPA, except for backups pending deletion and content we must retain by law. MUUD does not use User Content for advertising, publication, resale or any purpose unrelated to the Services.

11.3 Visibility. Free-text entries are visible only to the user who wrote them and are never displayed to school staff or other users. Designated staff of the Institutional Customer see indicators and alerts derived from check-ins, as described in the Privacy Policy. Aggregated reports for the organization never identify individual students unless the Customer's designated staff are following up on a specific alert.

11.4 Feedback. If you voluntarily send us suggestions about the Services, you grant MUUD a non-exclusive, perpetual, irrevocable, royalty-free license to use them to improve the Services. Feedback does not include personal data or User Content, and this Section does not apply to content created by children.

11.5 Responsibility. You are responsible for your User Content and represent that it does not infringe third-party rights or violate applicable law.

12. Intellectual Property

12.1 The Services, including software, source code, databases, design, text, graphics, audio, video and MUUD's trademarks and logos (excluding Customer Data and User Content), are owned by MUUD or its licensors and are protected by intellectual property laws in Chile and internationally. Except for the licenses expressly granted in these Terms, no rights are granted to you, and MUUD reserves all rights.

12.2 Copyright complaints. If you believe content on the Services infringes your copyright, notify us at soporte@muud.app with enough detail to identify the work, the allegedly infringing material and your contact information. We will process notices in accordance with Section 14 and applicable law.

13. Third-Party Services and Links

13.1 The Services may interoperate with third-party services enabled by you or your organization, such as single sign-on providers. Your use of a third-party service is governed by that third party's terms and privacy policy. MUUD will only connect third-party services to Customer Data as permitted by the DPA.

13.2 The Services may contain links to third-party websites, such as crisis helplines or educational resources. MUUD does not control and is not responsible for them.

14. Content Moderation, Notices of Illegal Content and Points of Contact (EU Digital Services Act)

14.1 Scope. This Section applies to the Services as an intermediary hosting service under Regulation (EU) 2022/2065 (the "Digital Services Act" or "DSA") and, as good practice, to users in every jurisdiction. User Content in the Services is private: it is not disseminated to the public and is visible only as described in Section 11.3.

14.2 Our content policy. Content that is illegal under applicable law, or that breaches Section 10, is not allowed in the Services. MUUD does not proactively monitor private User Content. Wellbeing indicators and alerts are a feature of the Services for the Institutional Customer's staff and are not a content moderation tool.

14.3 How we moderate. MUUD acts on (a) notices received under Section 14.4, (b) reports from Institutional Customers, and (c) security signals from our systems. The conversational check-in assistant applies automated safety rules that decline to generate harmful responses; these rules do not remove or restrict User Content. Every decision to remove content, restrict a feature or suspend an account is taken by a person at MUUD, not solely by automated means. Measures are proportionate and may include removing or disabling access to specific content, limiting features, suspending or terminating an account, and, for students, informing the Institutional Customer so that it can act under its own policies.

14.4 Notices of illegal content. Anyone may notify us of content in the Services that they consider illegal, by email to soporte@muud.app, through the data request form linked in the Site footer, or through our DSA legal representative (Section 14.7). A notice should include: (a) a sufficiently substantiated explanation of why the content is considered illegal; (b) a clear indication of where the content is located (for example, the account, school or screen concerned); (c) the name and email address of the person submitting the notice, except for notices concerning child sexual abuse offences; and (d) a statement confirming the good-faith belief that the information in the notice is accurate and complete. We confirm receipt without undue delay, process notices in a timely, diligent, non-arbitrary and objective manner, and inform the person who submitted the notice of our decision and of the available redress options.

14.5 Statement of reasons and redress. If we remove or restrict User Content or suspend or terminate an account, we will give the affected user (or, for students, the Institutional Customer) a clear and specific statement of reasons, including the facts relied on, the legal or contractual ground, whether automated means were used, and the redress available, unless the law prohibits it or the content is deceptive high-volume commercial content. Users may ask us to review any decision by writing to soporte@muud.app within six months; a different person from the one who took the original decision will review it. Users may also pursue judicial remedies under applicable law.

14.6 Threats to life or safety. If we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we will inform the competent law enforcement or judicial authorities as required by Article 18 of the DSA and other applicable law, and, where lawful, the Institutional Customer.

14.7 Points of contact and legal representative. MUUD's single point of contact for EU member state authorities, the European Commission and the European Board for Digital Services (DSA Art. 11), and for recipients of the Services (DSA Art. 12), is its legal representative in the EU under DSA Art. 13: Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland; email digitalrequest@datarep.com (quoting "MUUD SpA" in the subject line); webform www.datarep.com/data-request; telephone +353 1 919 8899. Letters must be addressed to "DataRep", not to MUUD SpA, and should refer clearly to MUUD SpA. Users may also contact MUUD directly at soporte@muud.app. Communications may be made in English or Spanish.

15. AI-Assisted Features

15.1 What they are. The Services include a conversational check-in assistant (Muudy) and automated features that summarize check-in history and generate wellbeing indicators and alerts. These features use large language models provided by third-party AI providers identified in the Privacy Policy, acting as MUUD's subprocessors.

15.2 Transparency. Users are informed within the App that they are interacting with an automated assistant, not a person. The assistant's replies are generated automatically in real time and are not reviewed by a person before they are shown. They may be incomplete or inaccurate, and they are not professional advice.

15.3 Human decision-making. Indicators and alerts are informational signals for trained staff of the Institutional Customer. No decision that produces legal effects or similarly significant effects for a student or employee is taken by MUUD or by the Services solely by automated means. Decisions about how to support a person remain with the Institutional Customer and its qualified staff.

15.4 Provider commitments. MUUD's AI providers process data only to generate the requested output, under contractual terms that prohibit them from using Customer Data to train their models. MUUD does not use Customer Data to train AI models.

16. Wellbeing Disclaimer; Not a Medical or Emergency Service

16.1 The Services are an educational and organizational wellbeing platform. They are not, and must not be used as, a medical device, or a clinical, diagnostic, psychological, psychiatric or therapeutic service, or as a substitute for professional advice, diagnosis or treatment. MUUD makes no representation that use of the Services will produce any particular wellbeing outcome.

16.2 Alerts and indicators are tools to help trained staff prioritize human follow-up. They are not clinical assessments, and the absence of an alert does not mean that a person does not need support.

16.3 Emergencies. The Services are not monitored in real time by MUUD and must not be used to report emergencies. If you or someone else is in danger, contact local emergency services immediately (for example, 131 or 133 in Chile, 112 in the EU, 911 in the United States and Mexico, 192 or 190 in Brazil), or the crisis line of your country.

17. Term, Suspension and Termination; Data Return and Deletion

17.1 Term. For Institutional Customers, the term is set out in the Order. For other users, these Terms apply while you use the Services.

17.2 Suspension. MUUD may suspend an account or access where reasonably necessary to (a) address a security risk or a violation of law, (b) comply with law or a binding order, or (c) address a material breach of these Terms that remains uncured after notice, except where prior notice is not reasonably possible. Suspension will be proportionate, limited in scope and duration, and accompanied by a statement of reasons under Section 14.5. MUUD will restore access once the cause is resolved.

17.3 Termination by you. Individual Users may stop using the Services and delete their account at any time through the data request form linked in the Site footer ("Delete account") or by writing to soporte@muud.app. Institutional Customers may terminate as provided in the Order.

17.4 Data return and deletion. Upon expiration or termination of an Institutional Customer's subscription, MUUD will (a) make Customer Data available for export in a commonly used, machine-readable format for 60 days, and (b) delete Customer Data from production systems within 90 days after termination, and from backups in their ordinary rotation cycle, during which backups remain isolated from any active processing, unless retention is required by law. MUUD certifies deletion in writing on request. During the subscription, the Customer may request the deletion of any Student Data at any time.

17.5 Inactive individual accounts. Accounts of Individual Users that remain inactive for 24 months are deleted after at least 30 days' prior notice to the account email. Student and employee accounts under an institutional subscription are managed by the Institutional Customer and are not deleted for inactivity without the Customer's instruction.

18. Warranties and Disclaimers

18.1 MUUD warrants to Institutional Customers that the Services will perform materially in accordance with the applicable documentation and the Order, and that MUUD will provide them with reasonable skill and care and in compliance with the Applicable Data Protection Laws that apply to MUUD.

18.2 Except as expressly stated in these Terms or an Order, and to the maximum extent permitted by law, the Services are provided "as is" and "as available", and MUUD disclaims implied warranties of merchantability, fitness for a particular purpose and non-infringement. We do not warrant uninterrupted or error-free operation.

18.3 Consumer rights preserved. If you use the Services as a consumer, you keep all warranties and remedies granted by the mandatory consumer law of your country of residence, and nothing in this Section limits them.

19. Limitation of Liability

19.1 Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including liability for willful misconduct or gross negligence, death or personal injury caused by negligence, fraud, and any liability to consumers or data subjects that mandatory law does not permit to be limited.

19.2 Subject to Section 19.1, neither party will be liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits or revenue, arising out of or related to these Terms.

19.3 Subject to Sections 19.1 and 19.2, each party's total aggregate liability arising out of or related to these Terms will not exceed the fees paid or payable to MUUD in the 12 months preceding the event giving rise to liability. An Order may set a different cap for breaches of confidentiality or data protection obligations, and no cap limits the statutory claims of data subjects.

19.4 This Section allocates risk between MUUD and Institutional Customers and applies to Individual Users only to the extent permitted by the consumer law of their country of residence.

20. Indemnification

20.1 By Institutional Customers. An Institutional Customer will defend and indemnify MUUD against third-party claims arising from (a) Customer Data or the Customer's instructions violating applicable law or third-party rights, or (b) the Customer's failure to give the notices or obtain the consents and authorizations required under Section 3, except to the extent caused by MUUD's breach of these Terms or the DPA.

20.2 By MUUD. MUUD will defend and indemnify the Institutional Customer against third-party claims alleging that the Services, as provided by MUUD and used as permitted, infringe intellectual property rights, and will remedy any established infringement by procuring rights, modifying the Services or refunding prepaid unused fees.

20.3 No indemnification obligations are imposed on Individual Users, students, parents or guardians beyond their liability under applicable law.

21. Changes to the Services and to These Terms

21.1 We continuously improve the Services and may add, change or remove features, provided that during a paid subscription we will not materially degrade the core functionality contracted.

21.2 We may update these Terms. For material changes, we will give at least 30 days' prior notice by email to the Institutional Customer's contacts and by in-product notice, identifying the changes. If you do not agree, you may terminate before the effective date; where a prepaid subscription is materially and adversely affected, the Customer may terminate and receive a pro-rata refund of unused prepaid fees. Continued use after the effective date constitutes acceptance only where such acceptance is valid under applicable law. Changes required by law or addressing security may take effect sooner, with notice as promptly as possible. The current version and its date are always published on the Site, and prior versions are available on request.

22. Governing Law and Dispute Resolution

22.1 Institutional Customers. Unless the Order states otherwise, these Terms are governed by the laws of Chile, and the ordinary courts of Santiago, Chile have exclusive jurisdiction; for Orders with MUUD Inc., they are governed by the laws of the state of the United States where the Customer is located, and the competent courts of that state have jurisdiction. In all cases, either party may seek urgent relief for intellectual property or confidentiality breaches in any competent court.

22.2 Consumers. If you use the Services as a consumer, you benefit from the mandatory protections of the law of your country of habitual residence and may bring claims before the courts of that country. MUUD may bring claims against a consumer only in the courts of the consumer's residence. Nothing in these Terms limits access to consumer protection authorities, such as SERNAC in Chile, PROCON in Brazil, PROFECO in Mexico, or national consumer bodies in the EU.

22.3 Data protection claims. Nothing in this Section limits the right of any data subject to lodge a complaint with a supervisory authority, including any EU/EEA supervisory authority, the Spanish Agencia Española de Protección de Datos, the UK Information Commissioner's Office, the Swiss Federal Data Protection and Information Commissioner, Brazil's Autoridade Nacional de Proteção de Dados, Chile's Agencia de Protección de Datos Personales, or Mexico's Secretaría Anticorrupción y Buen Gobierno, or to seek judicial remedies.

22.4 Good-faith resolution. Before starting formal proceedings, the parties will attempt in good faith to resolve disputes through the contacts in Section 26 for at least 30 days, except for urgent relief.

23. Jurisdiction-Specific Terms

23.1 European Economic Area, United Kingdom and Switzerland

Processing of personal data is subject to the GDPR, the UK GDPR and the Swiss FADP, as applicable. International transfers are protected as described in Section 4.6. Under GDPR Art. 27, UK GDPR Art. 27 and FADP Art. 14, MUUD has appointed Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland, as its representative in the EU/EEA, the United Kingdom and Switzerland. Data subjects and supervisory authorities can contact DataRep at datarequest@datarep.com (quoting "MUUD SpA" in the subject line), through www.datarep.com/data-request, or by post at DataRep's local address in their country, listed in the Privacy Policy. Letters must be addressed to "DataRep", not to MUUD SpA. DataRep is also MUUD's legal representative under the DSA (Section 14.7). Consumers in the EU and the UK keep their statutory withdrawal and digital content conformity rights.

23.2 Spain

In addition to the GDPR, the LOPDGDD applies. Personal data of students under 14 is processed only with the consent of the holders of parental authority or guardianship, or on another valid legal basis established by the school under Spanish education and data protection law (including the Organic Law of Education). The Agencia Española de Protección de Datos is the competent supervisory authority.

23.3 Brazil

The LGPD and the ECA Digital (Law No. 15.211/2025) apply. Personal data of children and adolescents is processed in their best interest (LGPD Art. 14). For school deployments, the school as controller establishes the legal basis and, where consent is required for children under 12, obtains the specific and highlighted consent of at least one parent or legal guardian; MUUD provides supporting information and mechanisms. In line with the ECA Digital, the Services are designed with privacy and safety by default, contain no advertising, no commercial profiling of children and adolescents, no loot boxes or engagement-maximizing mechanics, and no public social features. MUUD has not appointed an encarregado: for school and workplace deployments it acts as operator, and the customer is the controller. Data subjects in Brazil may contact MUUD through the channel in Section 26, which handles communications with data subjects and with the ANPD, and may petition the ANPD. Brazilian consumers keep their rights under the Consumer Defense Code.

23.4 Chile

Processing is subject to Law No. 19.628 and, from December 1, 2026, to Law No. 21.719, including its principles, the rights of access, rectification, erasure, objection, portability and blocking, the rules on sensitive data and on data of children and adolescents (processed in their best interest, with parental consent for children under 14 and for sensitive data of adolescents under 16), and the oversight of the Agencia de Protección de Datos Personales. Consumers keep their rights under Law No. 19.496.

23.5 Mexico

The LFPDPPP applies. MUUD's privacy notice (aviso de privacidad) for Mexico forms part of the Privacy Policy. For school and workplace deployments, the Institutional Customer is the controller (responsable) and MUUD acts as processor (encargado); communications of data to MUUD as processor do not require the data subject's consent. Data subjects may exercise their ARCO rights and revoke consent as described in the Privacy Policy, and may go to the Secretaría Anticorrupción y Buen Gobierno. Consumers keep their rights under the Federal Consumer Protection Law.

23.6 United States

In addition to Section 6, MUUD complies with applicable state student privacy laws, including prohibitions on targeted advertising to students, on selling student data and on non-educational profiling. MUUD does not sell or share personal information, as those terms are defined in the California Consumer Privacy Act, and rights under U.S. state consumer privacy laws are described in the Privacy Policy. California users may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, California 95834, or by telephone at (800) 952-5210.

23.7 Other jurisdictions

In Argentina, Law No. 25.326 applies, supervised by the Agencia de Acceso a la Información Pública. In Colombia, Law 1581 of 2012 and its regulations apply, supervised by the Superintendencia de Industria y Comercio. In Peru, Law No. 29733 and its regulations apply. Where the Services are provided in any other jurisdiction, MUUD complies with the applicable local data protection framework, and mandatory local rules prevail over any conflicting provision of these Terms.

24. Electronic Communications

You agree to receive communications from us electronically (email and in-product notices), and such communications satisfy any legal requirement of written form, to the extent permitted by law. You may request legally required communications on paper where the law grants that right. Electronic acceptance of these Terms and of Orders is valid under applicable electronic signature laws, including Chilean Law No. 19.799.

25. General Provisions

25.1 Entire agreement. These Terms, the Privacy Policy and, for Institutional Customers, the Order and the DPA constitute the entire agreement regarding the Services and supersede prior agreements on the same subject.

25.2 Assignment. You may not assign these Terms without our prior written consent. MUUD may assign these Terms to an affiliate or in connection with a merger, acquisition or sale of assets, provided that the assignee assumes all obligations, including data protection obligations, and that Institutional Customers receive prior notice. In a change of control, the protections applicable to Student Data continue to apply, or the Customer may terminate and require deletion of Customer Data.

25.3 Severability; waiver. If any provision is held unenforceable, the remainder stays in effect and the provision will be enforced to the maximum extent permissible. Failure to enforce a provision is not a waiver.

25.4 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, except for payment obligations.

25.5 Independent parties. The parties are independent contractors. These Terms create no partnership, joint venture, employment or agency relationship.

25.6 Language. These Terms are drafted in English. MUUD also publishes Spanish and Portuguese versions. Where the law of your jurisdiction requires information to be provided in a local language, the local language version applies, and in case of discrepancy the version most protective of the user prevails to the extent required by mandatory law; otherwise the English version controls.

25.7 Survival. Sections that by their nature should survive termination, including Sections 4, 5, 11.4, 12, 17.4, 18 to 20, 22 and 25, survive.

26. Contact

MUUD SpA, RUT 77.634.166-5
Av. Presidente Kennedy 5600, Of. 507, Vitacura, Santiago, Chile
Support, privacy and data protection requests: soporte@muud.app
Commercial and billing matters: comercial@muud.app
Telephone: +56 9 2691 3974
Data requests and account deletion: the form linked as "Delete account" in the Site footer
EU/EEA, UK and Swiss representative, and EU DSA legal representative: DataRep (see Sections 14.7 and 23.1)