Terms and Conditions MUUD SpA

These Terms of Service (the "Terms") are a legally binding agreement between MUUD SpA, a company organized under the laws of Chile, Chilean tax ID (RUT) 77.634.166-5, with its registered office at Av. Presidente Kennedy 5600, Of. 507, Vitacura, Santiago, Chile ("MUUD", "we", "us" or "our"), and the party accessing or using the Services (as defined below).

MUUD operates the website https://muud.app (the "Site"), the MUUD mobile and web applications (the "App"), and related products and services that reference these Terms (collectively, the "Services"). The Services are a student wellbeing platform through which educational institutions enable students and educators to complete check-ins, keep a personal journal, access wellbeing content, and give school staff visibility and early alerts to support healthy school communities.

IMPORTANT: The Services are provided primarily to schools and other organizations under a written subscription agreement. Students and other minors may only use the Services through an educational institution that has contracted with MUUD and in accordance with Section 3. Children may not create individual accounts on their own.

Summary of Key Points

This summary is provided for convenience only and does not replace the full Terms.

• (a) Schools own and control the Student Data processed through the Services; MUUD processes it only to provide the Services, under the school's instructions and a Data Processing Addendum.
• (b) MUUD does not sell personal data, does not show advertising within the Services, and does not use Student Data for targeted advertising or for profiling unrelated to the Services.
• (c) Minors access the Services only through their school, with consent obtained as required by the law of their country.
• (d) The Services are an educational wellbeing tool. They are not a medical, clinical, diagnostic or emergency service.
• (e) You can contact us, and exercise your privacy rights, using the details in Section 24.

1. Definitions

"Institutional Customer" (or "Customer") means the school, school district, network of schools, company, non-profit or other organization that has entered into a subscription agreement, order form or purchase order with MUUD for the provision of the Services (each, an "Order").

"Authorized User" means an individual authorized by an Institutional Customer to use the Services under the Customer's subscription, including students, teachers, school counselors, school leadership staff and, where enabled by the Customer, parents or legal guardians.

"Individual User" means a natural person of legal age who uses the Services in their own capacity and not through an Institutional Customer.

"Student Data" means personal data of a student (including any content a student creates in the Services, such as check-in responses and journal entries) that is processed through the Services under an Institutional Customer's subscription. Student Data includes "education records" as defined by FERPA (United States), "personal data" as defined by the GDPR, LGPD, Chilean Law No. 21.719 and the India DPDP Act, and equivalent concepts under other Applicable Data Protection Laws.

"Customer Data" means all data, including Student Data and personal data of other Authorized Users, submitted to the Services by or on behalf of an Institutional Customer or its Authorized Users.

"Applicable Data Protection Laws" means all data protection and privacy laws that apply to the processing of personal data under these Terms, including, as applicable: Regulation (EU) 2016/679 ("GDPR") and the UK GDPR; Spanish Organic Law 3/2018 ("LOPDGDD"); Brazilian Law No. 13.709/2018 ("LGPD"); Chilean Law No. 19.628 and Law No. 21.719; the U.S. Family Educational Rights and Privacy Act ("FERPA"), the Children's Online Privacy Protection Act ("COPPA"), the Protection of Pupil Rights Amendment ("PPRA") and applicable U.S. state student privacy laws (including California's SOPIPA and Ed. Code 49073.1); Mexico's Federal Law on the Protection of Personal Data Held by Private Parties; Colombia's Law 1581 of 2012; Peru's Law No. 29733; Argentina's Law No. 25.326; and India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.

"DPA" means the Data Processing Addendum entered into between MUUD and an Institutional Customer, which forms part of the agreement between MUUD and that Customer.

2. Structure of the Agreement; Who These Terms Apply To

2.1 Institutional Customers. If you are an Institutional Customer, your use of the Services is governed by (in order of precedence in case of conflict): (a) your Order; (b) the DPA; and (c) these Terms. The person accepting these Terms on behalf of an organization represents that they have authority to bind that organization.

2.2 Authorized Users. If you use the Services through an Institutional Customer, these Terms govern your access to and use of the Services, but the processing of your personal data is governed by the agreement between MUUD and your institution and by MUUD's Privacy Policy. Your institution, not MUUD, decides which features are enabled for you and controls your account within the platform.

2.3 Individual Users. If you use the Services as an Individual User, these Terms and the Privacy Policy govern your use directly. Individual accounts are available only to persons who have reached the age of majority in their jurisdiction, or the applicable digital consent age where an individual offering is expressly made available to older adolescents in that jurisdiction (see Section 3).

2.4 Parents and guardians. Where a school enables guardian access, or where a parent or guardian provides or confirms consent for a child's use of the Services, the parent or guardian accepts these Terms on their own behalf and, to the extent permitted by law, on behalf of the child.

2.5 Nothing in these Terms limits any right that an Authorized User, student, parent or consumer has under mandatory applicable law, including consumer protection law and Applicable Data Protection Laws. If any provision of these Terms conflicts with a mandatory right, the mandatory right prevails for that user.

3. Eligibility; Use by Children and Adolescents

3.1 No self-registration by children. Children may not register for the Services on their own. Accounts for students are created or provisioned only by, or at the direction of, an Institutional Customer, or with the verifiable consent of a parent or legal guardian where required and supported.

3.2 Age thresholds. For purposes of these Terms, a "child" is any user below the age at which the user can validly consent to the processing of their personal data in connection with information society services under the law of their jurisdiction, including: 13 in the United States (COPPA) and in EU member states that have adopted the minimum age; 14 in Spain (LOPDGDD, Art. 7); 16 in EU member states that retain the GDPR default (GDPR Art. 8); the ages set by applicable law in Brazil (LGPD Art. 14, processing of children's and adolescents' data in their best interest), Chile, and other Latin American jurisdictions; and 18 in India (DPDP Act, Section 9).

3.3 Consent for children's use. Where the personal data of a child will be processed through the Services: (a) in school deployments, the Institutional Customer is responsible for providing all legally required notices to parents and guardians and for obtaining, documenting and maintaining any legally required consents or authorizations, or for confirming that it may consent or authorize on the parents' behalf where the law permits (for example, the COPPA "school consent" mechanism in the United States for use limited to the educational context); (b) MUUD will provide the Customer with the information reasonably necessary to give those notices and obtain those consents; and (c) in jurisdictions where the law requires verifiable parental or guardian consent that a school cannot provide on the parents' behalf (including India under the DPDP Act and DPDP Rules, 2025), MUUD and the Customer will implement a compliant verifiable consent mechanism before any child's personal data is processed.

3.4 MUUD relies on the representations of the Institutional Customer that all required notices, consents and authorizations have been obtained. If MUUD becomes aware that a child's personal data has been collected without the legally required consent or authorization, MUUD will delete that data without undue delay, subject to any legal retention obligations, and will notify the Customer.

3.5 Adolescents and adult users. Users who have reached the applicable digital consent age but are still minors must have permission from a parent or guardian to use the Services where local law requires it. All other users must have full legal capacity.

4. Privacy and Data Protection

4.1 Privacy Policy. Our Privacy Policy, available at https://muud.app/politica-de-privacidad, describes what personal data we process, why, on what legal basis, for how long, with whom we share it and how data subjects can exercise their rights. The Privacy Policy is incorporated into these Terms by reference. In case of conflict between these Terms and the Privacy Policy regarding the processing of personal data, the Privacy Policy and the DPA prevail.

4.2 Roles. For Student Data and other Customer Data, the Institutional Customer is the data controller (or equivalent: "responsable del tratamiento", "controlador", "Data Fiduciary" under the India DPDP Act, or the educational agency or institution under FERPA) and MUUD acts as data processor (or equivalent: "encargado del tratamiento", "operador", "Data Processor") acting only on the Customer's documented instructions and under the DPA. For Individual Users, and for account, billing, support and website data, MUUD is the data controller.

4.3 Our commitments regarding Student Data. Regardless of jurisdiction, MUUD: (a) processes Student Data only to provide, maintain, secure and improve the Services for the Customer, and for no other purpose; (b) does not sell, rent or trade Student Data or any Customer personal data; (c) does not display third-party advertising in the student experience and does not use Student Data for advertising, marketing or behavioral targeting of any kind; (d) does not build profiles of students except as necessary to provide the contracted Services (for example, wellbeing check-in history visible to the school) and never for advertising; (e) does not track, monitor or profile children in ways prohibited by applicable law, including Section 9 of the India DPDP Act; (f) collects and processes only the data that is adequate, relevant and limited to what is necessary (data minimization); and (g) applies appropriate technical and organizational security measures, including encryption in transit and at rest, access controls, logging and regular reviews.

4.4 Sensitive data. Check-in responses and journal entries may reveal information about a student's emotional state, which may qualify as sensitive personal data or special category data under Applicable Data Protection Laws (including GDPR Art. 9, LGPD Art. 5(II) and 11, Chilean Law No. 21.719, and equivalent provisions). Such data is processed only with a valid legal basis established by the Customer (or by the Individual User's explicit consent, where applicable), only for the wellbeing purposes of the Services, under heightened confidentiality and access controls, and is never used for advertising or disclosed to third parties except as instructed by the Customer, as described in the Privacy Policy, or as required by law.

4.5 Subprocessors. MUUD uses vetted service providers (for example, cloud hosting) to operate the Services. A current list of subprocessors is available on request and, for Institutional Customers, is governed by the DPA, including flow-down of data protection obligations and advance notice of changes.

4.6 International transfers. The Services are hosted in [INSERT HOSTING REGION(S), e.g., the United States and/or Chile]. Where personal data is transferred internationally, MUUD implements the safeguards required by Applicable Data Protection Laws, including: the European Commission's Standard Contractual Clauses and the UK Addendum or IDTA for transfers from the EEA and the UK, with transfer impact assessments where required; the ANPD's standard contractual clauses or other valid mechanisms under LGPD Arts. 33 to 36 for transfers from Brazil; and the conditions for international transfers under Chilean Law No. 21.719 and other applicable Latin American and Indian rules. MUUD does not rely on "continued use" of the Services as consent for international transfers.

4.7 Data subject rights. Data subjects (including students, and parents or guardians acting on behalf of their children) may exercise their rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, and the ARCO rights recognized in Latin American jurisdictions, as described in the Privacy Policy. For Student Data in school deployments, requests will be fulfilled in coordination with, and at the direction of, the Institutional Customer, which remains the point of contact for parents under FERPA and equivalent frameworks. MUUD will provide the Customer with reasonable assistance and self-service tools to review, correct, export and delete Student Data.

4.8 Security incidents. MUUD will notify the affected Institutional Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Data, providing the information required by Applicable Data Protection Laws (including GDPR Arts. 33 and 34, Chilean Law No. 21.719, LGPD Art. 48 and the India DPDP framework) so the Customer can meet its own notification obligations. Where MUUD is the controller, MUUD will notify the competent authority and affected individuals as required by law.

4.9 Data protection contacts. MUUD's privacy contact and, where required, Data Protection Officer can be reached at privacy@muud.app [OR INSERT DEDICATED ADDRESS]. Jurisdiction-specific contacts (including MUUD's EU/UK representative, Brazilian encarregado and India Grievance Officer, where applicable) are identified in Section 21 and in the Privacy Policy.

5. Ownership and Use of Customer Data and Student Data

5.1 Customer ownership. As between MUUD and the Institutional Customer, the Customer owns and retains all right, title and interest in and to Customer Data, including Student Data. Students (and their parents or guardians) retain all rights in the content they create, such as journal entries, subject to the school's rights under applicable education law.

5.2 Limited license to MUUD. The Customer grants MUUD a limited, non-exclusive, non-transferable (except to subprocessors under the DPA), revocable license to host, process, transmit, display and create backups of Customer Data solely to the extent necessary to (a) provide and secure the Services, (b) comply with the Customer's instructions, and (c) comply with applicable law. This license terminates upon deletion of the data under Section 15. For clarity, MUUD claims no ownership of, and takes no perpetual or irrevocable license to, any Customer Data or any content created by students or other Authorized Users.

5.3 De-identified and aggregated data. MUUD may create de-identified and aggregated data from Customer Data, in accordance with the de-identification standards of Applicable Data Protection Laws, and may use it to develop, evaluate and improve the Services and for research on student wellbeing, provided that such data cannot reasonably be used to identify any individual or any specific Institutional Customer and that MUUD contractually prohibits re-identification. Where applicable law treats de-identified student data more strictly (for example, certain U.S. state student privacy laws), MUUD will comply with the stricter standard.

5.4 No mining for advertising. MUUD will not mine, scan or analyze Customer Data for advertising purposes or to build advertising profiles, and will not permit any third party to do so.

6. FERPA and U.S. Student Privacy (School Deployments in the United States)

6.1 School official. Where the Services are used by an educational agency or institution subject to FERPA, MUUD acts as a "school official" with a "legitimate educational interest" under 34 CFR 99.31(a)(1). MUUD (a) performs an institutional service or function for which the institution would otherwise use employees; (b) is under the direct control of the institution with respect to the use and maintenance of education records, as set out in the Order, the DPA and these Terms; (c) uses education records only for authorized purposes; and (d) does not re-disclose personal information from education records except as directed by the institution or as permitted by FERPA.

6.2 Parental rights. The institution remains responsible for responding to parents' requests to inspect and review education records under FERPA. MUUD will make Student Data available to the institution to enable it to comply.

6.3 COPPA. For students under 13 in the United States, MUUD relies on the school's authorization as permitted by the FTC's guidance on COPPA in the educational context: the school may consent on behalf of parents to the collection of students' personal information solely for the use and benefit of the school and for no commercial purpose. MUUD provides schools with the notices needed to inform parents, and parents may review, and request deletion of, their child's information through the school.

6.4 State student privacy laws. MUUD complies with applicable U.S. state student data privacy laws, including SOPIPA (Cal. Bus. & Prof. Code 22584) and student data privacy contracting statutes, and will enter into the state-required data privacy agreements where an Order so requires.

7. Accounts and Registration

7.1 You agree to provide accurate, current and complete registration information and to keep it up to date. Accounts are personal. You are responsible for maintaining the confidentiality of your credentials and for activity under your account, except where the activity results from MUUD's failure to maintain reasonable security or where mandatory law provides otherwise.

7.2 Notify us promptly at soporte@muud.app of any unauthorized use of your account. Institutional Customers are responsible for managing Authorized User provisioning and de-provisioning through the administrative tools provided.

7.3 We may reclaim or require a change to a username that is unlawful, offensive or infringes third-party rights.

8. Subscriptions, Fees and Payment

8.1 Institutional subscriptions. Fees, subscription periods, user counts, renewal and payment terms for Institutional Customers are set out in the applicable Order. Unless the Order states otherwise, fees are invoiced annually in advance, are stated exclusive of taxes, and each party bears the taxes for which it is legally responsible. VAT, withholding and similar taxes will be applied as required by the law of the invoicing jurisdiction.

8.2 Individual purchases. Where individual paid plans are offered, we accept the payment methods displayed at checkout. Purchases made through the Apple App Store or Google Play are also subject to the store's terms, including its billing and cancellation mechanisms. Prices, currency and applicable taxes are displayed before you confirm the purchase. We may change prices prospectively with prior notice; changes do not affect the current paid period.

8.3 Refunds and withdrawal rights. Except where the applicable Order provides otherwise, fees are non-refundable to the extent permitted by law. Nothing in these Terms excludes statutory withdrawal, cooling-off or refund rights that cannot be waived, including rights of consumers in the European Union and the United Kingdom (where a consumer may lose the withdrawal right for digital content only with prior express consent and acknowledgement), under Chilean Law No. 19.496, under Brazilian consumer law (CDC Art. 49), and under other applicable consumer protection laws. Purchases through app stores follow the refund policies of Apple or Google in addition to your statutory rights.

8.4 Late payment. If undisputed fees remain unpaid after written notice and a reasonable cure period of at least 15 days, MUUD may suspend the affected subscription until payment is received. MUUD will not delete Customer Data solely because of late payment before the retention periods in Section 15 have elapsed.

9. License to Use the Services; Restrictions

9.1 License. Subject to these Terms and, for Institutional Customers, the applicable Order, MUUD grants you a limited, non-exclusive, non-transferable, revocable license to access and use the Services, and to install and use the App on devices you own or control, for the intended purposes of the Services: internal educational and organizational use for Institutional Customers and Authorized Users, and personal, non-commercial use for Individual Users.

9.2 Restrictions. Except as permitted by mandatory law (including lawful reverse engineering for interoperability where such right cannot be excluded), you must not: (a) copy, modify, translate or create derivative works of the Services; (b) reverse engineer, decompile or disassemble the Services; (c) rent, lease, sell, sublicense, distribute or otherwise make the Services available to third parties outside your organization; (d) remove or alter proprietary notices; (e) use the Services to build a competing product; (f) access the Services by automated means (bots, scraping) without our written permission; or (g) circumvent security or usage limits.

9.3 App store terms. For Apps downloaded from the Apple App Store or Google Play, the applicable store terms also apply; Apple and Google are third-party beneficiaries of this Section with the right to enforce it, are not responsible for the App or its support, and your license is limited to use on devices running the applicable operating system as permitted by the store's usage rules.

10. Acceptable Use

10.1 You agree to use the Services only for their intended purposes and in compliance with applicable law. Without limiting the foregoing, you must not: use the Services to harass, bully, threaten, defame or harm any person; upload content that is unlawful, discriminatory, sexually explicit, violent or otherwise harmful, in particular content harmful to minors; impersonate any person; upload malware or interfere with the integrity or performance of the Services; attempt unauthorized access to accounts, systems or data; collect other users' personal data without authorization; send spam or unsolicited communications through the Services; or use the Services in violation of export control or sanctions laws.

10.2 Institutional Customers are responsible for communicating acceptable use rules to their Authorized Users and for addressing misconduct by their users in accordance with their own policies, in coordination with MUUD where needed.

10.3 We may investigate suspected violations and take proportionate measures, including removing content, restricting features or suspending accounts, in accordance with Section 15 and applicable law, including, where applicable, the notice and redress requirements of platform regulation.

11. User Content

11.1 Your content. "User Content" means content that users create or upload in the Services, such as journal entries, check-in responses, comments and messages. You (or, for Student Data, the student and the Institutional Customer as applicable) retain all rights in User Content. MUUD claims no ownership of User Content.

11.2 License to operate the Services. You grant MUUD a limited, non-exclusive, worldwide, royalty-free license to host, store, reproduce, transmit, display and back up User Content solely as necessary to operate, provide, secure and support the Services for you and, where applicable, your institution. This license is revocable and ends when the User Content is deleted from the Services in accordance with these Terms and the DPA, except for lawful backups pending deletion and content we must retain by law. MUUD does not acquire any perpetual or irrevocable license over User Content and does not use User Content for advertising, publication, resale or any purpose unrelated to the Services.

11.3 Journal privacy. Personal journal entries are private to the user by default. The visibility of any student content to school staff is determined by the feature design disclosed to the Customer and in the Privacy Policy (for example, wellbeing check-in results and alerts visible to designated staff), and never extends beyond what is necessary for the wellbeing purposes of the Services.

11.4 Feedback. If you voluntarily send us suggestions or feedback about the Services, you grant MUUD a non-exclusive, perpetual, irrevocable, royalty-free license to use that feedback to improve the Services, without obligation to you. Feedback does not include personal data or User Content, and this Section does not apply to content created by children.

11.5 Responsibility. You are responsible for your User Content and represent that it does not infringe third-party rights or violate applicable law. We may remove or restrict access to User Content that violates these Terms or applicable law, applying the safeguards in Section 10.3.

12. Intellectual Property

12.1 The Services, including software, source code, databases, design, text, graphics, audio, video and MUUD's trademarks and logos (excluding Customer Data and User Content), are owned by MUUD or its licensors and are protected by intellectual property laws in Chile and internationally. Except for the licenses expressly granted in these Terms, no rights are granted to you, and MUUD reserves all rights.

12.2 Copyright complaints. If you believe content on the Services infringes your copyright, notify us at soporte@muud.app with sufficient detail to identify the work, the allegedly infringing material and your contact information. We will process notices in accordance with applicable law and may remove infringing material and terminate repeat infringers.

13. Third-Party Services and Links

13.1 The Services may interoperate with third-party services enabled by you or your institution (for example, single sign-on providers). Your use of a third-party service is governed by that third party's terms and privacy policy. For Institutional Customers, MUUD will only integrate third-party services with Customer Data as permitted by the DPA.

13.2 The Services may contain links to third-party websites. MUUD does not control and is not responsible for third-party websites or content. Access them at your own discretion.

14. Wellbeing Disclaimer; Not a Medical or Emergency Service

14.1 The Services are an educational wellbeing platform. They are not, and must not be used as, a medical device, a clinical, diagnostic, psychological, psychiatric or therapeutic service, or a substitute for professional advice, diagnosis or treatment. MUUD does not provide medical or mental health care and makes no representation that use of the Services will produce any particular wellbeing outcome.

14.2 Alerts and check-in visualizations are informational tools to help trained school staff prioritize human follow-up. They are not clinical assessments, and the absence of an alert is not an indication that a student does not need support. Decisions about student support remain the responsibility of the Institutional Customer and its qualified staff.

14.3 Emergencies. The Services are not monitored in real time by MUUD and must not be used to report emergencies. If you or someone else is in danger or experiencing a crisis, contact local emergency services or a crisis line immediately.

15. Term, Suspension and Termination; Data Return and Deletion

15.1 Term. For Institutional Customers, the term is set out in the Order. For other users, these Terms apply while you use the Services.

15.2 Suspension. MUUD may suspend an account or access where reasonably necessary to (a) address a security risk or legal violation, (b) comply with law or a binding order, or (c) address material breach of these Terms that remains uncured after notice, except where prior notice is not reasonably possible. Suspension will be proportionate, limited in scope and duration, and MUUD will restore access once the cause is resolved. MUUD will not terminate or suspend arbitrarily or without cause and will state the reasons on request, subject to legal restrictions.

15.3 Termination by you. Individual Users may stop using the Services and delete their account at any time through in-product settings or by using the deletion form at https://muud.app (Legal, Delete account) or by writing to soporte@muud.app. Institutional Customers may terminate as provided in the Order.

15.4 Data return and deletion. Upon expiration or termination of an Institutional Customer's subscription, MUUD will (a) make Customer Data available for export in a commonly used, machine-readable format for at least 60 days, and (b) thereafter delete Customer Data from production systems within 90 days and from backups within the backup cycle, unless retention is required by law, in each case certifying deletion on request. During the subscription, the Customer can delete Student Data at any time using the administrative tools or by written instruction. For Individual Users, account deletion removes personal data in accordance with the Privacy Policy.

15.5 Inactive free accounts of Individual Users may be deleted after 24 months of inactivity, with at least 30 days' prior notice to the account email, consistent with data retention rules under Applicable Data Protection Laws, including the erasure-on-inactivity provisions of the India DPDP Rules where applicable. Student accounts under an institutional subscription are managed by the Institutional Customer and are not subject to automatic inactivity deletion without the Customer's instruction.

16. Warranties and Disclaimers

16.1 MUUD warrants to Institutional Customers that the Services will perform materially in accordance with the applicable documentation and that MUUD will provide the Services with reasonable skill and care and in compliance with Applicable Data Protection Laws that apply to MUUD as processor.

16.2 Except as expressly stated in these Terms or an Order, and to the maximum extent permitted by applicable law, the Services are provided "as is" and "as available", and MUUD disclaims implied warranties of merchantability, fitness for a particular purpose and non-infringement. We do not warrant uninterrupted or error-free operation.

16.3 Consumer rights preserved. If you use the Services as a consumer, you retain all warranties, guarantees and remedies granted by mandatory consumer law in your country of residence (including the legal guarantee regimes of the EU, Chile's Law No. 19.496, Brazil's CDC and equivalent laws), and nothing in this Section limits them.

17. Limitation of Liability

17.1 Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including liability for (a) willful misconduct or gross negligence, (b) death or personal injury caused by negligence, (c) fraud, and (d) any liability to consumers or data subjects that mandatory law does not permit to be limited.

17.2 Subject to Section 17.1, neither party will be liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits or revenue, arising out of or related to these Terms.

17.3 Subject to Sections 17.1 and 17.2, each party's total aggregate liability arising out of or related to these Terms will not exceed the fees paid or payable to MUUD in the 12 months preceding the event giving rise to liability. For breaches by MUUD of its confidentiality or data protection obligations under the DPA, a higher cap may be agreed in the Order, and any such cap does not limit data subjects' own statutory claims.

17.4 This Section allocates risk between MUUD and Institutional Customers and applies to Individual Users only to the extent permitted by the consumer law of their residence.

18. Indemnification

18.1 By Institutional Customers. An Institutional Customer will defend and indemnify MUUD against third-party claims arising from (a) Customer Data or the Customer's instructions violating applicable law or third-party rights, or (b) the Customer's failure to obtain legally required consents or authorizations under Section 3, except to the extent caused by MUUD's breach of these Terms or the DPA.

18.2 By MUUD. MUUD will defend and indemnify the Institutional Customer against third-party claims alleging that the Services, as provided by MUUD and used as permitted, infringe intellectual property rights, and will remedy any established infringement by procuring rights, modifying the Services or refunding prepaid unused fees.

18.3 No indemnification obligations are imposed on Individual Users, students, parents or guardians beyond their liability under applicable law.

19. Changes to the Services and to These Terms

19.1 We continuously improve the Services and may add, change or remove features, provided that during a paid subscription we will not materially degrade the core functionality contracted.

19.2 We may update these Terms. For material changes, we will give at least 30 days' prior notice by email and/or in-product notice before the changes take effect, identifying the changes. If you do not agree, you may terminate before the effective date; for prepaid subscriptions materially and adversely affected, the Customer may terminate and receive a pro-rata refund of unused prepaid fees. Continued use after the effective date constitutes acceptance only where such acceptance is valid under applicable law. Changes required by law or addressing security may take effect sooner, with notice as promptly as possible. The applicable version and its date will always be published on the Site, and prior versions are available on request.

20. Governing Law and Dispute Resolution

20.1 Institutional Customers. Unless the Order states otherwise, these Terms are governed by the laws of Chile, and the courts of Santiago, Chile have exclusive jurisdiction, except that either party may seek injunctive relief for intellectual property or confidentiality breaches in any competent court.

20.2 Consumers. If you use the Services as a consumer, you benefit from the mandatory protections of the law of your country of habitual residence, and you may bring claims before the courts of that country. MUUD may bring claims against a consumer only in the courts of the consumer's residence. Nothing in these Terms deprives consumers of access to local consumer protection authorities (for example, SERNAC in Chile, PROCON in Brazil, or EU consumer bodies and the EU Online Dispute Resolution platform where applicable).

20.3 Data protection claims. Nothing in this Section limits the right of any data subject to lodge a complaint with a supervisory authority (including any EU/EEA supervisory authority, the Spanish AEPD, Brazil's ANPD, Chile's Agencia de Proteccion de Datos Personales, or India's Data Protection Board) or to seek judicial remedies under Applicable Data Protection Laws.

20.4 Good-faith resolution. Before starting formal proceedings, the parties will attempt in good faith to resolve disputes through the contacts in Section 24 for at least 30 days, except for urgent relief.

21. Jurisdiction-Specific Terms

21.1 European Economic Area, United Kingdom and Switzerland

Processing of personal data is subject to the GDPR, the UK GDPR and the Swiss FADP, as applicable. The digital consent age is the age set by the member state of the user's residence (between 13 and 16; GDPR Art. 8). International transfers are protected as described in Section 4.6. Where required by GDPR Art. 27 or UK GDPR Art. 27, MUUD's EU and UK representatives are identified in the Privacy Policy: [INSERT EU REPRESENTATIVE] and [INSERT UK REPRESENTATIVE]. Consumers in the EU/UK retain their statutory withdrawal and digital content conformity rights.

21.2 Spain

In addition to the GDPR, the LOPDGDD applies. The digital consent age in Spain is 14 (LOPDGDD Art. 7); processing of data of children under 14 requires the consent of the holders of parental authority or guardianship, or another valid legal basis established by the school in accordance with Spanish education and data protection rules. The AEPD is the supervisory authority.

21.3 Brazil

The LGPD applies. Personal data of children and adolescents is processed in their best interest (LGPD Art. 14). For school deployments, the school as controller establishes the legal basis and, where consent is required, obtains the specific and highlighted consent of at least one parent or legal guardian; MUUD provides supporting mechanisms and information. MUUD does not condition participation in activities on the provision of data beyond what is necessary. MUUD's encarregado (data protection officer contact) for Brazil is identified in the Privacy Policy. Data subjects may petition the ANPD. Brazilian consumers retain their rights under the Consumer Defense Code, including Art. 49 withdrawal for distance purchases.

21.4 Chile

Processing is currently subject to Law No. 19.628 and, as from December 1, 2026, to Law No. 21.719, including its principles, the full set of ARCO rights plus portability, security and breach notification duties, rules for processing sensitive data and data of children and adolescents (processed in their best interest and with the consents the law requires), and the oversight of the Agencia de Proteccion de Datos Personales. Consumers retain their rights under Law No. 19.496. These Terms are intended to be read consistently with Law No. 21.719 as of its entry into force.

21.5 Other Latin American Jurisdictions

In Mexico, the Federal Law on the Protection of Personal Data Held by Private Parties applies, including ARCO rights and privacy notice requirements. In Colombia, Law 1581 of 2012 and Decree 1377 of 2013 apply, including the requirement that processing of minors' data respect their best interest and fundamental rights and the authorization regime supervised by the SIC. In Peru, Law No. 29733 and its regulations apply, supervised by the ANPD Peru. In Argentina, Law No. 25.326 applies, supervised by the AAIP. Where the Services are provided in any other jurisdiction, MUUD complies with the applicable local data protection framework, and mandatory local rules prevail over any conflicting provision of these Terms.

21.6 United States

In addition to Section 6 (FERPA and COPPA), MUUD complies with the PPRA in respect of survey-type content where applicable, and with applicable state student privacy laws, including prohibitions on targeted advertising to students, on selling student data and on non-educational profiling (for example, SOPIPA). For California consumers, applicable rights under the CCPA/CPRA are described in the Privacy Policy; MUUD does not sell or share personal information as those terms are defined by the CCPA. California users may also contact the Complaint Assistance Unit of the California Department of Consumer Affairs at 1625 North Market Blvd., Suite N 112, Sacramento, California 95834, or by telephone at (800) 952-5210.

21.7 India

The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 apply. For users in India: (a) any person under 18 is a child, and MUUD, together with the Institutional Customer, will ensure that verifiable consent of a parent or lawful guardian is obtained in the manner required by Rule 10 before processing a child's personal data, except to the extent a statutory exemption applies to processing by or for educational institutions; (b) MUUD does not undertake tracking or behavioural monitoring of children or targeted advertising directed at children; (c) notices and consent requests will meet the requirements of the Act and Rules, and consent may be withdrawn as easily as it was given; (d) personal data breaches will be notified to the Data Protection Board of India and affected Data Principals as required; and (e) MUUD's Grievance Officer for India can be contacted at [INSERT GRIEVANCE OFFICER NAME AND EMAIL], and Data Principals may escalate to the Data Protection Board of India.

22. Electronic Communications

You consent to receive communications from us electronically (email and in-product notices), and you agree that such communications satisfy any legal requirement of written form, to the extent permitted by law. You may request legally required communications on paper where the law grants that right. Electronic acceptance of these Terms and of Orders is valid in accordance with applicable electronic signature laws, including Chilean Law No. 19.799.

23. General Provisions

23.1 Entire agreement. These Terms, the Privacy Policy and, for Institutional Customers, the Order and DPA constitute the entire agreement regarding the Services and supersede prior agreements on the same subject.

23.2 Assignment. You may not assign these Terms without our prior written consent. MUUD may assign these Terms to an affiliate or in connection with a merger, acquisition or sale of assets, provided the assignee assumes all obligations, including data protection obligations, and Institutional Customers are given prior notice; in the event of a change of control, protections applicable to Student Data continue to apply or the Customer may terminate and require deletion of Customer Data.

23.3 Severability; waiver. If any provision is held unenforceable, the remainder remains in effect and the provision will be enforced to the maximum extent permissible. Failure to enforce a provision is not a waiver.

23.4 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, except for payment obligations.

23.5 Independent parties. The parties are independent contractors. These Terms create no partnership, joint venture, employment or agency relationship.

23.6 Language. These Terms are drafted in English. Where the law of your jurisdiction requires that consumer or data protection information be provided in a local language (for example, Spanish or Portuguese), the local language version published by MUUD applies, and in case of discrepancy the version most protective of the user prevails to the extent required by mandatory law; otherwise the English version controls.

23.7 Survival. Sections that by their nature should survive termination (including 4, 5, 11.4, 12, 15.4, 16 to 18, 20 and 23) survive.

24. Contact

MUUD SpA
Av. Presidente Kennedy 5600, Of. 507, Vitacura, Santiago, Chile
General support: soporte@muud.app | Tel: +56 9 2691 3974
Privacy and data protection: privacy@muud.app

© 2026 MUUD SpA. All rights reserved.