Privacy Policy

SMASH EDUCATION INC. Privacy and Personal Information Protection Policy

Document Version

Version: 2025 – v3.0 Last Updated: March 20, 2026 Effective Date: March 20, 2026 Next Scheduled Review: November 2026

Privacy Officer Name: Éliane Forget Title: Co-Founder & Privacy Officer Email: eliane.f@smasheducation.com

Scope of This Document This Policy applies to: • All users of the Smash Education platform (teachers, students, administrators, tutors, and individual users); • All associated services and features; • All jurisdictions in which Smash Education is used.

Table of Contents

1. INTRODUCTION................................................................................................................................. 2

2. DEFINITIONS ..................................................................................................................................... 2

4. INFORMATION WE COLLECT .............................................................................................................. 4

5. INFORMATION WE DO NOT COLLECT ................................................................................................. 9

6. PURPOSE OF COLLECTION ................................................................................................................. 9

7. LAWFUL BASIS & CONSENT .............................................................................................................. 10

8. DISCLOSURE TO THIRD PARTIES ....................................................................................................... 11

9. DATA HOSTING & TRANSFERS .......................................................................................................... 13

10. SECURITY MEASURES..................................................................................................................... 13

11. RETENTION & DELETION ................................................................................................................ 14

12. BREACH NOTIFICATION ................................................................................................................. 15

13. CHILDREN’S PRIVACY ..................................................................................................................... 15

14. COOKIES ....................................................................................................................................... 15

15. UPDATES TO THIS POLICY .............................................................................................................. 16

16. CONTACT ...................................................................................................................................... 16

© Smash Education Inc. — All rights reserved. 1/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

SMASH EDUCATION INC. — PRIVACY POLICY Version: 2025 – v3.0 Last Updated: March 20, 2026 Effective Date: March 20, 2026 Next Scheduled Review: November 2026

1. Introduction

Smash Éducation Inc. (“Smash Education,” “we,” “our,” or “us”) is a language-learning platform designed for schools, districts, teachers, and individual learners. We are committed to protecting the privacy and security of all users, especially students and minors.

This Privacy Policy explains how Smash Education collects, uses, stores, and safeguards information across our platform and services.

Smash Education processes personal information in accordance with the privacy laws that apply to our activities and to the educational institutions, organizations, or individuals that use our services. Our practices are aligned with the major legal frameworks relevant to our operations, including: • Québec’s Act respecting the protection of personal information in the private sector (Law 25) • Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) • Alberta Personal Information Protection Act (PIPA) • The Family Educational Rights and Privacy Act (FERPA) • The Children’s Online Privacy Protection Act (COPPA)

Depending on the jurisdiction, additional provincial, state, national, or international privacy requirements may apply. Smash Education works with its institutional partners to support, where appropriate, compliance with the obligations that apply in the regions where the platform is used.

By using Smash Education, you agree to the practices described in this Privacy Policy.

If any provision of this Privacy Policy conflicts with the Terms of Service, this Privacy Policy prevails for all matters involving personal information.

2. Definitions

Personal Identifiable Information (PII) Information that directly identifies an individual (e.g., full name, email address).

Personal Information (PI) Any information relating to an identifiable individual, including PII, Educational Data, and technical information.

© Smash Education Inc. — All rights reserved. 2/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

Non-PII Information that cannot identify a person by itself (e.g., initials, anonymized usage data).

Educational Data Progress, activities, scores, oral recordings, feedback, messaging, and other learning-related information created inside the platform.

Aggregated Data Data combined or anonymized so individuals cannot be identified.

User Any student, teacher, administrator, tutor, parent/legal guardian, or individual accessing Smash Education.

Individual User / Individual Account Any adult purchasing Smash Education for themselves or their child.

Minor / Child A User under 18 or under the age of majority in their jurisdiction.

Parent / Legal Guardian An adult legally responsible for a Minor User.

Educational Institution Any organization responsible for students and authorized to manage accounts on Smash, including: • public or private schools, districts, boards • ISDs, USDs, LEAs (U.S.) • centres de services scolaires, commissions scolaires (Québec) • conseils scolaires (Ontario & other provinces) • home education programs • international educational institutions and equivalent authorities

Administrator Account A designated staff member of an Educational Institution who manages teacher and student accounts.

Teacher Account An account used by a teacher, independent tutor, or any educator providing instructional services. This account may be created with an institutional email address (for users associated with an educational institution) or with a personal email address or one provided by an external employer (for tutors and independent educators).

Student Account An account used by a learner (student). This may include a student associated with an educational institution (school or institutional account) or a user linked to an individual account managed by a parent or guardian. The student account provides access to instructional activities and progress-tracking tools, in accordance with this Policy.

© Smash Education Inc. — All rights reserved. 3/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

Service Providers Third-party companies performing operational services (e.g., hosting, SSO, payment processing).

SSO (Single Sign-On) Google, Microsoft, or Apple login authentication.

3. Privacy Officer

Privacy Officer: Name: Eliane Forget Title: Co-Founder & Privacy Officer Email: eliane.f@smasheducation.com

The privacy officer oversees privacy compliance, responds to access or correction requests, manages incident reporting, and ensures alignment with applicable privacy laws.

4. Information We Collect

We limit data collection to what is necessary for educational delivery and platform operation.

4.1 Information Provided by Educational Institutions

STUDENT ACCOUNTS

Educational institutions choose the identifiers they wish to enter. Accepted formats include: • Student number • First name + initial • Initials only • Full name (optional; not required)

Student email addresses are not required.

TEACHER ACCOUNTS

Teachers must register with a professional email address issued by their educational institution to: • confirm affiliation with the correct educational institution board • receive technical support • receive system notifications • assist with account recovery • maintain platform security

This applies only to professional users and is compliant with privacy requirements.

© Smash Education Inc. — All rights reserved. 4/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

Separation of Private Tutoring and External Employment Activities Teachers offering private tutoring or working for another employer may not add those students to a Smash account created using a school-issued institutional email address.

• An account created with an institutional email may contain only students belonging to that institution. • Students tutored privately or taught for an external employer must be added to a separate account created using a personal or external-employer email address.

Institutional email addresses must never be used for private tutoring or external employment activities.

ADMINISTRATORS ACCOUNTS

Administrators must use a their institutional email address to: • manage licensing and onboarding • support administratively assigned classes • facilitate renewals • receive data and incident notifications • support compliance and reporting

4.2 Automatically Collected Information

Smash Education collects certain technical information necessary for the operation and security of the platform, including: • Login identifiers; • Usage and progression data; • Activity tracking within the platform; • Device and browser type; • Functional session cookies.

Technical logs generated by our hosting providers may include IP addresses. This information is used exclusively for security, diagnostics, and abuse-prevention purposes, and is never used for advertising or to create individual profiles.

Country-level information for public website pricing

On our public website, we temporarily use the country code available from our existing hosting/CDN provider to select regional institutional prices. Canada sees Canadian pricing in CAD; the United States sees US pricing in USD; other countries or unavailable detection receive international pricing or a pricing enquiry. Individuals & Families subscriptions remain priced in CAD.

This pricing feature uses the country code only during the request. It does not save your country or IP address, create location profiles or analytics events, use location cookies or browser storage, request device location permission, or access precise location. Detected country information is not sent to enquiries, customer accounts, the login page or the learning portal.

Our hosting provider processes network information, including IP addresses, to deliver requests and may retain existing technical or security logs under its own practices. The pricing feature does not disable those provider processes; the exact retention settings for this hosted environment have not been verified. The applicable purchasing market is confirmed separately using ordinary billing or organisation information.

4.3 Single Sign-On (SSO)

When users sign in with Google, Microsoft, or Apple, Smash Education receives only: • First name • First initial of last name • Email address • Authentication identifier

© Smash Education Inc. — All rights reserved. 5/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

A Smash Education username is autogenerated. No additional profile data is accessed or retained.

4.4 Individual Accounts

ADULT ACCOUNTS (18+)

We collect only information required to create the account and produce a legally compliant invoice: • Email address • Full name • Billing location information: o Province (for Canadian tax purposes) o Country (for international users) o Full billing address only if required by the payment processor

Smash Education does not request any other personal information directly from the user beyond what is necessary for account creation and billing. The technical browsing and usage data described in Section 4.2 may also be collected automatically during use of the platform.

ACCOUNTS FOR MINORS

When the user is a minor, the parent or legal guardian must request the creation of the account.

We collect the following information: • The full name of the parent/legal guardian • The parent/guardian’s email address and billing address (used solely for billing purposes) • The student’s educational institution grade or approximate language level, as provided by the parent/guardian This information is used only to allow our language-support specialists to assign the most appropriate content within the platform.

We do not request or collect the following information: • Date of birth • Home address • The child’s last name • Phone number • Demographic or sensitive information

Billing information always belongs to the paying adult and is never associated with the minor’s account.

Although we do not request this information, parents or legal guardians may voluntarily provide additional details by phone, by email, or during the account-creation process. In such cases, this information is used solely according to the explicit instructions of the parent or legal guardian(for example, displaying the child’s full name on the account).

© Smash Education Inc. — All rights reserved. 6/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

Smash Education does not require this information, does not request it, and does not use it for any purpose other than what has been requested by the parent/guardian. Parents fully determine which identifying or non-identifying information they choose to provide.

4.5 Features (Profile Photos, Voice Recordings, Messaging, Support Tickets) PROFILE PHOTOS AND AVATARS

Smash Education allows optional profile images to help teachers recognize students within their classes.

Students may upload a profile photo from their account; however: • all student photos are visible to and monitored by the teacher • identifiable photos are optional and subject to the educational institution’s own policies • teachers and educational institutions may remove or replace any image at any time • non-identifiable avatars or icons may be used instead • Smash Education does not require or enforce the use of photos

Smash Education does not use profile photos for facial recognition, analytics, advertising, or AI model training.

VOICE RECORDINGS (ORAL FLUENCY ACTIVITIES)

Students may record their voice as part of language-learning exercises. These recordings: • are used only for pedagogical and assessment purposes • are visible only to the student’s teacher and educational institution • are not accessible to other students • are never used for AI training or external analysis • are not shared with third parties • are permanently deleted each August along with the student account

TEACHER–STUDENT MESSAGING

Smash Education includes a secure messaging feature for instructional communication between teachers and students.

All messages: • are visible to the teacher • are stored securely • are deleted annually with student accounts • are used strictly for educational support

Messaging can be enabled or disabled according to teacher or educational institution preferences.

There is no student-to-student messaging, no student group chats, and no private chat rooms. Smash Education does not offer live audio or video calling.

SUPPORT TICKETS © Smash Education Inc. — All rights reserved. 7/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

Students and teachers may submit support tickets within the platform. • Teachers always have visibility into student-submitted tickets. • Smash Education agents reply only for technical assistance. • Communication follows the same protections and deletion timelines as platform messaging.

LIVE CHAT (PUBLIC WEBSITE AND TEACHER PORTAL)

Public Website Live Chat

A live chat widget is available on the Smash Education public homepage for general inquiries. This chat: • does not require visitors to provide personal information • may be used anonymously • is intended for adults seeking information or assistance • is used strictly for customer support • does not collect or store personal information from minors

Although personal details are not requested, visitors should avoid sharing sensitive or identifying information in this public-facing channel.

If an adult requests a quote, demo, or follow-up, the support agent may request an email address or phone number only when voluntarily provided by the adult user.

Smash Education staff are trained to end the conversation immediately if they believe they are interacting with a minor.

Teacher Portal Live Chat

The teacher portal includes a separate live chat feature accessible only to authenticated teacher or administrator accounts. This chat: • provides technical support to educators • is visible only to authorized Smash Education support staff • is not accessible to students • is not used for marketing or advertising

No student has access to this support channel.

4.6 Teacher & Tutor Uploaded Materials

Teachers and tutors may upload or enter instructional materials such as lesson notes, prompts, assignments, explanations, or other pedagogical content. Smash Education: • processes these materials solely to deliver the Services • does not claim ownership over uploaded materials • does not use educator-uploaded materials for AI training, advertising, or redistribution • does not share educator-uploaded materials with third parties • does not review or monitor these materials for copyright compliance © Smash Education Inc. — All rights reserved. 8/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

5. Information We Do NOT Collect

Smash Education does not request or collect the following information: • The student’s full last name (unless the educational institution chooses to enter it) • Date of birth • Home address • Phone number • Demographic information • Sensitive information • Behavioral profiles • Medical or health-related information

Although we do not request this information, educational institution, parents or legal guardians may voluntarily provide additional details by phone or by email.

When this occurs: • This information is not used, • It is not added to the student’s account, • It is not used for any other purpose, unless the educational institution, parent or legal guardian explicitly asks for a specific piece of information to be displayed in the account (e.g., displaying the child’s full name).

Educational institution, parents or legal guardians determine entirely which identifying or non-identifying information they choose to provide.

6. Purpose of Collection

Information is collected strictly to support the following purposes: • creating and managing user accounts; • delivering language-learning activities; • generating progression reports for teachers and school districts; • ensuring the performance, operation, and security of the platform; • providing technical support and troubleshooting; • improving the platform using anonymized data.

No data is used for advertising, profiling, or behavioral targeting.

© Smash Education Inc. — All rights reserved. 9/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

7. Lawful Basis & Consent

7.1 Educational Institution Accounts Educational Institutions act as authorized agents for their students. They are responsible for: • creating teacher and student accounts; • authorizing access to the platform; • making decisions regarding access, correction, or deletion of personal information.

In the United States, this includes the school consent model required under COPPA.

IMPLIED INSTITUTIONAL CONSENT

By creating or using a teacher, administrator, or student account (including demo or trial accounts), by distributing class codes, or by using the platform in any manner, the institution confirms that: • It accepts the Terms of Service and the Privacy Policy; • It authorizes teachers and students to use the platform; • It assumes responsibility for obtaining parental consent when required.

In jurisdictions where applicable, educational institutions also act as authorized representatives of parents/legal guardians (e.g., under FERPA and COPPA in the United States).

For other jurisdictions, Smash Education relies on institutional authorization as a sufficient legal basis for processing student information.

PARENT/GUARDIAN REQUESTS

Parents or legal guardians may request access or correction through the child’s educational institution.

Requests for deletion must also be routed through the teacher or school administration. Smash Education deletes a student account only after confirmation from the institution, in order to protect educational records.

ADULT USERS (Staff of an Educational Institution) • Teachers may request the deletion of their own accounts either by contacting Smash Education directly or through their educational institution’s administrator. Once deletion has been requested and confirmed, Smash Education is not responsible for any loss of data resulting from the removal of the account.

• Institutional Administrators may request deletion on behalf of their personnel by contacting their assigned Smash Education representative or consultant.

7.2 Independent Tutors & Private Instruction

Tutors must use a separate teacher account created with a personal email address or with an email address provided by their external employer. © Smash Education Inc. — All rights reserved. 10/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

Smash Education does not conduct verification or vetting of tutors or tutoring organizations. Parents and legal guardians remain fully responsible for selecting, authorizing, and supervising any tutoring services they choose to use.

7.3 Individual Accounts

ADULT USERS

Consent is provided when the adult requests an account, receives login credentials, or accesses the platform.

MINORS USERS

For minors, only the parent or legal legal guardian may request the creation of an account and will receive all billing and access information.

By submitting this request, the parent or legal guardian provides implied consent for the child’s use of the platform.

Parents and legal guardians may request access, correction, or deletion of their child’s information directly from Smash Education.

8. Disclosure to Third Parties

Smash Education does not: • sell data; • share data with advertisers; • use tracking cookies; • transfer educational data to third parties unrelated to platform operations.

Disclosure is strictly limited to essential service providers necessary for the operation, hosting, security, technical support, or performance analysis of the platform.

These service providers: • act solely as agents (“service providers”); • may access personal information only as needed to fulfill their mandate; • must implement industry-standard security measures; • may not sell, share, or use data for advertising or marketing; • must comply with applicable privacy laws.

Smash Education does not sell, rent, or share personal information for commercial or advertising purposes.

© Smash Education Inc. — All rights reserved. 11/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

8.1 Payment Processing and Refunds Payments are processed through QuickBooks Online using secure API connections. Smash Education does not access or store the following information: • Full card number • Expiration date • CVV code • Billing addresses • Postal / ZIP codes

Smash Education can only view: • The last four digits of the card • The card type • The cardholder’s name

PAYMENTS MADE BY USERS (ADULTS ONLY)

When an educational institution indicates that a student is responsible for paying a license fee, an invoice may appear inside the user portal associated with the account.

Smash Education does not collect age or date of birth and therefore cannot determine whether a user is a minor or an adult.

Payments must be made only by an authorized adult (parent, legal guardian, or another designated payer).

If a minor views or accesses an invoice displayed in the portal, Smash Education does not interpret this as authorization or an invitation for the minor to make a payment.

Smash Education relies on the representations of the educational institution and the parent/legal guardian regarding the identity and capacity of the individual initiating the payment.

Responsibility for ensuring that the payment is made by an adult lies entirely with the institution, the parent, or the legal guardian.

REFUNDS

Approved refunds are issued: • either to the original payment method (adults provide their card details at the time of refund; this information is not retained), • or by cheque (the mailing address is requested solely for this purpose).

Refunds are issued only to the adult payer (18+).

When a payment originates from a portal labeled “student,” Smash Education presumes that the payer is an authorized adult.

© Smash Education Inc. — All rights reserved. 12/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

8.2 Hosting and Infrastructure Providers

Smash Education’s hosting and infrastructure providers operate exclusively as essential service providers, in accordance with platform requirements and this Privacy Policy.

No data is shared with any provider for advertising purposes.

9. Data Hosting & Transfers

Smash Education’s platform infrastructure is hosted on servers located in Canada.

Personal data is stored and processed within Canada. Smash Education does not transfer personal data outside of Canada except where necessary for limited operational or technical purposes.

Appropriate technical and organizational safeguards are in place to protect personal data.

Smash Education may use third-party service providers to support the operation of the platform. These providers are required to handle personal data in accordance with applicable data protection obligations.

10. Security Measures

Smash Education implements administrative, technical, and physical security measures designed to protect personal information against loss, theft, unauthorized access, disclosure, alteration, or destruction.

Measures in place include, among others: • Encryption of data in transit and at rest; • Role-based access controls; • Continuous system monitoring; • Secure authentication procedures; • Periodic backup copies; • Internal security testing and assessments.

No security measure provides absolute protection.

Smash Education applies reasonable security practices consistent with industry standards to reduce risks to the extent possible.

© Smash Education Inc. — All rights reserved. 13/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

11. Retention & Deletion

Smash Education retains personal information only for the duration necessary to provide services, operate the platform, and meet applicable legal obligations.

SCHOOL AND INSTITUTIONAL ACCOUNTS

Educational institutions determine the retention period for the school and institutional accounts they create (teacher accounts, student accounts, and administrator accounts).

Each August, as part of our operational practices, Smash Education deletes student accounts associated with an educational institution unless the institution has expressly requested that they remain active.

Student accounts may also be deleted directly by teachers or administrators through their portal, in accordance with the permissions established by the institution.

Teacher and administrator accounts are deleted in accordance with the procedures described in Section 7.

CONTENT UPLOADED BY TEACHERS AND TUTORS

Content associated with a student account is deleted when the student account is deleted. Content stored in an active teacher or tutor account remains available as long as the account remains active.

Teachers and tutors may delete their own content at any time.

An educational institution may request the deletion of content it manages, provided this does not conflict with its obligations regarding educational records.

Smash Education does not retain teacher or tutor instructional materials beyond the periods described above.

INDIVIDUAL ACCOUNTS

For users who create a personal account, information is retained until the user requests deletion of their account.

AGGREGATED AND ANONYMIZED DATA

Smash Education may retain aggregated or anonymized data for analysis, platform improvement, and statistical reporting.

These data do not identify any individual.

© Smash Education Inc. — All rights reserved. 14/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

DATA DELETION

When an account is deleted, Smash Education deletes or anonymizes the associated personal information in accordance with our operational practices and legal requirements.

Some data may temporarily remain in backup copies before being permanently deleted.

12. Breach Notification

In the event of a privacy incident involving personal information, Smash Education will: • notify the affected educational institution or district promptly and without unreasonable delay • notify: - Quebec’s Commission d’accès à l’information (CAI), when legally required - Alberta’s Office of the Information and Privacy Commissioner (OIPC), when legally required

Because Smash Education does not collect student email addresses, educational institutions are responsible for communicating incidents to parents or guardians.

Smash Education maintains a mandatory confidentiality incident register in accordance with Law 25, available for inspection by the Commission d’accès à l’information upon request.

13. Children’s Privacy

Smash Education minimizes the collection of personal information about students. • No personally identifiable information is required to create a student account. • No targeted advertising, tracking, or analytical cookies are used in student sessions. • Student accounts linked to an educational institution are created and managed under the authority of that institution, in accordance with the education-consent model inspired by COPPA. • The institution is responsible for obtaining any required parental authorizations and for supervising the child’s use of the platform.

14. Cookies

Smash Education uses only functional cookies necessary for: • maintaining user sessions; • enabling secure authentication processes; • supporting proper navigation and platform operation.

No advertising, behavioral, or third-party analytical cookies are used.

© Smash Education Inc. — All rights reserved. 15/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026

15. Updates to This Policy

This Privacy Policy is reviewed annually in November and updated as needed to reflect legal requirements, platform features, or operational practices.

Significant changes are communicated to the relevant Educational Institutions and institutional partners. Previous revisions were conducted annually in November.

Earlier versions reflected the same operational practices, but in 2025 the Policy was clarified and expanded to improve transparency and align with evolving legal standards — including Quebec’s Law 25 — as well as the compliance expectations of Educational Institutions.

16. Contact

For any questions related to the protection of personal information or for any request covered by this Policy, you may contact:

Privacy Officer Éliane Forget Email: eliane.f@smasheducation.com

---------------------------------- End of Document----------------------------------

© Smash Education Inc. — All rights reserved. 16/16 Privacy Policy — Version: 2025 – v3.0

Last updated: March 20, 2026