1. Introduction and Who We Are

Gameful ("Gameful," "we," "us," or "our") operates an educational technology platform that lets teachers turn their classrooms into game-like learning experiences. Our platform is available at gameful.me and on teacher-managed subdomains.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights regarding it. We wrote this policy in plain language so that students, parents, teachers, and school administrators can all understand it.

If you have questions or concerns, contact us at:

• Email: privacy@gameful.me
• Mailing address: Gameful, [Address on file]

2. Who This Policy Covers

This policy applies to:

• Students — learners who access a classroom on the Gameful platform.
• Teachers and school administrators — educators who create and manage Gameful classrooms and hold subscriptions.
• Visitors — anyone who browses the public Gameful website (gameful.me).

If you are a school or district entering into a data-processing agreement with us, that agreement governs where it conflicts with this policy.

3. Information We Collect

4. How We Use Your Information

We use personal information only for the purposes described below. We do not sell personal information. We do not use student data for advertising or behavioral profiling.

5. Third-Party Services That Process Your Data

We work with the following third-party services. Each one has agreed to handle personal data in accordance with applicable law. Where a Data Processing Agreement (DPA) exists, we have linked to it in the sub-processor table in Section 9.

6. Children Under 13 — COPPA

Gameful is an educational platform and may be used by students under the age of 13. We take this seriously and have built our data practices around the requirements of the Children's Online Privacy Protection Act (COPPA).

How We Handle Student Consent

Gameful operates under the school official exception to COPPA. This means:

• Schools and teachers — not Gameful directly — obtain parental consent before enrolling students under 13.
• By enrolling a student under 13, a teacher certifies that the school has obtained the institutional or parental consent required by COPPA and applicable state law.
• Teachers who add a school domain to the auto-enrollment allowlist confirm they are authorized to enroll students from that domain.

What We Collect from Students Under 13

We collect only the minimum information needed to operate the educational features of the platform: display name, email address, Google account ID, and classroom activity data. We do not collect more information from children than is reasonably necessary for educational use.

What We Never Do with Student Data

• We never serve behavioral advertising to students of any age.
• We never sell student data.
• We never build advertising profiles based on student activity.
• We never disclose student data to third parties except as described in this policy (operating the platform, processing payments for teacher accounts, delivering transactional email).

Parental Rights

If your child is under 13 and uses Gameful through school, you have the right to:

• Review the personal information we have collected about your child.
• Correct inaccurate information about your child.
• Request deletion of your child's personal information.
• Refuse further collection or use of your child's information.

To exercise these rights, contact the teacher or school administrator who manages your child's classroom, or contact us directly at privacy@gameful.me. We will respond within 30 days.

Please note: if we delete a student's account data, the student will no longer be able to access the classroom or their progress history.

7. School Records and FERPA

Student records created on the Gameful platform — including assignment completions, grades, and activity data generated within a school's classroom — may be education records protected by the Family Educational Rights and Privacy Act (FERPA).

Who Controls Student Education Records

The school or teacher who creates and manages a Gameful classroom is the data controller for student education records in that classroom. Gameful acts as a school official under FERPA, meaning we access and process student education records only to provide the educational services the school has contracted for — not for any independent commercial purpose.

Your FERPA Rights

Eligible students (18 or older, or at the postsecondary level) and parents of students under 18 have the right under FERPA to:

• Inspect and review education records maintained by the school.
• Request amendment of records believed to be inaccurate.
• Consent to disclosures of personally identifiable information (with exceptions, such as disclosures to school officials with legitimate educational interest).
• File a complaint with the U.S. Department of Education regarding alleged failures to comply with FERPA.

To exercise FERPA rights, contact the school or teacher who manages your classroom. You may also contact us at privacy@gameful.me and we will direct your request to the appropriate party.

8. European Users — GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or equivalent laws apply to our processing of your personal data.

Lawful Basis for Processing

Your Data Subject Rights

Under the GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data ("right to be forgotten"), subject to legal retention requirements.
• Restriction — ask us to pause processing of your data in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing (we do not conduct direct marketing).
• Withdraw consent — where processing is based on consent (e.g., analytics cookies), you may withdraw consent at any time via our consent banner without affecting the lawfulness of prior processing.

To exercise these rights, email privacy@gameful.me. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

International Transfers

Our servers and most sub-processors are located in the United States. Transfers of personal data from the EEA to the United States are covered by Standard Contractual Clauses (SCCs) incorporated in our sub-processor agreements, or by the EU–U.S. Data Privacy Framework where applicable. See Section 9 for DPA links.

9. Sub-Processor List

The following companies process personal data on our behalf. We have a Data Processing Agreement (DPA) or equivalent with each — linked below.

The following administrative-tool vendors receive only site-level technical data (site URL, plugin version, license key). They do not receive student or teacher personal data and are not formal sub-processors under our privacy obligations; however, we list them for transparency:

• WPDeveloper (BetterDocs) — license verification; site URL and license key only. ⚠ No DPA available
• Cozmoslabs (Paid Member Subscriptions) — optional opt-in usage telemetry; site URL, member count, WP/PHP version. ⚠ No DPA available
• WP Mail SMTP — optional usage telemetry; site URL, email send counts. ⚠ No DPA available

10. How We Share Information

We share personal information only in the following circumstances:

• With sub-processors — as listed in Section 9, to operate and deliver the platform.
• With the student's teacher and school — teachers and school administrators can see the data of students enrolled in their classroom.
• With Gameful platform administrators — for support, security, and platform operation.
• When required by law — if we receive a valid legal process (subpoena, court order, or government demand), we will notify affected users to the extent permitted and share only what is legally required.
• In a business transfer — if Gameful is acquired, merged, or sells substantially all of its assets, we will notify users before personal data is transferred and before it becomes subject to a materially different privacy policy.

We do not sell personal information. We do not share data for advertising purposes.

11. How Long We Keep Your Data

• Student accounts: data is retained for as long as the account exists. When an account is deleted, associated personal data is removed from active systems.
• Teacher accounts: account data is retained

Gameful Terms of Service

Effective date: June 11, 2026

These Terms of Service ("Terms") are a legal agreement between you and Gameful ("Gameful," "we," "us," or "our"). By creating an account or using the Gameful platform at gameful.me or any subdomain (together, the "Platform"), you agree to these Terms. If you do not agree, do not use the Platform.

If you are a teacher, school administrator, or other institutional user, you are also agreeing on behalf of your school or institution. If you are a student user, your teacher or school has agreed to these Terms on your behalf.

1. Definitions

• "Platform" means the Gameful website, web application, subdomains, APIs, and any related services.
• "Teacher" means any adult educator, instructor, or school administrator who creates or manages a Gameful classroom.
• "Student" means a learner enrolled in a Teacher's classroom on the Platform.
• "School" means the educational institution that employs or authorizes a Teacher to use the Platform with students.
• "Subscriber" means a Teacher or School that holds an active paid subscription plan.
• "Content" means any text, images, files, game configurations, assignments, badges, or other material uploaded to or created on the Platform.
• "Student Data" means any personal information collected from or about a Student through the Platform, including gamification records, task completions, and activity events.

2. Who May Use the Platform

2.1 Teachers and School Administrators

To create a Teacher account, you must be at least 18 years old and either an authorized educator or a school administrator. By registering, you represent that you have the authority to bind your school or institution to these Terms where applicable.

2.2 Students

Student accounts are created by Teachers. Students do not independently agree to these Terms — the Teacher or School agrees on the Student's behalf. Teachers are responsible for ensuring that Student enrollment and use of the Platform is permitted under applicable laws and school policies.

2.3 Children Under 13 (COPPA)

The Platform may be used by children under 13 only through the school official exception under the Children's Online Privacy Protection Act (COPPA). This means:

• Teachers and Schools must obtain verifiable parental consent — or rely on existing institutional consent mechanisms — before enrolling any student under 13 in the Platform.
• By enrolling a student under 13, the Teacher certifies that appropriate parental consent has been obtained and is on file with the school.
• Gameful does not independently verify the age of students. That responsibility rests with the Teacher and School.
• Gameful does not engage in behavioral advertising directed at any student, including students under 13. Student Data is never used for advertising or behavioral profiling.
• Parents or guardians of students under 13 may contact us at privacy@gameful.me to review, correct, or request deletion of their child's data. We will work with the school to fulfill such requests.

2.4 Google Sign-In

The primary way to sign into the Platform is Google OAuth 2.0 ("Sign in with Google"). You may also use password-based login as a fallback. By signing in with Google, you authorize Gameful to receive your email address, display name, and Google account ID from Google. Teachers who use the Google Drive integration also grant Gameful limited Drive access (file creation and retrieval) for classroom file tasks.

3. Teacher and School Responsibilities

3.1 You Are the Data Controller for Your Classroom

Under FERPA and applicable privacy laws, the School is the data controller for Student Data within its classrooms. Gameful acts as a data processor — and as a "school official" under FERPA — processing Student Data only as directed by and on behalf of the School. Teachers and Schools retain control over what Student Data is collected and how classrooms are configured.

3.2 Parental Consent

Before enrolling any student, especially a student under 13, the Teacher or School is solely responsible for:

• Providing required notices to parents or guardians about the use of the Platform.
• Obtaining and maintaining records of any parental consent required by COPPA, FERPA, state law, or school policy.
• Ensuring that consent covers the specific data practices described in Gameful's Privacy Policy.

Gameful relies on Teachers and Schools to fulfill these obligations. Gameful will not independently contact parents to obtain consent on the Teacher's behalf unless specifically requested and agreed upon in writing.

3.3 Domain Allowlist and Auto-Enrollment

Teachers may configure a school email domain to allow automatic student enrollment. By adding a domain to the allowlist, the Teacher represents that:

• They are authorized by their school to enroll students from that domain.
• Required parental consents for students in that domain are in place.
• The domain is an official school domain and not a personal or public email provider.

3.4 Appropriate Use with Students

Teachers are responsible for supervising student use of the Platform in their classrooms. You agree to:

• Use the Platform only for lawful educational purposes.
• Not share your Teacher login credentials with students or unauthorized individuals.
• Promptly remove student accounts when a student leaves your class or school, or when a parent requests deletion.
• Configure game content and assignments in a manner appropriate for the age of your students.

3.5 Google Drive File Submissions

When Teachers assign Google Drive file tasks, students may submit work using the Google Drive file picker. Gameful stores only the file ID and file name as a reference — the file itself remains in the student's own Google Drive. Teachers are responsible for ensuring they have the appropriate permissions to view submitted student files within Google Drive.

4. Accounts and Security

4.1 Account Accuracy

You agree to provide accurate, current, and complete information when creating an account and to keep that information up to date. Gameful is not liable for problems caused by inaccurate account information.

4.2 Account Security

You are responsible for keeping your login credentials confidential. You agree to notify us immediately at privacy@gameful.me if you suspect unauthorized access to your account. Gameful is not liable for losses caused by unauthorized account access that results from your failure to protect your credentials.

4.3 One Account Per Person

Each Teacher account is for a single individual. Sharing a Teacher account among multiple instructors is not permitted. If your school needs multiple Teacher accounts, each instructor must register separately or contact us about a school subscription.

4.4 Administrative Access

Gameful platform administrators may access Teacher and Student accounts for support, security, and platform maintenance purposes. This access is logged. Impersonation sessions are recorded as required for security and compliance.

5. Subscriptions and Billing

5.1 Subscription Plans

Access to full Platform features requires a paid subscription. Subscription plans, pricing, and feature inclusions are described on the Gameful pricing page at gameful.me. We reserve the right to change pricing at any time, with reasonable notice provided to existing Subscribers before any price change takes effect.

5.2 Billing Cycle and Automatic Renewal

Subscriptions are billed on a recurring basis (monthly or annually, depending on your selected plan). Your subscription will automatically renew at the end of each billing period unless you cancel before the renewal date. By subscribing, you authorize Gameful and its payment processors to charge your payment method on each renewal date.

5.3 Payment Processing

Payments are processed by Stripe or PayPal, depending on your selected checkout method. Gameful does not store your full card number. When you pay by card, Stripe.js tokenizes your card data directly in your browser before it reaches our servers — raw card numbers never touch the Gameful platform. Payment records stored on our servers include: billing name, billing address, card type, last four digits of your card, transaction ID, amount, currency, subscription status, and the IP address at the time of payment (used for fraud prevention purposes).

5.4 Free Trials and Promotional Plans

Gameful may offer free trials or promotional pricing from time to time. Unless stated otherwise, a free trial automatically converts to a paid subscription at the end of the trial period. You may cancel before the trial ends to avoid being charged.

5.5 Cancellation

You may cancel your subscription at any time through your account settings or by contacting support@gameful.me. Cancellation takes effect at the end of the current billing period. You will retain access to paid features through that date. We do not offer prorated refunds for partial billing periods unless required by applicable law.

5.6 Failed Payments

If a payment fails, we will notify you by email and attempt to collect payment again. If payment cannot be collected after reasonable attempts, your subscription may be downgraded or suspended until payment is resolved.

5.7 Taxes

Subscription prices do not include taxes unless stated otherwise. You are responsible for any applicable sales tax, VAT, or other taxes that may apply to your purchase based on your location.

5.8 Refunds

Except as required by law, all subscription fees are non-refundable. If you believe you were charged in error, please contact us at support@gameful.me within 30 days of the charge and we will review your request.

6. Acceptable Use

6.1 Permitted Use

The Platform is designed for educational use. You may use it to create and manage gamified classrooms, assign educational tasks, track student progress, and engage students through game mechanics such as XP, badges, and leaderboards.

6.2 Prohibited Conduct

You agree NOT to:

• Use the Platform for any illegal purpose or in violation of any applicable law or regulation.
• Upload or share content that is obscene, harassing, hateful, defamatory, or otherwise harmful.
• Upload content that infringes on the intellectual property rights of others.
• Attempt to gain unauthorized access to any other user's account, data, or the Platform's systems.
• Use automated scripts, bots, or scrapers to access the Platform without written permission.
• Interfere with or disrupt the Platform's infrastructure, servers, or networks.
• Reverse engineer, decompile, or attempt to extract the source code of the Platform.
• Resell or sublicense access to the Platform without Gameful's prior written consent.
• Use the Platform to send spam, unsolicited communications, or bulk marketing messages.
• Use Student Data for any purpose other than the educational purpose for which it was collected.
• Engage in any form of behavioral advertising or profiling directed at students.

6.3 Content Standards

All content you upload to the Platform — including game assets, assignment descriptions, badges, and announcements — must be appropriate for the age group of your students. Gameful reserves the right to remove content that violates these Terms or that we determine, in our sole discretion, is harmful or inappropriate.

6.4 AI-Powered Features

The Platform includes AI-powered features (such as the game setup wizard) powered by Anthropic (Claude) and OpenAI. These features are available to Teachers and administrators only — not to students. You agree not to submit any student personal information, confidential school records, or sensitive personal data through AI-powered input fields. Inputs you provide to AI features may be sent to Anthropic or OpenAI as described in our Privacy Policy.

6.5 Google Drive Integration

Teachers who enable the Google Drive integration grant Gameful limited access to their Google Drive for classroom file management. You are responsible for ensuring that your use of the Drive integration complies with your school's Google Workspace policies and with Google's terms of service.

6.6 Enforcement

We reserve the right to investigate suspected violations of these Terms. We may suspend or terminate accounts, remove content, or take other action we deem necessary to protect the Platform, our users, and third parties. We are not obligated to monitor the Platform for violations but may do so.

7. Content Ownership and Licenses

7.1 Your Content

You retain ownership of all content you create and upload to the Platform, including classroom configurations, assignments, and game assets. By uploading content, you grant Gameful a limited, non-exclusive, royalty-free license to store, display, and process that content solely for the purpose of operating and improving the Platform for you and your students.

7.2 Student Data

Student Data is owned by the student and their family (and, for FERPA purposes, controlled by the School). Gameful does not claim ownership of Student Data. We use Student Data only to operate the Platform on behalf of the School and Teacher, and for no other purpose.

7.3 Gameful Platform

The Gameful Platform — including its software, game engine, design, branding, and documentation — is owned by Gameful and protected by copyright and other intellectual property laws. These Terms do not transfer any ownership rights in the Platform to you. You receive only a limited, non-transferable license to use the Platform as permitted by these Terms.

7.4 Feedback

If you submit suggestions, ideas, or other feedback about the Platform, you grant Gameful the right to use that feedback without restriction or compensation to you.

8. Privacy and Student Data

Our Privacy Policy explains in detail what data we collect, how we use it, and your rights. Key points relevant to these Terms:

• Student Data is used only to operate the Platform for the Teacher's classroom.
• We do not sell Student Data to any third party.
• We do not use Student Data for advertising or behavioral profiling.
• Gameful acts as a school official under FERPA, meaning Student Data is treated as an education record controlled by the School.
• Media files are stored on Amazon Web Services (AWS) S3. Transactional emails (such as registration and payment confirmations) are sent through Amazon SES.
• Google Custom Search results may be embedded on student-facing pages. When those pages load, the student's browser sends the search query and standard browser data (IP address, user-agent) to Google. Search queries on these pages are set by the teacher or admin — students do not enter custom queries.
• Google Analytics runs on the gameful.me homepage only. It does not run on student subdomains and does not fire for logged-in students.

9. FERPA

The Family Educational Rights and Privacy Act (FERPA) gives families rights over their children's education records. When Gameful processes Student Data on behalf of a school, it does so as a "school official" with a "legitimate educational interest," as those terms are used in FERPA.

• The School remains the data controller and retains FERPA obligations toward students and parents.
• Gameful processes Student Data only as directed by the School and Teacher.
• Schools or parents seeking to exercise FERPA rights (review, correction, or deletion of education records) should contact the Teacher or school administrator in the first instance. Gameful will support the school in fulfilling any valid FERPA request.

10. COPPA — Children Under 13

The Children's Online Privacy Protection Act (COPPA) places additional obligations on online services that collect personal information from children under 13. Under the school official exception to COPPA:

• The Teacher or School — not Gameful — is responsible for obtaining verifiable parental consent before enrolling students under 13.
• Teachers certify, by enrolling students under 13, that they hold institutional consent authority or that individual parental consent has been obtained and is on file.
• Gameful collects from students under 13 only the minimum data necessary to operate the classroom.
• We do not engage in behavioral advertising directed at students of any age.
• We do not sell or share the personal information of students under 13 for commercial purposes.
• Parents of students under 13 may contact us at privacy@gameful.me to request access to, correction of, or deletion of their child's personal information. We will coordinate with the school to fulfill valid requests.

11. Third-Party Services

The Platform integrates with third-party services to provide its features. By using the Platform, you acknowledge that your use of these services is also subject to their respective terms and privacy policies. Key third-party services include:

• Google — OAuth sign-in, Drive file picker, Google Custom Search, YouTube Data API (admin/wizard only), and Google Analytics (homepage only).
• Stripe — Payment processing and subscription management.
• PayPal — Alternative payment processing.
• Amazon Web Services (AWS) — Media file storage (S3) and transactional email delivery (SES).
• Anthropic — AI features (admin/teacher-facing only).
• OpenAI — AI setup wizard fallback (admin/teacher-facing only).

Gameful is not responsible for the practices or content of any third-party service. We encourage you to review the terms and privacy policies of any third-party services you use in connection with the Platform.

12. Disclaimers

THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. TO THE FULLEST EXTENT PERMITTED BY LAW, GAMEFUL DISCLAIMS ALL WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

We do not warrant that the Platform will be uninterrupted, error-free, or free of viruses or other harmful components. We do not warrant the accuracy or completeness of any content on the Platform.

AI-generated content produced by the Platform's AI features (powered by Anthropic or OpenAI) is for informational and educational planning purposes only. Gameful makes no representations about the accuracy of AI-generated output and is not liable for decisions made in reliance on such output.

13. Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, GAMEFUL AND ITS OFFICERS, EMPLOYEES, AGENTS, AND LICENSORS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF DATA, LOSS OF PROFITS, OR LOSS OF GOODWILL, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF THE PLATFORM.

IN NO EVENT WILL GAMEFUL'S TOTAL LIABILITY TO YOU FOR ALL CLAIMS RELATING TO THE PLATFORM EXCEED THE GREATER OF (A) THE TOTAL AMOUNT YOU PAID TO GAMEFUL IN THE TWELVE MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED DOLLARS (USD $100).

Some jurisdictions do not allow certain limitations of liability. In those jurisdictions, our liability will be limited to the greatest extent permitted by law.

14. Indemnification

You agree to defend, indemnify, and hold harmless Gameful and its officers, employees, agents, and licensors from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or related to:

• Your violation of these Terms.
• Your violation of any applicable law or regulation, including COPPA, FERPA, or applicable data protection laws.
• Your failure to obtain required parental consent before enrolling students under 13.
• Any content you upload or create on the Platform.
• Your school's or institution's use of the Platform.

15. Termination

15.1 Termination by You

You may stop using the Platform at any time. Teachers may cancel their subscription as described in Section 5.5. Cancellation of a subscription does not automatically delete your account or your students' data — contact privacy@gameful.me to request account and data deletion.

15.2 Termination by Gameful

We may suspend or terminate your account or access to the Platform at any time, with or without notice, if:

• You violate these Terms or our Acceptable Use Policy.
• You fail to pay subscription fees when due.
• We are required to do so by law or a government authority.
• We discontinue the Platform or a portion of it.

Where practical, we will give you advance notice of termination and an opportunity to export your data.

15.3 Effect of Termination

Upon termination, your right to access the Platform ends immediately. Provisions of these Terms that by their nature should survive termination — including ownership, payment obligations for amounts already due, disclaimers, limitation of liability, and dispute resolution — will survive.

15.4 Data Retention After Termination

After account termination, we retain data only as required by law or as described in our Privacy Policy. You may request deletion of your data and Student Data at any time by contacting privacy@gameful.me.

16. Changes to These Terms

We may update these Terms from time to time. When we make material changes, we will notify you by email (at the address associated with your account) and by posting the updated Terms on the Platform at least 14 days before the changes take effect. Your continued use of the Platform after the effective date of updated Terms means you accept the changes.

If you do not agree with updated Terms, you must stop using the Platform and cancel your subscription before the effective date of the changes.

17. Governing Law and Disputes

These Terms are governed by the laws of the United States and the state in which Gameful is incorporated, without regard to conflict-of-law principles. Any dispute arising from these Terms or your use of the Platform will first be addressed through good-faith negotiation between the parties. If a dispute cannot be resolved informally, it will be resolved through binding arbitration in accordance with the rules of the American Arbitration Association (AAA), unless both parties agree otherwise in writing.

YOU AND GAMEFUL EACH WAIVE THE RIGHT TO A JURY TRIAL AND THE RIGHT TO PARTICIPATE IN A CLASS-ACTION LAWSUIT OR CLASS-WIDE ARBITRATION, TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW.

Nothing in this section prevents either party from seeking emergency injunctive relief in a court of competent jurisdiction to prevent irreparable harm.

18. General Provisions

18.1 Entire Agreement

These Terms, together with our Privacy Policy and any other policies incorporated by reference, constitute the entire agreement between you and Gameful regarding the Platform. They supersede all prior discussions, representations, and agreements.

18.2 Severability

If any provision of these Terms is found to be unenforceable, the remaining provisions will continue in full force and effect. The unenforceable provision will be modified to the minimum extent necessary to make it enforceable.

18.3 Waiver

Gameful's failure to enforce any provision of these Terms is not a waiver of our right to enforce that provision in the future.

18.4 Assignment

You may not assign or transfer your rights or obligations under these Terms without our prior written consent. Gameful may assign these Terms, in whole or in part, in connection with a merger, acquisition, or sale of substantially all of its assets.

18.5 No Third-Party Beneficiaries

These Terms do not create any third-party beneficiary rights. Only you and Gameful have rights under these Terms.

18.6 Force Majeure

Gameful is not liable for delays or failures in performance caused by events outside our reasonable control, including natural disasters, power outages, internet disruptions, or government actions.

19. Contact Us

If you have questions about these Terms, please contact us:

• Inquiries: privacy@gameful.me

Data Processing Agreement

Effective Date: June 11, 2026

Parties: This Data Processing Agreement ("DPA") is entered into between Gameful ("Processor," "we," "us," or "our") and the school, district, or teacher ("Controller," "you") who uses the Gameful platform to manage classroom activities, gamification, and student engagement.

This DPA forms part of the Gameful Terms of Service and applies whenever Gameful processes personal data on your behalf. By using the Gameful platform, you agree to the terms of this DPA.

1. Definitions

• Personal Data: Any information that identifies or can identify a person — for example, a student's name, email address, or Google account ID.
• Processing: Anything done with personal data — collecting, storing, using, sharing, or deleting it.
• Controller: The school or teacher who decides why and how student data is processed. You are the Controller.
• Processor: Gameful, which processes personal data only on your instructions.
• Sub-processor: A third-party service that Gameful uses to help deliver the platform (for example, Amazon Web Services for file storage).
• Student Data: Personal data about students that is created, collected, or stored through your use of the Gameful platform.
• FERPA: The Family Educational Rights and Privacy Act (20 U.S.C. § 1232g), a US federal law protecting student education records.
• COPPA: The Children's Online Privacy Protection Act, a US federal law protecting the privacy of children under 13.
• GDPR: The General Data Protection Regulation (EU) 2016/679.

2. Roles of the Parties

2.1 You Are the Controller

Schools and teachers are the data controllers for student data within their classrooms. You determine which students use Gameful, what assignments are created, and how student progress is tracked. You are responsible for ensuring you have the legal right to enroll students and collect their data.

2.2 Gameful Is the Processor

Gameful acts as a data processor — we process student personal data only on your instructions, as described in this DPA and in the Terms of Service. We do not use student data for our own purposes, for advertising, or for behavioral profiling.

2.3 Gameful as School Official Under FERPA

To the extent that student data constitutes "education records" under FERPA, Gameful acts as a "school official" with a "legitimate educational interest" in accessing those records, as that term is used in 34 C.F.R. § 99.31(a)(1). Gameful will not disclose education records to third parties except as permitted by FERPA or as directed by you.

3. Data Processed Under This Agreement

3.1 Categories of Data Subjects

• Students enrolled in a teacher's or school's Gameful classroom
• Teachers and school administrators using the Gameful platform

3.2 Student Data Collected

• Display name and email address (via Google OAuth sign-in)
• Google account ID
• Gamification data: XP points, badges, and in-game inventory
• Task completion records and activity events
• Google Drive file references (file ID and file name only — file content remains in the student's own Google Drive account; Gameful does not access file content)
• Hashed IP address and hashed user-agent string, stored in the consent log

3.3 Teacher and Administrator Data Collected

• Name, email address, and Google account ID
• Google OAuth access and refresh tokens (stored encrypted in the database)
• Subscription and billing data (see Section 3.4)
• School domain allowlists used for student auto-enrollment
• Classroom and game configuration settings

3.4 Billing Data (Teachers / Schools)

Billing data collected for subscription management includes: billing name, billing address, card type, last four digits of card number, subscription plan and status, transaction ID, amount, and currency. Full card numbers are never stored on Gameful servers — card data is tokenized by Stripe.js or processed directly by PayPal before it reaches our systems. Transaction records also include a hashed IP address at the time of payment, retained for fraud prevention purposes.

3.5 Purpose of Processing

Gameful processes personal data solely to:

• Operate and deliver the Gameful classroom gamification platform
• Authenticate users via Google OAuth
• Store and display student progress, badges, and assignments
• Enable teacher-assigned Google Drive file submissions
• Send transactional email (registration confirmations, payment receipts, subscription alerts, password resets)
• Manage teacher and school subscriptions and billing
• Provide AI-assisted setup tools to teachers and administrators (no student PII is sent to AI services)
• Display embedded content such as Google Custom Search results on student-facing pages (search queries are set by administrator content and are not entered by students)

3.6 What Student Data Is Never Used For

• Advertising or behavioral profiling of any kind
• Sale or rental to third parties
• Marketing communications directed to students
• Any purpose beyond operating the platform for the enrolling school or teacher

4. Processing on Your Instructions

Gameful will process personal data only in accordance with your documented instructions, which are set out in this DPA and in the Terms of Service. If we are required by law to process data for any other reason, we will notify you before doing so unless the law prohibits such notification.

If we believe an instruction you give us violates applicable data protection law, we will promptly tell you.

5. Your Obligations as Controller

• Lawful basis: You are responsible for ensuring you have a lawful basis (such as parental consent or a FERPA school official exemption) for enrolling students and sharing their data with Gameful.
• COPPA consent: If you enroll students under 13, you are responsible for obtaining or certifying verifiable parental consent before enrollment, consistent with COPPA and your school's policies.
• Domain allowlists: When you add a school domain for auto-enrollment, you confirm that you are authorized to enroll students from that domain.
• Accuracy: You are responsible for ensuring that any personal data you provide to Gameful is accurate and up to date.
• Data subject rights: You are responsible for responding to requests from students, parents, or other data subjects exercising their privacy rights. Gameful will assist you as described in Section 9.

6. Security Measures

Gameful implements the following technical and organizational measures to protect personal data:

• Encryption in transit: All data is transmitted over HTTPS/TLS.
• Encryption at rest: Google OAuth access and refresh tokens are stored encrypted in the database. AWS S3 storage uses server-side encryption.
• Credential management: API keys and secrets are stored in a configuration file above the web root and are not committed to version control.
• Access controls: Student data is accessible only to the student's own teacher(s), school administrators, and authorized Gameful platform staff. Administrative impersonation (login-as-user) is logged to an audit trail.
• Database backups: Backups are encrypted at rest and are not publicly accessible. Payment records, which include transaction details, are stored in an encrypted backup environment.
• Third-party telemetry blocking: Gameful has disabled or blocked third-party plugin telemetry services that would otherwise transmit visitor data to external parties without a direct platform purpose.
• Google Fonts blocked: Gameful's custom font manager blocks all requests to fonts.googleapis.com and fonts.gstatic.com at multiple layers, preventing any visitor data from being sent to Google via font loading.

We will notify you without undue delay if we become aware of a personal data breach affecting data we process on your behalf, and we will cooperate with your breach response obligations.

7. Sub-processors

Gameful uses the following third-party sub-processors to help deliver the platform. Each sub-processor is bound by data protection obligations at least as protective as those in this DPA. By agreeing to this DPA, you authorize Gameful to use these sub-processors.

We will give you reasonable notice before adding or replacing a sub-processor that handles personal data about your students or teachers.

7.1 Core Infrastructure

• Amazon Web Services (AWS S3) — Media file storage and serving. Stores uploaded media file content. Location: USA. DPA: AWS Customer Agreement / DPA.
• Amazon SES — Transactional email delivery (registration, payment, password reset emails). Receives recipient email address and message content. Location: USA. DPA: Covered under AWS Customer Agreement.
• Cloudways — Server hosting and infrastructure. Processes data as part of server operation. Location: USA / varies by region. DPA: Cloudways Privacy Policy. ⚠ No DPA available

7.2 Authentication and Google Services

• Google (OAuth, Drive API, Analytics, YouTube Data API, Custom Search) — Multiple services:
  • Google OAuth 2.0: User sign-in — processes email address, display name, Google account ID, and access/refresh tokens.
  • Google Drive API: Teacher file storage and student file submission picker — processes file IDs and file names. File content remains in the user's own Google Drive.
  • Google Analytics: Web analytics on the Gameful home page only (gameful.me). Not active on student subdomains or for logged-in students. Processes page views, approximate location, browser/device type, referral source. Fires only after visitor consent.
  • YouTube Data API v3: AI-powered video search in the setup wizard (admin-facing only). Processes search query terms. Location: USA. DPA status: ⚠ No DPA available — admin-only feature; no student data sent
  • Google Custom Search (CSE): Embedded image search results on student-facing pages. Student browser data (IP address and user-agent) is sent to Google when a page containing search results loads. Search queries are set by administrator content; students do not enter search terms.
  Location: USA. DPA: Google Cloud Data Processing Addendum.

7.3 Payment Processing

• Stripe — Payment processing for teacher/school subscriptions. Processes cardholder name, billing address, card tokenization, and subscription data. Card numbers are tokenized by Stripe.js before leaving the browser — raw card data never reaches Gameful servers. Location: USA. DPA: Stripe DPA.
• PayPal — Payment processing (alternative to Stripe). Processes user billing data and PayPal account identity. Location: USA. DPA: PayPal Data Protection Addendum.

7.4 AI Features (Administrator-Only)

AI features are available to teachers and administrators for setup assistance and policy generation. No student personal data is sent to AI sub-processors. Inputs consist of wizard configurations, site content, and administrator-entered text only.

• Anthropic (Claude) — AI policy generation and setup wizard assistance. Processes prompt text from administrator wizard inputs. Location: USA. DPA: Anthropic DPA.
• OpenAI (GPT-4o) — AI setup wizard (fallback to Anthropic). Processes prompt text from administrator wizard inputs. Location: USA. DPA: OpenAI Data Processing Addendum.

7.5 Administrative Tools (No User Personal Data Transmitted)

The following tools are used for platform administration. They may send administrative metadata (such as site URL, plugin version, or license key) to their respective vendors, but they do not transmit student or teacher personal data.

• WP Mail SMTP — Routes transactional email through Amazon SES. May send site URL, email send counts, and plugin version to wpmailsmtpusage.com as usage telemetry. No user personal data is transmitted. ⚠ No DPA available for wpmailsmtpusage.com telemetry endpoint
• BetterDocs — Documentation plugin. License verification sends site URL and license key to wpdeveloper.com. Admin-only; no user data transmitted. Third-party telemetry to wpinsight.com is permanently blocked at the server level.
• Paid Member Subscriptions (Cozmoslabs) — Membership management plugin. Usage telemetry (site URL, member count, WP/PHP version) may be sent to cozmoslabs.com. No student or teacher personal data is included in telemetry.

8. International Data Transfers

Gameful and all sub-processors listed in Section 7 are based in or process data in the United States. Cloudways may process data in other regions depending on the hosting location selected.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, personal data may be transferred to the United States. Where such transfers occur, Gameful relies on the following lawful transfer mechanisms:

• Standard Contractual Clauses (SCCs) incorporated into sub-processor agreements, where applicable
• Sub-processor participation in recognized data transfer frameworks (such as the EU-US Data Privacy Framework), where applicable

You may request a copy of the transfer safeguards applicable to a specific sub-processor by contacting us at the address in Section 12.

9. Data Subject Rights and Your Requests

As the data controller, you are the primary contact for students and parents who wish to exercise their privacy rights — including the right to access, correct, or delete personal data, or to obtain a copy of records.

Gameful will assist you in responding to such requests. Specifically, we will:

• Provide you with the ability to view and export student data associated with your classroom through the platform's administrative interface
• Delete a student's personal data from Gameful systems promptly upon your request
• Correct inaccurate data when you direct us to do so
• Respond to your requests within a reasonable time frame and at no additional cost for standard requests

9.1 FERPA Rights

Under FERPA, parents and eligible students (those 18 or older) have the right to inspect and review education records, request corrections, and consent to disclosure. Because Gameful acts as a school official, requests to inspect or correct education records should be directed to the school or teacher. Gameful will support those requests at the school's direction.

9.2 COPPA Parental Rights

Parents or legal guardians of children under 13 have the right to:

• Review the personal data Gameful has collected about their child
• Request deletion of their child's personal data
• Refuse to permit further collection or use of their child's data

These requests should be directed to the child's teacher or school, who will work with Gameful to fulfill them. Gameful does not engage in behavioral advertising directed at students of any age.

9.3 GDPR Data Subject Rights (EEA Users)

If you or your students are in the EEA, UK, or Switzerland, data subjects have rights under the GDPR, including the right to access, rectify, erase, restrict processing of, and port their personal data, as well as the right to object to processing. To exercise these rights, contact your school or teacher (the Controller). Gameful will assist as Processor.

Lawful bases for processing activities are as follows:

• Student account and platform operation: Performance of a contract (Terms of Service) / legitimate interests of the school
• Google OAuth sign-in: Performance of a contract; legitimate interests
• Transactional email: Performance of a contract
• Payment processing: Performance of a contract; compliance with legal obligations
• Google Analytics (home page only): Consent (fires only after visitor accepts analytics cookies)
• AI setup wizard (admin only): Legitimate interests of the platform operator
• Fraud prevention (hashed payment IP): Legitimate interests

10. Data Retention and Deletion

Gameful retains personal data for as long as a user's account is active. When a student account is removed — whether by the teacher, the school, or the student — Gameful will delete that student's personal data from active systems.

Billing and payment records are retained for the period required by applicable tax and financial regulations, even after a subscription ends.

Upon termination of your agreement with Gameful, we will, at your election, delete or return all personal data we hold on your behalf within a reasonable time frame. We will confirm deletion in writing upon request.

Backup copies of data may persist for a limited period in encrypted backup storage before being purged as part of standard backup rotation cycles.

11. Confidentiality

Gameful staff who access personal data processed under this DPA are subject to a duty of confidentiality. We will ensure that anyone authorized to process personal data on your behalf has committed to appropriate confidentiality obligations.

Gameful will not disclose student data to any party other than those listed as sub-processors in Section 7, except:

• At your written direction
• As required by law (in which case we will notify you in advance where legally permitted)
• To protect the safety of a user or the public in an emergency

12. Audits and Compliance

Gameful will make available to you, upon reasonable written request, information necessary to demonstrate compliance with this DPA. This may include summary security documentation, sub-processor lists, or other relevant records.

Where you have a legal right to audit Gameful's data processing activities, you may exercise that right with reasonable advance notice. We may require that audits be conducted by an independent third party under a mutually agreed confidentiality agreement.

13. Changes to This DPA

Gameful may update this DPA from time to time to reflect changes in our services, sub-processors, or applicable law. We will notify you of material changes by email or through a prominent notice on the platform at least 30 days before the change takes effect. Continued use of the platform after the effective date constitutes acceptance of the updated DPA.

If you do not accept a material change to this DPA, you may terminate your agreement with Gameful by contacting us before the effective date of the change.

14. Contact

For questions about this DPA, to request deletion of student data, or to exercise any rights described in this agreement, please contact:

• Gameful Privacy Contact: privacy@gameful.me
• Website: gameful.me

Schools and teachers acting as controllers may also exercise their rights directly through the platform's administrative interface for common requests such as student data export and deletion.

Cookie Policy

Effective date: June 11, 2026

This Cookie Policy explains what cookies and similar technologies Gameful uses, why we use them, and what choices you have. It applies to the Gameful platform, including the main site at gameful.me and all classroom subdomains.

This policy is part of our broader Privacy Policy. If you have questions, contact us at privacy@gameful.me.

What Are Cookies?

Cookies are small text files that a website stores on your device when you visit. They help the site remember things like whether you are logged in or what preferences you have set. Cookies are not programs — they cannot run code or carry viruses.

We also use browser local storage, which works similarly to cookies but stays on your device and is not sent to our servers with every request. We explain how we use local storage in a separate section below.

Cookies Set by Gameful

The table below lists all first-party cookies our platform sets directly on your device.

Third-Party Cookies

Some pages load scripts from third-party services. These services may set their own cookies on your device. We do not control those cookies. Links to each service's privacy policy are provided below.

Browser Local Storage

We also use browser local storage to save small pieces of information on your device. Unlike cookies, local storage data is not sent to our servers with each page request. It is used only to improve your experience within the platform. None of the local storage items below are used for advertising or tracking across other websites.

• go_reload_map_on_close — Remembers whether the game map should reload when a lightbox window is closed.
• main_save_state — Saves your current progress state on the clipboard/inventory view so it is restored when you return.
• go_update_player_bar_res — Caches the result of a player status bar update to avoid unnecessary server calls.
• go_register_redirect — Stores the page you were trying to reach before being prompted to register, so you are sent there after sign-up.
• login_modal — Records whether the login prompt has been shown during your current session.
• go_unmatched — Temporarily flags a state where no matching game content was found, to prevent repeated lookups.
• user_show_loot / user_show_tot — Remembers your display preferences on the game map (whether to show loot and totals).
• update_badge_raw_id / update_badge_raw — Temporarily stores badge data used to refresh badge displays on the game map.
• go_update_announcements_res — Caches the result of an announcements check so the map does not re-fetch data unnecessarily.

You can clear local storage at any time through your browser's developer tools or privacy settings. Clearing it will reset any stored preferences listed above.

Children Under 13 (COPPA)

Gameful is used in K–12 classrooms and may be used by students under 13. We take extra steps to protect younger users.

• We do not use behavioral advertising cookies or tracking pixels on any student-facing page, for any age group.
• Google Analytics does not run on classroom subdomains or for any logged-in user — this means students are never tracked by Google Analytics.
• The only third-party scripts that may load on student-facing pages are Google Sign-In (if the student uses Google login) and Google Custom Search (if the teacher has embedded it in a content page). Both of these involve Google receiving the student's IP address and browser information as described above.
• Gameful relies on the school and teacher to provide or obtain any required parental consent before enrolling students under 13. This follows the COPPA school official exception, under which a school or teacher may provide consent on behalf of parents for educational services.
• Parents of students under 13 may request to review, correct, or delete their child's data by contacting the student's teacher or school, or by emailing us at privacy@gameful.me.
• Student data is never sold to third parties and is never used for advertising or behavioral profiling.

Your Cookie Choices

Cookie Summary Table

The table below provides a quick reference for all cookies described in this policy.

• wordpress_logged_in_* | Necessary | Session / 14 days | First-party
• wordpress_sec_* / wordpress_* | Necessary | Session | First-party
• wp-settings-* | Necessary | Up to 1 year | First-party
• redirect_blog_id | Necessary | Session | First-party
• go_kiosk_token | Necessary | Session | First-party
• go_kiosk_id | Necessary | Session | First-party
• go_pending_user | Necessary | Session | First-party
• pms_* | Necessary | Varies | First-party
• go_consent_v[N] | Consent record | 1 year | First-party
• go_consent_session | Consent record | 1 year | First-party
• reload_clipboard_page | Functional | 1 hour | First-party
• my_active_user_variable | Functional | Session | First-party
• mime_type_allowed | Functional | Session | First-party
• go_badges / go_badges_name | Functional | Session | First-party
• date_filter_leaderboard / chosenLabel_leaderboard | Functional | Session | First-party
• go_maintenance | Functional | Session | First-party (JS-set)
• betterdocs_insights_allowed | Functional | 30 days | First-party
• wp_loginasuser_* (3 cookies) | Necessary (admin only) | Session | First-party
• Google OAuth cookies | Necessary (when signing in) | Varies | Third-party (Google)
• Google Custom Search cookies | Functional (when CSE loads) | Varies | Third-party (Google)
• _ga / _ga_* | Analytics (consent required) | Up to 2 years | Third-party (Google Analytics)
• Stripe cookies | Necessary (payment pages only) | Varies | Third-party (Stripe)

Changes to This Policy

We will update this Cookie Policy when we add new cookies or change how existing cookies work. When we make material changes, we will update the effective date at the top of this page. We encourage you to check back periodically.

Contact Us

If you have questions about this Cookie Policy or how we use cookies, please contact us:

• Email: privacy@gameful.me
• Website: gameful.me