Acceptable Use Policy

1. The principle

SchoolERP holds the records of children. Almost everything in this policy follows from that single fact, and where a judgement is finely balanced we will resolve it in favour of the students whose data is held.

2. What is not allowed

• Attempting to access, enumerate or infer the existence of another school's data by any means, including through the assistant, the API or a crafted request.
• Probing, scanning or load-testing the platform without our written permission. Responsible disclosure of a genuine vulnerability is welcome and is not this.
• Uploading malware, or content that is unlawful, obscene, or that harasses or endangers a student or member of staff.
• Using a student's or parent's contact details held in the platform for marketing, political messaging or any purpose unconnected with running the school.
• Sharing a sign-in between people, or using an account issued to someone else.
• Extracting data in bulk for a purpose the School has not authorised, or to build a competing product.
• Using the platform to send messages at a volume or of a kind that would put our sending reputation or another school's deliverability at risk.

3. The assistant

The built-in assistant answers only from the signed-in user's own school and only within that user's permissions. Attempting to talk it into reaching beyond that — by instruction, by roleplay, or by content placed in a record for it to read — is a breach of this policy regardless of whether the attempt succeeds.

4. What we do

1. 1For a first, minor and apparently accidental breach: we contact the School and explain.
2. 2For a serious or repeated breach: we suspend the account or accounts involved and notify the School's administrator.
3. 3For anything that endangers a child or another school's data: we act immediately, then notify.
4. 4Where the law requires it, we report to the relevant authority.

5. Reporting a problem

If you believe an account is being misused, or you have found a security flaw, write to us at the address on the Grievance Redressal page. We do not pursue people who report a vulnerability to us in good faith and give us a reasonable chance to fix it.