Acceptable Use Policy

Scope of this policy

This Acceptable Use Policy ("AUP") applies to anyone who accesses or uses the OarClass website, school management platform, applications, portals, APIs, integrations and related services.

This includes schools, academies, administrators, teachers, students, parents or guardians, accounts staff, contractors and any other authorised users.

This AUP forms part of the OarClass Terms of Service and any applicable agreement with an institutional customer.

Customers are responsible for ensuring that people using OarClass through accounts they manage comply with this policy.

Your responsibility when using OarClass

You must use OarClass lawfully, responsibly and only for purposes consistent with your authorised role.

You are responsible for activity performed through your account and must take reasonable steps to protect your account, credentials, devices and access to school information.

You must comply with:

• Applicable law and regulation.
• Your institution's lawful policies and instructions.
• OarClass Terms of Service.
• Applicable privacy and data protection requirements.
• Terms that apply to connected third-party services.

Unauthorised access is prohibited

You must not access or attempt to access any account, record, function or system for which you have not been authorised.

Prohibited activity includes:

• Accessing another person's account without permission.
• Attempting to view information outside your assigned user role.
• Bypassing school, campus or tenant boundaries.
• Attempting to elevate your own permissions.
• Circumventing authentication, access controls or security restrictions.
• Sharing credentials with someone who is not authorised to use the account.
• Using an account after your authority to use it has ended.

Teachers, students, parents and other users must not attempt to access administrator, finance or other restricted areas merely because they are technically able to discover a route, endpoint or interface.

Security testing and malicious activity

You must not compromise, test or interfere with OarClass security without prior written authorisation.

Unless expressly authorised by OarClass, you must not:

• Perform penetration testing.
• Scan systems for vulnerabilities.
• Probe ports, endpoints or services for security weaknesses.
• Attempt privilege escalation.
• Exploit or attempt to exploit a vulnerability.
• Introduce malware, ransomware, viruses, worms, trojans or other harmful code.
• Attempt to obtain authentication tokens, secrets, passwords or credentials belonging to another user or system.
• Intercept or attempt to intercept information not intended for you.

If you believe you have discovered a vulnerability, do not exploit it or access unnecessary data. Report it to OarClass through the process published on our Security page .

Interference with the Services

You must not intentionally interfere with the availability, reliability or normal operation of OarClass.

Prohibited conduct includes:

• Denial-of-service attacks.
• Excessive or abusive requests intended to overload systems.
• Creating artificial traffic for the purpose of degradation.
• Attempting to disable monitoring, logging or security controls.
• Interfering with another institution's or user's access.
• Deliberately triggering system failures or resource exhaustion.
• Circumventing technical rate limits or usage restrictions.

Privacy and data misuse

OarClass may contain personal, educational, administrative and financial information that should be accessed only for legitimate and authorised purposes.

You must not:

• Access personal information without a legitimate authorised purpose.
• Export school or user data for unrelated personal use.
• Disclose confidential information to unauthorised persons.
• Use information obtained through OarClass to harass, profile, intimidate or target another person.
• Combine OarClass data with other datasets for an unauthorised purpose.
• Sell, rent or commercially exploit student or school Personal Data.
• Attempt to re-identify information that OarClass or the Customer has intentionally anonymised.

Personal Data must be handled in accordance with our Privacy Policy and applicable institutional requirements.

Student and children's information

Users must exercise particular care when handling information relating to students or children.

You must not use OarClass student information to:

• Create unauthorised advertising or marketing profiles.
• Contact a student for an unrelated commercial purpose.
• Publish confidential student records without authority.
• Humiliate, threaten, harass or discriminate against a student.
• Track or monitor a child outside legitimate educational or safeguarding purposes authorised by the relevant institution.
• Share a child's information with unauthorised third parties.

Schools remain responsible for determining appropriate access to student records and meeting applicable legal, privacy, safeguarding and consent obligations.

Prohibited content and conduct

You must not use OarClass to create, upload, transmit, store or distribute content that is unlawful or that materially harms users or the platform.

Prohibited content may include:

• Content that unlawfully threatens, harasses or abuses another person.
• Fraudulent or deliberately deceptive material used to cause harm.
• Content that unlawfully discriminates against or targets protected individuals.
• Malware or malicious code.
• Content that infringes copyright, trademark or other intellectual property rights.
• Content that unlawfully exposes private or confidential information.
• Material whose possession, publication or distribution is prohibited by applicable law.

OarClass is not intended to be used as a public social network or an unrestricted content-hosting service.

Communications, messaging and spam

OarClass communication features must be used for legitimate educational, administrative or institutional purposes.

You must not:

• Send unsolicited bulk commercial messages.
• Use school contact lists for unrelated marketing.
• Send deceptive, fraudulent or impersonated communications.
• Repeatedly message someone in a manner intended to harass them.
• Circumvent messaging limits or anti-abuse controls.
• Use OarClass integrations to send communications that violate the terms of the connected messaging provider.

Institutional customers are responsible for ensuring that their communications comply with applicable consent, privacy and electronic communications rules.

Automated access, scraping and extraction

You must not use automated systems to access OarClass in a manner that exceeds or bypasses the normal functionality provided to authorised users.

Without prior written permission, you must not:

• Scrape OarClass pages or user interfaces.
• Automatically extract school, student or user information.
• Use bots to bypass normal access restrictions.
• Enumerate accounts, users, identifiers or records.
• Use automated requests designed to discover private endpoints or information.
• Copy substantial portions of OarClass databases or content.

Approved API use is governed separately by the permissions, documentation and technical limits applicable to that API.

APIs, integrations and third-party platforms

When you connect OarClass to an external service, you must use that integration only for authorised purposes and in compliance with the third party's terms.

You must not:

• Use an integration to access data you are not authorised to access.
• Manipulate API requests to bypass OarClass permissions.
• Share access tokens, API secrets or integration credentials with unauthorised parties.
• Use Meta, Facebook, WhatsApp or other integrations in violation of their applicable platform terms.
• Use an integration to send unauthorised spam or deceptive communications.
• Attempt to exceed or circumvent API usage or technical limits.

OarClass may disable an integration if necessary to protect users, Customer Data, the platform or a third-party service.

Intellectual property and proprietary systems

You must respect the intellectual property rights of OarClass, institutional customers and third parties.

You must not:

• Copy, reproduce or redistribute OarClass software except where expressly permitted.
• Reverse engineer, decompile or attempt to derive source code except where such restriction is prohibited by law.
• Remove proprietary notices.
• Use OarClass branding in a manner that falsely suggests ownership, partnership or endorsement.
• Upload or distribute content that you do not have the right to use.

Identity, impersonation and account integrity

Users must not misrepresent who they are or the authority they hold.

You must not:

• Impersonate a student, teacher, parent, administrator or other person.
• Create accounts using false identities for deceptive purposes.
• Misrepresent your role within an institution.
• Falsely claim to represent OarClass.
• Use another person's credentials to perform actions on their behalf without authority.

Enforcement and consequences

OarClass may investigate suspected violations of this policy.

Depending on the nature, severity and urgency of the issue, OarClass may:

• Contact the user or institutional administrator.
• Require misuse to stop.
• Restrict access to a feature.
• Disable an integration.
• Temporarily suspend an account.
• Remove or restrict unlawful or harmful content.
• Terminate access in accordance with the Terms of Service.
• Preserve relevant records where reasonably necessary for investigation or legal purposes.
• Notify the relevant institutional customer.
• Cooperate with regulators or law enforcement where legally required.

OarClass may act immediately where delay could create a material security, privacy, safeguarding, legal or operational risk.

Where reasonably appropriate, we may provide an opportunity to explain or resolve a suspected violation before permanent action is taken.

Reporting misuse or security concerns

If you believe OarClass is being used in violation of this policy, please report the issue through our contact page.

When reporting an issue, provide only the information reasonably necessary for us to understand and investigate it.

Do not publicly disclose sensitive student information, access credentials, security tokens or other confidential information as part of a report.

For suspected security vulnerabilities, please use the responsible disclosure process published on our Security page .

Changes to this policy

OarClass may update this Acceptable Use Policy as the Services, integrations, security risks or legal requirements change.

Updated versions will be published on this page and the Last updated date will be revised.

Where a change materially affects institutional obligations, OarClass may provide additional notice where reasonably appropriate or required by applicable law or contract.

Contact OarClass

If you have questions about this policy or want to report suspected misuse, contact OarClass using the details below.