SpecialNeedsWare, Inc. dba Ori Learning · Version v2026.09 · Effective September 23, 2026
Exhibit 2 to the Data Privacy Addendum · the same text is the Subprocessor page at orilearning.com/legal/subprocessors/
1. Scope and relationship to the Agreement
1.1 What this Schedule is. This Subprocessor Schedule is Exhibit 2 to the Data Privacy Addendum and forms part of it (DPA §1.2). It is the list of Subprocessors the Customer authorizes under DPA §9.1, stating for each its legal entity, its function, the categories of data it receives, whether it receives Student Data, its processing location and the terms under which it processes. Ori Learning engages each Subprocessor under the written terms DPA §9.2 describes, as Section 1.5 states, relies on those terms for the protection of Student Data by any further subprocessor the Subprocessor engages (DPA §9.3), and remains responsible to the Customer for each Subprocessor’s performance as if it were its own (DPA §9.4). The Order Form identifies the version of this Schedule in effect at order; changes made under Section 4 during the Subscription Term amend that version, so that the current published version is the one in effect for the Customer (DPA §1.2, §9.1, §15.3), and every version is archived at orilearning.com/legal/archive/ so that the Schedule in effect on any date can be evidenced (Section 5). The public Subprocessor page is this Schedule; where the two differ, the version in effect for the Customer under this Section controls between the parties.
1.2 What it lists. Part A lists Subprocessors: third parties that process Customer Data or Student Data on Ori Learning’s behalf in providing the Services. Part B lists the third-party services that Platform pages load and that receive an Authorized User’s network information (Internet Protocol address, browser and device information, referring page) when they do, including in the Student Portal; each is a recipient on Ori Learning’s behalf and is disclosed with the data it receives and its purpose (DPA §5.8); a service the Platform does not need to operate is marked so in its row and is listed until Ori Learning’s removal of it is complete. Part C lists the roster and sign-in integrations the Customer may elect, which are the Customer’s own arrangements and not Subprocessors (DPA §9.1; Section 3.4 of the Master Subscription Agreement). Part D is the recipient history DPA §9.7 promises. A software-development contractor Ori Learning engages appears in Part A with its function, its country and the scope of its access where DPA §9.8 makes it a Subprocessor; none is engaged as of the version date.
1.3 What it does not list. Ori Learning’s corporate systems (email, collaboration, password management, video conferencing and business administration) are corporate tooling and are not listed here; the Information Security Program requires that Student Data not be handled outside the Platform, and the Retention & Deletion Schedule (category 11) states how Student Data that reaches a support or email record incidentally is handled. Ori Learning’s managed information-technology and security provider holds infrastructure and endpoint access and receives no flow of Student Data; it is not a Subprocessor and is not listed in Part A. The providers of the Marketing Website are described in the Website Privacy Notice.
1.4 Completeness. This Schedule lists the recipients of Customer Data and Student Data that Ori Learning has identified as of its version date. A new recipient is added under Section 4 (DPA §9.1, §9.6), and Ori Learning adds to this Schedule any further recipient it identifies.
1.5 The Terms column. Before a Subprocessor receives Student Data, Ori Learning evaluates its ability to protect the data and ensures that its written terms require it to protect Student Data consistent with the Data Privacy Addendum and limit its use to providing its services to Ori Learning (DPA §9.2). “Vendor terms” names the data-protection terms the vendor publishes for its service, which are the written terms under which Ori Learning engages it (DPA §9.2) unless the row states otherwise; no row represents that a separately signed data-processing agreement is in place unless it says so. Ori Learning does not authorize any Subprocessor to use Student Data to train an artificial-intelligence or machine-learning model. “Location” is where the Subprocessor processes the data, as the Subprocessor states. A vendor’s published statement about its own processing is attributed to the vendor and is not Ori Learning’s commitment.
2. Definitions
Capitalized terms have the meanings given in the Ori Learning Definitions (DPA §2.1). The purpose letters in Part A refer to the authorized purposes in DPA §5.2. The Website Privacy Notice, the Information Security Program and the Development Contractor Agreement are the documents so titled in the Ori Learning legal set.
3. Recipients
Part A — Subprocessors
| # | Subprocessor (legal entity) | Service and function | Data it receives | Student Data | Location | Terms | Purpose |
|---|---|---|---|---|---|---|---|
| A1 | Microsoft Corporation | Microsoft Azure (App Service, Azure SQL, Blob Storage, Cosmos DB, Table Storage, Queue Storage, Cache for Redis, Key Vault, Functions): hosting of the Platform and every production data store. Azure Application Insights: application logs and telemetry. Azure SignalR Service: real-time transport for live sessions and Collaboration Boards. | All Customer Data, including all Student Data; logs and telemetry that may contain user identifiers | Yes | United States (Azure United States region) | Vendor terms: Microsoft Products and Services Data Protection Addendum, microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA | (a)–(f), (h) |
| A2 | Google LLC | Cloud Translation: on-demand translation of lesson text into the language a user selects. Cloud Text-to-Speech: read-aloud of lesson text, receiving lesson text and returning synthesized audio. Google’s published position for Cloud Translation, as fetched on September 10, 2026, is that the text is held briefly in memory, is not persistently stored and is not used to train its models. Ori Learning does not authorize Google to use what it sends for training (DPA §5.5). | Lesson and Curriculum Content text sent for translation or synthesis, and any Student-written text the Platform sends for translation | Yes (treated as receiving Student Data) | United States (Google Cloud) | Vendor terms: Google Cloud Data Processing Addendum, cloud.google.com/terms/data-processing-addendum | (c), (e) |
| A3 | Amplitude, Inc. | Amplitude: product-usage analytics and the in-product reporting built on them | For Students: usage events (lesson, unit, course and session start and completion events) under a pseudonymous identifier, never a Student’s name, username or contact details. For staff: a user identifier and, until Ori Learning’s replacement of it with a pseudonymous identifier is complete, the username, with the same events. For both: district and school identifiers and names; state; role. Not aggregate or de-identified. | Yes | The Amplitude data region that hosts Ori Learning’s account | Vendor terms: Amplitude Data Processing Addendum, amplitude.com/dpa | (d), (h) |
| A4 | ChurnZero, Inc. | ChurnZero: customer-success platform, receiving usage events from the Platform and running a script on the Student, Teacher and Administrator portals. ChurnZero states that it is hosted on Amazon Web Services and uses Salesforce and HubSpot as its own subprocessors. | For Students: usage events (lesson, unit, course and session start and completion events, and the page-interaction data the script collects) under a pseudonymous identifier, never a Student’s name, username or contact details. For staff: staff user identifiers, with the same events. District identifier. Not aggregate or account-level only. | Yes | United States | Vendor terms: ChurnZero Data Processing Addendum and Privacy Policy, compliance.churnzero.com | (g), (h) |
| A5 | TrackJS, LLC (Request Metrics) | Request Metrics: front-end error and performance monitoring on every portal, including the Student Portal and the login application | Errors, performance timings, page addresses, browser and device information, Internet Protocol address | Yes | United States | Vendor terms: Request Metrics Data Processing Addendum, requestmetrics.com/dpa | (h) |
| A6 | Twilio Inc. (Twilio SendGrid) | SendGrid: transactional email sent by the Platform | Recipient email addresses and message content; a Student’s email address where the Customer supplies one | Yes, where a Student Account has an email address | United States | Vendor terms: Twilio Data Protection Addendum, twilio.com/en-us/legal/gdpr | (a), (b), (g) |
| A7 | HubSpot, Inc. | HubSpot: support chat on the Teacher and Administrator portals (the chat widget does not load in the Student Portal); customer relationship management. The Platform sends HubSpot only aggregate counts of active Student and Teacher Accounts for each Customer; no individual Student record. Educator-submitted chat content is unfiltered and may incidentally contain Student information, which is handled under Retention & Deletion Schedule category 11. | Educator chat conversations and chat-widget visitor data; Customer contact and account records; aggregate Account counts | No (the sync); Student information an educator includes in a chat is treated as Student Data | The HubSpot data region that hosts Ori Learning’s account | Vendor terms: HubSpot Data Processing Agreement, legal.hubspot.com/dpa | (g) |
Part B — Third-party services that receive network information when Platform pages load (DPA §5.8)
Each service below receives the Internet Protocol address, browser and device information and referring page of the Authorized User whose browser loads the page, including a Student’s, for the purpose stated; that information is Personal Information collected on Ori Learning’s behalf. Platform pages load fonts and similar resources from the providers listed below, which receive the network information a browser sends with any web request; Ori Learning evaluates each such service and uses it only in compliance with Applicable Law and the Data Privacy Addendum. A service the Platform does not need to operate says so in its Status and is listed here until Ori Learning’s removal of it is complete.
| # | Service (entity) | Where it loads and what it does | Status |
|---|---|---|---|
| B1 | Google Fonts (Google LLC) | Every portal, including the login page and the Student Portal; serves web fonts | In use |
| B2 | YouTube video embeds (Google LLC) | Loads when a lesson contains a YouTube-hosted video: the lesson media player (privacy-enhanced embed) | Capability in place |
| B3 | Google sign-in script (Google LLC) | The login page; the script load itself sends network information whether or not the Customer elects Google Sign-In | In use |
| B4 | Google Analytics script, legacy tag (Google LLC) | The shared application shell, other than the Student Portal, while it remains: a legacy Google Analytics script is requested from Google when a page loads and sends Google the network information above | Removed from the Student Portal; not needed for the Platform to operate, and Ori Learning lists it here until its removal from the other portals is complete |
Part C — Integrations the Customer elects (not Subprocessors)
Where the Customer elects an integration, Ori Learning exchanges Student Data with it only as the Customer’s integration requires, under the Customer’s own contract with the provider (DPA §9.1).
| # | Provider | Function | Data exchanged |
|---|---|---|---|
| C1 | Clever, Inc. | Rostering and single sign-on | Roster and identity data: names, identifiers, email address, school, grade, assigned Teacher, counselor, program |
| C2 | ClassLink, Inc. | Rostering (OneRoster) and single sign-on | The same roster and identity categories |
| C3 | Google LLC | Google Sign-In | Identity assertion |
| C4 | Microsoft Corporation | Microsoft account sign-in | Identity assertion |
Part D — Recipient history (DPA §9.7)
On request, Ori Learning lists, from the records it keeps and to the extent reasonably available, for the three years before the request, the Subprocessors and other recipients that received the Customer’s Student Data during the period the Customer specifies, including recipients no longer engaged (DPA §9.7). A Subprocessor removed from Part A after this version is recorded in the change log.
4. Changes to this Schedule (DPA §9.6)
4.1 Procedure. DPA §9.6 states the change procedure: Ori Learning keeps this Schedule current and notifies the Customer’s privacy and security contact identified under DPA §17.3 by email of changes to it, and a Customer that objects to a change on reasonable grounds relating to the protection of Student Data may terminate the affected Services on written notice and receive a refund of prepaid Fees for the remainder of the Subscription Term. This Schedule restates none of those terms differently. A material change to the collection, use or disclosure of Student Data also requires the renewed authorization DPA §15.4 describes.
4.2 Effect on this Schedule. A change takes effect on the date the notice states and is recorded in the change log with the new or changed row and the reason.
4.3 Reserved.
4.4 How notice is delivered. Ori Learning gives notice under DPA §9.6 by email to the Customer’s privacy and security contact identified under DPA §17.3, and posts each change on this page.
5. Changes and versions
Changes to this Schedule take effect under Section 4 and DPA §9.6; every version is recorded in the change log below with its date and the change, and prior versions remain available at orilearning.com/legal/archive/. The Order Form identifies the version in effect at order and Section 4 changes amend it during the Subscription Term, so that the current published version is the one in effect (Section 1.1; DPA §1.2, §15.3).
Change log.
| Version | Effective | Change |
|---|---|---|
| v2026.09 | September 23, 2026 | First published version |