We introduced our AI Use Policy on June 15, 2026. Your continued use of the website, app, and services on or after that date signifies your acceptance of this AI Use Policy.

AI Use Policy

Goosechase Adventures Inc. AI Use Policy

This AI Use Policy ("Policy") describes how Goosechase Adventures Inc. ("Goosechase", "we", "us") uses artificial intelligence and generative AI tools in connection with the Goosechase website at https://goosechase.com (the "Website"), the Goosechase Web Application (the "Web App"), the Goosechase mobile application (the "App"), and the Service described in our Terms of Service (collectively, the "Service"). It also describes how Goosechase personnel use AI tools internally. This Policy supplements our Privacy Policy, our Terms of Service, our Student Privacy Policy, our Cookie Policy, and our Sub-processors page. To the extent of any conflict, this Policy controls for AI-specific matters.

Why we publish this Policy; Goosechase is committed to transparent, lawful, and responsible use of AI. We publish this Policy, and will endeavour to update it frequently, so that our customers, users, parents, schools, and educational agencies can understand:

• which AI tools we use and for what purpose;
• how those tools handle personal information;
• what we will and will not allow AI to do with respect to your data;
• what rights you have when AI is involved in our services; and
• how to contact us with questions or requests.

1. Definitions

• "AI" means artificial intelligence, including generative AI systems and machine-learning models.
• "AI Service Provider" means a third party that provides AI inference, model hosting, or related services to Goosechase.
• "AI-Powered Feature" means any feature of the Service that uses AI to generate content, suggestions, classifications, or other outputs delivered to you.
• "Commercial-Tier Account" means a paid Anthropic, OpenAI, or other AI vendor account (such as Claude Team, Claude for Work, ChatGPT Business, or ChatGPT Enterprise) operating under the vendor's commercial terms, which incorporate a data processing addendum and prohibit use of customer inputs for model training.
• "User Content" has the meaning given in our Terms of Service §4.
• "Personal Information" has the meaning given in our Privacy Policy.
• "Student Data" means personal information of an individual under the Designated Age, including "covered information" under SOPIPA, "educational records" under FERPA, "covered information" under Texas SB 2087, and "student data" or "teacher or principal data" under New York Education Law §2-d.
• Capitalized terms used in this AI Use Policy that are not defined above have the meaning given to them in our Terms of Service or, where the term is not defined in the Terms of Service, in our Privacy Policy, in each case as in effect at the time the relevant question arises. If a definition in this AI Use Policy is inconsistent with a definition of the same term in the Terms of Service or the Privacy Policy, the definition in this AI Use Policy controls for purposes of this AI Use Policy only and does not modify the Terms of Service or the Privacy Policy for any other purpose. References to a section are to a section of this AI Use Policy unless otherwise stated; "including" means "including without limitation"; and the singular includes the plural (and vice versa).

2. Scope and Audience

This Policy applies to:

• AI used by Goosechase to provide AI-Powered Features in the Service;
• AI used internally by Goosechase personnel to assist them in operating the Service; and
• AI Service Providers acting as our sub-processors when they process Personal Information at our direction.

This Policy does not address (a) AI tools used by users on their own (for example, a Creator using a third-party AI tool to brainstorm a mission outside our Service); or (b) AI features of integrations a customer chooses to connect to its Goosechase account (which are governed by the integration provider's terms).

3. Our Commitments

Goosechase commits to the following in connection with all AI use covered by this Policy:

• Lawful basis. All AI processing of Personal Information is supported by a lawful basis under applicable law (Article 6 GDPR, CCPA business purpose, PIPEDA reasonable purpose, etc.).
• Commercial-tier accounts only. All AI use covered by this Policy, and all work-related AI use by Goosechase personnel, operates through commercial-tier accounts. Goosechase personnel are prohibited from using any free or personal-tier AI account for any work-related purpose, regardless of whether Personal Information is involved.
• No model training on your data. We do not use Personal Information, User Content, or any data we collect through the Service to train, fine-tune, or evaluate any generative AI or machine-learning model, whether ours or a third party's, without separate, explicit, opt-in consent.
• No model training on Student Data, ever. We do not use Student Data to train, fine-tune, or evaluate any AI/ML model under any circumstances. Any future change would require new, separate verifiable parental consent under 16 CFR §312.5 and any analogous state requirements.
• Vendor commitments. Each AI Service Provider's data processing terms (incorporated by reference into our commercial agreements with them) prohibit the provider from using our inputs or outputs to train its foundation models, require implementation of appropriate technical and organizational measures, and incorporate the EU Standard Contractual Clauses where applicable. Copies of the executed (click-through) commercial terms are archived in our internal vendor file.
• Human oversight. With one disclosed exception (AI-assisted evaluation of eligibility for pricing programs, see §5.5 and §8.2), we do not use AI to make any solely automated decision that produces legal effects concerning a user or similarly significantly affects a user. Where AI assists in customer support drafting, content review, or operational tasks, a Goosechase team member reviews the output before any action that materially affects the user is taken. Applicants whose applications are evaluated by AI for pricing-program eligibility have the right to request human review at any time (see §8.2).
• Transparency. We label AI-generated content delivered to users as AI-generated, in line with Article 50 of the EU AI Act and analogous transparency standards.
• Customer control. AI-Powered Features in the Service are on by default for every Organization. An organization administrator can disable them at the Organization level; individual users cannot override that setting for their Organization. The first time a Creator opens an AI feature, we surface an in-product notice describing the AI service provider, the data flow, and the Creator's responsibilities.
• Data minimization. We design AI-Powered Features to prevent the transmission of participants' Personal Information to AI Service Providers and explicitly advise creators not to input any PII.

4. Inventory of AI Vendors

The AI Service Providers Goosechase uses to deliver AI-Powered Features and to support internal operations are listed in our Sub-processors page, where each vendor's processor activities, cross-border transfer mechanism, and treatment of Student Data are described. The commitments in §3 (no training on customer data; commercial-tier accounts only; vendor data-protection terms in place), §6 (internal use of AI), and §7 (Student Data) apply to every AI Service Provider regardless of whether the vendor's name appears elsewhere in this AI Use Policy. We update the Sub-processors page when an AI Service Provider relationship begins, changes materially, or ends.

5. AI-Powered Features in the Service

We describe AI-Powered Features by purpose rather than by individual product name, so that we can add, change, or retire individual AI capabilities within these categories without amending this Policy. The current categories are:

• AI-assisted creation of Experiences;
• AI-assisted analytics and insights for Creators;
• AI-assisted safety and compliance review;
• AI-assisted customer support;
• AI-assisted accessibility; and
• AI-assisted evaluation of eligibility for pricing programs.

The same purpose-based framing is used in our Privacy Policies and Terms of Service. The list of specific capabilities and AI Service Providers within each category is in §4 above and on our Sub-processors page.

6. Internal Use of AI by Goosechase Personnel

Members of our team use commercial-tier generative AI tools to assist with productivity tasks. Internal policy requires:

• Commercial-tier only. Personnel are prohibited from using any free or personal-tier AI account for any work-related purpose, regardless of vendor and regardless of whether the prompt includes Personal Information. Personal accounts may not be used to draft, summarize, analyze, brainstorm, code, translate, or otherwise process any Goosechase work product.
• Data minimization. Personnel are trained to minimize the inclusion of Personal Information in prompts. When customer business information is necessary, it is provided in the form least identifiable to a natural person.
• Connector / MCP controls. Where a personnel AI client is connected to internal systems via an integration, Model Context Protocol ("MCP") server, or skill that can read or write Goosechase data, the integration is reviewed by Security and recorded in our internal AI Use Register. Each such integration is itself a sub-processor when it processes customer Personal Information and is subject to the controls in §3 ("Vendor commitments").
• No autonomous actions on customer accounts. Personnel may not configure AI agents to take autonomous actions (such as sending external communications, modifying customer records, or making refund decisions) without human-in-the-loop approval for each action that affects a user.
• Confidentiality. Personnel are bound by confidentiality obligations that extend to AI outputs derived from Goosechase data.

7. AI and Children / Students

Goosechase is committed to extra protections where AI may interact with the personal information of children, students, or other individuals under the Designated Age. The following commitments are in addition to those in our Student Privacy Policy:

• No training. Student Data is never used to train, fine-tune, or evaluate any AI/ML model.
• Default-on and not exposed to participants. AI-Powered Features are on by default for every Organization and can be disabled at the Organization level by an organization administrator. They are not made available to participant accounts and are configured not to receive Personal Information of participants in API calls. Educators using AI-Powered Features are responsible for ensuring that prompts they submit do not contain student Personal Information.
• Sub-processor controls. Sub-processors that may incidentally process Student Data have signed terms that (i) restrict processing to providing the Service, (ii) prohibit use of Student Data for product improvement, marketing, profiling, or model training, and (iii) require deletion of incidentally received Student Data on request.
• No AI advertising or profiling. AI is not used for targeted advertising to children, and AI outputs are not used to build profiles of students for any purpose other than providing the Service for a school purpose.
• NY Ed Law 2-d. In a New York educational agency context, AI sub-processors do not receive Ed Law 2-d Data unless the educational agency has authorized that processing in its supplemental contract with us. The full New York Education Law §2-d framework, including the Parents' Bill of Rights, the supplemental contract obligations under 8 NYCRR §121.3(c)(6), and the parent / eligible-student rights to challenge accuracy and request deletion, is set out in our Student Privacy Policy §6.11 and our Privacy Policy §10.10.
• District identity platform integrations. Where a K-12 customer district has procured Clever or ClassLink and authorised the optional single sign-on integration, Goosechase receives only the identity assertion required to authenticate users; identifiers and attributes received that relate to a K-12 student are treated as Student Data and, where applicable, as Ed Law 2-d Data. The substantive treatment is set out in our Student Privacy Policy §6.14 and our Privacy Policy §10.10.8.

8. Automated Decision-Making

9. AI-Generated Content Labeling (EU AI Act Article 50)

Beginning August 2, 2026, the EU AI Act (Regulation (EU) 2024/1689) imposes transparency obligations on AI-generated text, image, audio, and video content. Those obligations apply differently to providers, deployers, and publishers of the content, and depend on the type of content and the context of use.

• Where Goosechase deploys AI features for Creators, we ensure the AI nature of each feature is apparent at the point of use in the Studio interface, either through explicit disclosure or because it is obvious from the context of the interaction (Article 50(1)). Our upstream AI providers separately apply the machine-readable markings required of providers under Article 50(2).
• When a Creator incorporates AI-generated content into an Experience and publishes it to participants, the Creator acts as the deployer of that content. Terms of Service §16.4 records this allocation: Creators are responsible for their own compliance with applicable laws relating to AI-generated content, including any participant-facing disclosure obligations under Article 50 that may apply in their use case.

Goosechase monitors the European Commission's Code of Practice on AI-Generated Content and will align our practices with it where applicable.

10. Data Flows and Cross-Border Transfers

AI inference for Goosechase typically occurs in the United States. Personal Information sent to AI Service Providers may therefore be transferred from the EEA, the UK, Switzerland, Canada, and other jurisdictions to the United States. Our transfer mechanism for each AI Service Provider is identified on the Sub-processors page. As a baseline, we rely on the EU-US Data Privacy Framework (where the recipient is self-certified) and the EU Standard Contractual Clauses (June 4, 2021) supplemented by transfer impact assessments and additional technical and organizational measures as required.

For Quebec residents, we have completed the §17 transfer assessment under Quebec Law 25 with respect to the AI Service Providers identified on the Sub-processors page; a redacted summary is available on request.

11. Security

We apply administrative, technical, and physical safeguards designed to protect Personal Information processed by AI Service Providers, including: industry-standard encryption in transit and at rest; access controls limiting AI tooling to authorized personnel; logging and monitoring of AI tool use; vendor due diligence aligned with NIST CSF Function: Identify; and incident response procedures. Where Goosechase acts as a third-party contractor under New York Education Law §2-d, we apply the additional safeguards described in Privacy Policy §10.10.

12. Risk Assessment and Governance

Goosechase conducts a written risk assessment for each material AI use case before deployment, addressing the factors required by 11 CCR §7150 (CCPA risk assessment) and Article 35 GDPR (data protection impact assessment) where applicable. Each assessment identifies (i) purpose and necessity, (ii) data minimization and retention, (iii) accuracy and bias, (iv) human oversight, (v) security, and (vi) sub-processor diligence. Risk assessments are reviewed annually and on any material change to the AI use case. A redacted summary of an assessment is available to enterprise customers and educational agencies on request.

13. Acceptable Use of AI in the Service (User Obligations)

As a user of the Service, you agree:

• Not to use the Service, the App, the Web App, or the Website (or any data or content accessed through them) to train, fine-tune, evaluate, or otherwise develop any AI/ML model, whether your own or a third party's, without our prior written consent (this is also stated in Terms of Service §16.1);
• Not to use AI to generate content that violates the restrictions in Terms of Service §5 (including unlawful, harmful, or infringing content);
• Not to use AI to circumvent our access controls, security measures, or rate limits;
• To clearly identify AI-generated content if you incorporate it into an Experience you publish (consistent with Article 50 of the EU AI Act);
• Not to submit Personal Information of others to AI-Powered Features without an appropriate legal basis.

14. Acceptable Use of AI by Goosechase Personnel

Internal use of AI by Goosechase personnel is governed by an internal AI Acceptable Use policy in addition to this Policy. The internal policy:

• Prohibits the use of any free or personal-tier AI account for any work-related matter, regardless of vendor and regardless of whether Personal Information is involved;
• Prohibits entry of Personal Information of participants into any AI tool not listed in the AI Inventory (§4);
• Requires Security review of all High-tier connectors / MCP servers (§6.2) before they are used with customer data;
• Requires logging of AI use that involves customer Personal Information;
• Prohibits autonomous AI actions on customer accounts without human approval;
• Requires personnel to maintain confidentiality of AI outputs derived from Goosechase data; and
• Requires each member of personnel to review, on onboarding and at least annually thereafter, that they have read and will comply with this Policy and our internal AI Acceptable Use policy;
• Revokes commercial-tier AI seats and decommissions personnel-bound AI integrations on the same schedule as other access revocations during offboarding;
• Prohibits the use of Gmail aliases (for example, hi+anything@goosechase.com) or other shared-inbox aliasing to register AI accounts.

15. Your Rights

In addition to the rights set out in our Privacy Policy and Student Privacy Policy, you have the following AI-specific rights:

• Right to human review. Where AI assists in a decision affecting you, you may request human review by contacting us at hi@goosechase.com.
• Right to opt out of AI-Powered Features. AI-Powered Features in the Service are on by default and require organization-level opt-in. Customers and individual users may opt out of any AI-Powered Feature by adjusting account settings.
• Right of correction. If a decision is made about you using your Personal Information and you believe the input data is inaccurate, you may request correction under our Privacy Policy and applicable law.
• Right to lodge a complaint. You may lodge a complaint with your data protection authority (e.g., the Office of the Privacy Commissioner of Canada, the Quebec Commission d'accès à l'information, the California Privacy Protection Agency, or your EEA / UK supervisory authority).

16. Changes to this Policy

We will update this Policy as our AI program evolves. Material changes, including the introduction of new AI Service Providers that may process Personal Information of users, the introduction of solely automated decision-making, or any change to the no-training commitment, will be communicated by direct notice (email or in-product) at least 30 days in advance, and where required by law will not take effect until you have had a meaningful opportunity to object or withdraw consent. Non-material changes (e.g., editorial corrections, addition of detail to the inventory) will be reflected on this page with an updated "Last revised" date.

17. Contact

Questions, requests, or complaints regarding this Policy or our use of AI may be sent to hi@goosechase.com.

This AI Use Policy is effective as of June 15, 2026

This is a living document. We wish our world was as organized as a flock of geese flying south in a v-formation, but unfortunately, the intersection of technology and law can be messy due to its ever-evolving nature. We welcome questions and feedback from customers, parents, schools, and educational agencies as our AI program evolves.