Terms and Conditions

2.1 Age of Access

You must be at least the age of majority in your jurisdiction in order to access and use the Platform and represent and warrant that you have the right and authority to enter into and comply with the Terms.

2.2 Subscription

When using Services, Tartan hereby grants you a non-exclusive, non-transferrable, revocable, subscription to access and use the Platform, subject to your compliance with the Terms and any restrictions associated with your Account. If using the Services via the Application, also grants you a non-exclusive, non-sublicensable, non-transferrable, revocable, limited license to install and use the Application if downloaded from Tartan directly or from an authorized third party.

2.3 Accounts and Login Information

Access to and use of the Platform requires registering an account with Tartan ("Account"). Tartan may require you to verify your identity and select a username and password ("Login Information") as part of registering an Account. You are responsible for managing and ensuring the security, confidentiality and authorized use of your Account's Login Information and are prohibited from sharing your Login Information or your Account. You are solely responsible for any activity occurring under your Account, whether or not you authorized the associated activity, and you agree to notify Tartan immediately of any unauthorized use of your account. Tartan strongly recommends that you keep your Login Information confidential, and you shall notify Tartan promptly of unauthorized access to or use of your Account.

2.4 Verification

When registering your Account, signing up for a subscription and to deliver the services using the Platform, Tartan may collect a variety of personal information from you, including but not limited to your:

1. Student and Staff Identifiers (name, email address, school, title, department, references to district tools/services);
2. Simulation Outcomes (per-campaign results: clicked links, reported emails, completed training);
3. Technical and Security Logs (authentication timestamps, IP addresses, device fingerprints, rate-limit counters, page-load times, API latency, error stack traces);
4. Session and Behavioral Analytics (Click, scroll, anonymized text-exposure data; screens visited, buttons clicked, time spent on training content, phishing-report actions);
5. Web and Marketing Analytics (browser cookie or local-storage IDs, page views, IP-derived geolocation);
6. payment information; and
7. other information collected at the time of an Account registration.

Tartan will collect certain verified information when users sign up for our Platform, including but not limited to names, mailing addresses, phone numbers and emails, and other basic information regarding users who have been provided access to the Platform pursuant to your Account.

3.1 Subscription Fees

Unless you have purchased your access to the Platform through a third-party reseller ("Reseller") in which all Fees shall be detailed by and payable to such Reseller; Tartan charges fees for access to the Platform ("Fees"), as described on the Website or as presented to a subscriber via other means such as by email and outlined in the invoice provided to you and by agreeing to these Terms you hereby accept such Fees as described.

3.2 Automatic Renewal

Each subscription automatically renews for an identical term unless either party gives written notice at least 30 days before the current term ends. You must cancel the automatic renewal of your subscription by providing written notice to Tartan or if applicable, a Reseller, at least 30 days before the renewal date stated on your invoice.

3.3 Additional Schools or Users

Licenses are sold by school and by user type (employees and/or students). If during a term, you:

3.3.1 add schools not covered by your license,

3.3.2 import students or employees beyond the license you purchased, or

3.3.3 switch between "students-only" and "employees-only" configurations,

you must immediately purchase the appropriate additional licenses at our then-current rates.

3.4 Taxes

Fees excludes applicable taxes, which may be charged as required by the laws of a Subscriber's jurisdiction. Fees may be increased and charged accordingly, with such increased Fees effective upon 30 days' notice to Subscriber and shall be applicable upon the Fee payment after such 30-day notice period.

3.5 Invoices and Late Fees

You shall receive an invoice at time of payment, detailing Fees owed by you. Full and complete payment of Fees owed to Tartan is due net-30 days. Unpaid Fees owed to Tartan accrue interest at 1.5% per month (or the maximum legal rate, if lower). All Fees paid to Tartan are non-refundable.

4.1 Term

Unless otherwise specified in writing by Tartan, these Terms are effective on the date you create an Account and accept the Terms (the "Effective Date") and continues until terminated according to the Terms (the "Term").

4.2 Authorized Use

During your use of the Platform, you may not:

1. knowingly provide false or inaccurate information to Tartan;
2. use the Platform to send real-world malicious or deceptive emails;
3. allow anyone outside of your organization to access the Platform without Tartan's prior written informed consent;
4. alter, change or circumvent security related aspects of the Platform;
5. use any automated system (bot, spider, etc.) to access the Platform;
6. reproduce, rearrange, modify, change, alter, translate, create derivative works from, display, perform, publish, or distribute the Platform;
7. break, disrupt or attempt to break or disrupt any device used to support the Platform or another user's experience of the Platform or knowingly exploit a flaw or bug in the Platform;
8. store or transmit material that is infringing, libelous, unlawful or in violation of any person's rights or a group of people's rights;
9. use the Platform to provide information or data to a competitor of Tartan;
10. harass, abuse, stalk, threaten or impersonate any person or group of people, including any Tartan contractor, employee or agent;
11. upload unlawful, harassing, defamatory or otherwise inappropriate content to the Platform;
12. use hate speech, hate terms, racist speech, racist terms or any other words or symbols that signify hate towards any person or group of people, including derogatory comments against women or minorities;
13. sell, rent, lease or sublicense the Platform or access thereto, unless expressly permitted by Tartan in writing;
14. promote, encourage or undertake illegal activity; or
15. infringe or violate third-party rights including but not limited to: (i) contractual rights; (ii) copyright, patent, trademark or trade secret rights; (iii) privacy rights; (iv) publicity rights; or (v) confidential information,

as determined by Tartan in its sole and absolute discretion. Any breach of the provisions outlined in this section may result in immediate suspension or termination of access to the Platform, at Tartan's sole discretion, in accordance with Section 4.3.

4.3 Suspension and Termination

Your account access to the Platform may be suspended or terminated, without notice or compensation to you, at any time for any reason (or for no reason) including but not limited to technical issues, your non-compliance with the Terms, non-adherence to orders from a judge, court, regulatory agency, provincial or federal authority or educational standards board, failure to make a required payment or your failure to adhere to the terms of an agreement with Tartan. Tartan has sole discretion to lift a suspension or reverse terminated access. Your access to the Platform automatically terminates upon the earliest of the date: (a) 30 days after Tartan, or if applicable, Reseller, provides written notice to you; (b) 30 days following the date on which you, as a Subscriber, provide notice to Tartan or if applicable, Reseller, of your intention to terminate your access to the Platform; (c) of your non-compliance with the Terms, as determined by Tartan in its sole discretion; (d); or in connection with your access to and use of the Public Site, 10 days after you provide Tartan or if applicable, Reseller, written notice of termination. Cancellation or termination of your access to the Platform does not release you from any liability associated with your obligations to pay Fees associated with your Account or pursuant to any other Agreement you have with Tartan.

4.4 Connected Accounts and Environments

4.4 Connected Accounts and Environments. Certain features, including Google Workspace Audit, directory synchronization, Direct Message Injection ("DMI"), Threat Manager, and Breach Notifications, allow you to connect a third-party account or environment (such as your Google Workspace or Microsoft 365 tenant, or your domain's DNS records) to the Platform. You represent and warrant that you are authorized to establish such connection and to grant Tartan the access requested; that the individual establishing the connection is an administrator authorized to do so on behalf of your organization; and that you have obtained any consents required under your organization's policies and applicable law. Where you enable Breach Notifications, you further represent and warrant that each domain you submit for monitoring is owned or controlled by your organization, and you are responsible for publishing and maintaining the DNS record used to verify it. Where you enable features that deliver simulated phishing messages into user mailboxes or act on messages in user mailboxes (including DMI and Threat Manager actions), you authorize Tartan to insert, move, and delete messages in the connected environment as directed by your administrators, and you acknowledge that such actions — including permanent deletion of messages — are performed at your direction and are your responsibility. You are responsible for maintaining and, where appropriate, revoking these connections. Tartan accesses connected environments only as described in the Privacy Policy and only to provide the applicable features.

4.5 Use of Breach Findings

4.5 Use of Breach Findings. You may use breach findings provided through Breach Notifications only to protect your organization's accounts and users, and not to discipline, publicly disclose, or otherwise target any individual.

5.1 Tartan Ownership and Rights

Tartan retains all right, title and interest in the Platform, including but not limited to copyrights, copyrightable works, patents, patent rights, trademarks, trade names and trade secrets. The Terms do not convey any right, title or interest in, or constitute the sale of any right to the Platform or any software used in connection with the Platform.

5.2 Feedback and User Content

Through the Platform, you may provide Tartan with questions, responses, comments, customer feedback, recommendations, advice, ideas, submissions, forum posts, or other information ("User Content"). By providing User Content, you represent and warrant that all consents, licenses and rights necessary to license User Content to Tartan are obtained and hereby grant Tartan an irrevocable, fully-paid, royalty-free, non-exclusive, perpetual, worldwide license to User Content under all copyright, trademark, trade secret, patent, privacy and publicity rights and any other intellectual or industrial property rights you own or control to use, broadcast, disclose, display, distribute, modify, make derivative works of, publicly perform, publish, record, reproduce, sublicense (on multiple levels), translate, transmit or otherwise exploit for all purposes and in all formats and mediums without attribution, notice, permission, royalty or payment. Tartan is under no obligation to review or act upon any User Content that you may provide. You further agree that Tartan may use your organization's name and logo on its website and in promotional and marketing materials. To opt out and/or limit such use, please contact our support team.

6.1 Confidential Information

You, as a Subscriber, may receive (each, a "Recipient") confidential information not known or available outside of the other party (the "Discloser") including but not limited to: personal information (as defined in applicable privacy laws), Subscriber information, intellectual property, and other non-public information (collectively, "Confidential Information") (information known outside the Discloser and covered by a duty of confidentiality is also deemed Confidential Information). Notwithstanding the foregoing, Confidential Information excludes: (a) any information generally available to the public (otherwise than through any act or omission of Recipient); (b) any information obligated to be disclosed by law; and (c) any information known by Recipient prior to the Effective Date or obtained from a third party who is not under a confidentiality obligation to you and who has not received such Confidential Information from another in breach of a duty of confidentiality to Recipient.

6.2 Non-Disclosure

Recipient shall not disclose or use Confidential Information for any purpose other than to provide information, requested by directly by Discloser, or by Tartan, that requires use of Confidential Information. Recipient shall not disclose any Confidential Information of Discloser except to its employees, contractors or agents on a need-to-know basis and only if such employees, contractors or agents agree or have already agreed to similar confidentiality terms. If Recipient becomes aware of any unauthorized disclosure or use of Confidential Information, Recipient shall promptly notify Discloser and Tartan of such disclosure or use. Recipient acknowledges and agrees that no rights or licenses to Confidential Information are granted or implied by these Terms except as otherwise explicitly stated in these Terms.

6.3 Security

Tartan is committed to ensuring that anything you share with us is secure. In order to prevent unauthorized access to the Platform or Subscriber's personal information, Tartan has put in place suitable physical, electronic and managerial procedures to safeguard and secure systems.

7.1 Disclaimer

THE PLATFORM IS PROVIDED TO YOU "AS IS" AND TARTAN AND ITS SUBSIDIARIES, AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, REPRESENTATIVES AND ASSIGNS (COLLECTIVELY, "REPRESENTATIVES"), DISCLAIM ALL REPRESENTATIONS, WARRANTIES AND CONDITIONS, EXPRESS, IMPLIED OR STATUTORY, INCLUDING WITHOUT LIMITATION MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT OF THIRD-PARTY RIGHTS OR COMPLIANCE WITH LAWS WITHIN YOUR JURISDICTION. WITHOUT LIMITING THE FOREGOING, TARTAN MAKES NO REPRESENTATIONS OR WARRANTIES THAT USE OF THE PLATFORM WILL NOT INFRINGE ANY COPYRIGHT, PATENT, TRADEMARK LAW OR OTHER RIGHTS HELD BY A THIRD PARTY. FURTHER AND WITHOUT LIMITING THE FOREGOING, TARTAN AND ITS REPRESENTATIVES MAKE NO REPRESENTATIONS OR WARRANTIES THAT THE PLATFORM, SERVICES PERFORMED AND PRODUCTS PROVIDED BY TARTAN OR OTHER THIRD PARTIES, WILL COMPLY WITH APPLICABLE LAWS WITHIN YOUR JURISDICTION, MEET YOUR REQUIREMENTS, NOT CAUSE DAMAGE TO YOU, YOUR PROPERTY OR PROPERTY OF OTHERS, OR THAT THE OPERATION OF THE PLATFORM WILL BE UNINTERRUPTED, CONTINUOUSLY AVAILABLE AND ERROR FREE. NO ORAL ADVICE OR WRITTEN INFORMATION PROVIDED BY TARTAN AND ITS REPRESENTATIVES WILL CREATE ANY WARRANTY AND YOU SHALL NOT RELY EXCLUSIVELY UPON SUCH ADVICE OR INFORMATION. YOU BEAR THE ENTIRE RISK AS TO THE PERFORMANCE, OPERATION AND QUALITY OF THE PLATFORM.

7.2 Limitation of Liability

TARTAN AND ITS REPRESENTATIVES SHALL NOT BE LIABLE TO YOU FOR ANY CLAIM, LOSS OR DAMAGE OF ANY KIND ARISING OUT OF OR RELATING TO THE PLATFORM, THIRD-PARTY SERVICES, OR RESALE ACTIVITIES, INCLUDING WITHOUT LIMITATION DIRECT, CONSEQUENTIAL, INCIDENTAL OR SPECIAL DAMAGES. TO THE EXTENT THAT THE ABOVE LIMITATION OF LIABILITY IS NOT APPLICABLE IN YOUR JURISDICTION, ANY CLAIM THAT YOU MAY HAVE AGAINST TARTAN AND THE REPRESENTATIVES MUST BE COMMENCED NO LATER THAN 6 MONTHS AFTER THE DAY ON WHICH THE CLAIM IS DISCOVERED OR OUGHT TO HAVE BEEN DISCOVERED BY YOU.

7.3 Maximum Aggregate Liability

NOTE THAT SOME JURISDICTIONS DO NOT ALLOW THE DISCLAIMER OF CERTAIN TERMS OR WARRANTIES OR EXCLUSION OF LIABILITY FOR CERTAIN DAMAGES AND, IF ANY DISCLAIMER OR LIMITATION OF LIABILITY IS FOUND UNENFORCEABLE, VOID OR DOES NOT FULLY SHIELD TARTAN AND THE REPRESENTATIVES FROM LIABILITY, YOU AGREE THAT TARTAN'S (AND THE REPRESENTATIVES') MAXIMUM AGGREGATE LIABILITY IN ANY CASE WHATSOEVER WILL BE THE TOTAL AMOUNT PAID BY YOU TO TARTAN IN THE 12 MONTHS IMMEDIATELY PRECEDING THE DATE OF THE HARM IN QUESTION.

7.4 Indemnity

You shall defend and indemnify Tartan and its Representatives against any claim, demand, suit or proceeding made or brought against Tartan and its Representatives in connection with your use of the Platform, including claims that Tartan, the Platform, a Subscriber, or you: (a) infringe or misappropriate a third party's intellectual property rights through images or other data provided to Tartan; (b) violate any applicable law, including any failure to obtain the required legal documentation, including applicable consent documentation, prior to using the Platform; (c) cause bodily harm or death; (d) violate the terms of a third-party agreement to which you are bound; or (e) commit an act of negligence, gross negligence or intentional misconduct. Your obligation to indemnify Tartan and its Representatives arises so long as Tartan: (x) promptly gives written notice of the claim against Tartan; (y) gives you sole control of the defense and settlement of the claim except that you shall not enter any settlement or disposition that attributes liability or confers a financial obligation on Tartan without Tartan's advance written consent, which shall not be unreasonably withheld or delayed; and (z) gives all reasonable assistance, at your expense.

7.5 Security Assessment and Third-Party Data Disclaimer

7.5 Security Assessment and Third-Party Data Disclaimer. Any security assessments, audit findings, scores, or recommendations provided by the Platform (including through Google Workspace Audit) are generated by automated checks against third-party benchmarks and frameworks and are provided for informational purposes only. They do not constitute a guarantee that your environment is secure, free of vulnerabilities, or compliant with any law, regulation, or standard. Breach exposure information provided through Breach Notifications is derived from third-party sources, including Have I Been Pwned, that catalogue publicly disclosed data breaches. Tartan does not control these sources and does not warrant that breach information is accurate, complete, or timely, that alerts will be delivered within any particular time, or that the absence of a finding means an address has not been compromised. Breach Notifications reports findings to your administrators only; Tartan does not notify affected individuals, and you are responsible for determining and carrying out any response, including any communication with affected individuals. You are solely responsible for evaluating and implementing any changes to your environment, and Tartan is not liable for any decision made, or action taken or not taken, in reliance on such assessments, findings, or breach information.

8.1 Initial Dispute Resolution

Most disputes between you and Tartan can be resolved without resort to legal action. If you have any dispute with Tartan, you agree that before taking any formal legal action you will contact our support team and provide a brief, written description of the dispute and your contact information. You and Tartan agree to use commercially reasonable efforts to settle any dispute, claim, question, or disagreement directly through consultation, and good faith negotiations shall be a condition to either party initiating a lawsuit or arbitration.

8.2 Binding Arbitration

If you and Tartan cannot come to a resolution within 60 days after informal dispute resolution is initiated under Section 8.1, any disputes or claims between you and Tartan or any of its Representatives shall be resolved by confidential, final and binding arbitration under the Simplified Arbitration Rules of the ADR Institute of Canada, Inc. in effect when the arbitration is commenced (the “Rules”), before one arbitrator. The seat of arbitration is Toronto, Ontario, Canada, and the language of the arbitration is English. Any hearing may be conducted virtually unless the arbitrator directs otherwise. Any award may be enforced in any court of competent jurisdiction. Arbitration fees and the arbitrator’s compensation shall be governed by the Rules. BY AGREEING TO ARBITRATION, YOU UNDERSTAND THAT, TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, YOU ARE WAIVING THE RIGHT TO SUE IN COURT OR HAVE A JURY TRIAL FOR ALL CLAIMS SUBJECT TO ARBITRATION.

8.3 Class Action Waiver and Prohibition

YOU AGREE THAT ANY ARBITRATION OF A DISPUTE OR CLAIM SHALL BE LIMITED BETWEEN TARTAN, THE REPRESENTATIVES (IF APPLICABLE), AND YOU INDIVIDUALLY. TO THE FULL EXTENT PERMITTED BY APPLICABLE LAW, NO ARBITRATION SHALL BE JOINT WITH ANY OTHER AND YOU HAVE NO RIGHT OR AUTHORITY TO: (A) ARBITRATE A DISPUTE OR CLAIM ON A CLASS-ACTION BASIS OR TO UTILIZE CLASS-ACTION PROCEDURES; AND TO (B) RAISE A DISPUTE OR CLAIM IN A REPRESENTATIVE CAPACITY ON BEHALF OF THE GENERAL PUBLIC OR ANY OTHER PERSONS. YOU UNDERSTAND AND AGREE THAT YOU ARE WAIVING THE RIGHT TO HAVE ANY DISPUTE OR CLAIM RESOLVED AS A PLAINTIFF OR MEMBER OF A CLASS ACTION.

9.1 No Joint Relationship/Independent Contractor Relationship

Nothing in the Terms shall be construed to create any joint partnership, joint venture, employer-employee or agency relationship between you and Tartan.

9.2 Privacy Policy and Privacy Law Compliance

Your use of the Platform is governed by a Privacy Policy ("Privacy Policy") detailing how Tartan collects, uses and discloses personal information about you, and is available at https://tartan.app/privacy-policy/. By agreeing to the Terms and/or using the Platform, you represent and warrant that your use of the Platform complies with applicable privacy laws and are permitted to share the personal information that you share with Tartan. If at any time you disagree with the Privacy Policy, you must immediately stop use of the Platform and contact our support team.

9.3 Joint and Several Liability

If Subscriber is more than one person, all of the covenants and liabilities of Subscriber shall be joint and several.

9.4 Governing Law

The Terms and Privacy Policy are governed by the laws of the province of Ontario and the applicable laws of Canada, without reference to principles of conflicts of laws. Subject to Section 8, the parties irrevocably attorn to the jurisdiction of the courts of Ontario for proceedings permitted in support of arbitration, enforcement of arbitral awards, and any disputes or claims not subject to arbitration. Nothing in this Section limits enforcement of an arbitral award in any court of competent jurisdiction.

9.5 Severability and Waiver

If any provision of the Terms or Privacy Policy is held by a court of competent jurisdiction to be invalid or unenforceable, such provision shall be changed and interpreted so as to best accomplish the objectives of the original provision to the fullest extent allowed by law with remaining provisions of the Terms in full force and effect. No failure or delay by a party in exercising any right, power or remedy under the Terms constitutes a waiver.

9.6 No Conflicts

You confirm that by agreeing to the Terms or providing services through Tartan, you are not violating the terms or provisions of any other agreement you have with a third party.

9.7 Force Majeure

Except for any payment obligations, neither you nor Tartan shall be liable for failure to perform any obligation under the Terms to the extent such failure is caused by a force majeure event (including acts of God, pandemics (including government-imposed recommendations and restrictions due to a pandemic), natural disasters, war, civil disturbance, action by a government entity, strike, and other causes beyond reasonable control). The party affected by the force majeure event shall provide notice to the other party within a commercially reasonable time and shall use commercially reasonable efforts to resume performance as soon as practicable. Obligations not performed due to a force majeure event shall be performed as soon as reasonably possible when the force majeure event concludes.

9.8 Assignment

Tartan may assign the Terms to another legal entity without your consent. Subscriber cannot assign the Terms without Tartan's written consent. Notice of any assignment by Tartan shall be provided within 30 days of assignment.

9.9 Survival

Sections 2 to 9 survive termination of the Terms.

9.10 Entire Agreement

The Terms, together with the Privacy Policy and any other agreed upon documents linked to in these Terms, constitute the entire agreement between you and Tartan with respect to the subject matter hereof and supersedes any prior oral or written agreements, communications, representations or undertakings provided.

9.11 Updates

Tartan reserves the right to modify the Terms at any time (each, an "Update"). After informing you of an Update, you are deemed to accept any Update by continuing to use the Platform unless you terminate the Platform. Unless Tartan states otherwise, an Update is automatically effective 30 days informing you of such Update.