Organisation terms

Last updated 30 September 2026. Written in plain language on purpose, because a contract your teachers cannot read is a contract that protects nobody.

1. Who this agreement is between

These terms govern an organisation pilot, service or future licence between the school, district, academy or tutoring organisation named on a signed order form ("the school") and Receiptsproof Pte. Ltd. (UEN 202638224N), a private limited company incorporated in Singapore and the operator of Receipts ("we", "us"). A free pilot does not itself create a paid contract. A paid engagement begins only under a signed order form naming the exact contracting entity, jurisdiction, scope, price and authorised signatories. Where these terms and a signed order form conflict, the signed order form wins.

Two words used later, defined now so neither side can bend them: a material change is one that removes a feature the school was sold, raises the price mid-term, or reduces the data protections in section 5. A material breach is a failure to perform a core obligation that the party at fault does not fix within 14 days of written notice. A core obligation means the free student promise in section 2, the data protections in section 5, the fairness rules in section 6, or a total failure to provide the licensed product. A single late support reply, a single late data answer, or any one missed response time is not a material breach; the remedy for a missed response time is the service credit in section 2, not termination.

2. What your school is entitled to demand from us

The current free pilot includes only the scope stated on the school page. A paid implementation or future licence includes only the obligations its signed order incorporates; for the current tutoring-practice implementation, the four-hour, one-training and 30-day support limits in that order replace the broader allowances below.

• Setup done with you, not sold to you. Configuration of Receipts around your classes, your assignment flow and the tools you already use, delivered before the licence period is treated as started.
• Teacher training, live. At least one live training session for your teaching staff at launch, run by the founder or a trained member of our team, plus a written guide your teachers can keep. One refresher session per school year on request, up to two hours, at no extra cost; longer or additional sessions can be arranged.
• Support with a named human. Email support answered within one business day, and in practice usually the same day, by a real person, not a ticket queue. Anything that blocks students from writing or teachers from reviewing is treated as urgent, meaning we respond the same business day. If we repeatedly miss these response times in a term, the school's remedy is a service credit of up to one month of the licence fee, not termination; a single late reply is not a breach.
• Written answers about data. If your administration, your board, your IT team or a parent asks what data exists, where it lives and who can see it, you are entitled to a written answer within five business days, accurate and complete. Where a question repeats one already answered in writing, we may point to the earlier answer.
• No surprise changes to a signed deal. Your price is fixed for the term stated on your order form. We cannot raise it mid-term, remove a feature expressly sold mid-term, or move an expressly included feature behind a higher tier during that term.
• The free student promise, contractually. Recording, replay, proof links and process observations remain free for every student, whether or not an organisation buys anything. The free tier's in-app history is kept for 40 days as described in the consumer terms, while proof files and records a student has already exported remain under that student's control. No current organisation order extends paid history or paid features to separate student accounts.
• A real exit. No data lock-in exists because we do not hold your students' writing. If you leave, exported proof files and records in student-controlled storage remain theirs, while hosted product access follows the then-current individual terms.
• Notice of material changes. At least 30 days written notice before any change to these terms that affects your school, with the right to terminate and receive a pro-rated refund if you do not accept the change.

3. What a signed organisation order includes

• Use of the free core workflow by participating students and staff, subject to the individual product terms and the voluntary-participation rules below. This is not an organisation-wide paid entitlement.
• Organisation-wide paid features are included only if the signed order form names the tested entitlement method and the setup acceptance test for separate purchaser, staff and student accounts. No current order includes them.
• Only the configuration and private hand-in work named in the signed order. No direct Google Classroom integration is represented as live.
• The software includes an optional roster, assignment hand-in service, teacher dashboard and assistant. A sample dashboard does not connect a real class. These features are not included merely because a page is accessible: the applicable signed order must name the enabled features, stored fields, providers, price and delivery date before organisation activation.
• Only the support and training allowance named in the signed order.

3a. What "custom to your school" means, precisely

"Custom setup" means configuring and fitting the existing product to your school: your classes, your assignment flow, your submission process, your training needs and your rollout plan. It is a promise of fit, not a promise of bespoke software. Anything that requires building new functionality is handled as follows:

• Configuration: fitting the product as it exists to your organisation, including how private hand-in works with the current process, training materials and rollout scheduling. No hours are included unless the signed order states the cap. The current tutoring-practice implementation includes four total founder hours, including preparation, testing and training.
• No current founding build obligation: pilot feedback may steer priorities, but it creates no obligation for the school to buy or for us to deliver a feature by a date.
• Bespoke development (by written agreement only): features specific to one school are agreed in a written statement of work naming the deliverable, the date, the price if any, and, where the feature stores any data, an amendment to the data inventory in section 5. No verbal promise of future functionality binds either party.
• The three refusals that survive any customisation request: nothing will be built that outputs verdicts on students, nothing will be built that records outside the Receipts editor, and nothing will be built that stores student writing on our servers. Sections 4 and 5a apply to custom work without exception.
• Early features: anything marked beta or early access may change or be paused as it improves, with notice to affected schools. Nothing so marked carries a core promise from section 2 or section 4.

3b. Acceptable use by school staff

Teacher accounts are personal to the staff member and are not shared logins. Staff use Receipts to support teaching at the school, not to access or attempt to access another school's data, and not to work around the storage limits in section 5c. We may suspend an individual account misused this way, with notice to the school's administrator, without affecting any other account.

4. What the licence does not include, stated so nobody discovers it later

• No verdicts. Receipts never outputs a decision that a student cheated, and no feature will be added that does. It is not an AI detector and produces no score claiming a text is or is not machine written.
• No surveillance. Nothing is recorded outside the Receipts editor. There is no screen monitoring, no browser tracking, no background capture, and we will not build these, for any customer, at any price.
• No access to records students have not shared. A student's record becomes visible to a teacher when the student submits or shares it. The school licence does not create a back door into student records, and none exists for us to grant.
• No guarantee of any academic outcome, of what any external body will accept as evidence, or of any particular result in any dispute.

5. Student data, in detail

This is usually the longest negotiation in an education contract. Here it is settled in advance, precisely, because the honest answer is different for the two ways a school can run Receipts, and a school is entitled to know exactly which data exists in each before signing.

5a. The constant, in every mode

• Student writing never reaches our servers, in any mode. Documents, keystroke logs, timing data, drafts and deletions live in the student's browser and, if the student signs in, in the student's own Google Drive, under a permission scope limited to files the app created plus any single file the student personally opens through Google's file picker. This is architecture, not policy: we could not produce a student's essay if ordered to, because we do not have it.
• Records cannot be silently altered in the viewer. Each record displays client-side SHA-256 fingerprints over the displayed document and record. A difference made without recomputing them is visible, but because the same browser computes them they are not an independent seal and do not make a portable record unforgeable. A Drive short link also carries a digest for its fixed Drive snapshot. When an adult directly imports a Google Doc, Google's available revision snapshots and timestamps provide separate, periodic context; they may be incomplete and do not establish who operated the account.
• Nothing here ever trains an AI model. No student writing, no keystroke data and no school-layer data is used to train any AI or machine learning model, ours or anyone else's, in any mode.
• The consumer privacy policy at receiptsproof.com/privacy governs the standalone product students use on their own; this section governs any organisation service or future licence that a signed order adds. Where a student uses both, both protections apply.
• No mode changes this without a signed order form amendment. No customisation request, however phrased, moves student writing onto our infrastructure. If a requested feature would require it, the request is declined under section 3a.

5b. Standard mode: zero school-side storage

In standard mode, students write in Receipts and attach their proof link when they turn in work through whatever the school already uses, including Google Classroom. In this mode we store nothing for the school at all. No roster, no class list, no submission index. The links travel through the school's own systems, under the school's own agreements with those providers. Google Classroom is the school's relationship with Google; we are not a party to it, we read nothing from it, and no Receipts code runs inside it. Most schools can run this mode on day one, and it is the default unless the order form says otherwise.

5c. School layer mode: the exhaustive data inventory

The optional school layer is separate from standard mode. A signed order must authorize its activation and data inventory. Its server-side inventory is:

• A class code, encrypted class label, teacher credential hash and public encryption key.
• Hashes of individual student links and revoked links. The mapping from those links to student names stays in the teacher's browser.
• For each submission: assignment identifier, encrypted link reference to the student-held record, integrity hash, receipt timestamp, any student-supplied timestamp and rule version, and a student-link hash or encrypted typed name.

The teacher's browser separately holds roster names, assignment titles and due dates, computed receipt summaries, notes, the conversation and class access material. These are not a server backup. The optional assistant sends the teacher's request, recent conversation, coded receipt summaries and tool results through Vercel to Anthropic. Recognised roster names are replaced with student codes, but free text can still identify someone. Do not enter student writing, private links or personal information into assistant requests or notes. The assistant does not automatically receive essay text or the full editing record.

Never stored in the class drop box: essay text, keystroke or timing records, drafts, deletions, replay content, grades, disciplinary notes or free-text commentary about a student. Assistant processing has the separate scope above. Any additional stored field or processing purpose must be agreed in the signed data inventory before it is enabled.

• Where it lives: Vercel processes requests; Upstash stores class and submission metadata. Sensitive labels, typed names and proof references are encrypted before storage. Student writing stays in student-controlled browser storage or Drive.
• Who can see it: staff the school authorises, and us only as needed for requested support. Class-encrypted writing requires the private key held by the teacher; Receipts does not hold that key.
• Ownership and export: school-layer data belongs to the school. A complete export in a standard format is provided within 10 business days of a written request, at no charge once per term; unusually frequent repeat requests may carry a fee of no more than US$200, agreed in writing before the work.
• Retention and deletion: submission entries expire 30 days after receipt and are pruned on inbox reads and new hand-ins. Class metadata has a 30-day expiry refreshed by relevant activity, including authenticated inbox reads. Teachers may delete entries or the class sooner. On termination or written request, data in our custody is deleted within 30 days, with written confirmation. Browser copies, downloaded files and student-owned Drive records must be deleted by their owners.
• Proof links are sensitive. Ordinary proof links let a holder view the record. A class-encrypted snapshot also requires its class key. Each send preserves a separate snapshot; older files remain in the student's Drive until deleted. Stored references never appear in application logs or analytics.

5d. Google Classroom, stated exactly

Today, "works with Google Classroom" means the proof link travels inside the school's existing Classroom submission flow, with no connection between our systems and Google Classroom. If the school later wants roster or assignment sync through the Classroom API, that is an optional module: the exact Google permission scopes it uses and every field it reads or stores are listed on the order form before activation, section 5c's inventory is amended in writing to match, and the school can decline the module without affecting the rest of the licence.

5e. Compliance, subprocessors, younger students, breach

• US schools and FERPA: in standard mode we hold no education records at all. In school layer mode we act as a school official with a legitimate educational interest, under the direct control of the school as to how the records are used and kept, use the data solely to provide the service, and do not redisclose it to anyone except the subprocessors named below. This is designed to meet the school-official exception in 34 CFR 99.31(a)(1). Where the customer is not a FERPA-covered school, for example a tutoring organisation, the protections in this section still apply as contract terms.
• State student privacy laws: we do not sell student data, we do not build advertising profiles from it, and we do not use it to target advertising at students or anyone else. On request we will sign the Student Data Privacy Consortium's National Data Privacy Agreement or your state's required student data addendum, provided it is consistent with the architecture described in this section; where a district form goes further than these terms, we propose changes rather than sign as is. For New York schools using the school layer, a signed Parents Bill of Rights under Education Law 2-d and our written data security plan are attached to every order form by default, at no charge.
• Where the data lives: the order form must state the verified hosting and processing regions before school-layer activation. A US-only hosting or access requirement must be configured and verified before that use begins. We are based in Singapore, so support may otherwise involve access from outside the school's country. Nothing in section 16 reduces the commitments in section 5, whichever law governs a dispute.
• Security verification: on request, no more than once per year, we complete the school's standard security questionnaire and provide reasonable evidence of the controls described in section 5f.
• Who else touches anything (subprocessors): Vercel hosts the site and processes school-layer and assistant requests. Upstash stores class and submission metadata when the class service is enabled. Anthropic processes requests, coded receipt summaries and tool results when the live assistant is enabled; its API data-handling terms apply. Google provides sign-in and the student's own Drive, which is the student's relationship with Google, not ours. Polar processes individual purchases as merchant of record and organisation payments where a signed order uses a Polar checkout link; it never sees student work. Stripe may process organisation invoices where a signed order names it, holds the customer's billing details, and never touches student data. The signed order must identify which of these providers apply. This description does not activate a feature or amend an existing order. Any material provider or processing change remains subject to the 30 days notice and rights described in section 2.
• Younger students: the customer must identify the minimum digital-consent age and any parent or guardian notice and consent rules that apply where each student lives. Before a younger student signs in, connects Drive or shares a proof record, the customer obtains and retains any permission required by law and its own policy. A school may act as a parent's agent only where the law permits and only for school-directed educational use for the school's benefit. A tutoring organisation or other non-school customer may not assume school-agent status. Where permission is absent or uncertain, the student uses the no-account path or does not participate. Receipts does not use a child's information for advertising or independent marketing.
• If a breach of school-layer data ever occurs, we notify the school in writing without undue delay and no later than 72 hours after becoming aware, naming what was affected, what it contained, and what we are doing about it, and we promptly give the school whatever it needs to meet any legal duty it has to notify students or parents itself.

5f. Security commitments for the school layer

• Access to school-layer data is limited to the fewest people who need it: staff the school authorises, and us when providing support the school asked for. No school's data is ever visible to another school.
• Administrative access on our side requires strong sign-in with a second factor, and these protections are reviewed at least once a year.
• If you or a security researcher believes you have found a vulnerability, email Receiptsproof Pte. Ltd. at hello@receiptsproof.com. We acknowledge within two business days, investigate promptly, and fix confirmed issues before details are made public. We will not pursue a good-faith researcher who reports responsibly and does not access real student data while testing.
• The data privacy contact for everything in section 5 is Receiptsproof Pte. Ltd., attention Leo Brier, founder, at hello@receiptsproof.com.

6. Fairness rules the school agrees to

These exist to protect students, and they are the one part of this agreement where we place obligations on the school. They are conditions of the licence:

• Absence of a record is never evidence of guilt. A student who wrote on paper, on a phone, with assistive input, or simply outside Receipts has not proven anything either way, and must not be treated as though they have.
• No single signal decides anything. The record is context for human judgment. Disciplinary decisions must rest with your staff and your existing process, not with any number Receipts displays.
• Records belong to students. Participation in a pilot is voluntary and the school provides an equivalent non-Receipts route. A school policy may specify an assignment format only where law, accessibility duties and school policy permit it, and it must still provide a reasonable alternative. Missing, broken, incomplete or unusual evidence is never treated adversely. The school may not demand access to a student's other documents or records beyond what the student chooses to submit.

7. Pricing, invoicing and payment

• The pilot is free. A paid school licence is offered only after a pilot, at the yearly price published on the schools page for the school's size band, and only under a signed order form that states the price, coverage, delivery and renewal terms before payment.
• Founding schools: the first three schools to sign a licence after a pilot pay half of the published price, fixed for three years from the start date. A slot is taken only when the order form is signed and the first payment has cleared. A free pilot does not by itself reserve a discount, create an obligation to buy, or create an obligation for us to build a feature by a date.
• Invoices are issued in the name of Receiptsproof Pte. Ltd.; purchase orders are accepted; payment by bank transfer, check or card, due within 30 days of invoice. An invoice issued under any other name is not ours and should not be paid.
• Prices exclude any applicable taxes, which appear separately on the invoice where required.
• Public school districts: any future paid order and multi-year rate are subject to annual appropriation of funds by the district's governing body. If later funds are not appropriated, the district may end at term close without penalty.
• Late payment: if an invoice is more than 15 days past due, we may suspend teacher accounts and school-layer features after 5 business days written warning, restoring access within one business day of payment. Students' free tier is never suspended, for any reason. We do not suspend over an invoice the school has disputed in writing and is resolving in good faith.

8. Fees are final

This paragraph applies only if a future signed order expressly sells a term licence. Licence fees are non-refundable once that term starts, except where these terms or the order provide a refund. A school unsure whether Receipts fits should use the free pilot first: one class, one real assignment cycle or 30 days, whichever ends first, no charge, one pilot per school. The current tutoring-practice implementation is a one-time service with its own acceptance, cancellation and refund rules in the signed service order; it is not governed by this licence-fee paragraph.

9. Term, renewal and termination

• The licence runs for one year from the start date on the order form, unless the order form says otherwise.
• We send a renewal notice at least 45 days before term end. Nothing renews silently: renewal happens by the school accepting a renewal invoice, not by automatic charge.
• Either party may decline renewal without reason. The school may terminate mid-term for our material breach that we fail to cure within 14 days of written notice, with a pro-rated refund of prepaid fees.
• We may suspend or terminate the school layer, on written notice, if the school uses Receipts in clear breach of the fairness rules in section 6 and does not correct it within 14 days of that notice. Students keep the free tier and their records regardless.
• On any termination or non-renewal: students retain exported proof files and records in storage they control; accounts revert to the then-current free-tier rules; the school owes nothing further beyond fees already due.

10. Availability and what an outage means here

Receipts is provided as is, without an uptime guarantee, and it is run by one person, which the school knows and accepts. We do not currently carry commercial insurance; if your district's procurement requires a certificate of insurance, say so before signing and we will tell you honestly whether we can meet it. The honest mitigation is architectural: because writing and records live in the student's browser and their own Drive, an outage on our side does not destroy work, does not lose records and does not stop anything already written from being replayed later. We treat anything blocking students or teachers as urgent under the support terms in section 2. Neither party is responsible for delay caused by events genuinely outside its control, provided it tells the other promptly and keeps the impact as small as it can.

11. Intellectual property

• Students own their writing, entirely and always. We claim no licence over it and could not exercise one, since it is never sent to us.
• Receiptsproof Pte. Ltd. owns or has been validly assigned all intellectual property in the Receipts software, and warrants it has the right to grant this licence.
• We own the Receipts software, brand and site. The licence grants use, not ownership.
• Neither side may use the other's name, logo, testimonial or reference publicly without separate written consent.
• Feedback, suggestions and feature ideas the school gives us may be used to improve Receipts for every school, without payment or credit owed and without creating any ownership claim over the result. Anything the school marks confidential stays confidential.

12. Liability

• To the maximum extent permitted by law, our total liability under this agreement is capped at the fees the school paid in the 12 months before the claim arose.
• Neither party is liable to the other for indirect or consequential loss.
• For a breach of section 5, the cap is the greater of the fees paid in those 12 months or US$25,000. This higher cap is the total for all section 5 claims combined. Liability that cannot lawfully be limited, including for our own gross negligence or willful misconduct, is not limited by this section.
• If a third party claims that Receipts, as we provided it, infringes their US copyright, patent or trade secret, we will defend the school against that claim and either make the product non-infringing, replace the affected part, or refund the unused portion of the term. This is the school's remedy for infringement claims, and our total cost of defense and settlement counts toward the liability cap in this section. In return, the school is responsible for claims that arise from its own academic or disciplinary decisions, its use of records in those decisions, or its representations to students and parents; those decisions are the school's alone under section 6.
• Nothing in this agreement limits liability that cannot lawfully be limited.
• Academic and disciplinary decisions, and their consequences, are the school's alone. Receipts supplies evidence for humans to weigh; section 4 says what it cannot do, and the school agrees not to represent it otherwise to students or parents.

13. Changes to these terms

The date at the top changes when these terms change. For schools mid-term, section 2 applies: 30 days notice of any material change, and a refund-backed right to leave rather than accept it.

30 September 2026: clarified the optional class service and assistant, data inventory, providers, retention and region verification. Existing orders retain their notice and amendment requirements; publication alone does not activate these features for a school.

14. Assignment and successors

Receipts is operated by Receiptsproof Pte. Ltd., a private limited company incorporated in Singapore, which is the contracting party under these terms. Every agreement under these terms is signed for the company by a director or another person the company has authorised in writing, and that signatory represents they have authority to bind the company. We may assign this agreement, without the school's consent, to a successor entity that agrees in writing to assume every obligation in it, including section 5; the school's rights, price and term carry over unchanged, we give written notice when it happens, and a copy of the written assumption is provided on request. If a successor will not meet the data commitments in section 5, the school may terminate under section 9 with a pro-rated refund. The school may not assign this agreement without our written consent, except to a successor institution in a merger or reorganisation of the school itself, where consent will not be unreasonably withheld.

15. Notices, severability and the whole agreement

• Written notice to us goes to Receiptsproof Pte. Ltd. at hello@receiptsproof.com; written notice to the school goes to the contact named on the order form. Email counts as written notice under this agreement.
• If any part of these terms is found unenforceable, the rest stands, and the unenforceable part is read as close to its intent as the law allows.
• These terms plus the signed order form are the entire agreement, replacing prior discussions. A waiver of one breach is not a waiver of the next.
• Sections 5, 11, 12, 15 and 16, along with any payment already owed, survive termination or non-renewal. Exported proof files and records in student-controlled storage remain theirs. Access to the hosted app and free tier continues only while Receipts operates. Everything else ends when the licence does.
• This agreement and any order form may be signed electronically, including by e-signature service or a signed copy sent by email, and in counterparts that together form one agreement.

16. Governing law and disputes

For a school in the United States, this agreement is governed by the law of the school's home state, and each party consents to the state and federal courts located there. For schools elsewhere, and wherever the order form says so, the law of Singapore governs. In every case, both parties raise any dispute in writing, attempt resolution in good faith for 30 days, and then attempt mediation by video with a neutral mediator before any court filing, except where urgent relief is needed, and nothing in this section reduces the section 5 commitments.

17. If we can no longer run Receipts

If Receipts stops operating, by choice, incapacity or wind-down, every school with an active future licence is told in writing as soon as reasonably possible and, where circumstances allow, at least 30 days before service stops. Before shutdown, any school-layer export described in section 5c is made available at no charge. Students retain exported proof files and records in storage they control. We do not promise that the hosted app or free tier can remain available after operations end.

18. Accessibility

Receipts is built to be usable with a keyboard and a screen reader, aiming at WCAG 2.1 AA. At our current size there has been no formal third-party audit, and if a specific feature falls short we say so plainly when asked. If your district needs an accessibility statement or VPAT to complete procurement, ask and we provide what we honestly can.

19. Questions before signing

Every one of these terms can be discussed with the person who wrote the product, before anything is signed: Receiptsproof Pte. Ltd., hello@receiptsproof.com, or book a call. If your district requires its own paper, send it and it will be read properly, not skimmed.

Receipts. Show how it was written. Operated by Receiptsproof Pte. Ltd. For schools · Consumer terms · Privacy · For educators · Home © 2026 Receiptsproof Pte. Ltd.