Version terms@2026-08-08 · In force from 2026-08-08
In force, and prepared in-house.This document is binding on Firma Limited from the date shown above. It was written by Firma Limited from the source code of the product, and has not yet been reviewed by an independent lawyer — we say that plainly rather than imply a review that has not happened. When that review takes place, no commitment made to schools, families or students will be weakened without the notice process each document describes.
Terms of Service Privacy Policy For students Data Processing Agreement Subprocessors Security TrustThese terms are addressed to schools. Taonova is sold to schools, school groups and districts — not to individuals and not to students. If you are a student or a parent, your relationship is with your school; the Privacy Policy and the student summary are written for you.
Taonova is provided by Firma Limited, a company incorporated in New Zealand. "Taonova" is a product name; Firma Limited is the legal entity you contract with. "We", "us" and "our" mean Firma Limited. "You" means the organization that subscribes to or licenses Taonova.
"Your users" means everyone you give access to: staff, students, parents, guardians and anyone else.
Taonova is a school management, teaching and learning platform. Depending on which parts you enable it covers curriculum and unit planning, assessment and a gradebook, reporting, attendance, groups and classes, events, parent conferences, forms, a resource library, student support records, admissions, and integrations with a Student Information System and with Microsoft services.
It can be run two ways. Hosted, where we run it for you. Or self-hosted, where you install it on infrastructure you control under a separate licence — in which case most operational obligations are yours, not ours (clause 11).
We may improve and change Taonova. We will not make a change that materially reduces the core functionality you are paying for without at least thirty days' notice, except where required for security or by law.
Give us accurate information and keep your billing contact current. You are responsible for your administrators, for the access they grant, and for the configuration choices they make.
Several of those choices have real privacy consequences — in particular enabling an AI provider, connecting a Student Information System, and choosing where your uploaded files are stored. Clause 6 and the Privacy Policy explain each.
You are responsible for activity under your users' accounts. Tell us promptly if you think an account has been compromised.
Children. You will use Taonova with children only as part of your educational programme, and you confirm you have authority to do so — including, where applicable, providing consent on parents' behalf under COPPA. Individuals may not create accounts for themselves outside a school context.
Free and trial use is provided as is, may carry limits, and may be changed or withdrawn on reasonable notice.
Trial organizations created through self-serve signup are temporary: one created without an email address, and not used, is tidied away after 30 days. Add an email address and complete setup to keep it.
Please do not put real student information into a trial you do not intend to keep. It is still protected by the Privacy Policy and the DPA — but a trial is a poor place for children's records.
Paid subscriptions are billed in advance at the price and interval on your order form. Payment for the hosted service is processed by Stripe; we do not store card details.
Subscriptions renew automatically unless your order form says otherwise. You may cancel at any time, effective at the end of the current paid period. Fees exclude GST and other applicable taxes.
Price changes take effect at your next renewal, with at least thirty days' notice.
If payment fails we will tell you and allow a grace period before restricting access. We will not delete your data for non-payment without first giving you a reasonable opportunity to export it.
Taonova can connect to services run by other companies: AI providers, your Student Information System, Microsoft, an S3-compatible file store, Pixabay and others.
Almost all of these are off until you turn them on, and most require you to supply your own account and API key. No AI provider is enabled by default, and with none enabled no content leaves your installation to any AI provider at all.
When you supply your own key, your contract with that provider governs. We provide the connection. We are not a party to your agreement with that provider, we cannot pass our commitments through to them, and we are not responsible for what they do with data you send them. Read their terms — particularly on whether they train on your data — before enabling them.
DeepSeek is hosted in the People's Republic of China. If you enable it, content — which on some paths includes student names and student work — is transmitted there. We do not enable it for you, and we do not recommend it for schools in the EU, the UK, or anywhere with a data residency or foreign-technology policy.
OpenRouter forwards your request to another provider it selects — we pin which ones. Every request Taonova sends to OpenRouter carries a routing constraint limiting the upstream to a fixed set of providers, with re-routing disabled and retention or training refused. So the recipient list is closed and enumerable rather than chosen per request. A model no permitted upstream can serve is refused with an explanation rather than sent elsewhere. The Subprocessors page names the set for this installation — read it before enabling, because an installation may permit an upstream outside the United States and European Union.
You are responsible for having any consent or authority needed before sending your users' information to a third-party service you have enabled.
You and your users must not: use Taonova to break the law, or to harass, bully, defame, threaten or endanger anyone; upload unlawful or infringing material; upload malware; attempt to access another organization's data or another user's account; probe or test the security of the service without our prior written permission; resell or sublicense Taonova unless your agreement allows it; place unreasonable automated load on the service, including high-volume automated use of AI features; or remove any proprietary notice.
You are responsible for what your users put into Taonova. We do not routinely review it. If content is reported to us as seriously unlawful we may remove or restrict access to it, and we will tell you.
Security research is welcome, on terms. Report a vulnerability to us privately, give us a reasonable opportunity to fix it, and do not access other people's data while finding it. We will not pursue anyone who acts in that spirit.
We own Taonova. All rights in the software, its design and its documentation remain with Firma Limited. These terms grant you the right to use the service and nothing more.
You own your content. Everything you and your users put in — student records, curriculum you write, assessments, reports, uploaded files — remains yours. We claim no ownership.
You grant us a limited licence to host, store, transmit, back up and display your content solely to provide the service to you, and for no other purpose. It ends when your data is deleted.
We do not train models on your data. We will not use your content to train, fine-tune or improve any machine-learning model, ours or anyone else's.
Taonova includes open-source components under their own licences, and third-party content (for example Pixabay images, Open Library book metadata) under those providers' terms. If you send us suggestions, we may use them freely.
Our handling of personal information is governed by the Privacy Policy and, where you place student records in the platform, by the Data Processing Agreement, which forms part of these terms.
The short version, and we intend to be held to it. For the personal information of your students, families and staff:
For US schools we act as a school official with a legitimate educational interest under FERPA, under your direct control, and we will not redisclose education records.
If these terms and the DPA conflict on a data protection question, the DPA wins.
If there is a breach. If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within seventy-two (72) hours of becoming aware of it, with what we know at the time — we will not wait for the investigation to complete before telling you. The full commitment, including what the notice contains, the assistance you get afterwards, and what actually makes us aware in the first place, is in the DPA (clause 11) and the Privacy Policy (§10). It is repeated here so the commitment is a term of the contract itself, not only of the documents incorporated into it.
You may stop at any time. We may suspend or terminate if you materially breach these terms and have not fixed it within thirty days of written notice; immediately, and for as long as necessary, if your use presents a serious and immediate security risk; or if required by law. We will tell you why unless the law prevents us.
Getting your data out. For thirty days after termination you may ask us for your data in a commonly used, machine-readable format, and we will provide it within a further thirty days.
Deletion. We will delete your data from production systems within ninety days of termination unless the law requires us to keep it. Copies in encrypted backups go on the ordinary backup rotation. We will confirm deletion in writing if you ask.
How uploaded files are deleted. Deleting a record deletes the database entry, and the files hanging off it are queued for deletion rather than removed on the spot: a housekeeping job removes them after a grace period, and only once nothing else still refers to them. That indirection is deliberate — deleting an image another person's post also displays would be its own kind of data loss. What still survives on purpose is attachments on a record that is itself retained or anonymised rather than deleted: a transcript or a safeguarding file with its evidence stripped out is not a record a school can rely on.
If you run Taonova yourself you are responsible for the environment: hosting, database, backups, encryption at rest, network security, patching, TLS certificates, and your configuration choices.
We remain responsible for the security of the software we supply, and we will tell self-hosting customers about vulnerabilities we become aware of in it. We have no routine access to your data and process it only if and when you give us access for support.
We will provide Taonova with reasonable care and skill, and in accordance with the DPA. Except as stated in these terms and as required by law, Taonova is provided without other warranties. We do not warrant that it will be uninterrupted or error-free.
We are not responsible for third-party services you enable, for your own infrastructure in a self-hosted installation, or for the internet between us and you.
To the extent the law allows, our total liability in any twelve-month period is limited to the fees you paid us in the twelve months before the event giving rise to the claim, and neither party is liable for indirect or consequential loss.
Nothing in these terms limits rights under the Consumer Guarantees Act 1993 or the Fair Trading Act 1986 that cannot lawfully be limited, or excludes liability for fraud, for death or personal injury caused by negligence, or for anything else that cannot lawfully be excluded.
You will indemnify us against third-party claims arising from content your users put into Taonova, from your use of Taonova in breach of clause 7, or from your instructions to us where following them caused the claim.
We will defend you against a third-party claim that Taonova itself infringes that party's intellectual property rights, and pay any resulting award, provided you tell us promptly and let us control the defence.
These terms are governed by the law of New Zealand, and the courts of New Zealand have non-exclusive jurisdiction.
Nothing here restricts a data subject's rights under GDPR Articles 77 and 79, an individual's right to complain to the New Zealand Privacy Commissioner, or any other right of complaint to a regulator that cannot be contracted out of.
Before litigating, each party will raise the issue in writing and allow thirty days for it to be resolved. This does not prevent either party seeking urgent injunctive relief.
Each version has a version identifier and a date it came into force. We will give at least thirty days' notice before a material change takes effect, by email to your billing contact and by a notice in the product. If you do not accept it you may terminate before it takes effect and receive a pro-rata refund of prepaid fees.
We record which version of these terms and of the Privacy Policy your organization accepted, and when. Superseded versions are kept, so it is always possible to establish what you agreed to.
Firma Limited, New Zealand. New Zealand Business Number 9429036053421. Registered office and address for formal service: 64 Ngatiawa St, One Tree Hill, Auckland 1061, New Zealand. Notices, including legal notices, go to info@taonova.com, a monitored mailbox; the privacy contact is in the Privacy Policy.
These terms, the Privacy Policy, the DPA, your order form and (for self-hosted installations) your licence agreement are the whole agreement between us on their subject matter.
You may not assign without our consent, not unreasonably withheld; we may assign to a successor of our business, on notice to you. If a clause is unenforceable the rest stands. Not enforcing a right once does not waive it. Neither party is liable for a failure caused by something genuinely outside its reasonable control. Notices to you go to your billing contact email.
Taonova is a product of Firma Limited, a company incorporated in New Zealand. Governing law: New Zealand.
New Zealand Business Number 9429036053421. Registered office: 64 Ngatiawa St, One Tree Hill, Auckland 1061, New Zealand.
Privacy questions, data-subject requests, security reports and legal notices: info@taonova.com.
Terms of Service Privacy Policy For students Data Processing Agreement Subprocessors Security Trust