Terms of Service

Who these terms are between

These terms are between Seraco Pty Ltd (ABN 36 673 560 757), a company registered in Victoria, Australia, and the school that holds an agreement with us to use Kestrel.

The agreement is with the school, not with the people who sign in. A member of staff uses Kestrel under their school's agreement, and what they may do with an account is set out in the Acceptable Use Policy. What Kestrel does with personal information is set out in the Privacy Policy. Those two documents and these terms are read together.

What Kestrel is

Kestrel is a hosted student information system. A school's records are held in Kestrel's database and reached through a browser. We run the software, the database and the machine they are on. A school does not install anything and does not host anything.

The records belong to the school

Everything a school puts into Kestrel, and everything Kestrel derives from it, is the school's. We hold it to run the service for that school and for nothing else. We do not sell it, license it, train a model on it, or use it to build a product for anyone else.

The software is ours. An agreement to use Kestrel is a right to use it while the agreement runs, and it transfers no ownership of the software.

What we agree to do

Each of these describes the service as it runs. The security page sets out the mechanism behind each one, so a school can check the promise against the thing that keeps it.

To run the service, and to keep the records in Australia

The application, the database and the backups are on one virtual machine in Australia. We give a school written notice before any of that moves to another country, or before anyone in another country can reach unencrypted records.

To back the records up, and to prove the backups restore

Production is backed up three times a day and 8 days are kept. On the first of each month the most recent backup is restored into a scratch database and the rows are read back. A backup nobody has restored is a file, not a backup.

To keep each school's records apart in the database itself

Every school has its own PostgreSQL schema and its own database role. PostgreSQL refuses a crossing between two schools, so the refusal does not depend on our code getting a query right.

To tell a school when something goes wrong

If we find that someone has reached a school's records without authorisation, we write to that school's nominated privacy contact with what we know and what we do not, so the school can meet its own obligations under the Notifiable Data Breaches scheme.

To give a school its records back

When an agreement ends, we give the school a complete, machine-readable copy of its records, and we tell the school the date its schema is destroyed before we destroy it.

What we do not promise

• An uptime figure. None is published, because none has been measured, and a number invented for a contract is worse than no number.
• A recovery time. The same reason. What is published instead is the recovery point, which is up to 8 hours, being the gap between scheduled backups.
• That the service suits a particular school's process. A school should run the product against its own way of working before it signs.
• That any feature stays the same shape forever. We give notice before we change or withdraw one a school relies on.

What the school agrees to do

• To decide what personal information goes into the record, and to have a lawful basis for collecting it. The school is the organisation with the relationship to its families, and it makes that decision rather than us.
• To give an account only to a person the school authorises, and to tell us to close an account when that person leaves.
• To hold its people to the Acceptable Use Policy, which is published alongside these terms.
• To nominate a privacy contact we can reach in writing, and to keep that contact current.
• To pay the fees set in its agreement with us.

Fees

The fees, the billing period and the notice period are set in the agreement between the school and Seraco Pty Ltd. These terms neither set them nor change them.

Suspending an account or the service

We can suspend one account, and we tell the school on the same day and say why. We do that where an account is being used in a way the Acceptable Use Policy forbids, or where an account looks to be in someone else's hands.

Suspending a whole school's service is a different act and a last one. We give the school written notice and a period to fix the problem first, except where a law or a court order requires us to act immediately.

Ending the agreement, and getting the records out

Either of us can end the agreement on the notice its own terms set. A school does not have to give a reason.

A school gets a complete, machine-readable copy of its records before its schema is destroyed, and we tell the school the date of the destruction in writing before it happens. Records under legal hold, and records a retention obligation still runs on, are kept for as long as that obligation runs and are then disposed of.

The retention obligations are on the security page, class by class. The longest of them runs 45 years from a child's date of birth, so ending an agreement does not end every obligation the same day.

Liability

Australian Consumer Law gives a school guarantees that cannot be excluded. Nothing here excludes them, and where the law lets us choose a remedy for a failure to meet one, we may supply the service again or refund what was paid for it.

Beyond those guarantees, and to the extent the law allows, our total liability is limited to the fees the school paid us in the 12 months before the event. We are not liable for loss of profit, loss of goodwill, or a loss neither of us could reasonably have foreseen.

Two things are not limited by that. We do not limit our liability for our own fraud, and we do not limit it for a breach of the Privacy Act caused by our own act or omission. A vendor holding children's records and capping its liability for losing them has written a term no school should accept.

Changes to these terms

The version and the date at the top of this page tell you which edition you are reading. We write to every school before a change to these terms takes effect, and the letter tells them what changed. A school that does not accept a change can end its agreement on the notice its own terms set, and it gets its records under the section above.

The law that applies, and where a dispute is heard

These terms are governed by the law of Victoria, Australia. A dispute is heard by the courts of Victoria, and both of us submit to them.

Before either of us goes to court, we each agree to put the problem in writing to the other and to give the other 20 business days to answer it. Most of what reaches a court between a school and a supplier is a thing neither party wrote down early enough.

How to reach us

Write to hello@seraco.io about anything in these terms. For a question about personal information, write to privacy@seraco.io. To report a security vulnerability, write to security@seraco.io.