LEAD™ is a learning and formation platform operated by Fivable, LLC ("Fivable," "we," "us," or "our"), a South Carolina limited liability company with a mailing address at PO Box 1593, Banner Elk, North Carolina 28604. LEAD is provided to organizations — such as dioceses, archdioceses, parishes, apostolates, and other institutions (each, an "Organization") — who make it available to their members, learners, leaders, and administrators ("you" or "Users").

The Platform is available both as a web application and as native mobile applications for iOS and Android (the "App"). These Terms of Service ("Terms") and the Privacy Policy below govern your access to and use of the LEAD platform across all of these — our websites, the App, and related services (collectively, the "Platform").

Please read both parts carefully. By creating an account or using the Platform, you agree to these Terms and acknowledge the Privacy Policy. If you do not agree, do not use the Platform.

Fivable provides the LEAD software Platform. Each Organization operates its own separately configured environment (an "Instance"). Your account exists within the Instance of the Organization that granted you access. An Instance's content, programs, communities, and membership are controlled by that Organization, not by Fivable.

The App lets you belong to more than one Instance. Each Instance is independent, with its own data, membership, and — where the Organization chooses — its own additional terms, codes of conduct, or policies that apply to you in addition to these Terms.

• Minimum age. You must be at least 13 years old to hold a LEAD account. We do not permit anyone under 13 to create or use an account.

• Organization-set higher minimums. An Organization may set a higher minimum age for its Instance (for example, 16 or 18). Where an Organization has done so, you must meet that higher age to use that Instance.

• Minors. A minor may participate only (a) through a sub-profile created and managed by an adult Account Owner, as described in Section 3, or (b) otherwise with the consent and under the supervision of a parent or legal guardian and consistent with the Organization's rules. The adult who creates or manages a minor's participation represents that they have the authority and any required consent to do so.

• See the Privacy Policy, Section 7 (Children and minors), for how information about minors and sub-profiles is handled.

• Creating an account. Accounts are typically created through your Organization — by invitation, by enrolling in a program, or through your Organization's registration pages. The App itself does not sell accounts or subscriptions.

• Accurate information. You agree to provide accurate information and to keep it current.

• Account security. You are responsible for maintaining the confidentiality of your credentials and for activity under your account. Notify your Organization or us promptly of any unauthorized use.

An adult account holder (an "Account Owner") may create and manage sub-profiles — for a minor child or another family member — so that person can have their own learning experience under the Owner's care.

• No independent login. A sub-profile does not have its own credentials and cannot be signed into on its own. It is accessed only from within an authorized adult account — the Account Owner, or another full account the Account Owner has authorized as a manager through an established family relationship. The Account Owner may grant or revoke that manager authorization at any time.

• Entering and exiting. Once signed into their own account, an authorized adult may enter the sub-profile to accompany that person's learning, which is kept separate from the adult's own learning. Exiting the sub-profile requires the managing adult to re-enter their password, so a child cannot reach a full-account experience on their own.

• Promotion. When a sub-profile reaches the applicable age, the Account Owner may promote it to an independent account.

• Responsibility. The Account Owner is responsible for the sub-profiles they create and manage, including having the authority and any required parental or guardian consent for a minor.

You may delete your account at any time from within the App (Profile → Delete Account) or by contacting privacy@fivable.com. See the Privacy Policy, Section 9 (Data retention), for what happens to your data when you delete your account.

You agree not to:

• Use the Platform in violation of any law or your Organization's policies;

• Post or share content that is unlawful, harassing, abusive, hateful, defamatory, obscene, or that endangers the safety or dignity of any person, especially minors;

• Impersonate any person or misrepresent your affiliation;

• Attempt to access accounts, data, sub-profiles, or Instances that are not yours; probe, scan, or breach security; or interfere with the Platform's operation;

• Upload malicious code, scrape or harvest data, or use the Platform to send spam;

• Reproduce, resell, or commercially exploit the Platform or its content except as expressly permitted.

Organizations may enforce additional community guidelines within their Instances. Violations may result in content removal, suspension, or termination by your Organization or by Fivable.

• Ownership. You retain ownership of the content you submit — such as community posts, comments, replies, and profile information ("User Content").

• License. You grant Fivable and your Organization a non-exclusive, worldwide, royalty-free license to host, store, reproduce, display, and distribute your User Content solely to operate and provide the Platform to you and your Organization. This license ends when your User Content is deleted, except for reasonable backup copies and content others have already shared or that must be retained for legal or safety reasons.

• Responsibility. You are responsible for your User Content and represent that you have the rights to share it and that it does not violate these Terms or the rights of others.

• Moderation. Your Organization and Fivable may review, moderate, or remove User Content, but are not obligated to monitor it.

Each Organization is responsible for its Instance, including the accounts it provisions, the content and programs it offers, the age and eligibility rules it sets, and its compliance with laws applicable to its members and activities. Your relationship with your Organization is governed by any agreement you have with that Organization in addition to these Terms.

Organization data collection (questionnaires, assignments, and forms). Organizations may create questionnaires, assignments, and forms that collect information from Users. Each Organization is solely responsible for the data it collects this way — including having a lawful basis and legitimate purpose, giving Users a clear explanation within the form, collecting only what is necessary, following Fivable's Sensitive Data guidelines (which the form's creator must attest to each time), and refraining from collecting prohibited data such as payment card or bank details. If you complete a questionnaire or assignment, look to the Organization that created it for how that information will be used and shared.

• Where payment happens. Any paid registrations (for example, event tickets, program or class registrations, or premium content) are processed through web-based checkout powered by our payment processor (Stripe). Payments are not taken inside the mobile App and do not use in-app purchases.

• What you're buying. Purchases are registrations for real-world events, in-person or hybrid classes, conferences, and related services and materials provided by your Organization.

• Who receives your payment. Your Organization — not Fivable — is the merchant of record for these transactions. Payments you make for a course, event, or registration are collected for and settled to your Organization, not to Fivable, and your Organization is responsible for pricing, fulfillment, refunds, and related customer service. We do not store your full payment card details; those are handled by our payment processor.

The Platform, including its software, features, configurations, and Fivable trademarks (including "LEAD" and "Fivable"), is owned by Fivable or its licensors and is protected by intellectual-property laws. Content and materials you or your Organization upload remain yours. Except for the rights expressly granted, no rights are transferred. Organization and third-party marks belong to their respective owners.

The Platform integrates third-party services (for example, payment processing, analytics, cloud hosting, and communications) and may link to third-party websites or content. We are not responsible for third-party services or content, and your use of them may be subject to their own terms and privacy policies.

The Platform is provided "as is" and "as available," without warranties of any kind, whether express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement, to the fullest extent permitted by law. We do not warrant that the Platform will be uninterrupted, error-free, or secure.

To the fullest extent permitted by law, Fivable will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, data, or goodwill, arising out of or related to your use of the Platform. Fivable's total liability to you for any claim will not exceed the greater of one hundred U.S. dollars ($100) or the amount you paid directly to Fivable (if any) in the twelve months before the claim. For clarity, amounts you pay to an Organization — including payments for courses, events, or registrations processed through checkout — are payments to that Organization, not to Fivable, and do not increase this amount.

You agree to indemnify and hold harmless Fivable and its affiliates from claims arising out of your User Content, your use of the Platform, or your violation of these Terms or the rights of others, to the extent permitted by law.

You may stop using the Platform and delete your account at any time. Your Organization may suspend or terminate your access to its Instance. Fivable may suspend or terminate access to the Platform for conduct that violates these Terms or that we reasonably believe is harmful. Provisions that by their nature should survive termination (for example, ownership, disclaimers, and limitations of liability) will survive.

These Terms are governed by the laws of the State of North Carolina, without regard to its conflict-of-laws rules. The parties will first attempt in good faith to resolve any dispute informally; any legal action arising out of or relating to these Terms shall be brought exclusively in the state or federal courts located in North Carolina, and you consent to the personal jurisdiction of those courts.

We may update these Terms from time to time. If we make material changes, we will provide notice through the Platform or by other reasonable means and update the "Last updated" date. Your continued use after changes take effect constitutes acceptance.

Questions about these Terms:

Fivable, LLC · PO Box 1593, Banner Elk, NC 28604 · privacy@fivable.com

This Privacy Policy explains how information is collected, used, shared, and protected when you use the LEAD Platform, including the web application and the native mobile apps. It is written to reflect the principles of the EU General Data Protection Regulation (GDPR) and to apply those protections broadly, alongside applicable U.S. requirements.

LEAD is a multi-tenant platform. This affects who is legally responsible for your data:

• Your Organization is the "controller" of the personal data within its Instance. The Organization decides what data to collect, why, and how it is used within its programs, communities, and events. Fivable acts as a "processor," handling that data on the Organization's behalf and under its instructions, and treats it as confidential.

• Fivable is the "controller" only for the limited data it processes for its own purposes — for example, operating and securing the Platform, account authentication, aggregate analytics, and communications with Organizations.

If you want to exercise rights over data within your Organization's Instance, we will help, but the Organization may need to make certain decisions as the controller. For requests, contact privacy@fivable.com and/or your Organization's administrator.

Information you provide:

• Account and profile: name, email address, and — if you add them — a short bio and profile photo. (If you don't upload a photo, a default image based on your email may be shown via a third-party avatar service.)

• Date of birth: most Organizations require date of birth to verify age and eligibility — for example, to confirm an account holder meets the applicable minimum age and to establish that a sub-profile belongs to a minor. Where an Organization requires it, it is not optional; Organizations that do not use this feature do not collect it. Date of birth is used for age and eligibility purposes, not to build advertising profiles.

• Optional demographic information: where an Organization enables it, you may optionally provide fields such as sex and ethnicity. These are voluntary, include a "Prefer not to say" option, and are never required to use the Platform.

• Sub-profiles: information an Account Owner provides about a sub-profile they create for a minor or family member (see Section 7).

• Community content: posts, comments, replies, and reactions you create.

• Questionnaires, assignments, and forms: Organizations can create questionnaires and assignments with custom fields, and we collect the information you provide in them. Your Organization decides what these ask and why (as controller) and is responsible for having a lawful basis, explaining the purpose within the form itself, minimizing what it collects, and following Fivable's Sensitive Data guidelines — to which the person creating or updating the form must attest each time. Some Organizations may, for a specific and legitimate need, collect sensitive information (for example, a government identification number) through these forms; where they do, that data is stored with additional protections (see Section 10). Collecting payment card or bank details through these forms is not permitted — payments run only through the web checkout described in the Terms.

• Communications: messages you send us or your Organization, and — if you opt in — a phone number for SMS communications.

Information created through your use:

• Learning and participation data: courses, programs, learning paths, events, registrations, progress, and completion.

Information collected automatically by the App:

• Device and technical data: device type and operating system, app version, a device identifier, and diagnostic information.

• Push notification tokens: to deliver notifications you've enabled (via Firebase Cloud Messaging).

• Analytics and crash data: app usage events and crash reports (via Firebase Analytics and Firebase Crashlytics) to keep the App reliable and improve it.

• Authentication tokens: stored securely on your device (in the iOS Keychain / secure storage) to keep you signed in.

Payment information: payments are handled by our payment processor on the web. We do not collect or store your full payment card number.

We do not use your personal data to build advertising profiles, and we do not sell your personal data.

Depending on whether Fivable or your Organization is the controller, information is used to:

• Provide, operate, and secure the Platform and your account;

• Deliver your Organization's communities, courses, programs, and events;

• Send notifications and communications you've enabled;

• Maintain safety, enforce these Terms and community guidelines, and prevent abuse;

• Diagnose problems, and analyze and improve performance and reliability;

• Comply with legal obligations.

Lawful bases (GDPR). Where GDPR applies, we and/or your Organization rely on: performance of a contract; legitimate interests (to secure, maintain, and improve the Platform, balanced against your rights); consent (for optional items such as demographic fields, SMS messages, and push notifications — which you can withdraw at any time); and legal obligation.

The App uses Firebase Cloud Messaging to send notifications you enable (you can turn these off in your device settings), and Firebase Analytics and Firebase Crashlytics to understand usage and diagnose crashes. These are provided by Google; see Section 6 for how service providers handle data.

We share personal data only as needed to run the Platform:

• With your Organization. Your account, profile, participation, and community activity are visible to your Organization and, as appropriate, to other members of communities you join.

• With service providers (processors), under confidentiality and data-processing obligations, including, by category:

  • Cloud hosting and storage (Amazon Web Services);

  • Payment processing (Stripe);

  • Analytics, crash reporting, and push notifications (Google / Firebase);

  • Communications (email delivery and, where enabled, SMS);

  • Optional AI-assisted features — for example, an assistant that helps Organizations build questionnaires — provided by third-party AI vendors (such as OpenAI). Fields an Organization labels as sensitive are excluded from this AI processing.

• For legal reasons. To comply with applicable law, regulation, legal process, or an enforceable governmental request, or to protect the rights, safety, and security of Users, the public, or the Platform.

• In a business transfer. If Fivable is involved in a merger, acquisition, or sale of assets, data may be transferred subject to this Policy.

We do not sell personal data, and we do not share it for third-party advertising.

Our service providers may process data in the United States and other countries. Where personal data is transferred out of the European Economic Area, the United Kingdom, or other regions with transfer restrictions, we rely on appropriate safeguards (such as Standard Contractual Clauses) where required.

Protecting minors is a priority, especially given that LEAD supports faith formation and youth programs.

• No one under 13. We do not knowingly permit anyone under 13 to create or use an account. If we learn that an account for a child under 13 was created without the required authorization, we will delete it.

• Higher minimums. Organizations may set a higher minimum age (such as 16 or 18) for their Instance, and that higher minimum then applies.

• Minors participate through sub-profiles. A minor takes part through a sub-profile created and controlled by an adult Account Owner (see the Accounts section of the Terms). A sub-profile has no independent login — a minor cannot sign in on their own; the sub-profile is reached only from within an authorized adult's account, and exiting it requires the adult's password. The adult who creates the sub-profile is responsible for having the authority and any required parental or guardian consent, and the Organization (as controller) is responsible for its lawful basis for processing the minor's data.

• Information about a minor is limited to what the Organization's programs and events require, is not used for advertising, and is subject to the same protections and retention practices in this Policy.

• Managing or deleting a minor's data. An Account Owner can manage or delete a sub-profile from their account. For other requests about a minor's data, contact your Organization's administrator or privacy@fivable.com.

Subject to applicable law, you have the right to:

• Access the personal data held about you;

• Correct inaccurate or incomplete data (you can edit much of your profile in the App);

• Delete your account and personal data (Profile → Delete Account, or by contacting us) — see Section 9;

• Restrict or object to certain processing;

• Port your data (receive it in a portable format), where applicable;

• Withdraw consent for anything based on consent (such as demographic fields, SMS, or push notifications), without affecting prior processing.

To exercise these rights, contact privacy@fivable.com or your Organization's administrator. Because your Organization is the controller of Instance data, we may direct or coordinate with them to fulfill your request. You may also have the right to lodge a complaint with a data-protection authority where applicable.

We keep personal data only as long as needed for the purposes described in this Policy. Specifically:

• Account deletion. When you delete your account (Profile → Delete Account), we immediately deactivate it and revoke access on all your devices. Your remaining personal data is then retained until you request its permanent erasure by emailing privacy@fivable.com — or until your Organization requests erasure on your behalf — at which point we delete or anonymize it, subject to the exceptions below.

• Records an Organization must keep. Some records — for example, safe-environment or training-completion records an Organization is legally or contractually required to retain — may be kept by the Organization (as controller) for its required retention period, even after account deletion. Your Organization can tell you which records apply.

• Organization off-boarding. If an Organization ends its relationship with Fivable, its Instance data is handled under that Organization's agreement with Fivable (which provides an export window, after which the Instance may be permanently deleted).

• Legal holds and backups. We may retain limited data where required to comply with law, resolve disputes, or enforce agreements, and residual copies may persist briefly in secure backups before being overwritten.

We use administrative, technical, and physical safeguards designed to protect personal data:

• Encryption in transit and at rest. Personal data is encrypted while moving between your device and our servers and while stored in our database (an AWS RDS Aurora cluster).

• Content and asset storage. Course materials and user-uploaded assets are stored on Amazon Web Services (AWS) S3, with access to assets controlled by one-time access tokens generated by the Platform.

• On-device protection. Your authentication token is stored in your device's secure storage (the iOS Keychain), and access is protected by authentication controls.

• Sensitive form data. Questionnaire responses receive field-level encryption, and access to questionnaire and assignment responses is governed by role-based access controls and audit logging.

No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your information and to respond promptly to incidents.

The App stores limited data on your device to function — for example, your authentication token (in secure storage) and lightweight preferences. This data stays on your device and is cleared when you sign out or delete your account.

We may update this Privacy Policy from time to time. Material changes will be signaled by updating the "Last updated" date and, where appropriate, by additional notice through the Platform.

For privacy questions or to exercise your rights:

Fivable, LLC PO Box 1593, Banner Elk, NC 28604 Email: privacy@fivable.com

For data within a specific Organization's Instance, you may also contact that Organization's administrator, who is the controller of that data.