ArticulAI Privacy Policy

ArticulAI is designed for use by K-12 students, teachers, and school administrators. Our platform is intended for users age 13 and older. It is not directed to, and we do not knowingly collect personal information from, children under 13.

ArticulAI is used in two ways today:

• Through a school or district that has signed a Data Processing Agreement (DPA) with ArticulAI; or
• Through an individual (direct) account created by a student age 13 or older.

The protections in this Policy apply to all users, regardless of how they access ArticulAI or which state they are located in.

2.1 Account and Identity Information

When a user creates an account, we collect: email address, password hash, and role (student, teacher). Students provide this information themselves at signup; it is not entered on their behalf by a teacher.

• If a user signs up with Google, their full name and Google profile picture get transferred to their ArticulAI profile.
• Users may optionally add a profile bio.
• We do not collect demographic information such as race, gender, or special-education/IEP status.

2.2 Assessment Content

When a student completes an oral assessment, ArticulAI stores: the text transcript of the student's spoken response, rubric-based scores, evaluation feedback, and identified misconceptions.

ArticulAI does not store raw audio or video of a student's response. Audio is processed transiently, in real time, solely to generate a text transcript, and is not retained after the transcript is created. No video is captured or stored at any point.

Transcripts are linked to an identifiable student. This is necessary so teachers can review student work, provide feedback, and track progress over time — a transcript that could not be traced to a specific student would not be usable for grading or coursework. Access to identified transcripts is limited to the student, their teachers, and authorized school staff. We do not sell or share this data with third parties outside the service providers necessary to operate the platform (see Section 4, Sub-processors).

ArticulAI does not generate or store voice fingerprints, speaker embeddings, or any biometric voice profile. See Section 9 for more detail on voice data handling.

2.3 Technical and Usage Data

We automatically log limited technical and usage data, including speaking times during assessments and pages visited within the platform. We do not collect precise geolocation.

2.4 Cookies and Analytics

We use cookies, local storage, and analytics tools, including Google Analytics, to understand how ArticulAI is used and to improve the platform.

When a student speaks during an assessment, the live audio stream is sent to our speech-to-text provider, Deepgram, solely to convert speech into text. Deepgram operates under a zero-retention commitment, meaning the audio is not retained once the transcription request is complete. ArticulAI does not receive, store, or retain the audio itself — only the resulting text transcript is saved to our database.

The transcript text (without student name or other identifiers) is then sent to our language model provider, OpenAI, to generate rubric-based scores and feedback. ArticulAI's API tier excludes this data from being used to train OpenAI's models. OpenAI retains API inputs and outputs for 30 days for abuse-monitoring and safety review, after which they are deleted.

ArticulAI uses a limited number of third-party service providers to operate the platform, including for authentication and hosting, speech-to-text transcription, AI-based scoring and feedback generation, payment processing, email communications, and product analytics.

We do not permit any sub-processor to use student data for advertising, to sell student data, or to train their own models using student data beyond what is strictly necessary to provide their service to ArticulAI. Sub-processors are contractually bound to protect student data and to use it only for the purpose for which it was shared.

A current list of ArticulAI's sub-processors, including the categories of data each provider processes, is available to schools upon request by contacting [email protected]. Schools with a signed Data Processing Agreement will be notified of any material change to this list.

ArticulAI's primary database is Supabase Postgres, hosted in the United States. File and object storage is split between Supabase Storage (profile pictures, uploaded materials) and Amazon S3. All ArticulAI data is stored in the United States; we do not transfer student data outside the country.

We use role-based access controls to limit who can view student data; access is restricted to the student themselves, their teachers, and authorized school staff. Data is encrypted in transit using TLS and encrypted at rest in our database.

ArticulAI does not currently hold third-party security certifications (e.g., SOC 2). Where applicable, we rely on the security practices and infrastructure of our service providers. We do not yet have a formal, documented data-breach notification process; we are committed to notifying affected schools promptly in the event of a breach involving their students' data, and to formalizing this process ahead of broader rollout.

Student assessment data is not kept indefinitely and does not rely on manual deletion alone. Retention is governed by three defined triggers:

Outside of these triggers, data continues to be used only for the active educational purpose for which it was collected — ongoing assessment and progress tracking within a live school relationship. Data is not automatically purged at the end of each school year; as long as a school's contract with ArticulAI remains active, student and account data is retained so teachers and schools can track a student's progress across school years rather than starting over each fall. Deletion is tied to the end of the contractual relationship, not the calendar.

ArticulAI is currently in its pilot stage and is formalizing its deletion process. Today, deletion requests are handled directly by ArticulAI's founders, who manually locate and remove the relevant records from the production database. A single student's data can be deleted without affecting other students' records.

We are building toward the following process, which we intend to have in place before our first school pilot begins, and no later than August 3, 2026:

• Intake: requests directed to a dedicated contact, [email protected], rather than ad hoc outreach.
• Verification: for student data requests, confirmation is routed through the student's school rather than acted on from an unverified individual request alone.
• Execution: deletion from the production database.
• Propagation: deletion or purge confirmation from relevant sub-processors (e.g., Deepgram, LiveKit).
• Confirmation: written confirmation sent to the requester once complete.

We commit to completing verified deletion requests within 30 days.

Users and teachers may export their data in PDF or Excel format.

ArticulAI processes spoken student responses through a third-party speech-to-text service to generate a text transcript. Audio is used transiently for this purpose; our platform stores and analyzes the resulting transcript, not the audio recording. ArticulAI does not create or store voiceprints, speaker embeddings, or other biometric identifiers for identification purposes.

ArticulAI is intended for users age 13 and older; the youngest students on the platform today are 13. We do not knowingly collect personal information from children under 13.

For direct (non-school) signups, we require a neutral date-of-birth entry before any other account information is collected. Users who enter a birthdate indicating an age under 13 are blocked from self-registration. This is a self-declared date of birth, enforced server-side, with a device-level flag to prevent re-attempting registration with a different birth year; it is not identity- or document-based age verification.

For school pilots, schools sign an agreement with ArticulAI governing use of the platform. Whether a given school separately obtains parental consent is managed by that school and is confirmed on a school-by-school basis.

Where ArticulAI is used pursuant to a school's agreement with us, we operate under the direction and control of the school for purposes of the Family Educational Rights and Privacy Act (FERPA). Student records provided to or generated by ArticulAI remain the property of, and under the control of, the school. We use student data only for the educational purposes directed by the school and do not use it for any other purpose.

ArticulAI is designed for K-12 oral assessment. Regardless of the state in which a student is located, or whether a student accesses ArticulAI through a school agreement or individually, we apply the following protections to all K-12 student data:

• We do not use student information for targeted advertising, to or about students or their parents/guardians.
• We do not use student information to build a profile of a student for any purpose other than the educational purposes of the platform.
• We do not sell student information.
• We disclose student information only as necessary to provide the service, as directed by the school, or as required by law.
• We delete or de-identify student information at the request of a school, district, or, where applicable, a parent or eligible student.

Where ArticulAI is used pursuant to an agreement with a school or district, that agreement (our Data Processing Agreement) governs the specific handling, retention, and deletion terms for that school's students.

At signup, every user must actively check a box confirming agreement to our Terms of Service and Privacy Policy before an account can be created; account creation does not proceed unless this box is checked. Schools separately sign a Data Processing Agreement with ArticulAI, and a separate Terms of Service governs use of the platform.

ArticulAI does not sell, share, or monetize student data, and does not use student data for advertising, under any circumstances. Student data is not used to train or fine-tune ArticulAI's own models.

Students, parents, and schools may request access to, correction of, or deletion of student data by contacting [email protected]. For students accessing ArticulAI through a school, requests are generally verified through the school. Teachers and administrators may export account and assessment data in PDF or Excel format.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify schools of material changes and update the effective date above.

Questions about this Privacy Policy or requests regarding your data can be directed to:

• Inflection Path LLC, d/b/a ArticulAI
• Email: [email protected]