ArticulAI Privacy Policy

ArticulAI is designed for use by students and the educators who work with them: independent tutors, tutoring centres and private academies, K-12 schools and districts, and the parents and administrators involved in a student's learning. Our platform is intended for users age 13 and older. It is not directed to, and we do not knowingly collect personal information from, children under 13.

ArticulAI is used in three ways today:

• Through a school or district that has signed a Data Processing Agreement (DPA) with ArticulAI. The school directs how student data is handled, and that DPA governs.
• Through an independent tutor, tutoring centre, private school, or other organization that uses ArticulAI without a signed DPA. In that case there is no separate contract: this Policy and our Terms of Service, including the educator confirmation described in Section 1.1, are the agreement that governs student data.
• Through an individual (direct) account created by a teacher, parent, or a student age 13 or older.

The protections in this Policy apply to all users, regardless of how they access ArticulAI or which state they are located in. A signed DPA adds contractual commitments on top of this Policy for the school that signs it; it never reduces the protections described here for anyone else.

1.1 Independent Tutors, Academies, and Individual Teacher Accounts

Where a tutor, teacher, or organization uses ArticulAI without a signed DPA and invites students to participate, that tutor, teacher, or organization decides what is assigned, who is invited, and who may see the results. They are the party responsible for that decision, and ArticulAI processes the resulting student data on their behalf and on the student's own account.

Before inviting students, a tutor, teacher, or organization must confirm at signup that (a) their use of ArticulAI is authorized by any school or institution they work through, where applicable, and (b) they have obtained any consents required under applicable law, including parental or guardian consent for students under 18. We record that confirmation, with the date and version, against their account. ArticulAI does not collect parental consent on their behalf and does not verify it independently.

Students joining through a tutor's or teacher's class create their own accounts and are subject to this Privacy Policy, including the age requirements in Section 10. A student, or the parent or guardian of a student under 18, may contact us directly at any time to exercise the rights described in Sections 8 and 15, whether or not a school is involved.

2.1 Account and Identity Information

When a user creates an account, we collect: name, email address, password hash, and role (student, teacher, or parent; a small number of ArticulAI staff accounts carry an administrator role). Depending on role, we also collect the profile details asked for at signup: a student's grade level, and a teacher's or tutor's grade levels, subjects, and school or organization name. Students provide this information themselves at signup; it is not entered on their behalf by a teacher or tutor. We also record sign-in activity on the account, such as the time and method of the last sign-in.

• If a teacher or parent signs up with Google, their full name and Google profile picture get transferred to their ArticulAI profile. Student accounts never receive or retain a Google profile picture, regardless of sign-in method.
• We do not collect demographic information such as race, gender, or special-education/IEP status.

2.2 Assessment Content

When a student completes an oral assessment, ArticulAI stores: the text transcript of the student's spoken response, rubric-based scores, evaluation feedback, and identified misconceptions.

ArticulAI does not store raw audio or video of a student's response. Audio is processed transiently, in real time, solely to generate a text transcript, and is not retained after the transcript is created. No video is captured or stored at any point.

Transcripts are linked to an identifiable student. This is necessary so teachers can review student work, provide feedback, and track progress over time; a transcript that could not be traced to a specific student would not be usable for grading or coursework. Access to identified transcripts is limited to the student, the teacher or tutor who assigned the work, authorized school staff where a school account is used, and a limited number of authorized ArticulAI personnel who need it for support, security, and to carry out the retention and deletion processes in Sections 7 and 8. A teacher or tutor may additionally choose to share a student's report with that student's parent or guardian, for example by adding them to the account or sending them the report; ArticulAI never sends student results to a parent or guardian automatically, and never shares them with anyone the educator or school has not chosen. We do not sell or share this data with third parties outside the service providers necessary to operate the platform (see Section 4, Sub-processors).

ArticulAI does not generate or store voice fingerprints, speaker embeddings, or any biometric voice profile. See Section 9 for more detail on voice data handling.

2.3 Technical and Usage Data

We automatically log limited technical and usage data, including speaking times during assessments and pages visited within the platform. We do not collect precise geolocation.

2.4 Analytics

We use PostHog for analytics.

Separately from platform accounts, we collect the contact details you choose to submit through our website:

• The email address you enter in the newsletter form in our site footer, which we use to send occasional product updates.
• The name, work email address, organization, optional phone number, how you heard about us, and any message you submit through our “Book a demo” or guided-tour forms, which we use to respond to your enquiry and to follow up about ArticulAI.

This contact data is stored in our own database and is shared only with the service providers that deliver our email and internal team notifications. We never combine it with student assessment data, and we never sell it. You can ask us to stop contacting you, or to delete your contact record, at any time by emailing [email protected].

When a student speaks during an assessment, the live audio stream is sent to our speech-to-text provider, Deepgram, solely to convert speech into text. Deepgram operates under a zero-retention commitment, meaning the audio is not retained once the transcription request is complete. ArticulAI does not receive, store, or retain the audio itself; only the resulting text transcript is saved to our database.

Deepgram is also used to synthesize the AI assessor's spoken replies from text. The reply text, which may reference the student's response and may greet them by first name, is sent to Deepgram for voice synthesis only and is not retained by Deepgram. No student voice audio is ever used to generate synthesized speech. The live audio session itself runs over a real-time voice provider, which receives the student's first name as the display name of the participant in the session.

The transcript text (without student name or other identifiers attached by us) is then sent to our language model provider, OpenAI, to generate rubric-based scores and feedback. The teaching material a teacher or tutor uploads is also processed by OpenAI, to draft questions, key concepts, and rubric criteria and to index the material so the assessment stays inside it. ArticulAI's API tier excludes this data from being used to train OpenAI's models. OpenAI retains API inputs and outputs for 30 days for abuse-monitoring and safety review, after which they are deleted.

ArticulAI uses a limited number of third-party service providers to operate the platform, including for authentication, database and file hosting, real-time voice sessions, speech-to-text transcription and speech synthesis, AI-based scoring and feedback generation, payment processing, email communications, encrypted off-site backup storage, and product analytics.

We do not permit any sub-processor to use student data for advertising, to sell student data, or to train, fine-tune, or otherwise improve any machine learning or artificial intelligence model (whether the sub-processor's own or a third party's) under any circumstance. Sub-processors are contractually bound to protect student data and to use it only for the purpose for which it was shared.

A current list of ArticulAI's sub-processors, including the categories of data each provider processes, is available to schools upon request by contacting [email protected]. Schools with a signed Data Processing Agreement will be notified of any material change to this list.

ArticulAI's primary database is Supabase Postgres, hosted in the United States. File and object storage is provided by Supabase Storage (profile pictures, uploaded materials). All ArticulAI data is stored in the United States; we do not transfer student data outside the country.

We use role-based access controls to limit who can view student data; access is restricted to the student themselves, the teacher or tutor they work with, authorized school staff where a school account is used, any parent or guardian that teacher, tutor, or school has chosen to share a report with, and the limited number of authorized ArticulAI personnel described in Section 2.2. Staff reads of student data through our internal admin tools are logged. Data is encrypted in transit using TLS and encrypted at rest in our database.

ArticulAI does not currently hold third-party security certifications (e.g., SOC 2). Where applicable, we rely on the security practices and infrastructure of our service providers. In the event of a breach affecting personal data we hold, we will notify affected users, and the tutor, teacher, or school whose students are affected, without undue delay and no later than 72 hours after we confirm the breach, and will describe what happened, what data was involved, and what we are doing about it. Schools with a signed Data Processing Agreement (DPA) are additionally covered by the investigation and notification terms set out in that agreement, which control where they are stricter.

Student assessment data is not kept indefinitely. Retention is governed by the following defined triggers. ArticulAI is at an early stage and these triggers are carried out by authorized personnel following the process in Section 8 rather than by a fully automated deletion job; we are working towards automating them.

Outside of these triggers, data continues to be used only for the active educational purpose for which it was collected: ongoing assessment and progress tracking within a live school relationship. Data is not automatically purged at the end of each school year; as long as a school's contract with ArticulAI remains active, student and account data is retained so teachers and schools can track a student's progress across school years rather than starting over each fall. Deletion is tied to the end of the contractual relationship, not the calendar.

Deleted data may persist in encrypted system backups for up to 14 days after it is removed from production systems, after which it is overwritten in the ordinary course of our backup rotation. Backup copies are not accessible through the platform and are used solely for disaster recovery.

ArticulAI is currently in its pilot stage. Deletion requests are handled directly by ArticulAI's founders through the following process:

• Intake: Requests are directed to [email protected].
• Verification: We confirm that a request comes from someone entitled to make it before acting on it. A student may request deletion of their own data from the email address on their account. A parent or guardian may request deletion of the data of a student under 18 in their care; we verify the request with the student's account or with the tutor, teacher, or school that the student works through. Where the student is on a school account, we confirm the request with the school, since the school controls those records. Where the student joined through an independent tutor or an organization without a signed DPA, we confirm with that tutor or organization and act on the request directly; the absence of a school never blocks a deletion request.
• Execution: A limited number of authorized ArticulAI personnel hold access to student data in production systems; one of them locates and removes the relevant records from the production database. A single student's data can be deleted without affecting other students' records.
• Propagation: We confirm deletion or purge with relevant sub-processors (e.g., Deepgram, LiveKit).
• Confirmation: Written confirmation is sent to the requester once the deletion is complete.

We commit to completing verified deletion requests within 30 days of receipt.

Students, teachers, tutors, and schools can also obtain a copy of their data in PDF or Excel format, either from the dashboard where that export is available or by requesting it at [email protected].

ArticulAI processes spoken student responses through a third-party speech-to-text service to generate a text transcript. Audio is used transiently for this purpose; our platform stores and analyzes the resulting transcript, not the audio recording. ArticulAI does not create or store voiceprints, speaker embeddings, or other biometric identifiers for identification purposes.

ArticulAI is intended for users age 13 and older; the youngest students on the platform today are 13. We do not knowingly collect personal information from children under 13.

On first sign-in, every new user (student, teacher, or parent, whether registering with email and password or through Google Sign-In) must complete a one-time date-of-birth check before accessing any other part of ArticulAI. This applies uniformly across roles and sign-in methods; role selection does not skip the check. The date of birth is used only to compute whether the user meets our age-13 minimum: it is processed in memory for that calculation and is not stored in our database or backups. Users who enter a birthdate indicating an age under 13 are blocked from self-registration; where an account record was already created as part of the sign-in flow (as with Google Sign-In), that record is deleted. We retain a device-level flag to prevent immediately re-attempting registration with a different birth year or role, and, only where the check passes, an account-level verification flag and timestamp confirming it was completed. This is a self-declared date of birth, enforced server-side; it is not identity- or document-based age verification.

For school pilots, schools sign an agreement with ArticulAI governing use of the platform. Whether a given school separately obtains parental consent is managed by that school and is confirmed on a school-by-school basis.

Where ArticulAI is used pursuant to a school's agreement with us, we operate under the direction and control of the school for purposes of the Family Educational Rights and Privacy Act (FERPA). Student records provided to or generated by ArticulAI remain the property of, and under the control of, the school. We use student data only for the educational purposes directed by the school and do not use it for any other purpose.

Not every organization using ArticulAI is subject to FERPA, and not every organization signs a DPA. Where a private school, tutoring centre, or independent tutor uses ArticulAI without a signed DPA, this section is not a representation that FERPA applies to them or to us. In that case ArticulAI commits, under this Policy and our Terms of Service, to handle student data in a manner substantially equivalent to FERPA's core protections: student records are used only for the educational purpose they were collected for and stay under the direction of the tutor, teacher, or organization that assigned the work; they are never sold, used for advertising, or used to train AI models; and access, correction, and deletion requests are honoured as described in Sections 8 and 15. A school or organization that wants these commitments in a signed contract can request a DPA at [email protected].

ArticulAI is designed for K-12 oral assessment. Regardless of the state in which a student is located, or whether a student accesses ArticulAI through a school agreement or individually, we apply the following protections to all K-12 student data:

• We do not use student information for targeted advertising, to or about students or their parents/guardians.
• We do not use student information to build a profile of a student for any purpose other than the educational purposes of the platform.
• We do not sell student information.
• We disclose student information only as necessary to provide the service, as directed by the school, or as required by law.
• We delete or de-identify student information at the request of a school, district, or, where applicable, a parent or eligible student.

Where ArticulAI is used pursuant to an agreement with a school or district, that agreement (our Data Processing Agreement) governs the specific handling, retention, and deletion terms for that school's students.

At signup, every user must actively check a box confirming agreement to our Terms of Service and Privacy Policy before an account can be created; account creation does not proceed unless this box is checked. Schools separately sign a Data Processing Agreement with ArticulAI, and a separate Terms of Service governs use of the platform.

ArticulAI does not sell, share, or monetize student data, and does not use student data for advertising, under any circumstances. Student data is not used to train, fine-tune, or otherwise improve any machine learning or artificial intelligence model, whether ArticulAI's own or a third party's, including any model operated by a sub-processor.

Students, parents and guardians, tutors, and schools may request access to, correction of, or deletion of student data by contacting [email protected]. Every user has this right, whichever of the three access routes in Section 1 they came through. Requests are verified as described in Section 8: for students on a school account, through the school; for everyone else, through the account itself or the tutor or organization the student works with. Teachers, tutors, and administrators can obtain a copy of account and assessment data in PDF or Excel format, as described in Section 8.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify schools of material changes and update the effective date above.

Questions about this Privacy Policy or requests regarding your data can be directed to:

• Inflection Path LLC, d/b/a ArticulAI
• Email: [email protected]