ArticulAI Privacy Policy

ArticulAI is designed for use by K-12 students, teachers, parents, and school administrators. Our platform is intended for users age 13 and older. It is not directed to, and we do not knowingly collect personal information from, children under 13.

ArticulAI is used in two ways today:

• Through a school or district that has signed a Data Processing Agreement (DPA) with ArticulAI; or
• Through an individual (direct) account created by a teacher, parent, or a student age 13 or older.

The protections in this Policy apply to all users, regardless of how they access ArticulAI or which state they are located in.

1.1 Individual Teacher Accounts

Where a teacher uses ArticulAI through an individual account (outside of a school agreement) and invites students to participate, the teacher is responsible for ensuring that such use is authorized by their school or institution where applicable, and that any consents required under applicable law, including parental consent for students under 18, have been obtained. Students joining through an individual teacher's class create their own accounts and are subject to this Privacy Policy, including the age requirements in Section 10.

2.1 Account and Identity Information

When a user creates an account, we collect: email address, password hash, and role (student, teacher). Students provide this information themselves at signup; it is not entered on their behalf by a teacher.

• If a teacher or parent signs up with Google, their full name and Google profile picture get transferred to their ArticulAI profile. Student accounts never receive or retain a Google profile picture, regardless of sign-in method.
• Users may optionally add a profile bio.
• We do not collect demographic information such as race, gender, or special-education/IEP status.

2.2 Assessment Content

When a student completes an oral assessment, ArticulAI stores: the text transcript of the student's spoken response, rubric-based scores, evaluation feedback, and identified misconceptions.

ArticulAI does not store raw audio or video of a student's response. Audio is processed transiently, in real time, solely to generate a text transcript, and is not retained after the transcript is created. No video is captured or stored at any point.

Transcripts are linked to an identifiable student. This is necessary so teachers can review student work, provide feedback, and track progress over time; a transcript that could not be traced to a specific student would not be usable for grading or coursework. Access to identified transcripts is limited to the student, their teachers, and authorized school staff. We do not sell or share this data with third parties outside the service providers necessary to operate the platform (see Section 4, Sub-processors).

ArticulAI does not generate or store voice fingerprints, speaker embeddings, or any biometric voice profile. See Section 9 for more detail on voice data handling.

2.3 Technical and Usage Data

We automatically log limited technical and usage data, including speaking times during assessments and pages visited within the platform. We do not collect precise geolocation.

2.4 Cookies and Analytics

We use PostHog to understand which parts of ArticulAI are used and to improve the product: for example, which steps of creating a class, joining a class, or starting an assessment users complete, and where they drop off. This usage data is anonymous and cookieless: the anonymous visitor identifier is stored only in your browser's local storage, not a cookie, and is never linked to your name, email address, or account, only to your general role (student, teacher, or parent). Page URLs are stripped of specific class, assignment, or student identifiers before they are recorded, so only the general page (e.g. "class assignment page") is captured, never which one, and we configure PostHog to discard IP addresses rather than store them. Because it does not identify who you are, this anonymous analytics runs automatically as soon as you visit ArticulAI, whether or not you respond to the cookie banner.

Separately, PostHog can record and replay on-screen interactions (clicks, scrolling, and navigation) to help us diagnose usability issues; on-screen text and content are masked and not captured, regardless of whether a field is a password or any other input. Unlike the anonymous analytics above, this recording never starts unless you click "Accept" on the cookie banner shown on your first visit. If you decline or take no action, no recording occurs; ArticulAI remains fully usable either way. Your choice is remembered for 6 months, after which you will be asked again. You can change your choice at any time using the "Cookie Preferences" link in the site footer.

When a student speaks during an assessment, the live audio stream is sent to our speech-to-text provider, Deepgram, solely to convert speech into text. Deepgram operates under a zero-retention commitment, meaning the audio is not retained once the transcription request is complete. ArticulAI does not receive, store, or retain the audio itself; only the resulting text transcript is saved to our database.

Deepgram is also used to synthesize the AI assessor's spoken replies from text. The reply text, which may reference the student's response, is sent to Deepgram for voice synthesis only and is not retained by Deepgram. No student voice audio is ever used to generate synthesized speech.

The transcript text (without student name or other identifiers) is then sent to our language model provider, OpenAI, to generate rubric-based scores and feedback. ArticulAI's API tier excludes this data from being used to train OpenAI's models. OpenAI retains API inputs and outputs for 30 days for abuse-monitoring and safety review, after which they are deleted.

ArticulAI uses a limited number of third-party service providers to operate the platform, including for authentication and hosting, speech-to-text transcription, AI-based scoring and feedback generation, payment processing, email communications, and product analytics.

We do not permit any sub-processor to use student data for advertising, to sell student data, or to train, fine-tune, or otherwise improve any machine learning or artificial intelligence model (whether the sub-processor's own or a third party's) under any circumstance. Sub-processors are contractually bound to protect student data and to use it only for the purpose for which it was shared.

A current list of ArticulAI's sub-processors, including the categories of data each provider processes, is available to schools upon request by contacting [email protected]. Schools with a signed Data Processing Agreement will be notified of any material change to this list.

ArticulAI's primary database is Supabase Postgres, hosted in the United States. File and object storage is provided by Supabase Storage (profile pictures, uploaded materials). All ArticulAI data is stored in the United States; we do not transfer student data outside the country.

We use role-based access controls to limit who can view student data; access is restricted to the student themselves, their teachers, and authorized school staff. Data is encrypted in transit using TLS and encrypted at rest in our database.

ArticulAI does not currently hold third-party security certifications (e.g., SOC 2). Where applicable, we rely on the security practices and infrastructure of our service providers. Schools with a signed Data Processing Agreement (DPA) are covered by the formal, contractually defined breach-investigation and notification process set out in that agreement, including fixed timelines for confirming and reporting a breach. Outside of a signed DPA, we do not yet have an equally formalized, publicly documented data-breach notification process; we are committed to notifying affected users promptly in the event of a breach involving their data, and to formalizing this process ahead of broader rollout.

Student assessment data is not kept indefinitely and does not rely on manual deletion alone. Retention is governed by three defined triggers:

Outside of these triggers, data continues to be used only for the active educational purpose for which it was collected: ongoing assessment and progress tracking within a live school relationship. Data is not automatically purged at the end of each school year; as long as a school's contract with ArticulAI remains active, student and account data is retained so teachers and schools can track a student's progress across school years rather than starting over each fall. Deletion is tied to the end of the contractual relationship, not the calendar.

Deleted data may persist in encrypted system backups for up to 14 days after it is removed from production systems, after which it is overwritten in the ordinary course of our backup rotation. Backup copies are not accessible through the platform and are used solely for disaster recovery.

ArticulAI is currently in its pilot stage. Deletion requests are handled directly by ArticulAI's founders through the following process:

• Intake: Requests are directed to [email protected].
• Verification: For student data requests, we confirm the request through the student's school rather than acting on an individual request alone.
• Execution: ArticulAI's Chief Technology Officer, the only person with access to student data in production systems, manually locates and removes the relevant records from the production database. A single student's data can be deleted without affecting other students' records.
• Propagation: We confirm deletion or purge with relevant sub-processors (e.g., Deepgram, LiveKit).
• Confirmation: Written confirmation is sent to the requester once the deletion is complete.

We commit to completing verified deletion requests within 30 days of receipt.

Users and teachers may export their data in PDF or Excel format.

ArticulAI processes spoken student responses through a third-party speech-to-text service to generate a text transcript. Audio is used transiently for this purpose; our platform stores and analyzes the resulting transcript, not the audio recording. ArticulAI does not create or store voiceprints, speaker embeddings, or other biometric identifiers for identification purposes.

ArticulAI is intended for users age 13 and older; the youngest students on the platform today are 13. We do not knowingly collect personal information from children under 13.

On first sign-in, every new user (student, teacher, or parent, whether registering with email and password or through Google Sign-In) must complete a one-time date-of-birth check before accessing any other part of ArticulAI. This applies uniformly across roles and sign-in methods; role selection does not skip the check. The date of birth is used only to compute whether the user meets our age-13 minimum: it is processed in memory for that calculation and is not stored in our database or backups. Users who enter a birthdate indicating an age under 13 are blocked from self-registration; where an account record was already created as part of the sign-in flow (as with Google Sign-In), that record is deleted. We retain a device-level flag to prevent immediately re-attempting registration with a different birth year or role, and, only where the check passes, an account-level verification flag and timestamp confirming it was completed. This is a self-declared date of birth, enforced server-side; it is not identity- or document-based age verification.

For school pilots, schools sign an agreement with ArticulAI governing use of the platform. Whether a given school separately obtains parental consent is managed by that school and is confirmed on a school-by-school basis.

Where ArticulAI is used pursuant to a school's agreement with us, we operate under the direction and control of the school for purposes of the Family Educational Rights and Privacy Act (FERPA). Student records provided to or generated by ArticulAI remain the property of, and under the control of, the school. We use student data only for the educational purposes directed by the school and do not use it for any other purpose. For a private school that is not itself subject to FERPA, this section is not a representation that FERPA applies to the school or to ArticulAI; rather, ArticulAI contractually agrees to handle student data in a manner substantially equivalent to FERPA's core protections, as set out in that school's Data Processing Agreement.

ArticulAI is designed for K-12 oral assessment. Regardless of the state in which a student is located, or whether a student accesses ArticulAI through a school agreement or individually, we apply the following protections to all K-12 student data:

• We do not use student information for targeted advertising, to or about students or their parents/guardians.
• We do not use student information to build a profile of a student for any purpose other than the educational purposes of the platform.
• We do not sell student information.
• We disclose student information only as necessary to provide the service, as directed by the school, or as required by law.
• We delete or de-identify student information at the request of a school, district, or, where applicable, a parent or eligible student.

Where ArticulAI is used pursuant to an agreement with a school or district, that agreement (our Data Processing Agreement) governs the specific handling, retention, and deletion terms for that school's students.

At signup, every user must actively check a box confirming agreement to our Terms of Service and Privacy Policy before an account can be created; account creation does not proceed unless this box is checked. Schools separately sign a Data Processing Agreement with ArticulAI, and a separate Terms of Service governs use of the platform.

ArticulAI does not sell, share, or monetize student data, and does not use student data for advertising, under any circumstances. Student data is not used to train, fine-tune, or otherwise improve any machine learning or artificial intelligence model, whether ArticulAI's own or a third party's, including any model operated by a sub-processor.

Students, parents, and schools may request access to, correction of, or deletion of student data by contacting [email protected]. For students accessing ArticulAI through a school, requests are generally verified through the school. Teachers and administrators may export account and assessment data in PDF or Excel format.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify schools of material changes and update the effective date above.

Questions about this Privacy Policy or requests regarding your data can be directed to:

• Inflection Path LLC, d/b/a ArticulAI
• Email: [email protected]