Data Handling & Privacy
Our Commitment
The platform collects no verified or personally identifiable student information. Students are never authenticated; any name shown is a self-entered, unverified display name with no link to institutional identity, records, or grades. AI conversation content is processed through the institution's own AI provider account.
Design Constraints
The following constraints are enforced by design and must hold true for this privacy posture to remain valid:
- No authentication of students. The student runtime never verifies identity. There is no roster, no SSO, no student account.
- Name is an unverified display name. The student types a free-text name used only to label their session and messages in the UI. It is not validated, matched, or linked to any institutional record.
- No PII fields. The system collects no email, student ID, demographic, or grade data for students.
- No grade/assessment linkage. Conversations are not tied to grades or institutional outcomes.
- BYO-key data flow. AI request/response content is sent to the institution's own provider account (their Claude/OpenAI/Gemini key), not a vendor-owned account.
What Is Stored
- Simulation definitions (company, personas, assignment) — authored by instructors, not student data.
- Student conversation transcripts — stored only under the self-entered display name, with no link to verified identity. Encrypted at rest (platform-level, via the database provider) and TLS in transit.
Sub-Processors
| Sub-Processor | Role | Student Data? | Notes |
|---|---|---|---|
| Clerk | Auth & org management | No student accounts | Institution admin/instructor identity only |
| Neon | Database (PostgreSQL) | Transcripts — display name + an opaque per-browser session id (no account, email, or IP) | Encrypted at rest; TLS in transit |
| Vercel | Hosting & edge delivery | Transient only | TLS enforced; no student data at rest |
| Stripe | Billing | None | Institution billing data only; no student data |
| Configured AI Provider (Anthropic / OpenAI / Google) | AI conversation processing | Via institution's own key | Processed through the institution's own provider account and API key |
Scope Boundary
This posture is valid as long as students remain anonymous, which is the committed product direction: professors share a link, students self-identify with an unverified display name, and no LTI, roster, or grade integration is built. FERPA compliance (DPA, retention, audit, the "school official" exception) would only become necessary if a future decision reintroduced authenticated student identity — currently out of scope.
Last updated: 2026-06-20