Privacy Policy

1. Our role

Tutorify sells to higher-education institutions. When an institution enrolls, the institution is the controller of its data and we act as its service provider and, where applicable, a "school official" under FERPA with a legitimate educational interest, processing data only on the institution's documented instructions. Where an institution's agreement or a Data Privacy Agreement (DPA) conflicts with this policy, that agreement governs for that institution's data.

2. Information we handle

• Account and roster data — name, institutional email, role (admin/instructor/student), course enrollment, and institution identifiers, typically synced from your LMS via LTI 1.3 / OneRoster.
• Content you provide — course materials you upload (slides, readings, syllabi, transcripts), assessments, and student submissions processed for grading and feedback.
• Interaction data — questions students ask the AI assistant and the responses generated, used to deliver the Service and to show instructors course-level analytics.
• Usage and technical data — log data, device/browser info, and diagnostic data used for security and reliability.

We do not knowingly direct the Service to children under 13 and do not seek to collect their data; the Service is built for higher education.

3. How we use information

To provide and operate the Service; generate assessments, feedback, and grades for instructor review; sync approved grades to your LMS; produce analytics for the institution; provide support; maintain security; and comply with law. We do not sell personal data, use it for advertising, or use student data to train external AI models.

4. AI processing and sub-processors

Delivering the Service requires processing content through third-party large-language-model providers and infrastructure vendors ("sub-processors"). We contractually require sub-processors to protect the data, use it only to provide services to us, and not train their models on institutional or student data. A current list of sub-processors is available at [SUB-PROCESSOR LIST URL] and in our DPA.

5. How we share information

We share information only: with sub-processors under contract; with the institution that owns the data; when required by law or to protect rights and safety; and in a business transfer (merger/acquisition), subject to this policy.

6. Security

We protect data with AES-256 encryption at rest and in transit, SAML 2.0 SSO, multi-factor authentication, role-based access controls, and least-privilege internal access. No system is perfectly secure, but we maintain administrative, technical, and physical safeguards appropriate to the data.

7. Retention and deletion

We retain institutional data for the term of the institution's agreement and delete or return it on termination as described in the DPA, subject to legal retention requirements. Institutions and users may request deletion through [CONTACT].

8. FERPA and individual rights

Because the institution controls student education records, students (or parents/eligible students where applicable) should direct requests to access, correct, or delete records to their institution, which we support in fulfilling. Depending on location, individuals may have additional rights (access, correction, deletion, portability, objection); we honor these as directed by the controlling institution and applicable law.

9. International data

[Complete only if you process EU/UK data or offer data residency; otherwise remove this section. Describe transfer mechanisms (e.g., SCCs) and residency options.]

10. Changes

We may update this policy and will post the revised version with a new effective date. Material changes will be communicated to institutional customers.

11. Contact

Tutorify AI Inc. · [MAILING ADDRESS] · privacy@tutorify.ai