Enterprise Privacy Policy

1. Core Architectural Privacy Guarantees

ClassMind AI is architected from the ground up with Privacy-by-Design and Data Minimization principles for international educational institutions, academies, and private tutors:

• Zero Raw Video Storage: ClassMind AI does not store, archive, or transcode raw video streams. Video tracks are discarded; only the isolated audio feed is temporarily streamed to ephemeral memory for speech-to-text conversion and immediately deleted.
• Strict Zero-Training Guarantee: Institutional, instructor, and student data is NEVER used to train, retrain, or fine-tune public foundation LLMs (such as OpenAI, Anthropic, or Gemini public models). All AI processing is conducted exclusively via enterprise zero-data-retention APIs.
• End-to-End Encryption: All webhook payloads and data in transit are protected using modern TLS 1.3 encryption. Data at rest (e.g., tokens and student report summaries) is secured using industry-standard AES-256 encryption.

2. Data Controller vs. Data Processor Roles

Under the EU General Data Protection Regulation (GDPR), UK-GDPR, and the US Family Educational Rights and Privacy Act (FERPA):

• The educational institution, tutoring company, or instructor acts as the Data Controller.
• ClassMind AI acts strictly as the Data Processor (and as an authorized "School Official" under FERPA) performing services with legitimate educational purpose under customer instruction.

3. Categories of Data Processed

We process only the minimum metadata necessary to generate pedagogical reports:

• Session Metadata: Meeting ID, topic, date, start/end timestamps, and duration.
• Instructor & Student Indicators: Teacher email and student first name / pseudonym as provided by Customer settings.
• Lesson Outputs: Structured vocabulary items, corrected grammar phrases, homework assignments, and talk-time percentage ratios.

4. Student Privacy: COPPA & FERPA Compliance (School Consent Model)

Protecting student and child privacy is foundational to our mission. ClassMind AI complies with both the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. 6501–6506) and the Family Educational Rights and Privacy Act (FERPA, 34 CFR Part 99):

• School Consent Model (In Loco Parentis): Under COPPA regulations and FTC guidance for EdTech providers, educational institutions and language schools contract with ClassMind AI acting in loco parentis to authorize educational data processing on behalf of parents for students under the age of 13. The school warrants that it has collected necessary institutional consent and uses ClassMind AI solely for legitimate educational assessment.
• FERPA "School Official" Designation: Under FERPA regulations (34 CFR § 99.31(a)(1)(i)(B)), ClassMind AI operates as an authorized "School Official" with legitimate educational interests, performing an institutional service under the direct control of the school regarding the use and maintenance of educational records.
• No Commercialization or Profiling: Student data, session audio, and transcripts are never sold, rented, leased, or utilized for behavioral targeted advertising, commercial profiling, or third-party marketing.
• PII Minimization: Students may be identified solely by first names or school-assigned pseudonyms. Full names, home addresses, phone numbers, and financial details are never requested, stored, or processed.

5. Data Retention & Right to be Forgotten Protocol

ClassMind AI enforces strict data lifecycle boundaries and an automated 2-stage Right to be Forgotten protocol in accordance with GDPR Article 17, FERPA, and Zoom Data Compliance Standards:

• Zero Audio Retention (0 Days): Audio feeds ingested from Zoom Cloud recordings are buffered strictly in ephemeral memory during processing, transcribed to text, and instantly purged. Raw media is never archived, cached, or stored on persistent disk.
• Pedagogical Report Lifecycle: Structured lesson reports, talk-time metrics, and vocabulary glossaries are retained only for the duration of the school's active customer subscription to facilitate longitudinal progress tracking, or up to 30 days post-termination, after which records are shredded.
• Stage 1 — Immediate Revocation: Upon receiving an app_deauthorized event from the Zoom App Marketplace or an authorized deletion request sent to privacy@classmind.pp.ua, all OAuth access tokens, refresh tokens, and active webhook ingestion hooks are immediately revoked and deactivated within seconds.
• Stage 2 — Irreversible Data Purge: Within 24–48 hours following deauthorization or a deletion request, all historical transcripts, AI analysis cards, and associated database records for that account are permanently and irreversibly purged from our database in automated batches.

6. Zoom App Marketplace Deauthorization & Data Cleanup

When an institutional administrator uninstalls or deauthorizes ClassMind AI from the Zoom App Marketplace, Zoom issues an automated app_deauthorized webhook event. ClassMind AI automatically revokes all OAuth tokens and de-identifies or permanently erases all associated account records within 24 hours in compliance with Zoom Data Compliance Standards.

7. Third-Party Sub-Processors & Infrastructure Security

ClassMind AI engages carefully vetted third-party sub-processors that maintain enterprise-grade security standards (SOC 2 Type II, ISO/IEC 27001, HIPAA/GDPR compliance) and signed Data Processing Addendums (DPAs):

8. Data Subject Rights & Contact Information

Students, parents, teachers, and school administrators hold full statutory rights under GDPR, CCPA, and FERPA to inspect, export, rectify, and permanently purge personal records. For data requests or privacy inquiries, contact our Data Protection Officer:

• Privacy & Data Protection Desk: privacy@classmind.pp.ua
• Customer Support & SLA Desk: support@classmind.pp.ua
• Resolution Commitment: Inquiries are acknowledged within 4 business hours and fulfilled within 48 business hours.