Student data and FERPA

Two things are deliberately not records. The tutor keeps working notes during a session so it can follow the conversation; they exist only while the session runs, and are never saved with the student's records or shown to the student or the instructor. The one trace is a line in our server log, kept for 30 days, with the tutor's one-word reading of how the session is going (struggling, steady, confident or disengaged) against a shortened ID of the student's session record, not a name. The pronoun answer on the join form is kept only in the student's browser tab for the length of the session; it is never stored, and the instructor never sees it. Both are sent to the language-model provider, because that is how the tutor uses them (see the AI providers).

On the join form, before joining, a student sees a short notice: sessions are transcribed, they are recorded when the instructor turns recording on, and the school may review these records for educational purposes. The notice links to this page and to the privacy policy, which describe the AI providers and the insights report in full. The student ticks a box to confirm they have read it, and which version of that notice they saw, and when they acknowledged it, is stored on their session record.

After joining, the briefing screen tells the student, for this particular session, that it is an AI tutoring session, whether their voice is recorded, and who at their school may review it. Nothing starts, and nothing is recorded, until the student presses Start session.

After the session, if the instructor has chosen to share Student insights, the student sees their own copy on the end screen and can download it as a PDF. Otherwise the report is for the instructor, who can share it in their own words.

This is a notice, not a consent form, and we are careful about the difference. When a school uses TutorTalks for ordinary coursework under the school-official exception, the legal basis for processing is the school's; a student is not being asked to waive anything and cannot “withdraw consent” from their own coursework record. The acknowledgement exists so that the school can show the disclosure was actually made.

Access is enforced on the server, on every read, playback, download and export — not by hiding buttons in the interface. A request for a record outside the caller's own institution is answered as though the record did not exist. Inside an institution, an instructor's attempt to open a colleague's session is refused and recorded in the access log.

An instructor sees the students of the sessions they authored, and not a colleague’s. Being in the same department is not a legitimate educational interest in someone else’s class. One exception is the institution’s own owner and admins, who can reach every session — they are the ones who answer a student’s records request and ask us for an export or a deletion, and their reads are logged like everybody else’s.

A finance-office user who needs to fix a failed card is a billing admin, and a billing admin cannot open a transcript, apart from the older sessions described next. That separation is deliberate: paying for the service and reading students’ words are different jobs.

Older sessions with no recorded author. Sessions created before TutorTalks began recording which instructor created each session have no author on record. So that the instructors who created them do not lose them, any member of the institution can see and open those sessions, whatever their role. Every session created since then records its author, and the rules above apply to it in full.

Retention is configured by the institution within the limits below. These are the defaults a school starts with, not a legal requirement — your school should set or approve its own schedule.

A daily check deletes each record when its period ends, counting from when the session started, and logs the deletion. When the audio period ends first, the recordings are deleted together with the archived transcript files stored beside them; the transcript itself stays available in TutorTalks until the transcript period ends.

When a student's records are exported or deleted, the access log keeps the student's email address as the record of what was done, for as long as the log is kept. A student's records deleted at an owner's or administrator's request, a recording an instructor deletes, and a record whose retention period has ended are removed from our live systems straight away. Deleting a whole session removes its transcripts and session records straight away, but it does not yet remove the audio recordings and archived transcript files stored for that session, and the daily check cannot reach them afterwards. Until that changes, write to studio@arclightxr.com after deleting a session and we will delete those files. In every case, our cloud provider completes erasure from its own systems on its own schedule.

A PDF that a student downloads of their own insights copy is theirs to keep. The school's retention period does not reach it.

FERPA gives students the right to inspect and review their education records, and to ask for correction of records they believe are inaccurate or misleading (34 CFR §§ 99.10–99.12 and 99.20–99.22). Those rights are exercised through the school, which is the record holder.

So students should contact their instructor or registrar, not us. To make that workable, an institution owner or administrator can write to studio@arclightxr.com from the email address on their account, and we will:

• Export a complete student record — name and email address, every session, full transcripts, Student insights reports, and a list of the audio and archive files — as machine-readable JSON, produced on demand for that request and not stored by TutorTalks.
• Delete a student's records — their session records, transcripts, audio, archived files and insights reports — and send you a report of what was destroyed. The deletion is recorded in the access log.
• Help correct a record through the school's own amendment process. TutorTalks cannot edit a transcript in place; where a school decides a record should change, we can delete it on the school's instruction.

There is no dashboard control for these yet, which is why they go through us. FERPA generally allows a school 45 days to respond to a request to inspect records. We carry out an owner's or administrator's export or deletion request within 30 days of receiving it, so send it to us as soon as you receive the student's request. Instructors can also download their own sessions' transcripts and recordings themselves, where your institution allows downloads.

Running a spoken tutoring session means sending audio and text to speech-recognition, language-model and speech-synthesis providers. By default OpenAI does all three, and also searches the session's reference material, writes the Student insights report, and runs speech to speech where an instructor turns it on. HeyGen streams the video avatar. The subprocessors page lists every provider and what each receives. What we hold to:

• What identifies the student. The language-model provider receives the name the student typed at join, if any, and their pronoun answer, inside the tutor's instructions, so the tutor can address them properly; the name also appears in the request that writes the insights report. A student's email address and any student ID are never sent to an AI provider. The name field is optional, and a student who leaves it blank is recorded as Anonymous.
• No training on student content. We do not use student content to train AI models. We use our providers' business and API services, and we have opted out of provider training wherever an opt-out exists. A provider may keep what it receives for a limited time under its own terms, for example to monitor for abuse.
• A published list. Student content goes only to the providers on the subprocessors page. Which listed provider handles each step is a setting we can change without a software release, for example moving the tutor's replies from OpenAI to Google Gemini. Adding a provider that is not on the list is a software change, and the list is updated first.
• The avatar connection. In a video session the student's browser connects directly to HeyGen's video service, which therefore sees the browser's IP address. The student's microphone audio is not sent to HeyGen.
• Kept out of the logs. Our application logs and error reports are designed to exclude transcripts, audio, prompts and student names, and email addresses are removed from them. Our web server's access log is the exception: it records the address of each page requested, which can include a name or email address an instructor types into the Students search. Server logs are kept for 30 days.

• State recording-consent laws. Recording a student's voice may require notice or consent under the law of the state they are in. Our notice and its version history support that analysis; they do not perform it. Some states require all-party consent.
• State student-privacy laws. Several states impose vendor obligations beyond FERPA, mostly on services for K-12 schools. TutorTalks is not designed for K-12. A K-12 school should contact us before using it, because a written agreement is required.
• Voice and biometrics. We do not create voiceprints or speaker profiles, and a student's voice is never used to identify or authenticate anyone. Where an instructor turns on speech to speech, the AI hears the student's voice directly and responds to how they sound as well as what they say (slowing down for someone who sounds unsure, for example), and can judge speaking criteria such as pronunciation, fluency or confidence from it. Institutions subject to rules on emotion recognition, such as the EU AI Act, should review that setting before using it.
• Age and COPPA. TutorTalks is built for postsecondary and adult learners. Students must be 18 or older unless the institution has a written agreement with us that says otherwise, and it must never be used with children under 13. Some of the AI providers it depends on require their users to be 18 or older.
• AI-written assessments. A Student insights report is written by AI and can be wrong. It is for the instructor to review. Our Terms of Service forbid using it in decisions about admission, enrolment or discipline, and forbid using it as the sole or a principal basis for a grade of record or any other decision with significant effects on a student.
• Research use. An instructor using session recordings for research rather than instruction is doing something this service does not assume, and may need IRB approval.

• Encrypted in transit (TLS) and, in our cloud storage, at rest.
• Audio and transcripts live in private storage. There are no public file URLs; a browser is never handed a storage link, and every file is served through an endpoint that checks who is asking first.
• Every institution is a separate tenant, and the tenant boundary is checked on the server for every record.
• Access to transcripts, audio, exports and deletions is logged with the actor, the target, the time and the outcome. Those logs cannot be edited or deleted from within the application.

If you believe a student's records have been exposed, write to studio@arclightxr.com with “security” in the subject. We will acknowledge, contain and investigate it, and notify affected institutions without undue delay and, where student records are involved, no later than seven calendar days after we discover the breach.

TutorTalks is operated by Arclight Innovation LLC. Questions about this document, about a student record, or about a security concern go to studio@arclightxr.com.

If you are a student: requests to see, correct or delete your education records go to your school, not to us. Your school decides those questions; we carry them out on its instruction. Your instructor or your registrar's office is the right first contact.