Privacy Policy

TutorTalks (tutortalks.io) is operated by Arclight Innovation LLC (“Arclight”, “we”, “us”). Email is how to reach us about this policy, including privacy requests: studio@arclightxr.com.

This policy covers our website, the instructor dashboard and studio, the session pages participants use (including sessions embedded in other websites), and our billing. It does not cover websites that embed a session, Google’s sign-in pages, Stripe’s checkout pages, or what a customer does with records after taking a copy out of TutorTalks. Those are governed by their owners’ policies.

Where we decide

We are responsible for (in some laws’ terms, the “controller” of) personal information about people who visit our website; account holders, organization owners, administrators, members and billing contacts; people who receive a credit link from us or write to us; and the records that show someone accepted our Terms and this policy.

Where we act for our customers

Our customer is whoever holds the TutorTalks account: a college or university, a company, a training provider, or an individual instructor. When a customer runs sessions, the participants’ details, voice, recordings, transcripts, visit details and any AI-written insights about them (“participant records”, which our Terms call Session Records) are the customer’s. We process participant records only to provide TutorTalks to that customer, on its instructions and under its settings, such as whether audio is recorded and how long records are kept. In legal terms we act as the customer’s processor or service provider. We act in the same way for any personal information in the content a customer’s members put into TutorTalks, such as knowledge-base documents, uploaded images and approved-email lists (“Customer Content” in our Terms).

We do not use participant records for our own purposes, and we disclose them only to the customer, to the providers that help us run the service (section 6), or where the law requires. The customer is responsible for telling participants about its sessions and for any consent the law requires of it, for example to record a conversation.

Schools and student records

When the customer is a school, college or university subject to the Family Educational Rights and Privacy Act (FERPA), participant records are education records. We act as a school official with a legitimate educational interest, under the institution’s direct control, and the student data and FERPA notice explains how that works.

TutorTalks is designed for postsecondary, professional, corporate and medical training. It is not designed for primary or secondary (K-12) schools. A K-12 school must contact us first and may use TutorTalks only under a written agreement with us.

What we collect depends on how you use TutorTalks. The tables below set it out by whom it is about and where it comes from. We do not ask for government identification numbers (other than an optional business tax ID at checkout) or collect precise location, and we do not record video of anyone: the avatar’s video streams to the participant’s browser and is never recorded.

Website visitors

Account holders and organization members

Billing contacts

Participants (processed for our customers)

People who receive a credit link

Please do not put sensitive information, such as real patient records, government ID numbers or payment card numbers, into sessions, knowledge bases or conversations. TutorTalks is not designed to hold it, unless we have agreed otherwise in writing.

We use personal information only for the purposes below. The last column gives the legal basis we rely on under the EU and UK General Data Protection Regulation (section 13 explains those terms). For participant records, and for personal information in Customer Content, the legal basis is the customer’s, and we act on its instructions.

A spoken conversation with an AI avatar takes several AI services: one turns speech into text, a language model writes the tutor’s replies, another turns replies back into speech, and another animates the avatar. These services are run by the providers named on our Subprocessors page. We choose the provider for each task and may change it, but only to a provider listed on that page.

We never put an account holder’s or participant’s email address into a request to an AI provider, and approved-email lists are never shown to the AI. An email address reaches a provider only if someone says or types it in a conversation, or includes it in a brief or a document.

No training on your content

Arclight does not train, fine-tune or otherwise improve AI models with customer content or participant records. We use our providers’ business and API services, under terms that limit how they may use what we send, and we have opted out of provider training wherever a provider offers an opt-out. Providers may keep data for a limited time to detect abuse or as their terms require; OpenAI, for example, may keep API inputs and outputs for up to 30 days for abuse monitoring. Where a provider publishes how long it keeps API data, the Subprocessors page says so.

Voice and biometrics

We do not create voiceprints or speaker profiles, and we never use a voice to identify or authenticate anyone. Voice is used only to transcribe and hold the conversation and, where recording is on, to keep the recording for the customer. Where an instructor turns on speech to speech, the model hears the participant’s voice directly and responds to how they sound as well as to what they say (slowing down for someone who sounds unsure, for example), and it can judge speaking criteria such as pronunciation, fluency or confidence from it. Customers subject to rules on emotion recognition, such as the EU AI Act, should review that setting before using it.

Telling people it is an AI

Before a participant starts a conversation, the session’s notice tells them it is an AI tutoring session. The avatars are AI-generated video of stock presenters licensed through HeyGen, the voices are synthetic, and personas are characters an instructor writes, not real people. Our Terms do not allow anyone to use TutorTalks to pass an avatar off as a real person.

We disclose personal information only as described here. We do not sell it, and we do not share it for cross-context behavioural advertising. Our Subprocessors page names each provider, what it receives and where it processes data, and notes how long a provider keeps data where the provider publishes it.

Before your first payment under each version of our Terms of Service and this Privacy Policy (a plan, credits, an AI-credit pack, a plan change or an add-on), TutorTalks asks the person paying to read and accept both. If your earlier acceptance was for a one-off purchase, we ask again before your first subscription, plan change or add-on. When you accept, we keep a record on our servers. Records are only ever added to; what is written is never edited afterwards.

What a record contains

• Your user ID and, where there is one, your organization’s ID.
• Your email address, if you have verified it.
• The version of each document you accepted, and a SHA-256 fingerprint of each document’s text.
• The statements you ticked (that you agree to both documents, that you are 18 or older and, if you are buying for an organization, authorised to accept for it, and, for a subscription, that it renews automatically every month until you cancel), and whether you scrolled to the end of the documents.
• The date and time, from our server’s clock.
• Your IP address and your browser’s user-agent string.
• Which purchase prompted the acceptance, and a reference for the request, used to match it to our logs.

Each payment made under an acceptance, including the first, adds a short entry to the record: which purchase it was, the purchase summary the dialog showed if it was shown for that payment, the date and time, your IP address and browser user-agent string, a request reference and Stripe’s reference for the payment. These entries are kept for as long as the record.

We also archive the exact text of every version of these documents, so a record can be matched to the words you accepted. For purchases made through Stripe Checkout (plans, credits and AI-credit packs), we add the record’s ID and the document versions to Stripe’s record of the purchase. An acceptance may also be noted in your organization’s audit log.

Why we keep it, and for how long

We keep these records to prove that our agreement was made and on what terms, to answer payment disputes, and to establish, exercise or defend legal claims. Some automatic-renewal laws also require us to keep proof of consent. We keep each record for the life of the account plus six years, the time limit for contract claims under New York law, which governs our Terms. Because we need the records for legal claims, we do not delete them when an account is closed or when you ask us to delete your information, and we use them for no other purpose.

Our server does not set cookies. Our pages store some information in your browser, and Google Analytics sets cookies on four pages.

Your choices

TutorTalks uses no advertising cookies, tracking pixels or session-recording tools, and Google Analytics is not loaded on the pages participants use, including embedded sessions. To stop Google Analytics you can block cookies and site data for tutortalks.io in your browser, use a content blocker, or install Google’s opt-out browser add-on. Blocking Firebase storage signs you out whenever you close the page.

Because we do not sell or share personal information or use it for targeted advertising, we already treat everyone as opted out of those, and a Global Privacy Control signal changes nothing further. These signals, and Do Not Track, do not currently stop Google Analytics, so use the options above if you want it off.

We keep personal information only as long as we need it for the purposes in section 4. The periods below are what TutorTalks does today. Participant records follow the customer’s settings, which an owner or administrator of the organization can change in the dashboard.

Deleting information removes it from TutorTalks’ live systems straight away. We do not keep scheduled backup copies of TutorTalks data, and our cloud provider completes erasure from its own systems on its own schedule. The one exception is the earlier copies of the few accounts and sessions created before 2 September 2026, kept from when we moved TutorTalks to its current database. Those copies are outside the periods above; we apply deletion requests to them as well, and we will delete them entirely.

• Connections to TutorTalks are encrypted (TLS, with HTTP Strict Transport Security), and Google encrypts the information we store with it at rest.
• Our database and file storage refuse all direct access from browsers. Only our server can read them, and it serves a recording or transcript only after checking that the person asking is allowed to see it. There are no public links to files.
• Each organization’s information is kept separate, and that separation is checked on the server for every request.
• Roles limit who sees what: a member (the role instructors usually have) sees only the sessions they created, and a billing administrator cannot open a transcript. The exception is older sessions created before TutorTalks began recording which member created each session, which everyone in the organization can open.
• Viewing, playing, downloading, exporting and deleting participant records, and changes to roles, retention and billing, are recorded in an audit log.
• Our application logs are scrubbed of email addresses, sign-in tokens and keys, and are designed to exclude transcripts, audio and participant names. Our web server’s access log is the exception described in section 3: it records the address of each page requested, including any code or search text in it.
• Access by Arclight personnel is limited to authorised people who need it to run, support or secure the service. Our internal operator tools cannot open transcripts or recordings, and we do not read a participant’s conversation unless the customer asks us to, the law requires it, or we need to investigate abuse or a security incident.

No system is perfectly secure. If you find a vulnerability, please email studio@arclightxr.com with “security” in the subject rather than disclosing it publicly, and we will work with you.

If there is a breach

If we discover a security breach affecting personal information, we will contain and investigate it and notify affected customers without undue delay. For participant records we hold for a school, college or university, we will notify the institution no later than seven calendar days after we discover the breach. We will also notify individuals and regulators where the law requires, telling them what happened, what information was involved, what we are doing about it and what they can do. Participants are usually notified by the customer that holds their records, and we will help.

Account holders, organization members and billing contacts

You can ask us to:

• tell you what personal information we hold about you and how we use it;
• give you a copy of it, in a portable format where practical;
• correct it;
• delete it, or close your account.

These requests are handled by email rather than in the dashboard. Write to studio@arclightxr.com from the email address on the account. We will confirm we have your request and respond within 30 days. Some things you can do yourself: cancel a subscription from the Account page; delete a session, which deletes its transcripts and visit details (section 9 explains what happens to its recordings); delete an individual recording; download a session’s records, where your organization allows downloads; and, as an owner or administrator, set your organization’s retention periods and switch recording off. To export or delete one participant’s records, an owner or administrator can ask us and we will do it for them within 30 days.

Deleting an account also deletes the customer’s participant records, so we will confirm with the account owner and offer an export first. If you are a member of someone else’s organization, the sessions you created there belong to that organization, and we may need its owner’s agreement to delete them. We keep the records listed in section 9 that we must keep, such as acceptance and billing records. We will not treat you differently for exercising your rights.

Participants

Participant records belong to the customer that ran the session, so requests to see, correct or delete them go to the organization or instructor that invited you. If we receive a request from a participant, we pass it to the customer, tell the participant we have done so, and help the customer respond. We do not change or delete a customer’s records without its instruction unless the law requires us to.

Residents of California and of other states with comprehensive privacy laws have rights over personal information about them. We give the disclosures below whether or not a particular law applies to us. For participant records we act as a service provider or processor, so those requests go to the customer, as section 11 explains.

Your rights

• Know and access: the categories and specific pieces of personal information we hold about you, where it came from, why we use it and whom we disclose it to.
• Delete and correct it, and receive it in a portable format.
• Opt out of the sale or sharing of personal information, targeted advertising, and profiling in furtherance of decisions with legal or similarly significant effects. We do none of these.
• Limit the use of sensitive personal information. The only sensitive personal information we collect for our own purposes is account sign-in credentials, used solely to sign you in.
• Not be discriminated or retaliated against for using these rights, whether you are a customer or a participant.
• Appeal if we decline your request.

How to ask. Email studio@arclightxr.com with “Privacy request” in the subject; you do not need an account. We verify a request by confirming that you control the email address our records hold for you, and we may ask for more information if that is not enough. An authorised agent can ask for you with your signed permission, and we may ask you to confirm your identity with us directly. We confirm receipt within 10 business days and respond within 30 days; if the law allows more time for a complex request, we will tell you why and when to expect an answer.

Appeals. If we decline all or part of your request, reply with “Appeal” in the subject. We respond to appeals within 45 days. If we deny your appeal, you can contact the attorney general of your state.

Other disclosures. We do not sell or share personal information, including that of anyone under 16. We do not disclose personal information to third parties for their own direct marketing. We do not collect, use or sell personal data for the purpose of training large language models. We do not use or disclose sensitive personal information to infer characteristics about anyone.

California notice at collection

In the past 12 months we have collected the categories of personal information below. We have not sold or shared any of them, and we have disclosed them for business purposes only to the recipients listed. Participant information appears here for completeness; we process it for our customers.

If you are in the European Economic Area, the United Kingdom or Switzerland, data protection law gives you these additional details and rights.

• Controller. Arclight Innovation LLC is the controller of the information described in section 2 as ours, and can be reached at studio@arclightxr.com. We have not appointed a data protection officer. If we appoint a representative in the EU or the UK, we will name them here. For participant records and personal information in Customer Content, the customer is the controller and we are its processor.
• Legal bases. Section 4 sets out the basis for each purpose. Where we rely on legitimate interests, we have weighed them against your rights, and you can ask us for details. We do not rely on consent for any processing described here; if we ever ask for it, you will be able to withdraw it at any time.
• What is required. You must give us account and billing details to buy and use TutorTalks. A participant must give an email address to join a session; everything else they provide is optional or part of the conversation itself.
• Your rights. You can ask for access to your information, its rectification or erasure, restriction of processing, and portability, and you can object to processing based on legitimate interests, including analytics. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We respond within one month, or tell you within that month if we need up to two more because a request is complex.
• Complaints. You can complain to us at studio@arclightxr.com; we acknowledge complaints within 30 days and tell you the outcome. You also have the right to complain to a supervisory authority, such as the data protection authority where you live or work, the Information Commissioner’s Office in the UK, or the Federal Data Protection and Information Commissioner in Switzerland.
• Transfers. Section 15 explains how information reaches the United States and the safeguards we use.

TutorTalks is not directed to anyone under 18. Account holders must be 18 or older. Participants must be 18 or older unless we have agreed otherwise in writing with the customer, because several of the AI providers TutorTalks depends on require their users to be adults.

We never knowingly collect personal information from a child under 13. If we learn that we have, we will delete it and tell the customer concerned. If we learn that someone under 18 has taken part without such an agreement, we will tell the customer, who must stop that use under our Terms, and we may suspend the session; we delete that participant’s records on the customer’s instruction or where the law requires. If you believe either has happened, please email studio@arclightxr.com. A K-12 school must contact us before using TutorTalks, and may use it only under a written agreement with us.

Our own infrastructure is in the United States: our application server is in Boston, Massachusetts; our database runs in Google Cloud’s United States multi-region; and our background functions run in Google Cloud’s us-central1 region. Our providers may process information in other countries, and the Subprocessors page says where each one does.

If you use TutorTalks from outside the United States, your information is processed in the United States, where data protection law may differ from yours. Where the law of the EEA, the UK or Switzerland requires a transfer safeguard, we rely, for information our providers process for us, on the European Commission’s standard contractual clauses and the UK’s International Data Transfer Addendum included in those providers’ data processing terms. For participant records and Customer Content that an organization in the EEA, the UK or Switzerland puts into TutorTalks, those clauses apply once that organization and Arclight have signed a data processing agreement that includes them, and such an organization should sign one with us before using TutorTalks with participants. We are not certified under the EU-US Data Privacy Framework. Any institution that needs a data processing agreement can ask us for one.

When we change this policy, we publish the new version here with a new version date, and we keep every earlier version, which we will send you on request. For a material change, we will email account owners at least 30 days before it takes effect, unless the law or an urgent security need requires a change sooner. The dialog shown before payments will ask you to accept the new version before your next purchase.

Changes apply going forward. We will not use information we have already collected in a materially different way without your consent, and because we act only on our customers’ instructions for participant records and Customer Content, a change in how we use them applies to a customer only once it has agreed to it. Changes to the providers we use are announced on the Subprocessors page.

TutorTalks is operated by Arclight Innovation LLC. Write to studio@arclightxr.com about this policy, your information, or a security concern. Putting “Privacy request”, “Appeal” or “Security” in the subject helps us route your message.

If you are a participant: requests about your session records go first to the organization or instructor that invited you; if the session is run by a school, your instructor or the registrar’s office is the right contact. If you write to us, we will pass your request on and help them respond.