Data Processing

How uNote Processes Data

uNote is designed with data minimization and security as foundational principles. This page describes how we store and process data on behalf of our institutions, and lists the third-party subprocessors we rely on to deliver the platform.

The commitments below are not policy statements we can revise unilaterally. Each one is a term of the Data Processing Addendum ("DPA") an institution executes with uNote, which was drafted with legal counsel and covers FERPA, COPPA, PPRA, and state student privacy law. Where this page and an executed DPA differ, the DPA governs.

What We Collect - and What We Do Not

Within the platform, uNote processes the following categories of Student Data:

• Account information - name, institutional email address, username, and role.
• Enrollment information - which courses and sections a student is in, and when.
• AI conversations - questions typed to the assistant, the answers it gives, any files attached to a conversation, and the short search phrase the AI generates when a question needs current information from the internet.
• Coursework - assignment submissions and attachments, quiz answers and scores, grades, instructor feedback, and notes written in uNote.
• Usage information - records of when and how the platform was used, and technical logs needed to keep the service running and secure.

Because students type freely and can upload their own files, a student may include personal details uNote never asked for. We treat anything a student writes or uploads as protected Student Data under the institution's agreement, with the same restrictions as a grade or a submission.

Subprocessors

uNote engages the following third parties to deliver the platform. Each is contractually bound to protect Student Data on terms no less protective than those we maintain with our institutions, and each may use it only to help deliver the service. All of them process data in the United States.

Entries tagged Student Data are the subprocessors listed in Exhibit B of our DPA. Cloudflare and Keycloak are shown for completeness: Cloudflare serves only this marketing website, and Keycloak runs inside uNote's own AWS environment rather than as a third-party service.

Before adding or replacing a subprocessor that will process Student Data, uNote provides institutions with at least thirty (30) days' advance written notice, along with an updated parent notice reflecting the change.

How Data Flows Through the Platform

Course Materials and File Processing

When an instructor uploads a course material (PDF, DOCX, image), it is stored in AWS S3. If format conversion is needed (e.g., DOCX to PDF), an AWS Lambda function performs the conversion within uNote's own infrastructure. Processed files are then passed to the retrieval pipeline, which extracts text, generates embeddings via OpenAI, and stores the embeddings in the Supabase PostgreSQL database. Raw files and extracted text remain within uNote's AWS environment; only query-time context snippets (not full files) are sent to AI model providers during chat.

AI Chat Sessions

When a student sends a message to the AI tutor, the student's message and the relevant course material excerpts (retrieved via semantic search from pgvector) are assembled into a prompt and sent to an AI model provider (OpenAI, Anthropic, or Google). The provider processes the prompt and returns a response. The full conversation - student messages and AI responses alike - is stored in uNote's database and is visible to enrolled instructors through the instructor dashboard.

Student queries and the retrieved course content sent to AI providers constitute the extent of data shared with those providers. Raw uploaded files are not transmitted to AI providers. All AI providers uNote uses are under written terms that forbid using Student Data to train or improve their models, and that limit how long they may retain it.

Internet Search

Internet search is one of several tools the AI tutor can invoke automatically - it is not a separate, user-facing search bar. When the assistant determines that a question benefits from information more recent or broader than the language model contains (for example, current software versions, recent events, or live documentation), the model generates a short search query derived from the conversation and calls an internal web-search tool. That query is sent to Brave, a third-party internet search API, through uNote's model gateway. Brave returns a small number of public web results, each consisting of a title, URL, and text snippet. Those results are passed back to the language model as additional context so it can compose and cite its answer, and the interface shows a transient "Searching the web" indicator while this happens.

The only data sent to the search provider is the AI-generated query string, along with the API key uNote uses to authenticate. Because that query is derived from the user's message, it may incidentally include information the user typed, so we treat it as potentially containing personal data. No name, account identifier, authentication token, uploaded file, note, course enrollment, grade, or profile field is sent to the search provider. Results are filtered at the API level, and an institution that prefers no web results at all can ask us to disable the feature for its deployment.

Returned results are public web content that uNote does not write or control. The AI model providers involved in the assistant also process the search query and the returned results as part of composing the response.

Authentication

Authentication is handled by Keycloak, which is deployed and managed by uNote within our own AWS infrastructure (not a third-party SaaS service). User identity tokens are set as HTTP-only cookies and never exposed to client-side JavaScript. Session management and token refresh are handled by uNote's auth service.

How the AI Is Used and Its Limits

Grounding answers in an instructor's own materials reduces wrong answers. It does not eliminate them. uNote is a study aid, not a replacement for a teacher, and the institution remains responsible for instruction.

• The AI does not decide grades, academic standing, or discipline. Instructors assign grades. Automatic scoring of objective questions, such as multiple choice, is configured by the instructor and can be reviewed and overridden by the instructor.
• Students are told when they are talking to an AI.
• Output may contain errors. It supplements instruction; it does not substitute for it.
• Web content is third-party material. When the AI draws on information from the internet, that content comes from public websites uNote does not write or control.

Instructors govern how the assistant behaves in their course through Tutor Mode, Require Citations, Prevent Summarizations, and Advanced Prompts.

FERPA and Student Education Records

uNote operates as a "school official" under the Family Educational Rights and Privacy Act ("FERPA"), with our data use bound by the DPA the institution signs. This section explains how the platform's data architecture supports institutions' FERPA compliance obligations.

Access Control and Enrollment Gating

Every data access in uNote is scoped to an active CourseOffering - the unit representing a specific section of a course in a given term. Student education records (AI interactions, submissions, grades, notes) are only accessible to Users who are actively enrolled in that specific offering with an appropriate role (Student, Teaching Assistant, or Instructor). An instructor cannot see students in another course. A student cannot see another student's work. No other institution's data is reachable from an institution's account. This enrollment gate is enforced at the API layer on every request, not only in the UI.

What Is Shared with AI Providers Under FERPA

When student queries are processed by AI model providers, the data transmitted consists of the student's message text, retrieved course content excerpts, and session context. This transmission is necessary to provide the educational service and falls within the school official exception to FERPA's disclosure restrictions. AI providers are contractually prohibited from using this data for any purpose other than returning a response - they may not use it to train models, build profiles, or disclose it to additional parties.

Instructor Visibility and Legitimate Educational Interest

uNote's instructor dashboard - which shows enrolled instructors and teaching assistants the AI interaction history, submissions, and engagement records of students in their course - is an explicitly disclosed function of the platform. This access constitutes a "legitimate educational interest" under FERPA. It is also the point of the product: it is how an instructor notices that a student is stuck on a concept before the exam, and how the institution supports academic integrity.

Audit Trail and Record Integrity

AI interaction logs, assignment submissions, quiz attempts, and grades are stored with immutable timestamps and are protected against unauthorized modification. Submissions use on_delete=PROTECT constraints in the data model to prevent grading history from being deleted while a submission record exists. This architecture supports the accuracy and integrity requirements of FERPA education records.

What We Will Never Do

• Never sell, rent, or trade student information.
• Never use it for targeted advertising, or to market anything to a student or a parent.
• Never use it to train or improve AI models - ours or anyone else's - unless the institution separately signs an agreement permitting a specific, defined use.
• Never build a commercial profile of a student.
• Never require more information than the service actually needs.

Children's Data and COPPA

uNote serves both K-12 and higher education. Where an institution deploys uNote for students under 13, we rely on the school-authorization pathway recognized by the Federal Trade Commission: the institution consents to the collection of a child's personal information on behalf of parents, strictly within the educational context and never for advertising or any other commercial purpose.

Direct Notice Materials

That pathway is conditional: one of its conditions is that the provider give the school a clear description of its data practices that the school can use to notify parents. uNote furnishes institutions with ready-to-send Direct Notice Materials - a full parent notice, a short-form notice for newsletters and portals, and a parent FAQ - along with a source-of-authority table that maps every factual statement in the notice back to the DPA provision that binds us to it. We reissue those materials when we add or replace a subprocessor, and whenever we materially change our collection, use, disclosure, or retention practices.

Review, Correction, and Deletion Requests

Parents send review, correction, and deletion requests to the institution, not to uNote. The institution holds and controls the student's records; uNote acts only on the institution's instructions. If a parent contacts uNote directly, we refer them to the institution and let the institution know they reached out.

uNote does not currently provide a self-service administrator console for retrieving or deleting an individual student's records. The mechanism today is operational: a designated uNote privacy contact receives a written request from the institution, assists within ten (10) business days, and completes deletion within thirty (30) days, with written confirmation on completion.

Data Retention and Deletion

• While the institution uses uNote - data is retained for as long as it is needed to provide the service.
• Deletion on request - when the institution asks uNote to delete specific information, we do so within thirty (30) days, except where the law requires keeping it, or where the institution has asked us to preserve academic records such as grade history.
• On termination - the institution may export its data, and uNote deletes all of it from active systems within ninety (90) days.
• Backups - copies held in encrypted backups for disaster recovery are erased on the normal backup cycle, within thirty-five (35) days, and are never used for any other purpose.

Contact-form and waitlist submissions to this marketing website are retained only as long as needed to respond and to keep a record of the correspondence, after which they are deleted or anonymized.

Security and Incident Response

Student Data is stored in the United States and is not moved outside the country without the institution's written permission. It is encrypted both at rest and in transit. Access is restricted to the people who need it, and uNote maintains logs and automatic alerting to detect problems.

If a data breach affecting an institution occurs, uNote notifies that institution within seventy-two (72) hours of confirming it, describes what happened and who was affected, and assists with any notifications the law requires. The institution - not uNote - controls what families are told and when.

Requesting Our Data Processing Addendum

Our DPA was drafted with legal counsel and is the instrument that binds everything on this page. It covers:

• FERPA "school official" designation and prohibited re-disclosure
• The COPPA school-authorization pathway for students under 13, and delivery of the parent notice materials that pathway requires
• PPRA and state student privacy law obligations
• Categories of data processed, permitted purposes, and prohibited uses
• Subprocessor controls and thirty (30) days' advance notice of changes
• Seventy-two (72) hour breach notification and incident cooperation
• Retention, export, and deletion service levels
• US data residency, with international transfer only on the institution's written permission
• Audit rights and security safeguards