Privacy Policy

Introduction

uNote ("we," "our," or "us") is committed to protecting your privacy and ensuring transparency in how we handle your data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI learning management system.

By using uNote, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this privacy policy, please do not access the platform.

This policy applies both to this marketing website (which provides product information and lets visitors contact us or join our waitlist) and to the uNote learning platform. Where a section is specific to one or the other, we say so.

Privacy at a Glance

This summary gives you a quick overview of our key data practices. The full details are in the sections below.

Information We Collect

Information You Provide

• Account information - name, institutional email address, username, and role.
• Enrollment information - which courses and sections you are in, and when.
• Coursework - assignment submissions and attachments, quiz answers and scores, grades, instructor feedback, and notes you write in uNote.
• Communication data - messages and support requests.

Because students type freely and can upload their own files, a student may include personal details we never asked for. We treat anything a student writes or uploads as protected student information under our agreement with the institution, with the same restrictions as a grade or a submission.

What We Do Not Collect

uNote does not ask for or require Social Security numbers, financial or payment information, biometric data (such as fingerprints or face scans), health records, precise geolocation, or free- and reduced-price lunch status.

Contact and Waitlist Submissions

When you submit the contact form on this website, we collect the name, email address, and message you provide so we can respond to your demo, pilot, or partnership request. These submissions are delivered by email to members of the uNote team. We use your email address solely to reply to your inquiry. If you join our waitlist, we collect only your email address so we can notify you about availability and product updates.

We do not use information submitted through these forms for advertising, and we do not sell it. Providing this information is voluntary, but it is necessary for us to respond to you.

Information Collected Automatically

• AI conversations - the questions you type, the answers returned, files you attach to a conversation, and the short search phrase the AI generates when a question needs current information from the internet
• Usage analytics (features used, time spent, patterns)
• Device information (browser type, operating system)
• Log data (IP address, access times, pages viewed)

Marketing Site Analytics

This marketing website does not use third-party analytics, advertising, or cross-site tracking services. We do not build advertising profiles or sell visitor data.

AI Interaction Data

As a core feature of uNote, we log all interactions between students and the AI tutor. This data is what lets an instructor notice that a student is stuck on a concept before the exam. This logging is a fundamental part of our service and cannot be disabled.

How We Use Artificial Intelligence

AI is central to how uNote works. This section explains which AI models we use, what data is sent to them, and the controls that govern AI behavior on our platform.

AI Model Providers

uNote uses the following third-party AI model providers to power the AI tutor:

• OpenAI - used for chat responses and for generating text embeddings that index course materials
• Anthropic (Claude) - used for chat responses
• Google (Gemini) - used for chat responses

The specific model used for a given interaction is determined by uNote's routing logic based on course configuration. Institutions may contact us to inquire about which model is active for their deployment.

What Data Is Sent to AI Providers

When a student sends a message to the AI tutor, the following information is assembled into a prompt and transmitted to an AI model provider:

• The student's message text
• Relevant excerpts from instructor-uploaded course materials, retrieved through semantic search (not the full files)
• Course-level configuration settings (e.g., citation requirements, tutor mode restrictions)
• Recent conversation context (prior messages in the session, subject to token limits)

Raw uploaded files (PDFs, documents, images) are processed and indexed within uNote's own infrastructure and are not transmitted to AI model providers. Only the text excerpts most relevant to a student's query are forwarded.

Internet Search

The AI tutor can perform live internet searches to answer questions that benefit from information more recent or broader than the underlying AI model contains. Internet search runs automatically as one of the assistant's tools - there is no separate search bar. When a search is needed, the AI model generates a short query derived from the conversation and sends it to Brave, a third-party search provider, through uNote's model gateway. Brave returns a small number of public web results (titles, URLs, and snippets), which are added to the AI's context so it can answer and cite sources.

Only the AI-generated query text is sent to the search provider - no name, account identifier, authentication token, uploaded file, note, grade, or course enrollment. Because the query is derived from what the user typed, it may incidentally contain information the user included in their message, so we treat it as potentially personal. Results are filtered at the API level, and an institution that prefers no web results at all can ask us to disable the feature for its deployment. Returned results are public web content from third-party sources that uNote does not write or control, and any linked content is subject to those sources' own privacy practices. The AI model providers (OpenAI, Anthropic, Google) also process the query and results when composing a response.

AI Model Training

We never use Customer Data, student data, or any personally identifiable information to train or improve AI models - ours or anyone else's. The only exception would require the institution to separately sign an agreement permitting a specific, defined use. The AI providers we work with are under written terms that forbid training on this data as well, and that limit how long they may retain it.

Grounded AI and Instructor Controls

uNote's AI tutor is designed to be grounded in the course materials uploaded by the instructor and, when it performs an internet search, in the web results returned by our search provider. Instructors can configure the following controls per course:

• Tutor Mode - the AI walks students through a problem step by step rather than handing over the answer
• Require Citations - every answer must surface the exact course material it drew on
• Prevent Summarizations - blocks cliff-note responses on material students are expected to read
• Advanced Prompts - instructors describe exactly how the AI should behave in their course
• Enable/disable - instructors can turn off AI access for a specific course entirely

Instructor Transparency

All AI interactions in uNote are logged and visible to instructors and teaching assistants enrolled in the relevant course. They can review the full history of a student's AI interactions - including queries and AI responses - through the instructor dashboard. An instructor cannot see students in another course, and students cannot see each other's conversations or work. This logging is a fundamental and non-disableable feature of the platform, as it is central to uNote's value proposition.

Limits of the AI

Grounding answers in an instructor's own materials reduces wrong answers but does not eliminate them. uNote is a study aid, not a replacement for a teacher, and the institution remains responsible for instruction.

• The AI does not decide grades, academic standing, or discipline. Instructors assign grades.
• Automatic scoring of objective questions, such as multiple choice, is configured by the instructor and can be reviewed and overridden by the instructor.
• Students are told when they are talking to an AI.
• When the AI draws on information from the internet, that content comes from public websites uNote does not write or control.

How We Use Your Information

We use the collected information for the following purposes:

• Provide, operate, and maintain our platform
• Enable AI-assisted learning features
• Provide the instructor dashboard and surface where students are struggling
• Generate learning analytics and insights
• Improve and personalize user experience
• Communicate with you about updates and support
• Ensure platform security and prevent fraud
• Comply with legal obligations

How We Share Your Information

Within Your Institution

AI interaction data and learning analytics are shared with authorized instructors and administrators at your institution as part of the instructor dashboard. This sharing is fundamental to how uNote works.

Service Providers

We may share information with third-party service providers who perform services on our behalf. These providers are bound by confidentiality agreements. Current processors include:

• Amazon Web Services (AWS) - hosting, storage, and content delivery for both the platform and this website
• Resend - transactional email delivery, used both to send contact-form and waitlist submissions to the uNote team and to deliver platform notifications and academic updates; it receives a user's name and institutional email address for that purpose

The complete list of subprocessors that handle Student Data, along with what each one does and where it operates, is published on our Data Processing page. We give institutions at least thirty (30) days' advance written notice before adding or replacing a subprocessor that will process Student Data.

Contact-form and waitlist submissions are forwarded by email to members of the uNote team so we can respond to you. We do not sell or rent your personal information to anyone, and we do not share it with third parties for their own marketing purposes.

Legal Requirements

We may disclose information if required by law or in response to valid legal requests from public authorities.

Business Transfers

If uNote is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and of any choices you may have regarding your information.

Cookies and Tracking Technologies

This marketing website does not use advertising or cross-site tracking cookies, and it does not use third-party analytics. We may use a small number of strictly necessary, first-party storage items (for example, to remember your light or dark theme preference), which are required for the site to function and are not used for tracking.

Because we do not use non-essential tracking technologies, there is no cross-site advertising activity to opt out of on this website. The uNote platform uses only cookies necessary for authentication and security.

Data Security

We implement appropriate technical and organizational security measures to protect your information, including:

• Encryption both at rest and in transit
• Access restricted to the people who need it, enforced per enrollment on every request
• Logging and automatic alerting to detect problems
• Regular security assessments
• Employee security training
• Incident response procedures

If a data breach affecting an institution occurs, we notify that institution within seventy-two (72) hours of confirming it, describe what happened and who was affected, and assist with any notifications the law requires. The institution - not uNote - controls what students and families are told, and when.

Data Retention

While your institution uses uNote, we retain information for as long as it is needed to provide the service. The concrete timelines below are commitments in the Data Processing Addendum your institution signs, not policy we can revise unilaterally:

• Deletion on request - when your institution asks us to delete specific information, we do so within thirty (30) days, except where the law requires keeping it or where the institution has asked us to preserve academic records such as grade history.
• On termination - the institution can export its data, and we delete all of it from active systems within ninety (90) days.
• Backups - copies held in encrypted backups for disaster recovery are erased on the normal backup cycle, within thirty-five (35) days, and are never used for any other purpose.

Contact-form and waitlist submissions are retained only as long as needed to respond to your inquiry and maintain a record of our correspondence, after which they are deleted or anonymized.

Legal Bases for Processing

If you are located in the European Economic Area, the United Kingdom, or another region with similar laws, we process your personal information under the following legal bases:

• Consent - when you submit a form or opt in to communications.
• Contract - to provide the platform and services you request.
• Legitimate interests - to operate, secure, and improve our site and product, where not overridden by your rights.
• Legal obligation - to comply with applicable laws and regulations.

Where Your Data Is Stored

Student Data stays in the United States. uNote is based in the United States, our infrastructure runs there, and every subprocessor we use to deliver the platform processes data there. We do not move Student Data outside the country without the institution's written permission.

For institutions outside the United States that require them, we can put appropriate transfer safeguards in place - such as the European Commission's Standard Contractual Clauses - as part of a negotiated Data Processing Addendum. Contact [email protected] to discuss.

Your Rights

Depending on your location, you may have the following rights:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Object to processing of your information
• Data portability
• Withdraw consent where applicable

If you are a student or a parent, send requests about student records to your institution rather than to us. The institution holds and controls those records, and uNote acts only on its instructions; if you contact us directly we will refer you to the institution and let it know you reached out. For everything else - including information you gave us through this website - contact [email protected]. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising your rights.

California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) provides you with rights to know what personal information we collect, to access and delete it, to correct inaccurate information, and to limit certain uses of sensitive information. You may exercise these rights using the contact details below.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months.

FERPA Compliance

The Family Educational Rights and Privacy Act ("FERPA") is a federal law that protects the privacy of student education records at institutions that receive federal funding. uNote is designed to support institutions' FERPA compliance obligations. This section describes how we handle student education records and our commitments to institutions and students under FERPA.

What Constitutes Education Records in uNote

Under FERPA, "education records" are records directly related to a student and maintained by an educational institution or a party acting on its behalf. Within uNote, the following may constitute education records for enrolled students at covered institutions:

• AI tutor interaction logs (student queries and AI responses)
• Assignment submissions, grades, and instructor feedback
• Quiz attempts, answers, scores, and grading history
• Participation data and engagement analytics tied to a student's account
• Student-uploaded notes and course materials

uNote as a School Official

uNote acts as a "school official" with a "legitimate educational interest" as those terms are used in FERPA. This means uNote may access and process student education records to the extent necessary to fulfill the services described in our Terms of Service and this Privacy Policy - for example, to operate the AI tutor, generate learning analytics, and surface the instructor dashboard. We do not use education records for any purpose unrelated to providing educational services to the contracting institution.

Access is scoped to enrollment and checked on every request. An instructor cannot see students in another course, a student cannot see another student's work, and no other institution's data is reachable from an institution's account. What binds us to all of this is the Data Processing Addendum the institution signs, not this policy alone; where the two differ, the DPA governs.

Disclosure Restrictions

uNote will not disclose student education records to third parties except:

• To authorized school officials (instructors, TAs, and administrators enrolled in the relevant course offering) as part of uNote's instructor dashboard, which constitutes a disclosed function under FERPA's school official exception.
• To subprocessors (such as AI model providers) strictly to the extent necessary to deliver the platform, under data processing terms consistent with FERPA obligations.
• As required by law or valid legal process, subject to applicable notice requirements.
• With the prior written consent of the eligible student (or parent/guardian for students under 18), as directed by the institution.

uNote does not sell student education records, share them for advertising purposes, or disclose them for any commercial purpose unrelated to the educational services we provide.

Student Rights Under FERPA

FERPA grants students (and parents of students under 18) the following rights with respect to education records held by their institution:

• Right to inspect and review - eligible students may request access to their education records maintained by the institution.
• Right to request amendment - students may request that the institution correct records they believe to be inaccurate or misleading.
• Right to consent to disclosure - with limited exceptions, institutions must obtain written consent before disclosing personally identifiable information from education records.
• Right to file a complaint - students may file a complaint with the U.S. Department of Education concerning alleged failures to comply with FERPA.

These rights are administered by the institution, not directly by uNote. Students wishing to exercise FERPA rights should contact their institution's registrar or designated FERPA officer. If your institution directs a request to us, we will cooperate promptly and in accordance with the institution's instructions.

Institutional Agreements

Institutions deploying uNote to students subject to FERPA should execute a Data Processing Addendum (DPA) with uNote that formalizes the school official designation and our respective obligations. See our Data Processing page for details or contact [email protected] to request a DPA.

Children's Privacy (COPPA)

uNote serves both K-12 and higher education. Where an institution deploys uNote for students under 13, we rely on the school-authorization pathway recognized by the Federal Trade Commission under the Children's Online Privacy Protection Act ("COPPA"): the institution consents to the collection of a child's personal information on behalf of parents, strictly within the educational context and never for advertising or any other commercial purpose.

How Consent Works

uNote does not operate a consumer-facing registration flow open to the general public. Accounts are provisioned through institutional agreements. When a school or district deploys uNote, its agreement with us constitutes consent for uNote to collect the personal information of enrolled students to the extent necessary to provide the educational services described in this policy. We use that information only for educational purposes on the school's behalf, and we do not disclose it to third parties except as necessary to deliver the Services.

Notice to Parents

The school-authorization pathway is conditional: one of its conditions is that the provider give the school a clear description of its data practices that the school can use to notify parents. We furnish institutions with ready-to-send Direct Notice Materials - a full parent notice, a short-form notice, and a parent FAQ - along with a table mapping every factual statement in the notice to the Data Processing Addendum provision that binds us to it. The school controls the form, timing, and delivery of notice to families. We reissue those materials when we add or replace a subprocessor, and whenever we materially change our collection, use, disclosure, or retention practices.

Parental Rights

Parents and legal guardians of children under 13 enrolled through an institution have the right to:

• Review the personal information collected from their child.
• Request correction of inaccurate personal information.
• Request deletion of their child's personal information, subject to legal and academic record-keeping obligations.
• Refuse further collection or use of their child's personal information, which may require the institution to disable the child's access to the platform.

Send these requests to the school, not to uNote. The school holds and controls your child's records; uNote acts only on the school's instructions. If you contact uNote directly at [email protected], we will refer you to the school and let the school know you reached out. Under our agreement with the school, we assist within ten (10) business days and complete a deletion request within thirty (30) days of receiving it from the school, with written confirmation on completion. We do not currently offer a self-service administrator console for this; the mechanism is an operational one handled by our designated privacy contact.

Whether a student may opt out of using uNote is the school's decision, not ours. Ask your school what alternative arrangement is available.

Discovery of Unauthorized Collection

If we learn that we have inadvertently collected personal information from a child under 13 without appropriate authorization, we will delete that information as promptly as reasonably practicable. If you believe we may have collected such information, please contact us immediately at [email protected].

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Significant changes will be communicated via email or platform notification.

Contact Us

If you have questions about this Privacy Policy, your Personal Information, or the Services you can contact us at [email protected].