An AI tutor privacy checklist for schools, answered from the privacy policy

Each question below is answered from a specific section of the privacy policy, named so a reviewer can open the policy and check the wording. The policy is the document that binds; this page is a reading guide to it. If an answer here seems wider than the section it cites, the section wins and we would like to hear about it.

The policy is written under PIPEDA and applicable Ontario law, and it applies to the CANtutor AI website and app.

Section 7 explains that to answer a question, generate a lesson or hold a voice conversation, the content of the request is sent to third-party AI services that produce the response: typed text, uploaded files, images and lecture recordings, and in a voice session the speech, its transcript, and the camera or shared screen if either is on.

Section 8.1 names the providers by company: Supabase for sign-in, the database and file storage; Vercel for hosting; OpenAI for the AI that answers questions, grades work, builds lessons and transcribes lectures; Google for the AI that runs a live voice session, and separately for Classroom and Drive if connected; LiveKit for carrying the live audio and video; Stripe for payments; Resend for transactional email; and Apple where a subscription is bought through the App Store.

Section 7 states that these services are used under commercial terms that restrict them to processing content in order to return a result, and that the agreements do not permit them to use content to train their general-purpose models.

Section 8.2 says that some providers operate outside Canada, that personal information may be stored or processed outside Canada including in the United States, that while there it is subject to that country's laws and may be accessible to its courts and authorities, and that contractual and other measures are used to require a comparable level of protection. A school that requires Canadian-only processing should read that section as a no, and we would rather it did than discover otherwise later.

Section 3 lists what is not collected or done: personal information is not sold and not disclosed for a third party's own marketing; there is no advertising in the product and no advertising or behavioural profiling network in it; government ID, street address and financial account details are not asked for; and activity is not tracked across other companies' websites or apps.

Section 6 covers school and Google accounts. Where a school or district enables the service for its students, the school determines what information is provided, and the service handles it on the school's instructions under the agreement with the school; information received through a school integration is used to provide the service to that school and its students and for nothing else. Google permissions are requested only for the features used, at the point the feature is turned on, and can be revoked from the account settings or from Google's own security settings. Use of Google API data adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google Classroom connects for personal Google accounts and for school accounts where the district permits third-party apps. Some districts block it; if yours does, everything else still works and you upload your material instead.

Section 11: account and learning content is kept while the account is open. Lecture recordings, transcripts and uploaded files are kept until the user deletes them or the account is deleted; there is no deletion on a schedule of the service's own. Voice-session audio and video are not recorded at all; only the text transcript of a session is kept. Billing records are kept as long as tax and accounting law requires. Security and error records are kept for a short period.

Deletion is requested from inside the app under Settings, Account, Delete account, or by email. It is scheduled rather than immediate, with a grace window during which signing back in cancels it, and the policy links to a page setting out what happens to the data.

Section 5.2: the service is a general-audience learning tool and not directed to children. Profile setup asks for a birth year, the year only, so the service knows whether the user is old enough to hold an account on their own; the answer is not verified. Section 12: safeguards include access control, encryption in transit and at rest, and restricted internal access; the details of security controls are deliberately not published; and a breach creating a real risk of significant harm is notified to the person and to the Office of the Privacy Commissioner of Canada as the law requires. Section 13: the rights of access, correction, withdrawal of consent, deletion and complaint, exercised by email from the account's address, with no charge.

It does not name hosting regions, model names or security mechanics, by design. It does not describe a teacher or school dashboard, because there is not one. It does not claim age verification. A review that needs any of those should treat their absence as the answer rather than assume a favourable one. For anything the policy does not cover, the privacy contact in section 17 reaches the person accountable for it.