Privacy & FERPA Compliance

FERPA Overview

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

TrustAI operates as a “school official” with a legitimate educational interest under 34 CFR § 99.31(a)(1). This means we may access personally identifiable information from education records when designated by a school or district, solely to provide the educational services outlined in our agreements. We do not use student data for any purpose other than delivering and improving the services contracted by the educational institution.

Data We Collect

TrustAI collects only the data necessary to provide its educational services:

• Student names and email addresses (provided via Clerk SSO through the school’s identity provider)
• Assignment submissions and related coursework
• AI interaction logs (conversations with AI tutoring tools)
• Behavioral analytics (keystroke counts, paste events, time-on-task) used to support academic integrity analysis

How We Use Data

All data collected is used exclusively for educational purposes. This includes providing AI-assisted grading support, powering student-facing AI tutoring tools, generating teacher dashboards and analytics, and producing academic integrity reports. We do not use student data for advertising, marketing, or any non-educational purpose.

Data Security

• All data is encrypted in transit using TLS and encrypted at rest
• Role-based access controls ensure only authorized users can view student records
• We do not sell, rent, or share student data with third parties for commercial purposes
• Access to production systems is limited to authorized personnel and subject to audit logging

Parental Rights Under FERPA

Parents and eligible students have the following rights under FERPA:

• The right to inspect and review the student’s education records
• The right to request amendment of records believed to be inaccurate or misleading
• The right to consent to disclosures of personally identifiable information
• The right to file a complaint with the U.S. Department of Education concerning alleged FERPA violations

To exercise any of these rights, please contact your school or district administrator, or reach out to us at hello@trytrust.ai.

Data Retention & Deletion

Student data is retained for the duration of the academic term or the period defined in our agreement with the school or district. Upon request from the school or district, we will delete all associated student data within 30 days. Schools and districts may request data deletion at any time by contacting hello@trytrust.ai.

Related Policies