Schools hold some of the most sensitive data there is: the names, ages, contact details, and academic records of children. When you add an AI assistant to that environment, the obvious question is also the most important one — what exactly gets sent to the model, and where does it go?
Strip first, then send
Our answer is to send as little as possible. Before a tutoring request leaves the device, personal identifiers — names, roll numbers, contact details — are stripped out and replaced with neutral placeholders. The model receives the academic substance of the question, which is all it needs to help, and never receives the identity of the child asking it.
Student data stays on the school's server
The records that make up a student's profile — attendance, marks, homework, report cards — live on the school's own deployment, not in a shared cloud we mine for our own purposes. Each school is a separate tenant with its own isolated data. There is no cross-school pooling of student information.
Access that matches the role
Privacy is also about who inside the school can see what. Teachers see their own departments and classes; parents see their own children; students see themselves. Student-to-student chats are visible only to the relevant department teachers, and only for safety. Every sensitive action is auditable, including a login activity log that records device, IP, and location so an administrator can spot anything unusual.
None of this is a feature we bolt on at the end. Stripping PII before the model sees it, isolating each school's data, and scoping access to roles are decisions baked into how the platform is built — because with children's data, the default has to be caution.