Skip to content

Privacy Policy

Last updated: October 6, 2026

1. Introduction

Zelvi ("we," "us," or "our") operates the zelvi.ai website and platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. We are committed to protecting your privacy and complying with applicable data protection laws worldwide, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the UK Data Protection Act 2018, Australia's Privacy Act 1988, Canada's PIPEDA, and other applicable regulations.

By using Zelvi, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

  • Account information: Name, email address, password, profile photo, time zone, and language preferences.
  • Tutor profile information: Qualifications, teaching experience, subjects taught, availability, hourly rate, and identity verification documents.
  • Payment information: Processed securely by Stripe. We do not store full credit card numbers on our servers.
  • Communications: Messages exchanged between students and tutors on the platform.
  • User-generated content: Study materials, notes, flashcards, quiz responses, and uploaded documents.

2.2 Information Collected Automatically

  • Usage data: Pages visited, features used, session duration, and interaction patterns.
  • Device information: Browser type, operating system, device type, and screen resolution.
  • IP address and location: Approximate geographic location derived from IP address for service optimization.
  • Cookies and similar technologies: As described in our cookie notice below.

3. How We Use Your Information

We use collected information to:

  • Provide, maintain, and improve our tutoring marketplace and AI study tools
  • Match students with appropriate tutors
  • Process payments and payouts to tutors
  • Generate AI-powered study materials (flashcards, quizzes, mind maps, study guides)
  • Track learning progress and provide personalized recommendations
  • Communicate with you about your account, bookings, and platform updates
  • Ensure platform safety, prevent fraud, and verify tutor identities
  • Comply with legal obligations
  • Improve the reliability and features of the platform, using aggregated usage statistics. We do not use your content, or any data received from Google or Microsoft, to train or improve AI models.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and Switzerland, we process personal data on the following legal bases:

  • Contract performance: Processing necessary to provide our tutoring services.
  • Legitimate interests: Platform improvement, fraud prevention, and analytics.
  • Consent: Marketing communications and optional AI features.
  • Legal obligation: Tax reporting, compliance with court orders.

5. Data Sharing and Disclosure

We do not sell your personal data. We may share information with:

  • Tutors/Students: Relevant profile and session information to facilitate lessons.
  • Service providers: Stripe (payments), Supabase (database hosting), Vercel (hosting), and AI model providers (OpenAI, Google Gemini and Anthropic), which receive only the text needed to answer a request, under API terms that do not allow them to use it to train their models.
  • Legal requirements: When required by law, court order, or to protect our rights.
  • Business transfers: In connection with a merger, acquisition, or asset sale (with prior notice).

5A. Google and Microsoft User Data

Zelvi connects to Google and Microsoft only when a user chooses to, and asks only for the permissions the feature they started needs. This section describes exactly what Zelvi accesses, why, and what happens to it.

What we access

  • Sign in with Google or Microsoft: your name, email address and profile picture, used only to create and sign in to your Zelvi account.
  • Google Classroom roster import (read-only, started by a teacher): the teacher's list of active classes, and the names and email addresses of the teachers and students in the class the teacher selects.
  • Google Docs and Google Slides import (read-only, started by a teacher): the text of the one document or presentation the teacher selects, including slide speaker notes.
  • Google Classroom coursework and Google Forms (started by a teacher): Zelvi creates an assignment in the teacher's own Classroom class, or a quiz in the teacher's own Google Forms, from practice questions the teacher has reviewed in Zelvi.
  • Microsoft 365 (read-only, started by a teacher): the Word or PowerPoint file the teacher selects from their OneDrive or SharePoint.

How we use it

Only to provide the feature the user asked for: signing in, placing students and teachers in the right Zelvi course, turning a selected document into draft course material the teacher reviews before students see it, and creating the assignment or quiz the teacher requested. Course material imported this way may be sent to our AI model providers to answer students' questions about that course, and for no other purpose.

How we store and protect it

  • Google and Microsoft access tokens are short-lived (under one hour), held in a secure, HTTP-only browser cookie limited to that course, and are never stored in our database. Zelvi does not request offline access or keep refresh tokens.
  • What we keep: the Zelvi accounts and course enrollments created from a roster import (name and email address), and the text of a document the teacher imported, stored as course material. Assignments and forms are created in the teacher's own Google account; Zelvi keeps no copy.
  • All data is encrypted in transit and at rest, and each institution's data is isolated at the database level.

How we share it

We do not sell Google or Microsoft user data, use it for advertising, or transfer it to data brokers or information resellers. It is shared only with the service providers listed in Section 5 that are needed to run the feature the user requested, and when required by law. No person at Zelvi reads it unless the user asks us to (for example, for support), it is needed for security or to comply with the law, or it has been aggregated and made anonymous for internal operations.

No AI training

Zelvi does not use data obtained through Google Workspace APIs, or data derived from it, to develop, train or improve generalized or non-personalized artificial intelligence or machine-learning models. The same applies to data obtained from Microsoft.

Limited Use

Zelvi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access and deleting data

You can remove Zelvi's access at any time from your Google Account permissions or your Microsoft account's app permissions. Teachers can delete imported course material in Zelvi. To delete your account and the data associated with it, use the account deletion option in Zelvi or email [email protected]; we complete deletion within 30 days, as described in Section 7.

6. Your Rights

6.1 All Users

  • Access your personal data
  • Correct inaccurate data
  • Delete your account and associated data
  • Export your data in a portable format
  • Opt out of marketing communications

6.2 EEA/UK Residents (GDPR)

  • Right to erasure ("right to be forgotten")
  • Right to restrict processing
  • Right to data portability
  • Right to object to processing
  • Right to withdraw consent at any time
  • Right to lodge a complaint with a supervisory authority

6.3 California Residents (CCPA/CPRA)

  • Right to know what personal information is collected
  • Right to delete personal information
  • Right to opt out of the sale of personal information (we do not sell data)
  • Right to non-discrimination for exercising privacy rights
  • Right to correct inaccurate personal information
  • Right to limit use of sensitive personal information

6.4 Australian Residents

Under the Privacy Act 1988, you have the right to access and correct your personal information. You may also make a complaint to the Office of the Australian Information Commissioner (OAIC).

6.5 Canadian Residents (PIPEDA)

You have the right to access your personal information, challenge its accuracy, and withdraw consent (subject to legal or contractual restrictions).

7. Data Retention

We retain personal data for as long as your account is active or as needed to provide services. Upon account deletion, we remove personal data within 30 days, except where retention is required by law (e.g., financial records for tax compliance) or for legitimate business purposes (e.g., resolving disputes).

8. Data Security

We implement industry-standard security measures including: encryption in transit (TLS 1.3) and at rest, access controls, regular security audits, and secure payment processing via Stripe (PCI DSS Level 1). However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, and compliance with applicable transfer mechanisms.

10. Children's and Students' Privacy

10.1 Two ways a child can use Zelvi

Through a school. A school, school district or other educational institution (the "school") can give its students, including children under 13, access to Zelvi for classroom learning. This section governs that use. Our written agreement with the school also applies, and if the two conflict on student data, the agreement with the school wins.

On their own. Our personal (non-school) service is not directed to children. A child under 13, or under the age of digital consent in their country (up to 16 in some EEA countries), may not create a personal account. If we learn that we have collected personal information from such a child outside a school account without verifiable parental consent, we delete it promptly. A parent who believes this has happened can email [email protected].

10.2 School consent (COPPA)

Under the US Children's Online Privacy Protection Act (COPPA), a school may consent on behalf of parents to collecting personal information from students under 13. That consent is limited to the educational context: we use the information only to provide Zelvi to the school and its students, and never for any commercial purpose of our own. We give the school the information in this section so it can decide whether to consent and can tell parents about it. Schools that want to tell parents themselves, or ask for parental consent, can share this section or contact us for help.

10.3 What we collect from students

  • Identity: for a student who joins with a class code, only a first name. No email address, password, surname or date of birth is asked for; we assign the account an internal address that cannot receive mail. For a student added by the school (roster, Clever, ClassLink, Google, Microsoft or the school's learning management system), the name, school email address and roster identifiers the school provides.
  • Class membership: the school, classes and role.
  • Learning activity: answers to practice questions and quizzes, retries, hints shown, work handed in, marks and teacher feedback, and live-game answers.
  • Conversations with the AI tutor: the text of questions the student types or says and of the tutor's answers. Spoken questions are streamed to our AI provider to be understood and answered; Zelvi does not store the audio.
  • Messages a student sends to their teacher, and files a student chooses to upload.
  • Technical information: IP address, browser type and session cookies, used to keep the student signed in and the service secure.

We do not ask students for a home address, phone number, date of birth, photograph, precise location or government identifier. A student is never required to give more information than the activity needs.

10.4 How we use it

Only to run Zelvi for the school: to let the student learn and practise from the school's material, to show teachers and school administrators how their students are doing, to keep the service working and secure, and to protect students' safety (Section 10.6). We do not:

  • sell or rent student information;
  • show advertising to students, or use student information for targeted or behavioural advertising;
  • build a profile of a student for any purpose other than the school's education purposes;
  • use student information, including conversations with the AI tutor, to train or improve AI models; or
  • use third-party advertising or tracking cookies on the pages students use.

10.5 Who sees it

  • The student's school: the student's teachers and the school's administrators, for the classes they are responsible for. Schools cannot see each other's data.
  • Our service providers listed in Section 5, which host the service and run the AI tutor. They may use student information only to provide their service to us, under contracts that require them to protect it and that do not allow them to train AI models on it.
  • When the law requires it, or to protect the safety of a student or another person.

If Zelvi is ever sold or merged, student information remains subject to this policy and to our agreements with schools, and we will tell schools before it moves to a new owner.

10.6 Student safety

If a student writes or says something to the AI tutor that suggests they may be at risk of harm to themselves or others, or of abuse, the tutor responds with care and shows how to reach help, including a crisis line. We record the alert, including a short excerpt of what the student said, and notify the staff the school has designated so a trusted adult can follow up. Zelvi is not an emergency service and does not contact emergency services itself.

10.7 Parents' rights

A parent or guardian may review the personal information we hold about their child, have it corrected or deleted, and refuse to allow any further collection or use of it. Please make the request through your child's school, which controls the account and can act straight away (school administrators can permanently erase a student's account from Zelvi). You can also email [email protected]. We will verify the request with the school and act on it within the time our agreement with the school sets. If a parent refuses further collection, the child will no longer be able to use Zelvi. Under FERPA and similar laws, parents and eligible students also have rights against the school, which remains responsible for its education records.

10.8 How long we keep it

  • We keep student information only as long as needed to provide Zelvi to the school. These rules run automatically, every day.
  • When a school erases a student, the account and everything it created (answers, practice, tutor conversations, uploads, messages and marks) are permanently deleted at once.
  • A student account created with only a first name is deleted automatically, with everything it created, once it has not been used for 180 days.
  • When a school closes its account in Zelvi, for example at the end of its agreement, all of its student information is deleted automatically 30 days later, unless the agreement sets a different period. The school can cancel during those 30 days, and its administrators receive written confirmation by email when deletion is complete.
  • Deleted information leaves our rolling backups automatically within the backup period of our database provider.
  • We do not keep student information indefinitely.

10.9 How we protect it

Student information is encrypted in transit and at rest. Each school's data is separated at the database level, and staff can see only the classes they are responsible for. Access by Zelvi personnel is limited to what is needed to run and support the service. Administrative actions, including erasure, are written to an audit log. If we confirm a security breach affecting student information, we will notify the affected schools without undue delay, and within the time required by law and our agreement with each school, so they can inform families.

10.10 Laws and agreements

We designed our school service to support schools' obligations under COPPA, the Family Educational Rights and Privacy Act (FERPA), the Protection of Pupil Rights Amendment (Zelvi does not survey students about protected topics), and state student-privacy laws such as California's SOPIPA and New York Education Law § 2-d. Under FERPA we act as a "school official" under the school's direct control, using education records only for the purposes the school authorised. We will sign a school's student data privacy agreement, including the Student Data Privacy Consortium's National Data Privacy Agreement.

10.11 Contact

Questions about children's or students' privacy: [email protected] or 530-618-2420. We will answer within 10 business days.

11. Cookies

We use essential cookies to operate the platform (authentication, security). We may use analytics cookies on our public website to improve our service, but never on the pages students use when signed in through a school. You can manage cookie preferences in your browser settings. We do not use cookies for third-party advertising.

12. AI-Generated Content

Our AI study tools (flashcards, quizzes, mind maps, study guides) process your uploaded content to generate study materials. This processing is performed to deliver the service you requested. We do not use your personal study content to train our AI models. Generated content is associated with your account and subject to the same privacy protections as other user data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on our platform. Continued use of Zelvi after changes constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related inquiries, data access requests, or complaints:

For EU/UK residents, you may also contact your local Data Protection Authority.