Privacy & Student Data

Student login & identity

Students sign in using an anonymous credential (a username and password) that we issue to the school, which the school passes to the student.
This credential does not contain a student’s name, home address, or personal email, and is not created from or linked to a student’s real-world identity.
The school controls the connection between a login and a specific student.
Practice records and reports are associated with these credentials, not with student names.

Individual and summary reports are delivered to the designated mentors or administrators at the school.
Reports are provided to the school, which distributes them to families — reports are never delivered to the student.
During a practice session, a student sees immediate coaching feedback on their own answer on screen — a score, strengths, areas to work on, and a model answer. That on-screen feedback is how the tool teaches. It is not a report, and it is not sent anywhere on the student’s behalf.
GoSaySo does not hold parent or guardian contact information, and does not maintain any mapping between a student and a parent’s email.

Before a practice answer is analyzed or stored, our system automatically detects and removes the names of third parties (such as teammates, teachers, or family members) and replaces them with neutral labels.
This removes other people’s names; it does not remove the name of a school or town, and it does not make an answer fully anonymous.
We keep student answer content out of our operational logs.
The student practice platform uses no third-party advertising or marketing integrations, and no advertising or analytics trackers of any kind. Our public marketing website uses standard advertising and analytics tools; it does not process student practice data.

GoSaySo uses API-based AI services to score written answers and to transcribe spoken responses.
Student content is never used to train AI models, and is never sold, shared, or combined with other data.
Our AI provider retains submitted content only briefly — up to 30 days — for safety and abuse monitoring, after which it is deleted.
A signed data-processing agreement governs this provider, under which it acts only on our instructions as a service provider.
Third-party names are removed from a practice answer before it reaches the AI provider for scoring.

One limit worth stating plainly. A spoken answer has to be turned into text before any filter can read it, so the recording itself reaches our transcription provider as spoken. If a student says a name aloud, that name is in the audio. This is inherent to all cloud speech-to-text and cannot be engineered away. Names are removed from the transcript immediately afterwards, before scoring and before storage.

Student practice data is stored in Google Workspace, configured so that the data is stored at rest in the United States.
Data is encrypted in transit (HTTPS); our storage provider encrypts data at rest.
Access to student data is restricted to what is necessary to operate and secure the service.

We keep student practice data for as long as the school uses GoSaySo.
We delete student data at the school’s request, or when the school’s engagement with GoSaySo ends.
Our AI provider’s short retention window is described above.

GoSaySo is intended for students aged 13 and older; we do not knowingly collect information from children under 13.
When used by a school, GoSaySo acts as a “school official” with a legitimate educational interest under FERPA, processing data under the school’s direction and for its educational purposes.
We are prepared to sign district and state student-data privacy agreements, including the SDPC National Data Privacy Agreement (NDPA), where required.
We follow FERPA’s core principles: data minimization, transparency, and access & deletion under the school’s control.

Questions about this policy or about student data:

GOSAYSO INC
info@gosayso.ai
One Cabot Road, Ste 290
Hudson, MA 01749, United States