Privacy Policy

1.Scope of This Policy

This Privacy Policy explains how Yalkut AI collects, uses, shares, stores, and protects personal information when teachers, beta testers, website visitors, and other authorized users use Yalkut AI. It covers the Teacher Portal, Student Portal, AI Teacher, AI Tutor, assessments, guest live assessments, and related services. During the current beta, student-feature testing is limited to fictional or sample student data; real student use is not authorized.

This policy applies to the Yalkut AI pilot or beta service. It does not cover third-party websites or services that Yalkut AI does not control.

2.Who Is Responsible for Personal Information

Tauga AI Ltd., located at 29 David Remez Street, Tel Aviv, Israel, is the operator responsible for this policy. Privacy questions and requests may be sent to idan@tauga.ai or +972 55-980-3346.

Tauga AI Ltd. is responsible for personal information processed during the direct beta for individual teachers and other authorized testers, including people who are not teachers. If Yalkut AI later runs a school or organization pilot, the parties must document their respective responsibilities and, where applicable, enter into a Data Processing Agreement before real student information is collected.

3.Information We Collect

We may collect the following information when it is needed to operate the service:

• Account and profile information, such as name, email address, role, school or organization, grade level, and account identifiers.
• Course and classroom information, such as course names, rosters, invitations, learning objectives, and class settings.
• Teacher-created content, including lessons, homework, tests, activities, instructions, rubrics, and follow-up materials.
• Uploaded source materials, including documents, images, scans, videos, and related file information.
• Student-feature and assessment data, including submissions, answers, attempts, scores, feedback, progress, and activity completion. During the current beta, these records must use fictional or sample student data. Guest live assessment names are optional; session participation, answers, and results are saved after the session even when the guest has no account.
• AI interaction data, including prompts, generated responses, Tutor messages, selected settings, and user feedback about AI outputs.
• Usage and technical data, including login events, feature activity, timestamps, browser and device information, error logs, security events, and approximate network information. Website analytics may also include page URLs and titles, referring websites, campaign information, cookie or similar identifiers, interaction events, clicks, scrolling, and page/interface content subject to Clarity's masking settings.
• Support and feedback information provided through testing, surveys, bug reports, or communications.

4.How Information Is Collected

Information is collected directly from teachers and other authorized beta testers, through their account information, product activity, guest live assessment participation, and uploaded materials, and from service providers used for authentication, hosting, storage, artificial intelligence, email, and browser-based voice input. Google Analytics and Microsoft Clarity are active and automatically collect usage and interaction information on the approved pages where their tracking code is enabled, as described in Section 17. All beta testers must use fictional or sample student profiles and must not enter personal information about real students. If real student access is enabled later, information may also be collected from students who join through teacher invitations or authorized live assessment codes or links.

5.How We Use Information

We may use personal information to:

• Create and manage accounts, courses, classes, activities, and invitations.
• Generate and revise lessons, questions, assessments, feedback, and learning support.
• Provide the AI Tutor and apply teacher-selected support settings.
• Record submissions, attempts, scores, progress, and teacher-approved results.
• Operate live assessments and classroom activities.
• Provide support, investigate bugs, prevent misuse, and maintain security.
• Measure pilot adoption, engagement, completion, reliability, and product performance, understand how visitors discover and use the website, and identify navigation or registration friction.
• Improve the product using aggregated or de-identified information, without using user prompts, uploads, submissions, or AI conversations to train AI models.
• Meet legal obligations and enforce the Terms of Use.

6.Artificial Intelligence Processing

Yalkut AI uses OpenAI as its artificial intelligence provider. Depending on the feature, OpenAI may process teacher prompts, text and images from uploaded materials, audio from uploaded videos for transcription, Student Tutor messages, and relevant course content used to generate or retrieve answers. Student Tutor messages are also screened using OpenAI's moderation service.

The current service uses GPT-5.4 for the Student Tutor, text extraction, and heavier analysis; GPT-5.4-mini for the Teacher Assistant, course and activity generation, and feedback suggestions; text-embedding-3-large to search course materials; Whisper to transcribe uploaded videos; and OpenAI's moderation model to screen Student Tutor messages. These models may change as the service develops.

Yalkut AI does not use prompts, uploaded materials, submissions, or AI conversations to train AI models, and Tauga AI does not opt in to OpenAI model training using this content. Under OpenAI's standard API terms, API data is not used to train OpenAI models unless the customer opts in. OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring unless the account is approved for Zero Data Retention. Uploaded files are not stored in OpenAI's file-storage service; the necessary contents are sent within individual requests. Raw user content is processed to provide, secure, and support the requested features. Authorized Tauga staff may access it only as needed for support, debugging, or security. Product improvement uses aggregated or de-identified information.

7.Voice Input

Voice input uses the speech-recognition feature provided by the user's browser. Yalkut AI does not upload or store the original voice recording. Some browsers may send audio to the browser provider's speech service, which is governed by that provider. The user may review and edit the transcript before sending it; once sent, the transcript is stored as a normal chat message. For uploaded video materials, audio is sent to OpenAI's Whisper service for transcription. The transcript is stored for course-material search, and the original video remains stored until the teacher deletes the material.

8.Student and Minor Privacy

The current beta is open to individual teachers and other authorized testers, including people who are not teachers. All testers must use fictional or sample student profiles and must not enter personal information about real students, including when testing guest live assessments. This restriction does not prevent collection of a beta tester's own account, support, and usage information. If real student access is enabled later, Yalkut AI will collect only information needed for the educational purpose and will not use student information for targeted advertising or sell it.

Microsoft Clarity must not be used on websites or apps targeting users under 18, in accordance with Microsoft's published guidance. The approved Clarity coverage is limited to adult-facing public landing and teacher signup pages. Authenticated teacher/student pages, guest assessment entry and participation, assessments, identifiable student records, submissions, uploaded materials, and AI conversations are excluded. Coverage and masking must be verified, and provider eligibility must be reviewed before any expansion. The current lack of in-site cookie consent controls is disclosed in Section 17.

If real student access is enabled later, students may not register independently. They may join through an authorized teacher invitation or teacher-issued live assessment code or link, including guest participation where available. The inviting teacher must confirm that the student is in Grades 9 to 12, is at least 13 years old, and that required notices, consents, authorizations, and permissions have been addressed. Guest display names are optional, but guest participation is not treated as anonymous: answers and results are saved and may be accessible to the assigned teacher.

Users under 13 must not register for or use Yalkut AI. Supporting users under 13 would require a separate parental consent process and additional age, privacy, provider, testing, and legal safeguards before access is enabled. The pilot is available only in Israel, the United Kingdom, Canada, Australia, and the United States. Before first use of the AI Tutor, eligible students are shown a short, plain-language notice explaining what information is collected, how AI is used, what assigned teachers can view, and how to contact Yalkut AI with a question or privacy request.

9.Teacher and School Responsibilities

During the current beta, all testers are responsible for using fictional or sample student profiles and excluding real student personal information. Before later real-student use, the teacher or participating organization must have authority to use the service, admit only authorized students through invitations or live assessment codes or links, confirm age and grade eligibility, provide required notices, obtain required permissions, limit uploads to appropriate educational content, and use student information only for legitimate educational purposes.

Among teachers, only those assigned to the relevant course can view a student's identifiable AI Tutor conversation for an activity. They may view the conversation when they open that student's submission for homework, tests, or lessons containing questions. For a test's pre-test study chat, the conversation becomes available once the student starts the test. Lessons without questions do not create a submission for the teacher to open. Students are shown a notice before using the AI Tutor and on each activity explaining what assigned teachers can view. Access to identifiable AI Tutor conversations is recorded. Authorized Tauga staff may access these records only as needed for support, debugging, or security.

Teachers can also view individual messages that a student sends using “Ask the teacher,” total AI Tutor usage in their course analytics, and applicable activity results. Teachers do not receive AI-generated conversation summaries or safety alerts. If OpenAI's moderation service flags a message, the message is blocked and the student is asked to rephrase it. Platform administrators can view platform-wide Tutor usage and helpfulness ratings.

10.Legal Reasons for Processing

Tauga AI Ltd. processes information as needed to provide the service, perform pilot agreements, protect users and system security, comply with Israeli law and other applicable law, pursue legitimate operational interests that do not override user rights, or obtain consent where required. Before real student access begins in a pilot country, Tauga AI and, where applicable, the participating teacher or organization must confirm the applicable student privacy requirements.

11.When Information Is Shared

Personal information may be shared only as reasonably necessary with:

• Assigned teachers for the relevant course or assessment, and users accessing their own information through supported features. Authorized Tauga staff may access user content only as needed for support, debugging, or security. During the current beta, student-feature records must contain fictional or sample student data. Any later access by a school, parent, guardian, or other party must have an applicable authorization and legal basis.
• Supabase for accounts, database, file storage, authentication, usage events, and audit logs; OpenAI for AI generation, search embeddings, transcription, and moderation; Vercel for application hosting and operational logs; Resend for course-invitation emails; Google for Google Analytics website measurement; Microsoft for Clarity heatmaps and session replays; and, when voice input is used, the speech-recognition service made available by the user's browser. Service providers receive information needed for their function, subject to applicable settings and contractual terms.
• Professional advisers, auditors, insurers, or transaction partners subject to appropriate confidentiality obligations.
• Authorities or other parties when required by law or reasonably necessary to protect rights, safety, security, or the integrity of the service.

Google Analytics and Microsoft Clarity are used for website measurement and usability analysis as described in Section 17. Vercel operational error logs may include user and activity identifiers. Each provider handles information under its own contractual, privacy, and retention terms. More information is available in Google's Privacy Policy and Microsoft's Privacy Statement.

12.No Sale or Targeted Advertising

Yalkut AI does not sell teacher or student personal information. Student information must not be used for targeted advertising or unrelated commercial profiling. This commitment must be reflected in all vendor contracts used for the pilot.

13.Data Retention and Deletion

Users can initiate account deletion themselves through the service. Personal information associated with an active account is generally retained while the account remains active and as needed to provide the service. When an account or course is permanently deleted, related data is removed from active systems within 30 days, subject to the educational-record handling described below. Security and operational logs are retained for up to 90 days. De-identified analytics may be retained for up to 24 months. Limited information may be retained longer when required by law or reasonably necessary to protect security or legal rights. Guests without an account may contact the privacy contact listed in this policy to request applicable access or deletion of their live assessment records.

When a student deletes their account, the account and associated enrollments, submissions, answers, live-session participation, and AI conversations are queued for removal from active systems within 30 days. When a teacher initiates account deletion, the account is deactivated and identifying profile information is removed within 30 days. Authorized educational records may be transferred to the school or another authorized teacher, or deleted or anonymized according to the applicable pilot agreement. A course must first be archived, which is reversible. Permanently deleting an archived course queues its database records, uploaded materials, extracted text, transcripts, related generated files, activities, submissions, enrollments, and Tutor conversations for deletion from active systems within 30 days. Deleting an individual uploaded material also queues its file and extracted text for deletion within 30 days. An activity may be permanently deleted only when no student has submitted work; otherwise it may be archived. Removing a student from a course hides the enrollment but preserves authorized past educational records until the applicable course or account deletion schedule is completed. The audit log records deletion actions.

Deleted information may remain in automatic backups for up to 90 days before being overwritten or removed. OpenAI may retain API inputs and outputs for up to 30 days as described above. Vercel and Yalkut AI security and operational logs are retained for up to 90 days. De-identified analytics held by Yalkut AI may be retained for up to 24 months and cannot reasonably be linked back to an individual. Privacy and deletion requests may be sent to the contact listed in this policy. Some information may be retained longer when required by law or needed to protect security or legal rights.

Data held by Google Analytics and Microsoft Clarity follows the relevant project settings and provider retention rules rather than the account/course deletion schedule above. Google Analytics user-level and event-level retention is controlled by the property's configured retention setting; standard properties offer 2-month or 14-month settings, and standard aggregated reports follow different retention rules. Clarity normally retains playback data for 30 days and labeled or favorited sessions, heatmap data, and click data for 9 months. Applicable deletion requests must be handled separately with the relevant provider where supported. See Google Analytics retention information and Clarity retention information.

14.Security

The operator uses reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. No system can guarantee absolute security.

Users should protect their credentials and report suspected security incidents promptly. The operator will investigate incidents and provide legally required notifications.

15.International Data Transfers

The application is hosted by Vercel and currently runs in Vercel's default Washington, D.C. region unless the project settings specify another region. Supabase stores database, account, and uploaded-file data in the AWS us-west-1 region. OpenAI processes AI requests in the United States by default, and Resend processes course-invitation email data in the United States. Google and Microsoft may process website analytics information in countries outside the user's country of residence, including the United States, under their applicable service terms and safeguards. The pilot is available in Israel, the United Kingdom, Canada, Australia, and the United States, and information from these countries may be transferred to and processed in the United States. Tauga AI Ltd. must put appropriate contractual, organizational, and international-transfer safeguards in place before collecting personal information in a pilot country. A participating school or organization must also meet its own obligations where applicable.

16.User Privacy Rights

Depending on applicable law, users, parents, guardians, schools, or eligible students may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and to complain to a privacy regulator.

Requests may be submitted using the privacy contact listed at the beginning of this policy. Identity and authority may be verified before a request is completed.

17.Cookies and Similar Technologies

Yalkut AI uses Supabase authentication cookies needed to keep users signed in. The browser also stores the user's light or dark theme preference and whether a student has dismissed the AI Tutor privacy notice. It also remembers the email address of the last account that signed in on that browser, so the Sign-in page can prefill it; this is never the password, is kept for up to one year, and is removed when you delete your account on that browser or clear your browser data. Yalkut AI records first-party usage events and time-on-platform data in Supabase for teacher analytics and the administrator dashboard. Fonts are served from Yalkut AI's own domain. Vercel keeps standard operational logs.

Yalkut AI also uses Google Analytics 4 to understand website visits, acquisition sources, page navigation, engagement, and configured interaction events. Google Analytics may use cookies or similar identifiers and process device/browser information, page information, referring websites, campaign information, and approximate location. Names, email addresses, passwords, access tokens, student answers, uploaded content, and AI conversations must not be sent as Google Analytics event parameters or exposed through tracked URLs.

Microsoft Clarity is used to understand website usability through heatmaps and session replays. It collects interactions such as clicks and scrolling, technical/session information, and page/interface content subject to its masking settings. Masking must be configured and tested to protect personal content, including values rendered outside form fields; sensitive URLs and parameters require separate protection. The intended adult-facing scope and student exclusions are set out in Section 8. Session replay describes on-page interactions; it is not a webcam or microphone recording.

Google Analytics and Microsoft Clarity are active on the approved pages. Yalkut AI does not currently provide an in-site cookie consent banner or Accept/Reject preference controls. Analytics cookies and collection remain subject to applicable legal requirements and provider settings; where consent is required, it must be obtained before the relevant cookies or collection begin. Accepting the Terms or reading this policy does not replace a required consent choice. The absence of in-site controls does not remove these requirements, and a provider's cookieless mode does not by itself establish that collection is permitted.

Users can manage cookies through their browser. In-site analytics consent and preference controls are not yet available. Blocking essential cookies may prevent sign-in or other core functions. Google also provides a Google Analytics opt-out browser add-on, which applies to Google Analytics but not Clarity. Users may contact idan@tauga.ai to ask about analytics settings, request applicable privacy rights, or raise a concern. Further information is available in Google Analytics privacy information and Microsoft Clarity privacy information.

18.Changes to This Policy

This policy may be updated to reflect product, vendor, legal, or operational changes. Material changes will be communicated through the service, by email, or through another reasonable method before they take effect when required by law.

19.Contact and Complaints

Questions, privacy requests, complaints, or concerns may be sent to idan@tauga.ai, by WhatsApp or telephone at +972 55-980-3346, or by mail to Tauga AI Ltd., 29 David Remez Street, Tel Aviv, Israel. Users may also contact the privacy regulator that applies in their jurisdiction.