Does Tabitha use student work to train AI models?

Never. Submissions are processed in real time and are never used to train commercial language models or sold to third parties.

Is Tabitha compliant with FERPA and COPPA?

Yes. Tabitha adheres strictly to FERPA and COPPA guidelines and enters into standard district Student Data Privacy Agreements upon request.

How can teachers delete student grading history?

Teachers can permanently delete grading sessions, feedback slips, or entire accounts at any time from account settings.

Privacy Policy

Last Updated: September 2026

At Tabitha.ai, we believe in pedagogical integrity, not digital surveillance. We are committed to protecting the privacy of teachers, educators, and students alike in strict compliance with FERPA and COPPA standards.

1. Information We Collect & Process

Teacher Account Information: Name, school email address, school affiliation, and authentication credentials.
Billing Data: Payment processing is handled directly by Lemon Squeezy with PCI-DSS Level 1 compliance. Tabitha.ai never stores payment card numbers.
Classroom Inputs: Student essays, handwritten scans, and evaluation rubrics are processed ephemerally in real time to generate feedback slips and report card comments.

2. Zero Public Model Training

We maintain a strict policy: student submissions, paper scans, and grading rubrics are never used to train public language models, nor are they sold to third-party data brokers. All data remains the intellectual property of the educator and school district.

3. Data Retention & Erasure

Educators have full control over their account data. You may delete past grading sessions, class rosters, or entire account profiles at any time directly through your settings, triggering permanent cryptographic deletion from our servers.

4. Educational Compliance (FERPA & COPPA)

Tabitha is designed to support institutional compliance with the Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Act (COPPA). We enter into standard Student Data Privacy Agreements (SDPA) with school districts upon request.

5. Security & Cryptographic Standards

All data transmitted between your browser and our servers is secured using TLS 1.3 encryption. Stored assets and database records are safeguarded with AES-256 bit encryption at rest, hosted in SOC 2 Type II certified data centers.

6. Third-Party Subprocessors & Audits

We rigorously vet all infrastructure providers for educational privacy compliance. Any subprocessor handling encrypted network traffic must demonstrate ISO 27001 or SOC 2 certification and execute legally binding data processing agreements conforming to student privacy legislation.

7. International Privacy Standards (GDPR & UK-GDPR)

For our international educational partners across the United Kingdom, European Union, and Switzerland, Tabitha complies with General Data Protection Regulation mandates. We provide Standard Contractual Clauses (SCCs) and honor data portability and erasure requests promptly.

8. Breach Notification & Incident Response

In the highly improbable event of a data security incident impacting educator records, Tabitha adheres to strict 72-hour notification protocols, informing designated district data privacy officers and affected users in full alignment with state reporting statutes.

9. Contact Our Privacy Officer

For inquiries regarding data protection, district audits, or security documentation, please contact our Data Protection Officer at [email protected].

10. Student Data Privacy Consortium (SDPC) Alignment

Tabitha actively supports standard state Student Data Privacy Consortium (SDPC) exhibits and agreements. We provide standardized National Data Privacy Agreements (NDPA) to participating districts, guaranteeing enforceable technical and organizational safeguards against data exposure.

11. Ephemeral Ingestion & Memory Cleansing

When a multi-page copier PDF is submitted for optical character recognition or AI authenticity scanning, document buffers are held strictly in temporary GPU volatile memory. Once scoring is completed and the educator receives their evaluation slips, original image buffers are immediately wiped from runtime caches, preventing unauthorized retrospective access.

12. Auditing & Transparency Rights

Contracting school districts and institutional partners maintain full audit inspection rights. Upon written request, our compliance team provides comprehensive infrastructure diagrams, annual third-party penetration testing attestations, and verifiable data erasure logs.

13. Certified Cloud Infrastructure Standards

All server instances and storage clusters reside within ISO 27001 and SOC 2 Type II certified data centers located in North America and Western Europe, enforcing strict physical security, encrypted backups, and 24/7 automated intrusion detection.

14. Zero Third-Party Advertising or Behavioral Tracking

Tabitha is completely free from third-party advertising networks, marketing trackers, and behavioral profiling cookies. We do not monetize student or teacher attention, nor do we sell lead lists to commercial textbook publishers or software vendors. Our revenue derives exclusively from transparent educator and district software subscriptions.

15. Periodic Data Privacy Audits & Compliance Certification

We undergo rigorous annual external compliance assessments conducted by independent educational data privacy auditors. These evaluations inspect our data encryption controls, access logging protocols, API permission boundaries, and memory disposal routines to verify full alignment with federal and state student privacy regulations.

16. Transparency Reports & Legal Inquiries

We publish annual institutional transparency summaries documenting our data protection practices and confirm that no government or commercial backdoors exist within our educational evaluation software.

17. Data Minimization & No Generative Retention

We adhere to strict data minimization principles under privacy by design frameworks. Student written assignments and educator rubric notes are processed solely for the ephemeral generation of feedback slips and report card narratives. At no point are student texts added to permanent public corpora, aggregated into training datasets for third-party commercial large language models, or used to build biometric profiles.

Educators retain complete ownership of their classroom data, with the autonomous ability to delete uploaded assignments, evaluation records, and account credentials permanently at any time directly through their account settings.