Privacy Policy

1. Who we are & scope

Soft Serv is a product of Soft Serv LLC ("Soft Serv," "we," "us," or "our"). Soft Serv is a web platform that lets students practice real-world skills through AI-driven roleplay and receive rubric-based feedback. We provide the platform primarily to schools, colleges, and other educational institutions ("Institutions") and their instructors and students.

This Privacy Policy applies to our marketing site, the Soft Serv web application, and our integrations with learning management systems (such as Canvas via LTI 1.3). It does not apply to third-party services that we link to but do not control.

2. Our role & FERPA

When we provide the service to an Institution, the Institution controls the student data and Soft Serv acts as its service provider. Under the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g), Soft Serv operates as a "School Official" with a legitimate educational interest, performing a function the Institution would otherwise perform itself.

This means we process student education records only to provide the service to the Institution and under its direction. We do not re-disclose education records except as permitted by FERPA, and we do not use student data for any purpose other than delivering the service — including, never, to sell data, to serve advertising, or to train third-party AI models.

If you use Soft Serv as an individual who registered directly (not through an Institution), we act as the controller of your account data, and this policy describes how we handle it.

3. Information we collect

Information you or your Institution provide

• Account & identity: name, email address, role (student, teacher, or administrator), and — when you join through your LMS — your LMS user identifier.
• Authentication: for direct accounts, a password (stored only as a salted hash by our authentication provider, never in plain text). When you sign in through your LMS, your Institution's system authenticates you and we do not receive your password.
• Course content: courses, lessons, and roleplay assignments created by instructors.

Information created when you use roleplays

• Recordings: audio and video of your practice sessions (see Section 4).
• Transcripts: a text transcript of the conversation between you and the AI.
• Assessment data: rubric scores, overall percentages, and AI- or instructor-generated feedback.
• Session metadata: duration, word counts, and timestamps.

Information collected automatically

• Usage & diagnostics: limited technical logs and AI-usage records used to operate, secure, and troubleshoot the service.
• Cookies: a single session cookie that keeps you signed in. We do not use third-party advertising cookies or cross-site tracking.

4. Audio & video recording

Roleplay activities record your microphone and camera so the AI can hold a spoken conversation with you and so the session can be transcribed and graded. Before your first recording, we show you a consent notice describing what is captured and where it goes.

During a session, your audio and (if enabled) video are sent to our AI provider, OpenAI, to power the conversation and generate a transcript and feedback. Your recording, transcript, and score are saved to your account and are visible to your instructor and your Institution. You can choose not to enable your camera where the activity allows, or decline to participate by contacting your instructor.

5. How we use information

• To provide and operate the service — run roleplays, transcribe and grade sessions, and return scores to your instructor and your LMS gradebook.
• To provide support, maintain security, prevent abuse, and debug problems.
• To improve the service in aggregate. We do not use student personal information to develop unrelated products or to train third-party AI models.
• To communicate with you about the service (for example, course invitations).
• To comply with legal obligations.

We do not sell or rent personal information, and we do not use it for advertising.

6. AI processing

Soft Serv uses artificial intelligence to deliver its core features. We use OpenAI to power the live roleplay conversation, to transcribe audio, and to grade transcripts against a rubric. Course-illustration images may be generated with Google's Gemini models, which receive only the course title and description — never student personal information.

We use these providers under business/enterprise terms that require them to act as our processors, to keep data in the United States, and not to use data submitted through their APIs to train their models. For our primary AI provider we additionally require zero data retention for student session data.

7. How we share information

We share information only as described here:

• With your Institution and instructors — so they can administer courses and review your work. This is the core purpose of the service.
• With your LMS (e.g., Canvas) via LTI 1.3 — to authenticate you and return grades to the gradebook.
• With service providers (subprocessors) who process data on our behalf under contract (listed below).
• For legal reasons — if required by law or valid legal process; where permitted, we will notify the Institution first.
• In a business transfer — if Soft Serv is involved in a merger, acquisition, or sale of assets, data may transfer subject to this policy.

We do not sell personal information or share it for advertising.

8. Where data is stored

All personal information processed by Soft Serv is stored and processed in the United States. Our database (Supabase) is hosted in AWS US East (Ohio), and recordings and images are stored in Cloudflare's US-West region. We do not store or transfer Institution data outside the United States without the Institution's authorization.

9. How we protect information

We use administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption in transit (TLS, and encrypted WebRTC for live sessions) and at rest (AES-256).
• Access controls — role-based access, database row-level security, and per-record ownership checks, with least-privilege administrative access.
• Hosting on major cloud platforms (Cloudflare, Supabase/AWS) that maintain SOC 2 Type 2 attestations.
• Monitoring and a documented incident-response process, including timely notification to affected Institutions of any data breach involving their data.

No method of transmission or storage is completely secure, but we work continually to protect your information and to improve our safeguards.

10. Retention & deletion

We retain personal information for as long as needed to provide the service and as directed by your Institution. When an Institution's agreement ends, or upon the Institution's request, we will return or securely delete the Institution's data — and instruct our subprocessors to delete their copies — within the period required by our agreement, and certify deletion where required. Secure deletion follows recognized standards (e.g., NIST SP 800-88).

Students and instructors may request deletion of specific recordings or submissions through their Institution.

11. Your rights & choices

• Students & parents (FERPA): education records are controlled by your Institution. You exercise rights to access or correct those records through your Institution, which can direct us to make changes.
• Direct account holders: you may access, update, or delete your account information by contacting us at the address below.
• Recording choices: you may decline camera use where an activity permits, or decline to participate by contacting your instructor.
• State privacy rights: depending on where you live, you may have rights to access, correct, or delete personal information, or to opt out of "sale" or "sharing." We do not sell or share personal information for advertising. To exercise a right, contact us (Institution-controlled student data is handled with your Institution).

12. Children's privacy

Soft Serv is intended for use by educational Institutions and their students, not for direct use by children. Where the service is used with students under 13, we act as a service provider to the school and rely on the school to provide consent on parents' behalf, consistent with the Children's Online Privacy Protection Act (COPPA). We collect and use such students' information only to provide the educational service and never for advertising. We do not knowingly collect personal information directly from a child under 13 without the school's authorization.

13. Information for schools & institutions

For our Institution customers: Soft Serv acts as a FERPA School Official and processes student data only under your direction and for the purpose of providing the service. Your Institution retains ownership of its data. We make available, on request, our Data Privacy & Security Overview, our security self-assessment (HECVAT), and our Accessibility Conformance Report (VPAT). We will return or destroy your data on termination as described in Section 10 and in our agreement with you.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes affecting Institutions, provide notice consistent with our agreements. Your continued use of the service after an update means you accept the revised policy.

15. Contact us

If you have questions about this policy or how we handle personal information, contact us:

For accessibility questions, see our Accessibility Statement.