Privacy Policy

1. Introduction

RHETORYX Inc. (“RHETORYX,” “we,” “us,” or “our”) operates an AI-powered oral defense platform for higher education. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Service. Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

2. Information We Collect

Account Information

When you register, we collect your name, email address, institutional affiliation, and role (instructor or student). Institutions may also provide roster data including student names and email addresses for course enrollment.

Defense Session Data

When a student completes an oral defense, we collect and store video recordings, audio, AI-generated transcripts, AI evaluation scores, rubric feedback, and professor review notes. This data is retained for the period specified by your institution's plan and then permanently deleted.

Usage Data

We automatically collect certain technical information when you use the Service, including IP address, browser type, operating system, pages visited, and timestamps. This data is used to operate, maintain, and improve the Service.

Payment Information

Payment information is collected and processed by Stripe, our third-party payment processor. We do not store full credit card numbers. We retain billing records (plan, amount, dates) for accounting and compliance purposes.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Process defense sessions and generate AI evaluations
• Send transactional emails (evaluation results, retake approvals, assignment reminders)
• Process payments and manage subscriptions
• Respond to support requests and inquiries
• Monitor for security incidents and abuse
• Comply with legal obligations

We do not use student recordings, transcripts, or evaluation data to train AI models without explicit written consent from the institution.

4. Student Privacy and FERPA

We are committed to protecting student educational records consistent with the Family Educational Rights and Privacy Act (FERPA). When we process student data on behalf of an educational institution, we act as a service provider under the institution's direction and do not exercise independent control over student records.

Institutions retain ownership and control of their students' educational records. We process such records only as directed by the institution and do not disclose them to third parties except as necessary to provide the Service or as required by law. Students may request access to their own records through their institution.

5. Disclosure of Information

We may share your information with:

• Service providers — third parties that help us operate the Service (cloud storage, AI processing, payment processing, email delivery, error monitoring). These providers are contractually bound to protect your data and use it only as directed.
• Your institution — instructors and administrators at your institution may access your defense recordings, transcripts, and evaluation results as part of the Service.
• Legal requirements — we may disclose information if required by law, subpoena, or other legal process, or to protect the rights and safety of RHETORYX, its users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a materially different privacy policy.

We do not sell personal information to third parties.

6. Data Retention

We retain account information for as long as your account is active. Defense recordings and transcripts are retained according to your plan tier (90 days for Individual Professor, 180 days for Department Pilot, custom for Institution License) and then permanently deleted. You may request earlier deletion by contacting us.

Billing records and audit logs may be retained for up to 7 years to comply with financial regulations.

7. Data Security

We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk.

In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

8. Third-Party Services

Our Service integrates with the following third-party providers:

• Supabase — database and authentication
• OpenAI — AI transcription and evaluation
• Stripe — payment processing
• Resend — transactional email delivery
• Sentry — error monitoring
• Netlify — application hosting

Each provider processes data according to their own privacy policies. We encourage you to review those policies if you have concerns.

9. Cookies

We use cookies and similar tracking technologies to maintain your session and remember your preferences. We do not use third-party advertising or tracking cookies. You may disable cookies in your browser settings, but some features of the Service may not function properly without them.

10. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information (subject to legal retention requirements)
• Object to or restrict certain processing
• Request a portable copy of your data

To exercise these rights, contact us at privacy@rhetorix.ai. Students at educational institutions should also contact their institution, which controls their educational records under FERPA.

11. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the Service before the changes take effect. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

13. Contact Us

For privacy-related questions or requests, please contact: privacy@rhetorix.ai