Privacy Policy

1. Introduction

ChitterChatter, Inc. (“we,” “us,” or “our”) is committed to protecting the privacy of our users. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use ChitterChatter (the “Service”), an AI-powered voice speaking practice platform for language education.

The Service is used by students and instructors at colleges, universities and K-12 schools, and by adult learners. We understand the sensitivity of student education records and are committed to compliance with the Family Educational Rights and Privacy Act (FERPA), state student privacy laws such as New York Education Law §2-d, and other applicable privacy laws.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Definitions

• “Service” refers to the ChitterChatter platform, accessible at chitterchatter.app and through any associated applications.
• “Institution” refers to the university, college, school, school district, board of cooperative educational services (BOCES), or other educational organization that has authorized use of ChitterChatter for its courses.
• “Instructor” refers to a faculty member, teaching assistant, or other educator who creates and manages conversation activities on the Service.
• “Student” refers to an individual enrolled in a course that uses the Service.
• “User” refers to any individual who accesses or uses the Service, including Students and Instructors.
• “Personal Information” refers to information that identifies, relates to, or could reasonably be linked to a specific individual.
• “Student Education Records” refers to records directly related to a student that are maintained by an educational institution or a party acting on its behalf, as defined under FERPA.

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, institutional affiliation, and course enrollment information provided during registration.
• Profile Information: Username, language preferences, and any optional profile details you choose to provide.
• Voice and Audio Data: Audio recordings of your speaking practice sessions. These recordings are stored so that Students and Instructors can review them for learning purposes.
• Conversation Content: Transcripts of your AI-powered speaking practice sessions, including text inputs and AI-generated responses.
• Activity and Performance Data: Activity completion status, session duration, and feedback provided by the AI coach.
• Demo and Quote Requests: If you ask for a demo or a quote, we collect your name, institutional email address, institution, state or location, role and, for a quote, an estimated number of students. We use these details only to respond to your request.
• Payment Information: If you purchase access to the Service, payment is processed securely by our third-party payment processor (e.g., Stripe). We do not store your credit card number or full payment details on our servers. We may receive limited transaction information such as the last four digits of your card, billing address, and transaction confirmation.

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, session timestamps, and interaction patterns within the Service.
• Device Information: Browser type, operating system, device type, and screen resolution.
• Log Data: IP addresses, referring URLs, access times, and error logs. If you are an adult learner who signed up yourself, we also record the campaign tags and ad-click identifiers in the link you arrived from.
• Cookies and Analytics: We use Google Analytics and cookies to understand how people use the Service. Google Analytics receives usage statistics, such as pages viewed, session length and general location, without names, email addresses or user IDs. On our public pages, on the pages adult learners who signed up themselves visit while signed in, when an instructor or adult learner signs up, starts a free trial or makes a purchase, and when an adult learner finishes their first practice conversation, we also use Meta’s advertising tools (see Section 8). We never send information about student accounts provided by a school, district or teacher to advertising tools. You can opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on.
• Error and Diagnostic Data: We may use Sentry to diagnose technical issues, including browser errors, performance traces, and privacy-masked session replay for error sessions. We configure this telemetry to avoid sending conversation transcripts, audio recordings, recording URLs, payment details, or raw request and response bodies.

3.3 Information from Institutions

If your Institution has integrated ChitterChatter with its systems (such as a learning management system), we may receive student roster information, course enrollment data, and other information necessary to provide the Service, as authorized by the Institution.

3.4 Student Data Ownership

ChitterChatter does not claim ownership of Student Data. Student Data—including conversation transcripts, audio recordings, activity completion data, and any other records generated through use of the Service—remains the property of the Student, the Institution, or the educational organization that provided the data, in accordance with applicable law and institutional agreements.

ChitterChatter processes Student Data solely to provide, maintain, support and secure the Service as authorized by the Institution.

4. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: To facilitate AI-powered speaking practice sessions, store and play back audio recordings for review, provide AI coach feedback, and enable Instructors to monitor student engagement and progress.
• Improving the Service: To analyze usage patterns, diagnose technical issues, and improve the quality and performance of the platform. For student accounts provided by a school, district or teacher, we use student data only to provide, maintain and secure the Service, and any analysis to improve the Service uses de-identified data.
• Communication: To send you Service-related notices, respond to your inquiries, and provide customer support.
• Marketing: To send marketing emails to instructors, adult learners who signed up themselves, and students whose accounts come through a business or other non-academic organization, and to measure and target our own advertising. We never market to student accounts provided by a school, college, university or district, or a teacher there. See Sections 8 and 15.
• Compliance: To comply with legal obligations, enforce our Terms of Service, and protect the rights and safety of our users.

We never sell Personal Information. We never use Student Education Records, or any information about student accounts provided by a school, college, university or district, or a teacher there, for advertising or marketing, and we never build profiles of students for non-educational purposes. For instructors, adult learners who sign up themselves, and students whose accounts come through a business or other non-academic organization, we use limited information for our own marketing emails, as described in Sections 8 and 15.

5. Aggregated and De-Identified Data

We may compile and use aggregated, anonymized, or de-identified data derived from your use of the Service. This data does not identify any individual User and may be used for:

• Service improvement, including analyzing usage trends and optimizing platform performance.
• Academic research and publication, such as studies on language learning outcomes and AI-assisted education. Any published research will use only aggregate or de-identified data and will not identify individual Users.
• Internal business analytics and reporting.

Aggregated and de-identified data is not considered Personal Information or Student Education Records under this Privacy Policy or under FERPA.

We do not include students whose accounts are provided by a school, college, university or district, or a teacher there, in research studies unless their school agrees in writing.

6. Artificial Intelligence and Automated Processing

ChitterChatter uses artificial intelligence to power its core speaking practice and feedback features. AI is used solely to provide educational functionality within the Service, including generating conversational responses, evaluating spoken language, and providing coaching feedback to Students.

We are committed to the following principles regarding AI and Student Data:

• We do not use Student Data—including voice recordings, conversation transcripts, or activity data—to train publicly available artificial intelligence or machine learning models.
• We use OpenAI and Google only through their business APIs. Under those API terms, they do not use the data we send to train their models, and they may use it only to provide their service to us, including limited processing to prevent abuse.
• AI processing of Student Data is performed solely to deliver the educational features described in this Privacy Policy and in our agreements with Institutions.

7. Voice and Audio Data Processing

Given that ChitterChatter is a voice-based language practice platform, we want to be transparent about how your voice data is handled.

7.1 How Voice Data Flows

• During a live voice conversation, your browser connects directly to OpenAI’s Realtime API over an encrypted connection, and OpenAI generates the AI partner’s spoken replies. Our servers start the session, and for some accounts pass your browser’s connection request to OpenAI, but they never receive or relay the live audio. Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models.
• Your browser also records the practice session (your voice and the AI partner’s), and short clips of each of your turns, and uploads them to our private cloud storage over an encrypted connection.
• We send audio recordings and conversation text to Google’s Gemini API to create the written transcripts Students and Instructors review, to give pronunciation feedback, to generate AI feedback and scores, to power the AI coach chat about your feedback, and to run text chat conversations. Under Google’s paid API terms, data sent through the API is not used to train Google’s models.
• Audio recordings are stored on Amazon S3 (encrypted at rest) so that Students and Instructors can review practice sessions.
• Conversation transcripts and activity metadata are stored in our application database.

7.2 What We Do Not Do with Voice Data

• We do not sell or license audio recordings to any third party.
• We do not use audio recordings to create voiceprints or biometric identifiers.
• We do not use audio recordings for advertising or marketing purposes.
• Our AI subprocessors (OpenAI, Google) may not train their models on your audio or text data, and may keep it only as their API terms allow.

8. Third-Party Service Providers (Subprocessors)

We use the third-party service providers below. Each processes data only as needed for its function and is bound by written terms to protect it.

8.1 Core service providers — all users, including students

These providers help us run the Service for everyone, including students whose accounts are provided by a school, district or teacher.

8.2 Marketing and advertising providers — never used to market to school and university students

We use these providers only for our own marketing to instructors, to adult learners who sign up themselves, to students whose accounts come through a business or other non-academic organization (by email only), and to visitors of our public pages. We never market to student accounts provided by a school, college, university or district, or a teacher there: Meta never receives information about them, ActiveCampaign keeps their contact details only to send service emails (see the table above), and no advertising events are sent from any student’s screen.

9. FERPA Compliance

When ChitterChatter is used by an Institution, we may receive Student Education Records as defined by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. In these cases, we act as a “school official” with a “legitimate educational interest” under FERPA, as defined in our agreement with the Institution.

We commit to the following:

• We will use Student Education Records solely for the purpose of providing the Service as authorized by the Institution.
• We will not re-disclose Student Education Records to any third party except as authorized by the Institution or as required by law.
• We will maintain reasonable administrative, technical, and physical safeguards to protect Student Education Records.
• Upon termination of our agreement with an Institution, or upon the Institution’s request, we will delete or return all Student Education Records within 30 days.
• We will notify the Institution in writing without unreasonable delay, and no later than 72 hours after we confirm a data breach involving Student Education Records.

Parents and eligible students who wish to access or amend Student Education Records should direct their requests to the student’s Institution, which controls those records under FERPA.

10. Schools, Districts and K-12 Students

When a school, school district, BOCES or teacher provides ChitterChatter accounts to students, these extra commitments apply to those students’ data, in addition to Section 9. They do not apply to accounts provided by a business or other non-academic organization.

• Student privacy laws. We follow the student privacy laws that apply to the school, including New York Education Law §2-d and Part 121 of the Commissioner’s Regulations. Where New York law applies, the school’s Parents’ Bill of Rights for Data Privacy and Security is part of our agreement with the school, and the school posts it on its website. We will provide a copy on request.
• No marketing to students. We never sell student data and never use it for advertising or marketing. Student accounts never receive marketing emails, students at K-12 schools never receive surveys, and we never send information about student accounts to advertising tools.
• Only to provide the Service. We use student data only to provide the Service to the school and its teachers and students, and to keep it secure and working. We do not include these students in research studies unless the school agrees in writing.
• Deletion. We delete a student’s data, a class, or all of a school’s student data when the school asks in writing, and when our agreement with the school ends, within 30 days, including copies in our backups and with our hosting and storage providers. Copies that other service providers keep for a limited time under their own terms, such as error reports, expire on those providers’ schedules. We confirm the deletion in writing. Parents and students should send requests through the school.
• Breach notice. If student data is breached, we notify the school in writing within 72 hours of confirming the breach, so the school can inform families as the law requires.

If there is a conflict, a data privacy agreement signed with the school controls.

11. Data Retention and Deletion

We retain your Personal Information—including account information, audio recordings, conversation transcripts, and activity data—for as long as your account is active. Inactive accounts may be deleted after 12 months of inactivity.

Usage and analytics data may be retained in anonymized or aggregated form indefinitely for Service improvement purposes.

Demo and quote requests: We keep the details you submit with a demo or quote request while we follow up with you. We delete the request, our internal notification records about it, and its row in our internal request spreadsheet 12 months after we close the request, or sooner if you ask us to. Notification emails to our team are delivered through Resend, which keeps delivery records under its own retention settings; the copies in our team mailbox are kept only as long as we need them to respond to you.

Upon request by a User or Institution, we will delete Personal Information and Student Education Records within 30 days, except where retention is required by law. Upon termination of an agreement with an Institution, we will return Student Education Records if the Institution asks, and delete them within 30 days. This includes copies in our encrypted backups, which are kept for a short rolling period, and with our hosting and storage providers. Copies that other service providers keep for a limited time under their own terms, such as error reports, expire on those providers’ schedules.

12. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS/HTTPS) for all data transmitted between your browser, our servers, and our third-party service providers.
• Encryption at rest for audio recordings stored on Amazon S3 and for data stored in our application database.
• Names and email addresses are encrypted a second time inside our database, and passwords are stored only as secure hashes.
• Staff accounts require two-step sign-in, and staff viewing of student records is logged.
• Staff who can access student data are trained on federal and state student privacy law every year and sign a confidentiality agreement.
• Access controls that limit access to Personal Information to authorized personnel who need it to operate, support and secure the Service. Instructors can see only the students in their own classes.
• Regular security reviews of our application and infrastructure.

While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

In the event of a data breach that affects your Personal Information, we will comply with all applicable breach notification requirements, including notifying affected Users and Institutions as required by federal and state law. We notify affected Institutions within 72 hours of confirming a breach of their students’ data.

13. Data Hosting and Storage Location

We store all data in the United States, including our application servers (Render), database (PostgreSQL on Render), and file and backup storage (Amazon S3). Our AI providers (OpenAI and Google) process conversation data under their API terms, which may involve their facilities outside the United States; they do not store it for us.

ChitterChatter does not store Student Data outside of the United States.

14. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your Personal Information:

• Access: You may request a copy of the Personal Information we hold about you.
• Correction: You may request that we correct inaccurate Personal Information.
• Deletion: You may request that we delete your Personal Information, subject to our retention obligations and legal requirements.
• Data Portability: You may request a copy of your data in a structured, commonly used, machine-readable format.
• Opt-Out of Analytics: You may opt out of Google Analytics tracking by installing the Google Analytics Opt-Out Browser Add-on. You may also contact us to request limits on optional diagnostic telemetry where applicable.

To exercise any of these rights, please contact us at legal@chitterchatter.app. We will respond to your request within 30 days.

15. Marketing and Communications

We never send marketing emails to student accounts provided by a school, college, university or district, or a teacher there. Those accounts receive service emails, such as sign-in and password messages; college and university students may also occasionally receive surveys about the Service, and students at K-12 schools never do. If you are an instructor, an adult learner who signed up yourself, or a student whose account comes through a business or other non-academic organization, we may occasionally send you updates about the Service, new features, or educational content, using our email service provider, ActiveCampaign. You may opt out of these communications at any time by:

• Clicking the “unsubscribe” link included in any marketing email.
• Contacting us at legal@chitterchatter.app.

Even after opting out of marketing communications, you will continue to receive essential Service-related messages, such as account notifications, security alerts, and updates required by your Institution.

16. State Privacy Law Disclosures

16.1 California (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what Personal Information we collect and how it is used, the right to request deletion, and the right to opt out of the sale or sharing of your Personal Information. We do not sell your Personal Information. We use Meta’s advertising tools on our public pages, on the pages adult learners who signed up themselves visit while signed in, when instructors and adult learners sign up, start a free trial or make a purchase, and when adult learners finish their first practice conversation, to measure and improve our ads (see Section 8.2). We never sell information about student accounts provided by a school, district or teacher, and never use it for advertising.

16.2 Illinois (BIPA)

ChitterChatter does not create voiceprints or other biometric identifiers from your audio recordings. Voice data is processed for the purpose of language practice and feedback only. If our practices change in the future to involve biometric data collection, we will obtain informed written consent as required by the Illinois Biometric Information Privacy Act (BIPA) before any such collection.

16.3 New York (SHIELD Act)

We maintain reasonable administrative, technical, and physical safeguards as required by the New York SHIELD Act to protect the security, confidentiality, and integrity of private information of New York residents.

17. Children’s Privacy

Accounts that people create for themselves are for adults 18 and older. Schools, districts and teachers may provide accounts to students who are 13 or older; the school is responsible for any consent the law requires. The Service is not directed at children under 13, and we do not knowingly collect Personal Information from children under 13. If we learn that we have collected Personal Information from a child under 13, we will delete it promptly. If you believe we have collected such information, please contact us at legal@chitterchatter.app.

18. Links to Other Websites

The Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on our website and updating the “Last Updated” date at the top of this page. For changes that materially affect the handling of Student Education Records, we will also notify affected Institutions. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

20. Contact Us

If you have any questions about this Privacy Policy, your data, or your rights, please contact us at:

For FERPA-related inquiries or data access requests on behalf of an Institution, please contact us at the email above with the subject line “FERPA Request.”