Vidya Inc. ("Vidya", "we", "us") is a Michigan corporation. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to vidya.co, the Vidya web app, the Vidya mobile apps for iOS and Android, the Vidya BOS browser extension, Digital Twins, and every other product or service that links to this policy (together, the "Service").
If you use Vidya through your college or university under a Mascot institutional license, your institution's agreement with us governs how we handle your information. Where that agreement and this policy differ, the agreement controls. Section 13 explains this in more detail.
Account information. Name, email address, password (stored hashed) or the token from your sign-in provider (Apple, Google), school or organization, and your role (learner or educator).
Profile and onboarding. When you set up Vidya we ask about your interests, goals, dislikes, schedule, and personal context. You choose how much to share. This information seeds your personal Vidya memory.
Conversations. Everything you type, say, or upload to Vidya, including messages, files, images, documents, and the responses Vidya gives you.
Voice. When you use voice features we collect audio recordings and transcripts of what you say. If you choose to create a voice clone (educators for a Digital Twin, learners for their own companion), we collect voice samples and generate a voice profile. Voice cloning is governed by our Voice and Likeness Consent, which you sign separately.
Verification. To claim free Digital Twin access at your school, you verify a school email address. We record the address, the institution, and the verification date. Educators verify faculty status through a third-party identity provider (ID.me or SheerID). We receive a verified status, your name, and your institution. We do not receive or store your identity documents.
Payment. Payments are processed by Apple, Google, or our payment processor our payment processor. We receive transaction records, plan, amount, and the last four digits of a card. We never see or store full card numbers.
Digital Twin content. If you are an educator, the course materials, syllabi, slides, notes, and recordings you upload to build a Digital Twin, and the settings you choose for it.
Referrals. Your referral code, the codes you redeem, and the reward status of each referral.
Support and communications. Messages you send us, survey responses, and feedback.
You can connect Vidya to systems you already use, such as a learning management system, calendar, library catalog, dining service, campus health center scheduling, or other tools through connectors and MCP servers. When you connect a source, Vidya reads only what that source makes available and what you authorize, which may include courses, assignments, due dates, grades, calendar events, and booking availability. You can see every connected source in Settings and disconnect any of them at any time. Disconnecting stops new collection immediately. Data already in your Vidya memory stays until you delete it.
Connected services have their own privacy policies. We are not responsible for how they handle your information.
Vidya BOS operates in two modes. In copilot mode it helps you with the page you are on. In agent mode it completes tasks you assign across web pages.
When you invoke Vidya BOS, it collects the content and URL of the active tab, text you select, and screenshots of the page needed to understand and act on it. In agent mode it also records the actions it takes on your behalf and the values it enters into form fields at your direction. This information is processed on your device or in our cloud depending on the runtime you choose, and is used only to complete your request.
Vidya BOS does not collect your browsing history, does not read tabs you have not invoked it on, does not log keystrokes outside the Vidya interface, and never captures or stores passwords or payment card numbers. See the Vidya BOS Privacy Disclosure for permission-level detail.
Device type, operating system, browser, app version, language, time zone, IP address and the approximate location derived from it, identifiers such as a device ID or session ID, usage events (features used, buttons tapped, session length, error events), and crash reports. We use a small number of first-party cookies and similar technologies described in our Cookie Notice. We do not use third-party advertising trackers, and we do not track you across other companies' apps or websites.
The iOS and Android apps ask for permission before using any of the following. Each is optional; if you decline, the related feature is unavailable and the rest of Vidya works normally.
| Permission | Used for | Not used for |
|---|---|---|
| Microphone | Voice conversations with Vidya and recording voice samples for a voice clone you request | Listening when you are not in a voice session |
| Camera | Scanning documents, whiteboards, or problems you want help with | Any background capture |
| Photos and files | Attaching images or documents you choose | Reading your library beyond what you select |
| Notifications | Reminders, due-date alerts, and responses to tasks you assigned | Marketing, unless you opt in separately |
| Calendar (if you connect your device calendar) | Reading and adding events you ask Vidya to manage | Anything outside the events you authorize |
We do not request access to your contacts, precise location, call logs, or SMS. We do not use the Apple advertising identifier (IDFA) or the Google advertising ID, and we do not ask for App Tracking Transparency permission because we do not track you across other companies' apps or websites. If your device offers biometric unlock for the app (Face ID, Touch ID, fingerprint), that check happens on your device through the operating system; Vidya never receives your biometric data.
The privacy details on our App Store listing and the Data safety section on our Google Play listing summarize this policy. We keep them consistent with it and update them together.
We use information to:
Vidya generates responses using a combination of models we run on our own infrastructure and models we access from third-party AI providers under contract.
Which providers, and what they receive.
| Provider | What it processes | Why |
|---|---|---|
| Google LLC (Gemini API) | The text of your messages, relevant context from your memory and connected sources, files you attach, and voice audio for transcription and speech | To generate responses and voice output |
| Ollama Inc. (Ollama Cloud) | The text of your messages and relevant context | To generate responses |
| ElevenLabs Inc. | Text to be spoken; voice samples and voice profiles if you have consented to voice cloning | To synthesize speech |
Models we run on our own infrastructure process the same categories of information without leaving systems Vidya controls.
Your permission comes first. Before Vidya sends any of your personal information to a third-party AI provider for the first time, the app shows you a disclosure naming the providers and what they receive, and asks for your permission. If you decline, Vidya limits you to features that run on Vidya-controlled infrastructure. You can review or change this choice at any time in Settings > Privacy > AI providers.
Equal protection. Each provider is bound by a written agreement that prohibits using your information to train its models, limits retention to what is needed to process the request and prevent abuse, requires security measures at least as protective as ours, and prohibits any use other than providing the service to Vidya. We confirm these protections before adding a provider, and we list every provider in our Security Overview.
Personalization models are trained only on your data, used only for you, and run on Vidya-controlled infrastructure.
AI outputs can be wrong. Vidya is a study companion. Verify anything that matters before you rely on it. You can flag any response from within the app; we use reports to improve filtering and moderation.
A Digital Twin is an AI representation of an educator's course materials. When you ask a Digital Twin a question, your question and the answer are stored in your conversation history like any other Vidya conversation.
Educators do not see who asked what. Educators receive aggregated, de-identified analytics about their Digital Twin, such as which topics generate the most questions and where learners get confused. We set a minimum group size before we show any statistic. An educator can see your identity or your specific questions only if you choose to share them, for example by submitting a question to the educator directly.
If an educator has enabled a cloned voice, Digital Twin speech is synthetic. It is generated from the educator's materials, not from the educator in real time.
You may tell Vidya things that are sensitive, such as information about your health, disability, religion, ethnicity, or personal life. Vidya may also help you with health-adjacent tasks, such as booking a campus health center appointment. We use sensitive information only to respond to you and complete the task you asked for. We never use it for advertising, never sell it, and never disclose it except as described in this policy or with your consent. Vidya is not a healthcare provider and does not provide medical diagnosis or treatment.
Voice recordings and voice profiles may be considered biometric information under the laws of some states. We collect voice profiles only with your separate written consent, retain them only as described in Section 9 and in the Voice and Likeness Consent, and never sell, lease, or trade them.
We share personal information only in these cases:
Service providers. Companies that host our infrastructure, store data, deliver email, process payments, provide analytics, verify identity, and generate AI responses. Each is bound by contract to use your information only to provide services to us. Our current subprocessor list is published in our Security Overview.
Your institution. If you use Vidya under a Mascot license, we share account-level and aggregated usage information with your institution's designated administrators as set out in their agreement. We do not give institution administrators access to your conversation content. If an institution's agreement or applicable law ever requires otherwise, we will tell you before that access begins.
Educators. Aggregated, de-identified Digital Twin analytics as described in Section 5.
Connected services. When you connect a source or ask Vidya to take an action (submit an assignment, book an appointment, add a calendar event), Vidya sends the information needed to that service at your direction.
Payment and verification providers. As needed to process payments, pay educators, and verify eligibility.
Legal and safety. When required by law, subpoena, or court order; to protect the rights, property, or safety of Vidya, our users, or the public; or to investigate fraud or abuse. Where the law allows, we will notify you before disclosing your information in response to a legal request.
Business transfers. If Vidya is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred. We will notify you and the new owner will be bound by this policy or one that offers equivalent protection.
With your consent or at your direction.
Vidya is hosted in the United States. Our engineering team works from Hyderabad, India, and may access production systems under access controls, logging, and confidentiality agreements. If you use Vidya from outside the United States, your information is transferred to and processed in the United States and may be accessed from India.
For users in the European Economic Area, the United Kingdom, and Switzerland, we rely on the European Commission's Standard Contractual Clauses and equivalent UK and Swiss mechanisms, plus additional safeguards, for these transfers.
| Information | Retention |
|---|---|
| Account information | While your account is active, then deleted within 30 days of account deletion |
| Conversations, memory, uploads | Until you delete them or your account, then deleted within 30 days |
| Personal model adapter | Deleted within 30 days of account deletion or when you turn off personalization |
| Voice recordings (raw audio) | Deleted within 30 days of the interaction; transcripts kept with the conversation |
| Voice samples and voice profiles (clones) | Deleted within 30 days of revoked consent or account deletion, and in all cases within 3 years of your last interaction with the feature |
| Connected-source data | Refreshed while connected; deleted from active systems within 30 days of disconnection unless saved to your memory |
| Vidya BOS task data (page content, screenshots) | Deleted within 24 hours of task completion unless you save the result |
| Payment and billing records | 7 years, as required for tax and accounting |
| Usage logs and security logs | 12 months |
| Support communications | 3 years |
| Backups | Rotated and purged within 90 days |
After you delete your account we keep only the minimal records needed for billing, tax, fraud prevention, dispute resolution, and legal compliance.
We encrypt data in transit (TLS 1.2 or higher) and at rest (AES-256). Access to production systems requires multi-factor authentication and is role-based, logged, and reviewed. Conversation content is separated from administrative tooling at the database level so that staff cannot read it. We test for vulnerabilities, patch promptly, and maintain an incident response plan. If a breach affects your personal information we will notify you and the relevant authorities as required by law, and in any event without undue delay.
No system is perfectly secure. Use a strong, unique password and keep your sign-in provider account secure.
Everyone who uses Vidya can:
If you cannot exercise a right through Settings, email hello@vidya.co. We verify requests using your account email and respond within 30 days, or sooner where the law requires. You may use an authorized agent where the law permits; we will ask for proof of authorization. We will not discriminate against you for exercising your rights.
This section applies if you are a California resident and the California Consumer Privacy Act applies to Vidya.
Categories of personal information we collect (defined in Cal. Civ. Code 1798.140): identifiers (name, email, IP address, device ID); customer records (payment record, school); commercial information (plans, purchases); internet or network activity (usage events, extension activity you invoke); geolocation (approximate, from IP); audio information (voice recordings, transcripts); biometric information (voice profiles, only with consent); education information (course and assignment data you connect, verified school email); professional information (educator status and institution); inferences (learning preferences drawn from your use, used only to personalize Vidya for you); sensitive personal information (account credentials; contents of your messages; health or other sensitive details you choose to share; biometric voice profiles with consent).
Sources: you, your device, sources you connect, your institution, app stores, verification providers.
Business purposes: those listed in Section 3.
Disclosed for a business purpose to: the service provider categories in Section 7.
Sold or shared: none. We do not sell personal information and do not share it for cross-context behavioral advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
Sensitive personal information is used only to provide the Service you request, for security, and as otherwise permitted by Cal. Civ. Code 1798.121(a). We do not use it to infer characteristics about you.
Your rights: to know what we collect and how we use it, to access it in a portable format, to delete it, to correct it, to limit use of sensitive personal information, and not to be discriminated against. Exercise these rights through Settings or hello@vidya.co. We respond within 45 days and may extend once by 45 days with notice.
Retention by category is set out in Section 9.
Shine the Light: we do not disclose personal information to third parties for their direct marketing.
Controller. Vidya Inc., 239 Bogue St, East Lansing, MI 48823, is the controller of your personal data when you use Vidya directly. When you use Vidya under a Mascot license, your institution is the controller and we are its processor.
Lawful bases.
| Purpose | Lawful basis |
|---|---|
| Providing the Service, billing, support | Performance of a contract |
| Personalization memory and personal model adapter | Consent (you can withdraw in Settings) |
| Voice recordings for voice features | Performance of a contract; consent for the biometric element of voice cloning (explicit) |
| Sensitive data you share in conversation | Explicit consent, given by choosing to share it |
| Security, fraud prevention, abuse detection | Legitimate interests (protecting the Service and our users) |
| Aggregated product analytics | Legitimate interests (improving the Service) |
| Marketing email | Consent |
| Legal compliance | Legal obligation |
Your rights. Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact hello@vidya.co. You may lodge a complaint with your local supervisory authority.
Automated decision-making. Vidya does not make decisions producing legal or similarly significant effects about you solely by automated means.
Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws have rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, sale, and certain profiling. We do not engage in targeted advertising, sale, or profiling with legal effects. Exercise your rights through Settings or hello@vidya.co. If we deny a request, you may appeal by replying to our decision email with "Appeal" in the subject line. We respond to appeals within 45 days and will tell you how to contact your state attorney general if you disagree with the result.
Voice profiles may be biometric identifiers under the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and the Washington biometric law. We collect them only with your written consent, disclose the purpose and retention schedule in advance, do not sell, lease, or trade them, and destroy them as set out in Section 9 and the Voice and Likeness Consent. That consent and this policy together constitute our publicly available retention and destruction policy.
We do not sell covered information as defined under Nevada law.
Using Vidya directly. When you sign up for Vidya yourself and connect your own sources, you are sharing your information with us directly. The Family Educational Rights and Privacy Act (FERPA) governs institutions, not students' own choices, so it does not restrict what you share with us. This policy governs.
Using Vidya through your institution. When your institution licenses Vidya (for example through Mascot), we act as a "school official" with a "legitimate educational interest" under FERPA and under the institution's direct control. We use education records only for the purposes the institution authorizes, never re-disclose them except as the institution directs or the law requires, and return or delete them when the agreement ends. Requests about education records should go to your institution.
Educators and Digital Twins. Course materials are not education records. Educators are prohibited from uploading student records, grades, rosters, or other student personal information into a Digital Twin.
Vidya is designed for higher education. You must be at least 13 years old to use Vidya, or the minimum age to consent to data processing in your country if higher. If you are under 18, you must have your parent or legal guardian's permission. Voice cloning is available only to users who are 18 or older. We do not knowingly collect personal information from children under 13. If we learn we have, we delete it. Parents who believe their child under 13 has an account should contact hello@vidya.co.
Vidya may link to or work with services we do not control, including connected sources, app stores, and identity providers. Their privacy policies govern their handling of your information.
When we change this policy we update the date at the top. For material changes we notify you by email or in the app at least 30 days before the change takes effect, unless the change is required sooner by law. If you keep using Vidya after the effective date, the updated policy applies.
Vidya Inc. 239 Bogue St, East Lansing, MI 48823 hello@vidya.co
We respond to privacy inquiries within 10 business days and to rights requests within the periods described above.
