1. Introduction

ANDI Labs, Inc. ("ANDI Labs," "we," "us," or "our") operates an AI-powered instructional coaching platform (the "Service") that transforms classroom audio into personalized teaching insights. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, including the websites located at coachandi.app and practice.coachandi.app.

This Policy applies to all users of the Service, which is designed exclusively for professional educators, instructional coaches, and school administrators ("Users"). By using the Service, you agree to the practices described in this Policy.

This Policy should be read together with our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

2. Data Controller and Processor Relationship

ANDI Labs acts in a dual capacity depending on the type of data processed:

• Data Controller: For account and platform usage data about educators (e.g., your name, email, and professional profile), ANDI Labs acts as the data controller and determines the purposes and means of processing.
• Data Processor: For classroom recordings, transcripts, and any student data captured incidentally during sessions, ANDI Labs acts as a data processor on behalf of the educational institution ("Institution"). The Institution is the data controller for such educational records and is responsible for its own compliance with applicable law, including FERPA.

Where ANDI Labs processes educational records on behalf of an Institution, it acts as a "school official" with a "legitimate educational interest" as those terms are used in FERPA, subject to a written data processing agreement with the Institution.

3. Information We Collect

3.1 Account and Profile Information

Collected when you register or update your profile:

• Name and email address
• School or institution affiliation and role
• Grade levels taught and subject areas
• Authentication provider information (from Google OAuth or Azure Entra ID sign-in)
• Profile preferences and onboarding responses

3.2 Audio Recordings and Session Data

When you use the recording feature:

• Audio files uploaded or recorded via your browser
• Session metadata (date, duration, class name, subject, grade level)
• Auto-generated transcripts with speaker diarization produced by ElevenLabs
• AI coaching analysis and CIQ scores generated by Google Gemini
• Coaching insights, ECI component scores, and evidence quotes

Important: Classroom recordings may incidentally capture student voices. Student voice data is treated as an educational record under FERPA and handled accordingly. See Section 8 (Educational Privacy Compliance).

3.3 Usage and Interaction Data

• Pages visited and features used within the platform
• Dashboard interactions, session history, and coaching engagement
• Search queries and navigation patterns
• Error logs and performance data

3.4 Technical and Device Data

• IP address and approximate geographic location (country/region)
• Browser type, version, and operating system
• Device type and screen resolution
• Session identifiers and authentication tokens

3.5 Analytics Data (Google Tag Manager)

We use Google Tag Manager and associated analytics tools to understand how educators use the platform. This includes:

• Page view events and navigation flows
• Feature engagement and session duration
• Referral sources and campaign attribution

4. How We Collect Your Information

• Directly from you: When you create an account, upload a recording, complete your profile, or contact us
• Automatically: Through cookies, browser APIs, and platform logging as you interact with the Service
• Via OAuth providers: When you authenticate via Google OAuth or Azure Entra ID, we receive basic profile information (name, email, profile picture) from those providers, subject to your settings with them
• Via email magic links: When you sign in by email, we collect the email address you provide
• Via analytics tools: Google Tag Manager automatically collects usage data when you visit the platform

5. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service: Process your recordings, generate transcripts and CIQ analysis, display coaching insights, and maintain your account
• Personalize your experience: Tailor coaching insights and recommendations based on your teaching context, subject area, and professional goals
• Improve the platform: Analyze aggregated, de-identified usage patterns to improve features and the quality of the coaching experience
• Communicate with you: Send service updates, transactional emails (e.g., magic link sign-in), and important notices about changes to the Service or this Policy
• Ensure security and prevent misuse: Monitor for unauthorized access, enforce our Terms of Service, and protect the integrity of the platform
• Comply with legal obligations: Respond to lawful requests, court orders, and applicable regulatory requirements

Purpose limitation: We use your data only for the purposes described in this Policy. We do not repurpose your recordings, transcripts, or coaching data for any use unrelated to your professional coaching experience on the platform.

6. How AI Processes Your Data

ANDI uses third-party AI services to power its core functionality. Understanding this pipeline is important:

1. Audio upload: When you upload or record a classroom session, the audio file is stored securely in Microsoft Azure Blob Storage.
2. Transcription (ElevenLabs Scribe): The audio is transmitted to ElevenLabs' Scribe API for transcription with speaker diarization and audio event detection. ElevenLabs processes the audio and returns a structured transcript. ElevenLabs does not retain your audio beyond what is required for processing.
3. Coaching analysis (Google Gemini): The transcript (not the audio) is transmitted to Google's Gemini API for AI analysis. Gemini generates your CIQ score, ECI component scores, coaching insights, and evidence quotes. Google processes the transcript under our API agreement.
4. Results stored: The transcript and AI analysis results are stored in ANDI's database (Azure PostgreSQL) linked to your account, where you can access, review, and delete them.

7. Third-Party Sub-Processors

We engage the following third-party sub-processors to deliver the Service. Each sub-processor is bound by data processing agreements that limit their use of your data to the specific purpose for which it was shared.

We will update this table when we add or replace sub-processors and provide notice of material changes as described in Section 17.

8. Educational Privacy Compliance

8.1 FERPA (Family Educational Rights and Privacy Act)

ANDI Labs acts as a "school official" with a "legitimate educational interest" under FERPA when processing educational records on behalf of an Institution. This means:

• We process educational records only as directed by and for the benefit of the Institution
• We do not disclose educational records to third parties except as required to deliver the Service (through our named sub-processors) or as required by law
• We support Institutions in honoring parent and eligible student rights under FERPA, including rights of access and correction
• A written data processing agreement with the Institution is required before ANDI processes educational records on behalf of that Institution

8.2 COPPA (Children's Online Privacy Protection Act)

The ANDI platform is directed to professional educators and administrators — not to children. We do not knowingly collect personal information directly from children under 13. Student voices that may be captured incidentally in classroom recordings are processed as part of an educational record under the school's FERPA authorization, not as direct data collection from the student.

8.3 SOPIPA (Student Online Personal Information Protection Act — California)

ANDI Labs does not use student data for advertising, does not build profiles of students for non-educational purposes, and does not sell student information. These commitments apply in California and reflect our practices nationwide.

8.4 PPRA (Protection of Pupil Rights Amendment)

ANDI does not conduct surveys of students and does not collect personal information from students for commercial purposes. The platform is a teacher professional development tool, not a student-facing application.

9. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:

• Sub-processors: The named service providers in Section 7, under data processing agreements that restrict their use of your data
• Institutional administrators: Authorized school or district administrators with a legitimate educational interest in your account, consistent with applicable law
• Legal requirements: When required by law, regulation, or valid legal process (e.g., subpoena, court order), or to protect the rights, property, or safety of ANDI Labs, its users, or the public
• Business transfers: In connection with a merger, acquisition, sale of assets, or other business combination, subject to the acquiring party agreeing to honor this Privacy Policy or providing you with notice and a choice
• With your consent: When you explicitly authorize a specific disclosure

We do not share your data with advertisers, data brokers, or any party for commercial marketing purposes.

10. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption in transit using TLS for all data transmission
• Encryption at rest using AES-256 for stored audio files and database records
• Role-based access controls limiting employee access to personal data
• Azure-managed security controls including network isolation, threat detection, and audit logging
• Authentication via established providers (Google OAuth, Azure Entra ID) with no passwords stored by ANDI
• Incident response procedures and breach notification protocols in accordance with applicable law

No method of electronic transmission or storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee its absolute security. If you have reason to believe your account has been compromised, please contact us immediately at privacy@andilabs.ai.

11. Data Retention

We retain your data for the periods described below:

When you delete a recording or close your account, we initiate deletion within a reasonable time. Copies may remain in encrypted backups for up to 30 days before full purge, except where a legal hold applies.

12. Your Privacy Rights

Depending on your location, you may have the following rights with respect to your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Deletion: Request deletion of your personal data, subject to legal retention obligations
• Data portability: Request an export of your data in a machine-readable format
• Restriction: Request that we limit our processing of your data in certain circumstances
• Objection: Object to certain types of processing, including processing for direct marketing

EU/UK Users (GDPR / UK GDPR)

If you are located in the European Union or United Kingdom, you have the rights listed above under GDPR/UK GDPR, as well as the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data in accordance with applicable law.

To exercise any of these rights, contact us at privacy@andilabs.ai. We will respond within 30 days. We may need to verify your identity before processing your request.

13. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific privacy rights:

• Right to Know: Request information about the categories and specific pieces of personal information we collect, the purposes for which it is used, and the categories of third parties with whom it is shared
• Right to Delete: Request deletion of personal information we have collected about you, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide the Service
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights

To submit a California privacy request, email privacy@andilabs.ai with the subject line "California Privacy Request." We will verify your identity and respond within 45 days (extendable to 90 days with notice).

14. Children's Privacy

The ANDI platform is designed for and directed to professional educators. We do not knowingly collect personal information directly from children under 13, and we do not allow children to create accounts or use the Service directly.

Student voices may be captured incidentally in classroom audio recordings made by educators using our platform. Such audio data is treated as part of an educational record under FERPA and processed solely under the authorization and control of the educator's Institution. ANDI does not independently collect, analyze, or use student data for any purpose outside of providing the transcription and coaching analysis service to the recording educator.

If you believe we have inadvertently received personal information from a minor in a context not covered by the above, please contact us at privacy@andilabs.ai and we will promptly delete it.

15. International Data Transfers

ANDI Labs is based in the United States, and most of our processing occurs in the United States. If you access the Service from the European Union, United Kingdom, or other regions with data transfer restrictions, your data may be transferred to and processed in the United States.

For transfers of EU/UK personal data to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the UK International Data Transfer Agreement. Our sub-processors are similarly required to implement appropriate transfer safeguards.

16. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve the Service:

• Session cookies: Essential for authentication and maintaining your signed-in session; these are required for the Service to function
• Analytics cookies (Google Tag Manager / Analytics): Used to understand how educators navigate and use the platform; data is aggregated and used to improve the Service
• Preference cookies: Remember your settings and preferences within the platform

You can control non-essential cookies through your browser settings. Disabling analytics cookies will not affect your ability to use the Service. Note that disabling session cookies will prevent you from signing in.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. We will notify you of material changes by:

• Posting the updated Policy on this page with a new "Last updated" date
• Sending an email notice to your registered email address at least 30 days before material changes take effect

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Policy. If you do not agree to the updated Policy, you must stop using the Service before the changes take effect.

18. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have a concern about how we handle your data, please contact us:

We will acknowledge your request within 5 business days and respond within the timeframe required by applicable law.