Privacy Policy

Last updated

How We Collect, Use, Protect, and Respect Your Data

Effective Date: October 26, 2026

Version: 1.8

Applies To: tavalearning.ai and all sub-domains; the TAVA web application; the TAVA browser extension; all TAVA APIs and services

Governing Entity: TAVA Learning Inc., United States

Regulatory Topics: FERPA · COPPA

Privacy Contact: support@tavalearning.ai

Related Document: Terms of Service (tavalearning.ai/terms)

Our Five Privacy Commitments - Read This First

Your Topics are private within TAVA and are not shared with institutions, employers, teammates, or other users. TAVA staff do not access Topic content except as described in Section 4. Service-provider processing and disclosures required by law are described in Sections 6 and 7.

TAVA does not use your data to train AI models and has not given Microsoft or OpenAI permission to do so. Azure OpenAI processing is described in Section 6.

You choose which Notes to move from a private Topic into a shared Project. Project content is visible to authorized Project members as described in Section 4.

We do not sell your data to anyone, for any purpose.

You can use the available platform tools to access, correct, export, and delete your Content, or contact support@tavalearning.ai for other privacy requests, including account deletion. We will respond to privacy requests within 30 days, or sooner where applicable law requires.

Please read this Policy in full, including the details of data processing, sharing, retention, and deletion below.

Table of Contents

1. Who We Are

2. Scope of This Privacy Policy

3. The Data We Collect and Why

4. The Two-Space Architecture — Topics vs. Projects

5. How We Use Your Data

6. AI Features and Data

7. Data Sharing and Sub-Processors

8. Data Retention

9. Your Rights

10. FERPA — Student Educational Records

11. COPPA — Children Under 13

12. Cookies and Tracking Technologies

13. Data Security

14. Data Breach Notification

15. Changes to This Privacy Policy

16. Contact Information

TAVA Learning Inc. ("TAVA," "we," "us," or "our") is a US corporation developing and operating the TAVA platform. TAVA is an AI-assisted research platform that brings people, sources, AI, and the research process together in one persistent workspace.

For users accessing the Services directly, TAVA Learning Inc. is the data controller.

This Privacy Policy applies to all data we collect when you:

Visit the TAVA website at tavalearning.ai and any sub-domains

Create an account or use the TAVA web application

Install and use the TAVA browser extension

Access TAVA through an institution or organization

Contact us by email, form, or other means

Participate in pilots, surveys, or research programs

This Policy does not apply to third-party services you open from TAVA (for example, a video that opens on YouTube). Those services have their own privacy policies.

This Policy should be read alongside our Terms of Service (tavalearning.ai/terms).

We collect the minimum data necessary to provide the Services:

Account Data — Your email address and an optional display name. You are not required to provide your full name. Sign-in, passwords, and verification codes are handled by Microsoft Entra; TAVA does not store your password. If another user invites you to a Project, TAVA uses the email address they provide to send the invitation and keeps it as described in Section 8.

Content Data — Notes, Topics, Projects, generated documents, bookmarks, screenshots, translations, and AI prompts and responses that you create in the platform. TAVA stores this content so the Services can work and processes it automatically to run features such as AI responses and relevance checks on your Notes. TAVA staff do not view your Content except as described in Section 4.

Provenance Metadata — For every Note: origin method, author (contributor name), timestamp, and source URL or document reference. Generated automatically. In a Topic, provenance is visible only to you. In a Project, it is visible to Project members, who can see and search contributor names on Notes. See Section 4.

Usage Data — Counts of questions asked per day, AI usage (tokens), and storage used. Generated automatically and used to operate and improve the Services. Usage Data does not include the content of your Notes or documents.

Technical Data — TAVA’s servers automatically record limited technical information needed to run and secure the Services, such as IP address, browser details, request addresses, error logs, and performance metrics. This information is kept in security logs for 90 days (see Section 8). Sign-in and device information is handled by Microsoft Entra under Microsoft’s privacy terms.

Communication Data — Emails you send to TAVA, support tickets, feedback submissions, and survey responses. Provided when you contact us, used to respond to your inquiries and improve the Services.

Browser Storage and Cookie Data — The TAVA platform does not use cookies. It keeps your sign-in session and display settings in your browser’s local storage. On the public website only, Google Analytics cookies and a cookie that records your choice are set if you accept analytics. Google Analytics does not run within the TAVA platform. See Section 12 for details and controls.

Topics are private within the platform

Topics are stored in a user-scoped data partition. TAVA has no screen, API endpoint, or administrative interface that displays Topic content to other users, institutions, or TAVA staff. TAVA staff do not access Topic content except where necessary to respond to a support request you make, protect the security of the Services, or comply with law. Production database access is restricted as described in Section 13. AI processing and disclosures required by law are described in Sections 6 and 7; Topic privacy does not mean that such processing or disclosure is technically impossible.

Topics

Private Workspace with Topics — Your private research sandbox, used to explore ideas, ask questions, clarify material, and draft early thoughts freely and without judgment.

Who can see it — Topic content is not shared through the platform with other users, collaborators, or institutions. TAVA staff access is limited as described above. The processing and legal-disclosure provisions in Sections 6 and 7 also apply.

AI queries inside Topics — Your prompt and relevant context are processed by Azure OpenAI to generate a response. The response is stored in your private Topic space. Provider processing is described in Section 6.

Data enforcement — User-scoped storage and access controls separate Topic content from shared Project access.

Projects

Collaborative Workspace — Your project workspace for Notes promoted from Topics, Topics converted into Projects, generated documents, and uploaded materials. A Project is private to you unless you invite collaborators.

Who can see it — You and the collaborators you explicitly invite, at the role level you assign.

Project history — A history of Notes, sources and contributors, and documents generated with author identification, visible to authorized Project members.

AI queries inside Projects — Recorded in the Project history and visible to Project collaborators.

Data enforcement — Applied at the API and database level: role-based access is validated on every request before any Project data is returned.

Content moves from your private Topic space to a shared Project space only through your deliberate action: adding a Note from a Topic to a Project, or converting a Topic into a Project. These actions are recorded in the Project history with a timestamp and author attribution.

Providing the Services — Storing and retrieving your Notes, Topics, Projects, and documents; enabling collaboration; running AI features, including automated relevance checks on your Notes. Uses Content Data, Provenance Metadata, and Usage Data.

Account Management — Creating and maintaining your account; authenticating your identity through Microsoft Entra. Uses Account Data.

Security and Fraud Prevention — Detecting and preventing unauthorized access, abuse, and fraud; maintaining security logs. Uses Technical Data, Account Data, and Usage Data.

Platform Improvement — Diagnosing bugs and performance issues. We may also review aggregate usage patterns to improve features. Uses Technical Data and Usage Data, aggregated and de-identified where possible.

Legal Compliance — Complying with applicable laws and regulations; responding to lawful legal process. Uses any data categories as required by applicable law.

Communications — Using your email address to send Project invitations; responding to support requests; notifying you of material changes to this Policy. Microsoft sends your sign-in verification code. Uses Account Data and Communication Data.

What we do not do: TAVA does not use your data to train AI models, sell your data, or use your Content for advertising or marketing. Azure OpenAI processing is described in Section 6.

TAVA currently uses OpenAI models through Microsoft Azure OpenAI for research assistance, Note generation, document creation, and gap analysis. When you use an AI feature, TAVA sends your prompt and relevant context to Azure OpenAI for processing. TAVA uses a Global Standard deployment: TAVA’s Azure resources are located in the United States, but Microsoft may process prompts in other Azure regions. TAVA deletes the AI conversation thread after each request. The response is returned to TAVA and stored in the Topic or Project where you initiated the query. Provider processing is governed by Microsoft’s applicable service terms and data-protection terms.

TAVA does not use your data to train AI models, and TAVA has not given Microsoft or OpenAI permission to use your data to train or improve their models. Microsoft’s default abuse monitoring applies to Azure OpenAI, which means content flagged by Microsoft’s automated systems may be reviewed by authorized Microsoft personnel. Microsoft’s processing, including any retention for abuse monitoring, is governed by its applicable terms.

Azure OpenAI — OpenAI models hosted by Microsoft Azure power Ask LLM, document generation, Boost Insight, and What Am I Missing? TAVA sends your prompt text and relevant context, which may include your Notes. TAVA does not include user IDs, names, or email addresses in AI requests. Personal information may nevertheless be present in text you write or in your Notes.

TAVA does not sell, rent, or trade your personal data to any third party for any purpose. TAVA's products are ad-free. We do not generate revenue from your data.

With service providers who process data on our behalf to provide the Services, and with the external services described in Section 7.3

With collaborators you invite to a Project, limited to the content of that Project

When required by law, regulation, or valid legal process

In connection with a merger, acquisition, or sale of TAVA, subject to the protections in Section 7.4

Microsoft Azure — Hosting of the application infrastructure and database in the United States. Data categories: platform data needed to provide the Services.

Azure OpenAI — Processing of prompt text and relevant query context for AI features. Because TAVA uses a Global Standard deployment, prompts may be processed in Azure regions outside the United States. See Section 6.

Development Contractors — TAVA uses outside development contractors who have signed confidentiality agreements. Any temporary database access is limited to the database structure; SQL permissions prevent contractors from reading production data. Contractors do not receive access to user content.

Microsoft 365 — Delivery of TAVA’s emails, such as Project invitations and notices of changes to this Policy. Project invitations include the Project name and the inviter’s name and email address, but no Project content.

Microsoft Entra — Sign-in and account verification. Microsoft holds your sign-in credentials and sends verification codes. TAVA does not store passwords.

Google Fonts — The TAVA web app and browser extension load the Open Sans font from Google Fonts to display text, so the font request goes to Google. When your browser requests the font, Google can see your IP address and browser information. When TAVA creates a PDF export, TAVA’s server requests the font, not your browser. TAVA does not send research content or account data with these requests.

Google Search, Google Images, and YouTube — To retrieve search results, TAVA sends short keyword phrases to Google Search, Google Images, or YouTube. The phrases are generated by the AI or typed by you. TAVA does not send documents or user identifiers, and does not add user or contributor names. Avoid including personal information in your questions or tags. Image and video searches are optional and enabled by the user. Selecting a video opens YouTube outside TAVA.

Datadog — Monitors the performance of TAVA’s servers and receives server error logs, from its US site. These logs are not designed to contain Topic, Project, or document content, and are kept for 90 days.

Google Analytics — Used on TAVA’s public website only, and only if you accept analytics cookies. TAVA sends no names or email addresses. See Section 12.

If TAVA is involved in a merger, acquisition, or sale of all or substantially all of its assets, your data may be transferred as part of that transaction. We will notify you by email before your data becomes subject to a different privacy policy.

We may be required by law to disclose your data in response to a valid court order, subpoena, or warrant. When legally permitted and reasonably practicable, we will notify you before disclosing your data to a government authority. We will not disclose more data than legally required.

Topic content is subject to valid legal process. Its private status within the platform does not make it immune from a legally required disclosure.

The following describes TAVA’s current retention and deletion practices. TAVA does not currently apply an automatic purge after account closure, trial expiry, or placement of a Project in Trash. Deletion requires the user actions or manual account-deletion process described below.

Account Data — Retained while your account exists. To delete your account, contact support@tavalearning.ai. TAVA performs account deletion manually. Deletion removes your email address, display name, collaborations, comments, Topics, Projects, and documents from TAVA’s active systems. Your Microsoft sign-in account belongs to you and Microsoft and is not deleted by TAVA. Deleted data may remain in database backups until those backups expire.

Content Data — Users can delete Topics, Projects, and documents within the platform. A Topic is removed immediately when deleted. A deleted Project moves to Trash, where it can be restored or permanently deleted by the user. Projects in Trash are not currently purged automatically. When an account is deleted, Projects owned by that user are also deleted for their collaborators, and Notes the user added to other users’ Projects are removed. Documents already generated in shared Projects are not changed, but the deleted user’s Notes are not used if a collaborator generates the document again. Files exported before deletion remain with the person who exported them.

Provenance Metadata and Project History — Retained while the account exists and deleted with the account.

Security Logs — Retained for 90 days, including server error logs sent to Datadog. These logs are not designed to contain Topic, Project, or document content.

Communication Data — Support messages, feedback, and survey responses are kept only as long as needed to resolve your request and are deleted on request.

Project Invitation Email Addresses — Kept until the invitation is accepted or cancelled, or until the Project is permanently deleted. If you request deletion of your account, we also delete invitations sent to your email address.

Free Trials — Trial expiry does not currently trigger automatic deletion. Users may delete their Content within the platform or request manual account deletion by email.

Database Backups — Retained for up to 30 days. Data removed from the active database may remain in backups until they expire. If a backup is restored, TAVA re-applies completed account-deletion requests.

Users of all account types can use the available self-service tools described below. For account deletion and other privacy requests that the tools do not address, contact support@tavalearning.ai. We will respond within 30 days, or sooner where applicable law requires.

Access — You can view your email address and optional display name in Account settings. Other categories of data TAVA processes are described in Section 3. Contact support@tavalearning.ai for privacy requests not covered by the available tools.

Correction — You can update your email address or display name at any time directly in your Account settings.

Deletion — You can delete your Content within the platform. Topics are removed immediately; Projects first move to Trash, where you can restore or permanently delete them. To delete your account, contact support@tavalearning.ai. TAVA performs this deletion manually, as described in Section 8, including its effect on shared Projects. Deleted data may remain in backups for up to 30 days. TAVA cannot delete your Microsoft sign-in account or files you have already exported.

Export — You can export documents as PDF. Topics cannot be exported directly; you can convert one or more Topics into a Project and use the “Your Selected Notes” option in Doc Builder to export their Notes as a PDF. Word and JSON export are not available.

Complaint — If you believe we have violated your privacy rights, you are welcome to write to us first at support@tavalearning.ai so we can try to resolve your concern directly.

For any education institution deployment, TAVA’s handling of student education records will be set out in a written agreement with that institution.

TAVA is intended for users aged 13 and older and is not directed to children under 13. Users must be at least 13 years old and accept this requirement in the Terms of Service when registering. TAVA does not knowingly collect personal information from children under 13.

If we learn that we have collected personal information from a child under 13, we will delete it. Parents who believe their child under 13 has provided information to TAVA should contact support@tavalearning.ai.

TAVA Platform — The TAVA platform and TAVA’s own code set no cookies. Your sign-in session and display settings are kept in your browser’s local storage. Microsoft may set its own cookies on its sign-in pages under Microsoft’s terms.

Public Website Analytics — Google Analytics runs on the public website only, not within the TAVA platform, and only if you select Accept Analytics in the cookie banner. No cookies are set before you choose. If you accept, Google Analytics sets two cookies that last about 13 months, and the website sets a cookie that remembers your choice for about 6 months. Google Signals and advertising features are turned off. Google Analytics keeps event data for 2 months and user-level data for 14 months. TAVA sends no names or email addresses to Google Analytics.

No advertising or behavioral tracking cookies

No social media tracking pixels

The TAVA browser extension uses local browser storage to maintain your authentication session. It does not track your browsing activity except when you actively use it to capture research content. Research and AI requests from the extension and platform go to TAVA’s servers, which then call Azure OpenAI and the search services described in Section 7.3. Google Fonts requests are made directly from the web app and the extension to Google. If you choose to watch a video, it opens on YouTube outside TAVA.

The TAVA platform does not use cookies. You can turn off public-website analytics by selecting Reject non-essential in the cookie banner. Clearing your browser storage signs you out of TAVA and resets your display settings.

Encryption at Rest — The production database, including its backups and logs, is encrypted at rest using Azure database encryption.

Encryption in Transit — Data is encrypted in transit using HTTPS with TLS.

Data Isolation — User-scoped Topic storage and role-based Project access separate private research from shared work.

Access Control — Sign-in is handled through Microsoft Entra. Production database access is restricted to a limited number of authorized TAVA administrators. Development contractors receive temporary schema-only access, with SQL permissions preventing access to production data. TAVA staff do not access Topic content except as described in Section 4. Logs and reports are not designed to contain Topic, Project, or document content, and external monitoring tools do not have direct database access.

No security system is perfect. We encourage you to use a strong, unique password for your Microsoft sign-in account and to notify us immediately at support@tavalearning.ai if you suspect any unauthorized access.

In the event of a personal data breach likely to result in a risk to individuals, TAVA will notify affected users without undue delay and within the time required by applicable law.

Affected Users — Notifications will describe the nature of the breach, categories of data affected, likely consequences, measures taken or proposed, and contact information for further inquiries.

US State Regulators (where applicable) — As required by applicable state breach notification law.

Reports of suspected breaches should be sent to support@tavalearning.ai.

We may update this Privacy Policy from time to time as our practices evolve or as legal requirements change. When we make material changes, we will:

Send an email notification to the address on your Account

Update the effective date at the top of this Policy

If you disagree with a material change, you may request deletion of your account by emailing support@tavalearning.ai. If you continue to use the Services after an updated Policy takes effect, the updated Policy applies to your use.

For questions about this Policy, privacy requests (including access, correction, export, or account deletion), security incidents and breach reports, or concerns about children’s information, contact support@tavalearning.ai.

Effective October 26, 2026 · Version 1.8 · tavalearning.ai/privacy

TAVA: AI-assisted research you can trust, control and keep.