On this page, "DPA" means the Lecture Hat Data Processing Addendum, and "Student Data" has the meaning given in that DPA.
Live Subtitles are available on Standard and Pro. Provider-generated Read Aloud and lesson narration require Pro access. Executing a DPA does not deactivate ElevenLabs or any other AI feature, and we deactivate no feature based on how an account was created. A teacher can turn off transcription of uploaded audio and video for a class. Until the applicable ElevenLabs data-processing agreement and provider settings are verified for institutional use, do not use Live Subtitles, provider-generated Read Aloud, narrated-lesson playback/export, or uploaded-media cloud transcription with Student Data that your institution requires to remain under such an agreement. See the DPA.
Website resources can create separate network requests: some blog articles embed YouTube videos, and the tutorial welcome screen loads an Unsplash image. Their providers receive browser network information when those resources load. See Other Third-Party Services in the provider inventory and the Cookie Policy for those flows.
Data relationships
Direct account
An individual signs up directly under the Terms of Service.
FERPA: Direct signup alone does not establish a school-official relationship
Storage: Persistent until the user deletes the account or the item
Audience: Individuals 18 or older working on their own. Standard and Pro plans
Institutional deployment under a DPA
An eligible institution whose authorized users are all 18 or older may execute a Data Processing Addendum defining its approved processing. The execution form is at /dpa. A school-official designation is selected only where relevant.
FERPA: Where applicable, the completed DPA records the school-official designation. Actual processing must also satisfy FERPA conditions, including institutional control, legitimate educational interests, use limits, and the institution's annual-notice criteria
Storage: Returned or deleted under the return-and-deletion provisions of the executed DPA, subject to its retention exceptions
Audience: Institutions and adult-learner programs covered by an executed DPA
Per-feature data flow
The visibility fields describe access by other users. Authorized Lecture Hat operators and the hosting, network, and backup providers listed in our Subprocessor List may also process these records for the purposes in our Privacy Policy. Per-item deletion is subject to the backup, derived-index, and other retention exceptions below. Copies another user has saved or exported are not removed by deleting your copy.
AI agent chat
Collected: Your message, relevant notebook, document, and lecture-transcript text, relevant page images, and any image you attach
Stored at: Saved chat history is stored in Lecture Hat-controlled PostgreSQL (general_chats) when the applicable class policy permits retention or the student opts in. Where operational prompt collection is enabled, prompt_logs also retains the prompt and the response. Personal-account logging depends on deployment configuration; pilot and strict-privacy course logging requires the applicable student choice.
Retention: Deleting saved chat history hides it immediately and makes the row eligible for permanent deletion after 30 days. Prompt logs have no fixed expiry and remain until account deletion, class-chat deletion, or manual deletion.
Visible to: You. Teachers see chat only when it is retained in an assignment submission under the applicable class policy. Authorized Lecture Hat personnel may access saved chat and prompt-log records for the purposes stated in the Privacy Policy. Prompt logs are never surfaced to teachers.
Third-party processors: Cactus and Cactus Lite route to Anthropic Claude through AWS Bedrock. Cactus Micro in the standard hosted catalog routes to Google Gemma through AWS Bedrock. A separately enabled local chat option processes that selected inference request on Lecture Hat-controlled infrastructure; indexing and other managed tasks can still use Bedrock. Browser Extension chat uses AWS Bedrock, whose terms prohibit using inputs or outputs to train the underlying models.
Live lecture transcription
Collected: Live audio from your microphone or an explicitly selected browser tab, streamed for transcription
Stored at: Transcript text in PostgreSQL when saved or recovered. We do not store the live audio stream; separately uploaded audio and video files are stored as uploads.
Retention: Until you delete the recording or your account
Visible to: You and authorized notebook collaborators. A teacher broadcasting a live class shares transcript text with participating students, who can save their own transcript copy.
Third-party processors: Real-time transcription runs at ElevenLabs over an encrypted WebSocket. We send enable_logging=false on every connection. We have not verified our account's Zero Retention Mode, model-improvement opt-out, or applicable data-processing agreement. Provider retention and use depend on the applicable contract and account settings. Uploaded audio and video normally use Lecture Hat-operated Whisper; when unavailable, audio is sent to ElevenLabs Scribe v2 using standard processing with provider logging and retention enabled, as described in the next row.
Uploaded audio and video transcription
Collected: The uploaded media file and audio extracted from it
Stored at: The source file in Lecture Hat-controlled object storage; transcript text and segments in PostgreSQL.
Retention: Tied to the source file and account; the backup periods below also apply.
Visible to: People authorized to access the source file under its notebook and class sharing settings.
Third-party processors: Lecture Hat-operated Whisper is preferred. If unavailable, audio is sent to ElevenLabs Scribe v2 using standard processing with provider logging and retention enabled. We have not verified a fixed provider retention period. The ElevenLabs limitations and institutional restriction on this page also apply.
Stored at: Lecture Hat-controlled object storage. Chunks are indexed in PostgreSQL and pgvector.
Retention: Trashed files remain in the recycling bin pending permanent deletion. The displayed 30-day countdown is not a verified automatic erasure deadline; use permanent deletion to request cleanup. Derived indexes and backups follow separate cleanup.
Visible to: You and authorized notebook collaborators. Course sharing and class upload settings can make files available to your teacher or class. Anyone with a public note-sharing link can view the linked note.
Third-party processors: Uploading a supported file starts indexing automatically. Primary storage, text embeddings, and graph records remain on Lecture Hat infrastructure. OCR can fall back to Amazon Textract and uploaded-media transcription to ElevenLabs when Lecture Hat-operated services are unavailable. Extracted text and transcripts can then be sent to AWS Bedrock for indexing and other AI tasks; handwriting recognition and image-aware retrieval can also send rendered page images.
Knowledge graph and smart search
Collected: Text embeddings of your document chunks, plus extracted definitions, theorems, and formulas
Stored at: PostgreSQL and pgvector on Lecture Hat-controlled infrastructure
Retention: Tied to the source document. Permanent deletion of the source enqueues asynchronous cleanup of its derived index records.
Visible to: Your personal graph and search records are scoped to your account. Entities and excerpts derived from class-shared materials can also be available to authorized enrolled students.
Third-party processors: Embeddings, retrieval, and graph storage run on Lecture Hat infrastructure. Entity extraction runs on Google Gemma through AWS Bedrock.
Practice sets
Collected: Your selected source content, your answers, and time-on-question
Stored at: Practice-set content, answers, and progress in Lecture Hat-controlled PostgreSQL
Retention: Until you delete the practice set or your account
Visible to: Your personal practice responses are associated with your own copy. Teachers can share practice questions with a class; enrolled students can create separate working copies. Work you submit as an assignment is visible under the Assignment submissions row below.
Third-party processors: Question extraction, generation, and answer evaluation run through AWS Bedrock. The AI Disclosure page lists the current models.
Text-to-speech and narrated lessons
Collected: The response text or lesson script requested for playback or a narrated export on web or iOS
Stored at: The speech-generation endpoint does not persist generated audio; the underlying saved response or lesson script remains part of your content. Web Read Aloud can cache audio, the first 100 text characters, voice, and speed in localStorage (2 MB limit). Web lesson narration caches audio and timing data separately in IndexedDB (80 MB target limit). Native playback and exports can also keep audio on your device.
Retention: Web Read Aloud entries expire after 7 days and are removed when next read. Web lesson audio older than 30 days is not reused and is pruned during later cache writes; expired entries can remain longer without activity. Sign-out attempts to clear these browser caches. Saved source content and exports have separate lifetimes; clear site data or delete local exports to remove your local copies.
Visible to: You and people authorized to access the source response or lesson. Exported narration is visible to the recipients you share it with.
Third-party processors: ElevenLabs. We send enable_logging=false on every request. The ElevenLabs limitations stated under Live lecture transcription apply to this text. Browser Extension Read Aloud instead uses a local device voice and does not send text to ElevenLabs.
OCR (image and PDF text extraction)
Collected: Image bytes of the pages you upload
Stored at: Extracted text becomes part of the document chunks. See File uploads.
Retention: Tied to the source file
Visible to: People authorized to access the source file, as described under File uploads
Third-party processors: Lecture Hat-operated PaddleOCR is preferred. When unavailable, page images are sent to Amazon Textract for OCR and text coordinates. Its separate service-improvement and retention terms are described below. Hosting and backup providers still apply, and extracted text can be sent to AWS Bedrock during subsequent indexing.
Assignment submissions (individual or institutional class use)
Collected: Submission content, version history, any AI chat retained under class policy, time spent, and derived cross-student similarity, code-style, and AI-dependency signals
Stored at: Lecture Hat-controlled PostgreSQL (assignment_submissions, submission_versions, and integrity_flags)
Retention: Closing an assignment or archiving a class does not delete the submission. Account deletion removes account-owned submission records.
Visible to: You and your assignment teacher. Integrity flags are teacher-facing, and chat-derived evidence is omitted when class policy forbids chat disclosure. The student assignment API can return the stored score and AI analysis before the teacher returns the submission.
Third-party processors: Submitting starts an automatic analysis on Anthropic Claude through AWS Bedrock. The request includes submission content, assignment configuration, metadata, version history, and chat retained under the applicable class policy. A successful analysis writes its score suggestion to the score field with no teacher review; a teacher may later override it.
Where data leaves Lecture Hat infrastructure
The Subprocessors page names each vendor entity, processing location, and the models routed through it.
Service
What it sees
Model-training and independent-use limits
Retention at vendor
Amazon Web Services (Amazon EC2 and EBS hosting)
Every record and file Lecture Hat stores, on Lecture Hat-administered servers in US East (N. Virginia)
Used here for hosting and recovery; Lecture Hat does not use stored Account Content to train models.
Held while stored. Encrypted volume snapshots target hourly retention for 48 hours and daily retention for 14 days, subject to successful cleanup.
AWS Bedrock (Anthropic and Google models)
Prompts, retrieved snippets, extracted document text, and page images, for chat, indexing, practice, submission analysis, and background assistance
AWS states inputs and outputs are not used to train the underlying models. We have not independently verified this for every production request.
Retention and AWS human review depend on the model and effective mode, unverified by us
Amazon Textract
Uploaded images and rendered document pages during OCR fallback
AWS service terms permit service-improvement use unless an effective AI services opt-out applies. We have not verified that setting for our account.
Governed by AWS service terms and account settings; we have not verified zero retention
ElevenLabs
Live audio for real-time captions, uploaded-file audio during transcription fallback, and response text or lesson scripts requested for playback or narrated export
A logging-disable request is not a verified model-improvement opt-out. Provider terms may permit model-improvement use of submitted audio or text.
Uploaded-media fallback uses standard processing with provider logging and retention enabled. Live-caption and speech-output Zero Retention Mode is unverified; provider terms and effective account controls govern.
Stripe
Email, name, and payment method for web subscriptions and institutional billing. The iPad app has no checkout flow.
Stripe independently uses payment and transaction information for purposes including AI-powered services and fraud prevention under its privacy policy. Our Account Content training restriction does not describe Stripe's separate payment-data practices.
Customer record deleted on account deletion. Stripe independently retains payment and transaction records under its policies and applicable legal obligations.
Cloudflare
Request payload at the edge for CDN and WAF inspection. TLS terminates at the edge; Cloudflare Tunnel protects the connection to cloudflared, whose local hop to our reverse proxy uses HTTP. A Worker with Workers KV runs on the marketing routes and stores only a maintenance flag and banner text. It is not on the API, notebook, or storage paths.
Cloudflare processes content on our behalf and uses network data for security and service improvement under its privacy policy. This is not a blanket guarantee against every use of network data to improve its systems.
Depends on the service, configuration, and applicable terms. We have not verified one retention period for all edge logs and derived security data.
Use restrictions
Lecture Hat does not sell or rent Student Data, use it for advertising, or use it to train models. Under an executed DPA, data use is limited to the customer's documented instructions and the agreement's permitted purposes. Provider-specific limitations, particularly for ElevenLabs, remain as disclosed above.
Saved chat and configured operational prompt logs can contain content as described in the Privacy Policy. We do not promise that every operational log is content-free or that backup copies disappear immediately when an active record is removed.
Deletion
Use the available in-app deletion controls for your content, or contact support for a deletion request. To request account deletion, go to Settings → Privacy → Delete My Account. You may cancel during a 30-day grace period. After it, our account-deletion handler processes the following systems, subject to the exceptions below:
Lecture Hat-controlled application PostgreSQL records: notebooks, files, saved chats, transcript records, practice data, assignments, usage records, and support requests
A user-level cleanup event enqueued for the separate PostgreSQL and pgvector retrieval index, covering document chunks, knowledge entities, and image metadata. The account-deletion transaction does not establish when that cleanup finishes.
Current Lecture Hat-controlled MinIO storage: notebook files, notebook images, PDF page images, and user avatars. Legacy lecture-audio objects in the retired notebook-recordings bucket are not covered by the current job, and we have not verified completion of the separate manual sweep.
Stripe: every non-terminal subscription is cancelled and the account-owned Customer record is deleted before Lecture Hat content or identity
Your Clerk identity record: email, name, Clerk user id, sessions, and Google OAuth profile fields where that sign-in method was used. We have not enabled passwords or Sign in with Apple.
After completion, Lecture Hat retains deletion-coordination records holding deleted account, deleted class, and deleted Stripe Customer identifiers. Storage cleanup also creates permanent records holding the storage bucket and object key, and an object key can include a filename or identifying text. These records omit file and message bodies, payment details, and Stripe event payloads, but they are not necessarily anonymous or free of personal information.
Lecture Hat infrastructure means servers Lecture Hat administers: Amazon EC2 servers in US East (N. Virginia) and a Lecture Hat-owned server in the United States, connected by an encrypted WireGuard (Tailscale) tunnel. Backup retention targets are about 35 days for direct encrypted PostgreSQL and Redis backups in Amazon S3 (US East, N. Virginia, us-east-1), 48 hours for hourly dumps, about 14 days for daily dumps, and about 28 days for weekly or search-index dumps. Encrypted EBS snapshots target hourly retention for 48 hours and daily retention for 14 days. Uploaded files are mirrored to encrypted Lecture Hat-operated backup storage. An encrypted copy of uploaded files is also kept in Amazon S3, including while Amazon EC2 is the primary host. The current copy targets synchronization on the hourly backup schedule; replaced or deleted objects target removal from backup history after about 14 days. Backblaze B2 is the legacy backup provider in US East. Any remaining historical copies are archived and removed after verified restore checks; new direct backups use Amazon S3. Migrated historical archives have a separate expiration target of no more than 35 days after migration; they are outside routine dump and file-history pruning, and deletion still depends on successful cleanup. Missed or failed cleanup can extend these periods. Our policy targets residual backup purge within 90 days of a deletion request, but the backup system does not mechanically enforce that deadline. Our policy is not to restore deleted accounts, but restore tooling does not enforce an account-level exclusion.
Questions? Email [email protected]. For institutional onboarding, see /dpa. For subscription and refund terms, see /refunds.