Effective date: October 4, 2026
Last updated: October 4, 2026
This revision replaces the Privacy Policy last updated September 28, 2026.
This Privacy Policy describes how Lecture Hat, Inc., a Delaware corporation ("Lecture Hat," "we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with our websites at https://lecturehat.com and https://askcactus.com, our iPad and desktop applications, our browser extensions, and any related service that links to this Policy (collectively, the "Services"). The Services are offered in the United States to individuals 18 years of age or older.
Roles depend on who actually determines the purposes and means of each processing activity and on applicable law. For individual account administration and other purposes we determine, Lecture Hat is a controller where applicable data-protection law assigns that role. State-law obligations, including the California Consumer Privacy Act, apply where their coverage requirements are met; listing state rights does not mean every law applies to every account. When we process covered institutional data on an institution's documented instructions, we act on its behalf under the executed Data Processing Addendum. That agreement supplies required contractual safeguards; signing or labeling it does not by itself determine GDPR roles or make every account, billing, or security operation institutional processor activity. We have not appointed an EU or UK Article 27 representative. Institutional users should also read their institution's notice.
The Services are in Public Beta, and this Policy applies to it in full; non-privacy beta terms are in our Public Beta Terms. Course Pilot terms may add to or narrow the processing permitted inside that course, and this Policy remains the baseline notice of our processing. The Lecture Hat Browser Extension, listed in the Chrome Web Store as Lecture Hat Study Companion, is governed by the separate Browser Extension Privacy Policy and Study Companion Terms of Service. Their collection and Limited Use restrictions continue to govern all data obtained through the Extension, including after import into a Lecture Hat account. This Policy supplies the account notice and other processing details without expanding those permissions.
We collect personal information when we have a reason to do so: to provide the Services, communicate with you, and keep the Services secure and useful. We aim to collect only what those purposes require, keep it only while we have a reason to keep it, and give you control over what you share and delete. This Policy explains those practices and your choices.
We receive information in three ways: information you provide, information collected automatically when the Services operate, and information from outside sources you authorize.
The information we receive depends on the features you use and the sources you authorize. The Services are not intended for protected health information; avoid uploading health records or other sensitive information that a study feature does not need. Contact us if you need help removing such information.
This table summarizes the categories we collect, where they come from, why we use them, recipient categories, and retention. It provides a California-style notice at collection where that law applies. Section 5 names principal providers, Section 10 explains cleanup and backups, and the Extension has its own notice for Canvas and shared-page information.
| Category | Sources | Business or commercial purpose | Categories of third parties | Retention |
|---|---|---|---|---|
| Identifiers and customer records: name, email address, identity-provider user ID, date of birth, profile photo, IP address | From you; automatically from your device | Account creation, authentication, 18+ age check, security, communications | Identity provider; network-security provider; email-delivery provider; collaborators and referring users as described in Section 5.3 | While needed for your account or content; account deletion has a 30-day grace period, followed by cleanup. Backup and legal exceptions are described in Section 10. IP addresses in operational logs remain until rotation |
| Customer records and commercial information: subscription status, last four digits of a payment card, billing metadata | From you; from our payment processor | Subscriptions, payments, invoicing, fraud prevention | Payment processor | For account and billing administration; Stripe may separately retain transaction records under its own legal obligations and privacy policy |
| Sensitive personal information where applicable: account identifiers with authentication credentials or session tokens; contents of private communications imported from Canvas | From your authentication session; from the institutional account you direct the Extension to use | Authentication and session security; storing, indexing, and answering questions about communications you choose to import | Identity and network-security providers for authentication; hosting and AI providers for imported communication content | Session tokens are short-lived and refreshed during an active session; cached authentication context follows device controls. Imported communications: While needed for your account or content; account deletion has a 30-day grace period, followed by cleanup. Backup and legal exceptions are described in Section 10 |
| Internet or other electronic network activity: device and request, error, and security logs | Automatically from your device | Security, rate-limiting, abuse investigation, product improvement | Network-security provider | Until overwritten by size-based operational-log rotation; longer where a documented security or legal incident requires it |
| Electronic network activity and commercial information: AI feature and model use, token counts, costs, timing, usage quotas, and rate-limit events | Generated from your use of the Services | Usage metering, billing, quotas, service operation, and abuse prevention | Hosting and backup providers | Stored in account-linked databases, with no automatic age-based expiry. Account deletion, backup, and legal exceptions follow Section 10 |
| Audio, electronic, visual, or similar information: lecture audio, transcripts, uploaded documents and images, handwriting, chat messages | From you | Providing the Services: transcription, indexing, retrieval, AI Features | Speech provider (live captions and read-aloud only); AI model providers; cloud infrastructure providers | While needed for your account or content; account deletion has a 30-day grace period, followed by cleanup. Backup and legal exceptions are described in Section 10. Lecture Hat does not persist the live audio stream; uploaded media is stored |
| Professional or education-related information: class enrollment, assignments, submissions, imported coursework | From you; from your institutional account at your direction | Providing class, assignment, and teacher-facing features | AI model providers; the teacher or institution running your class | While needed for your account or content; account deletion has a 30-day grace period, followed by cleanup. Backup and legal exceptions are described in Section 10 |
| Inferences: knowledge graphs, concept maps, practice progress, automated scores, academic-integrity indicators, class insight reports | Derived from your Account Content, activity, and, for cross-student comparison, other submissions in the same class | Providing learning, class evaluation, and academic-integrity features | AI model providers; the teacher or institution running your class | While needed for your account or content; account deletion has a 30-day grace period, followed by cleanup. Backup and legal exceptions are described in Section 10 |
| Geolocation: coarse country or region derived from IP address | Automatically from your device | Security and fraud prevention | Network-security provider | Until overwritten by size-based operational-log rotation; longer where a documented security or legal incident requires it |
We do not request government identifiers, precise geolocation, or biometric identifiers. Account Content can contain sensitive information you supply; optional Canvas Inbox import can include the contents of private communications. We use such information to provide the requested features, maintain security, and meet applicable legal obligations, rather than to infer unrelated sensitive characteristics.
The table describes our current collection and disclosures. We do not sell personal information or share it for cross-context behavioral advertising.
We use information about you for the purposes below:
We do not use Account Content for advertising, sell it, or use it to train our AI models. Optional research and institutional processing remain subject to the applicable notice, consent, class settings, and executed agreement.
Where applicable law requires a legal basis, we use information on the following grounds, as relevant to the processing:
Account creation and onboarding require an email address, first name, and date of birth. Other content is required only for the feature that uses it; you can create an account without uploading a document. A profile photo and last name are optional.
These grounds describe processing for which we are a controller. An institution that determines covered processing must identify its own lawful basis and give its required notice; we process on its documented instructions. Your agreement with Lecture Hat does not itself supply a legal basis for processing someone else's personal information. Processing special-category information requires an additional condition where the law requires one, and information about criminal convictions or offenses has separate restrictions.
We share information with vendors that need it to provide their services to us or to you. Our Subprocessor List describes provider functions and data; the AI Use Disclosure explains AI routing and provider limitations. Principal recipients include:
Teachers can receive enrollment, assignment submissions, scores, feedback, integrity indicators, and class insight records made available by class features. This differs from the separate research transcript, which is not exposed as a teacher transcript. A teacher can disable transcription of uploaded audio or video; signing a DPA does not itself disable speech or AI features. The applicable course terms and executed agreement determine permitted institutional processing.
We do not sell personal information, share it for cross-context behavioral advertising, or use Account Content to train our AI models. Provider-specific limitations in Section 6.2 apply separately.
The Services include features powered by large language models and other automated systems, including question-and-answer over your notes, summarization, practice-set generation and evaluation, knowledge-graph construction, image understanding, transcription, and text-to-speech (collectively, "AI Features").
Core storage and retrieval and text embeddings run on the servers described in Section 5.1. OCR and uploaded-media transcription normally run there; when unavailable, page images can be sent to Amazon Textract and uploaded audio to ElevenLabs. Extracted text and transcript records are stored in our databases. Other AI Features normally use a provider identified in Section 5.1, which receives the prompt together with the content excerpt, extracted document text, audio stream, or image needed to produce the output. Cactus Micro runs through AWS Bedrock in the standard hosted chat catalog. Where a deployment enables the local Gemma option and that option is selected, its chat inference instead runs on Lecture Hat-operated infrastructure in the United States. This local chat route does not prevent automatic document indexing, title generation, or other background Gemma tasks from sending content to AWS Bedrock. The Browser Extension uses the Bedrock chat catalog.
Lecture Hat does not use Account Content to train, fine-tune, or otherwise adjust the parameters of an AI model. AWS states that inputs and outputs submitted to Amazon Bedrock are not used to train the underlying models, and AWS documents that retention and possible AWS human review depend on the selected model and effective account or project retention mode, and states that content sharing with model providers is not currently supported. We have not independently verified the effective retention mode for every production request and do not promise categorical zero retention. See AWS data-retention documentation. Amazon Textract has separate AWS terms permitting content storage and service-improvement use unless an effective AI services opt-out applies; we have not verified that setting or zero retention. ElevenLabs carries a separate limitation: uploaded-media cloud transcription uses standard processing with provider logging and retention enabled. Live-caption and speech-output requests ask it to disable logging, but we have not verified the contractual coverage and provider-level Zero Retention Mode or model-improvement opt-out applicable to our account. Its published business terms incorporate a DPA; that does not establish our account's effective configuration or every permitted use. Do not use third-party AI Features for content you are not willing to process under these limitations. Aggregated or de-identified uses remain subject to Section 5.3, the applicable content license, and the Extension's Limited Use restrictions; removing identifiers does not expand training permission. Any future Lecture Hat model training on your content would require separate affirmative opt-in consent describing the data and purposes; notice or continued use alone would not authorize it, and consent cannot waive the Extension's Limited Use restrictions.
Limitations on AI output, and our disclaimers regarding its accuracy, are set out in our Terms of Service and our AI Use Disclosure.
Personal-notebook chat history, including Extension conversations, is saved by default. A separate service-operation or research log of message and response text is off for personal notebooks by default; the software includes an operator configuration that can enable it, and a change in that practice requires notice under Section 18. In a standard class, the class transcript-retention setting can permit history and research logging. In a pilot or strict-privacy class, saving verbatim text requires the student's latest research opt-in. That choice can be revoked for future logging through the applicable class privacy control. The separate research record is not shown to teachers and is not used to train models; it has no automatic expiry, and revoking opt-in does not delete existing records. Class chat-deletion controls, account deletion, or a request to support can remove the retained records. Deleting a saved chat hides it immediately; after 30 days it becomes eligible for permanent deletion by cleanup in bounded batches, subject to legal or security exceptions and backup rotation in Section 10.
These settings describe retention, not unrestricted reuse. A class retention setting or acceptance of this notice does not itself authorize separate research reuse or broader human review of Account Content. Such review must stay within providing and securing the requested Services or have separate, specific permission, subject to applicable law, an executed DPA, and the Extension's additional single-purpose and human-access restrictions for Extension data.
When you start Live Subtitles, microphone audio, and any browser-tab or system audio you explicitly add, is processed to produce text. Lecture Hat does not persist that live audio stream as a recording; transcripts may be saved to your notebook, and draft transcripts may be cached on your device. Provider processing can involve the retention limitations in Section 6.2. This differs from an audio or video file you upload: the source file is stored with your notebook and follows Section 10. Uploaded audio and video normally use Lecture Hat-operated transcription; if it is unavailable, audio is sent to ElevenLabs for cloud transcription under the provider limitations in Section 6.
We do not create or store voiceprints, perform speaker identification or verification, or otherwise use audio as a biometric identifier. Should that change, we will publish a written retention and destruction schedule and obtain written consent before collection.
Recording law and institutional rules vary. Before capturing anyone else's speech, satisfy all applicable consent, notice, and other requirements described in our Recording Consent Notice.
Cookies help us identify a signed-in session and remember access preferences. Local storage and other device stores also keep drafts, cached responses, transcripts, and offline edits. Our Cookie Policy describes where we use these technologies, their purposes, retention, and browser controls. We do not deploy advertising cookies or cross-site advertising pixels in the current application.
Blocking required cookies can prevent sign-in. Clearing device data can delete unsynced work, and signing out does not necessarily erase every offline record. We do not respond to browser Do Not Track signals; Section 11.5 addresses Global Privacy Control.
We use safeguards designed to protect information against unauthorized access, alteration, disclosure, and destruction, including authenticated access and encrypted connections. Our Security Statement describes current controls and their limitations. No online service or storage method is completely secure, so we cannot guarantee absolute security.
We notify affected individuals and authorities of a personal-data breach where applicable law requires it, within the deadlines that law imposes. A GDPR supervisory-authority deadline and the timing of notice to an individual can differ.
We generally discard information when it is no longer needed for the purposes for which we collect and use it and we are not legally required to keep it. The time depends on the record and the deletion process:
notebook-recordings bucket are outside the current job, and we have not verified completion of their separate manual cleanup. Provider failures may require retries; independent legal retention by a provider is separate.Copies of records may persist after active-system deletion in encrypted backups. Retention targets are 48 hours for hourly database dumps, about 14 days for daily dumps, and about 28 days for weekly or search-index dumps. Direct encrypted database and Redis backups in Amazon S3 (US East, N. Virginia, us-east-1) target deletion after about 35 days. Encrypted volume snapshots of our Amazon EC2 servers can contain all records and uploaded files on the volume and target hourly retention for 48 hours and daily retention for 14 days. Uploaded files are also mirrored to Lecture Hat-operated backup storage. An encrypted copy of uploaded files is also kept in Amazon S3, including while Amazon EC2 is the primary host. The current copy targets synchronization on the hourly backup schedule; replaced or deleted objects target removal from backup history after about 14 days. Backblaze B2 is the legacy backup provider in US East. Any remaining historical copies are archived and removed after verified restore checks; new direct backups use Amazon S3. Migrated historical archives have a separate expiration target of no more than 35 days after migration; they are outside routine dump and file-history pruning, and deletion still depends on successful cleanup. These targets depend on successful backup and cleanup jobs; missed or failed runs can extend retention or create gaps. Our policy targets purge of residual backup data within 90 days of a deletion request, but the backup system does not mechanically enforce that deadline. Our policy is not to restore deleted accounts from backup, but the restore tooling does not enforce an account-level exclusion.
Depending on where you live, the law's coverage requirements, and any applicable exceptions, you may have the following rights:
You can use the account-deletion control in Settings to schedule deletion. To request deletion or exercise another privacy right, email [email protected] with the subject line "Privacy Request." You do not need to create an account to submit a request. Where verification is required or permitted, we use your authenticated account, confirmation that you control the account email, or another proportionate method. We do not require a verifiable consumer request for a California sale/sharing opt-out or sensitive-information limitation request. An authorized agent may submit a request where the law permits; we may ask for proof of authority and, where permitted, signed permission and direct confirmation of your identity or the agent's authority. We honor the applicable exceptions for a valid power of attorney. We respond within the deadline for the right and jurisdiction: access, correction, and deletion ordinarily allow forty-five (45) days, with an additional forty-five (45) days only where permitted and on notice; opt-out and limitation requests can have shorter deadlines.
If we deny a request, you may appeal by writing to [email protected] with the subject line "Privacy Appeal." We respond within the appeal deadline applicable to your request and state, and explain any permitted extension. If we deny the appeal we will state the reasons and provide a method by which you may submit a complaint to your state Attorney General. Virginia: oag.state.va.us. Colorado: coag.gov/file-complaint. Connecticut: portal.ct.gov/AG.
California Civil Code § 1798.83 permits California residents to request information about disclosures of personal information to third parties for those parties' direct-marketing purposes. We make no such disclosures.
We do not sell or share personal information for cross-context behavioral advertising and do not engage in cross-site tracking. We treat a Global Privacy Control signal transmitted by your browser as a valid opt-out of any sale or sharing; because we conduct none, the signal produces no change in our processing. If we begin any processing for which the signal is operative, we will honor it and update this Policy before doing so.
Academic-email and referral offers involve account identifiers, email address and domain, referral code and attribution, subscription status, and reward history. We use this information to determine eligibility, apply the offer, and prevent duplicate or fraudulent rewards; referral-status sharing is described in Section 5.3. The offers may be financial incentives where California law applies. Participation does not authorize sale, advertising, or model training on your information. Where law requires separate prior opt-in for an incentive, ordinary account registration or this notice alone does not supply that consent.
To withdraw from an academic or referral offer, email [email protected] with "Promotion Withdrawal." Withdrawal stops future participation; it does not require you to close the free account. An unpurchased grant or discount has no cash redemption value. We estimate the value of the eligibility and attribution information by the cost of the discount, granted access, or credit, rather than proceeds from selling data. We have not assigned your Account Content a sale value.
Where the relevant European or Swiss data-protection law applies, you may have the rights below, subject to that law's conditions and exceptions. Swiss rights are governed by the Swiss Federal Act on Data Protection rather than automatically matching every GDPR provision.
To exercise these rights, contact [email protected]; you do not need an account to ask about information concerning you. We respond without undue delay and within the applicable deadline. GDPR requests normally require a response within one month; complexity or the number of requests can permit up to two additional months, with reasons given within the first month. Swiss access requests normally require a response within 30 days. We may request only information reasonably needed to establish identity or authority, as the applicable law permits. For data we process on an institution's behalf, we assist the institution with its response; that does not restrict your rights against us for our own controller processing.
The Services are limited to users 18 years of age or older. They are not directed to children under 13 and are not offered to anyone under 18, with or without parental consent. Authentication occurs before onboarding, so our identity provider may already hold an authentication record, including an email address and profile information supplied at sign-in, before we receive a date of birth. We process that record and the onboarding submission to apply the age check; apart from that, we do not knowingly collect or use personal information from anyone under 18. If the submitted date of birth indicates an age under 18, we do not persist it, we do not mark the account as onboarded, and the preexisting authentication record is not automatically deleted. Otherwise we retain the date of birth solely to enforce this requirement.
If we learn that we have inadvertently collected personal information from a user under 18, we will close the account and delete the associated personal information promptly. A parent or legal guardian who believes a child has created an account should email [email protected] with the subject line "Minor Account."
For an individual account, Lecture Hat contracts with you rather than automatically becoming an agent of your school. Coursework can remain subject to institutional confidentiality and other rules even when you copy it into a personal notebook. Canvas assignment import can include scores, submission status, late or missing flags, feedback, and rubric assessments; disable assignment import if you do not want those records copied.
A teacher's creation of a class does not by itself establish the school-official exception under FERPA. Where an eligible institution enters a written agreement, it must identify its authority to disclose education records and the required direct control and permitted purposes. An executed Data Processing Addendum governs the covered institutional processing. Contact the institution first about its education records; we assist under that agreement. We do not sell education records, use them for advertising, or train AI models on them.
Course Pilot processing follows the applicable Pilot Terms and privacy choices. Public Beta participation does not waive privacy rights or replace an executed institutional data agreement.
We send sign-in, billing, security, deletion, class-invitation, and other account notices needed to operate the Services. Marketing messages, if sent, provide an unsubscribe option and require consent where law requires it. Opting out of marketing does not stop necessary account notices. You can also email [email protected] with "Marketing Opt-Out."
Lecture Hat's primary records are hosted in the United States. Using the Services from another country can transfer information to the United States and to provider locations described in the Subprocessor List. Configured global AWS inference profiles can process requests in supported commercial AWS regions worldwide. Your local laws may provide protections different from those in a destination country.
Where a restricted international transfer requires a safeguard, an executed agreement may use the European Commission's Standard Contractual Clauses, a UK transfer addendum, or another lawful mechanism. This notice does not establish that a transfer agreement has been executed for every user, provider, or destination. Lecture Hat is not self-certified under the EU-U.S. Data Privacy Framework or its UK or Swiss extensions. Contact us to ask which mechanism applies to your processing or to request the relevant executed terms.
Submitting an assignment automatically starts an AI review. If it succeeds, the Services store a generated score from 0 to 100, mark the submission as reviewed, and store the analysis and annotations before any teacher action. Integrity checks can consider text similarity to up to 200 classmates' submissions, completion speed, differences from your prior code style, and AI-chat activity. A model-identified verbatim paste sets the automated score within the 50 to 55 range. Automated systems also produce practice-set evaluations and class insight reports. These records can affect how an instructor evaluates your work if they rely on them. A teacher may later review or change a score, but human review is not required before a score is stored or made available. The AI Use Disclosure provides further feature limits.
Whether automated processing produces a legally or similarly significant decision depends on its actual use and effect, including an institution's reliance on a score. The ability to change a score later does not by itself establish meaningful human involvement in the decision. Applicable rights apply whenever their legal conditions are met, including for current features. If you believe an automated output about you is inaccurate, contact your instructor. You may also contact us at [email protected], and we will provide the relevant record and correct it where it is within our control. Where applicable law grants a right to information, explanation, opt-out, human review, correction, or contest, you may exercise that right under Sections 11 and 12. For decisions an institution controls, we assist it with requests concerning our processing on its behalf.
Although most changes are likely to be minor, we may change this Policy from time to time. We identify the revision and effective dates on this page and provide email or prominent in-product notice of material changes before they take effect. Where a change requires consent, we request it before the affected processing. Continued use alone does not waive a privacy right or replace consent required by law.
This Policy describes processing; our Terms of Service state contractual rights and dispute procedures for individual use. Applicable privacy law and its mandatory remedies continue to apply. An executed institutional DPA controls processing covered by that agreement; applicable Pilot Terms govern pilot course activity. The Extension Privacy Policy adds collection and Limited Use restrictions for Extension data. A beta disclaimer does not authorize additional data use or eliminate this notice.
For privacy questions, requests, or complaints:
Lecture Hat, Inc.
Attn: Privacy
7710 SW 67th Ave
South Miami, FL 33143-4532, USA
Email: [email protected]
Where the GDPR or the Swiss Federal Act on Data Protection applies and you cannot resolve your concerns with us, you may lodge a complaint with your supervisory authority. European Economic Area authorities are listed at edpb.europa.eu; the United Kingdom authority is the Information Commissioner's Office (ico.org.uk); the Swiss authority is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
Template credit and reuse: Adapted from Automattic's Privacy Policy. Lecture Hat changed the services, information categories, providers, AI and education processing, retention, rights, and contact details. This adapted policy text is available under CC BY-SA 4.0. Automattic does not endorse Lecture Hat.