Privacy at Multilinguals
We built Multilinguals for classrooms with real students. That means privacy is not optional, not configurable away, and not bolted on. Seven principles that define how we handle student data.
§01 — §07 · Read each below
- 01
Data minimization, by design
K-8 students join by a three-letter code and give a first name or an alias. We collect the minimum needed to run the classroom support. Students do not have accounts, profiles, or persistent identity.
- 02
Server-side AI only
All translation, text-to-speech, and other AI processing happens on our servers. Student devices never contact external AI vendors. No student PII is sent to any third-party AI service.
- 03
No advertising, no data sale
We do not sell student data. We do not show ads. We do not build student profiles for commercial purposes. Revenue comes from school and district subscriptions.
- 04
Short retention windows
K-8 session data is retained for 30 days. HS session data for 90 days. HS transcript data for 7 days. Retention is configurable downward on district plans.
- 05
Teacher authority
Teachers control what students see. Students cannot access AI features, external content, or each other's data. The teacher is the gatekeeper.
- 06
Compliance-ready
FERPA and COPPA considerations are addressed by design. We support district-specific Data Privacy Agreements, including the SDPC National DPA framework.
- 07
No dark patterns
Nothing tries to trick students into engagement. No streaks, no badges, no notifications that shame a student for inactivity. The tool exists to make a lesson accessible, not to manufacture time-on-app.
What we collect, by mode
Exactly what is collected, for how long, and who can see it.
Table A
Student data collected by product mode
Student identity
K-8
First name or alias. No accounts, no persistent identity.
High school
Minimal: provider ID, first name, and an email hash (not the email itself).
Data collected
K-8
Session participation, selected language, activity responses.
High school
Above, plus placement results and transcript display preferences.
Retention
K-8
30 days for session data, then deleted.
High school
90 days session data. 7 days transcript data.
External AI vendor PII
K-8
None sent.
High school
None sent. All processing is server-side, behind our auth layer.
Advertising or sale
K-8
Never.
High school
Never.
Compliance documentation
IT whitelist guide, security overview, and DPA support on request.
District evaluations usually want a security brief, a data flow diagram, and a draft DPA. We have them ready. Ask and we will send.
Request documentation