Eddie

Privacy Policy

Effective date: April 11, 2026  ·  Last updated: April 11, 2026

This Privacy Policy describes how Eddie AI ("Eddie," "we," "us," or "our") collects, uses, stores, and protects information when you use the Eddie platform, and explains the rights available to you and to schools, parents, and guardians under applicable law, including the Illinois Student Online Personal Protection Act (SOPPA), the Family Educational Rights and Privacy Act (FERPA), and COPPA.

Eddie is an operator as defined by SOPPA (105 ILCS 85/). We enter into a written agreement (IL-NDPA with Exhibit G) with each school or school district before collecting any covered information from students. No covered information is collected from students without a signed school agreement in place.

1. Information We Collect

1a. Account Information

When you create an account, we collect:

If you sign in with Google, we receive only your email address and Google profile name from Google's OAuth service. We do not receive your Google password.

1b. Chat and Conversation Data

When you use Eddie's chat interface, we store the messages you send and Eddie's responses in our database, linked to your account. This lets you access your conversation history in the portal. Chat data is associated with your user ID and is never shared with other users.

1c. Uploaded Documents

If you upload documents (PDF, DOCX, CSV, TXT, HTML), we store the file in Google Cloud Storage and create a searchable index of its contents in our vector database (ChromaDB). Documents are stored under your user ID and are not accessible to other users.

1d. Usage and Audit Logs

We maintain an audit log of security-relevant events: logins, logouts, failed login attempts, messages sent, documents uploaded or deleted, and data deletion requests. Audit logs are retained for compliance purposes and are not used for advertising.

1e. Automatic Technical Data

Like most web services, our servers log IP addresses and request timestamps for security and rate-limiting purposes. We do not use this data for tracking or advertising.

2. How We Use Your Information

We use the information we collect solely to:

We do not use student or teacher data to target advertising, build advertising profiles, or sell data to third parties. We do not use covered information for any purpose not disclosed in this policy or in the applicable school agreement.

3. Subcontractors and Third-Party Services

We disclose our subcontractor list as required by SOPPA. The following third-party services may process covered information on our behalf:

We do not share covered information with any other third parties without explicit written consent from the applicable school or as required by law.

4. Data Retention and Deletion

We retain your data for as long as your account is active or as needed to provide the service. Upon a verified deletion request, we will delete all covered information within 7 calendar days, consistent with SOPPA §15(a).

Deletion includes:

Audit log entries referencing your user ID are anonymised rather than deleted, as required for security compliance records. Session tokens are short-lived (15 minutes) and automatically expire.

5. Security

We implement the following security measures:

6. Parent and Student Rights (SOPPA §33 / FERPA)

Parents, guardians, and eligible students have the following rights with respect to covered information held by Eddie:

These requests must be submitted through your school or district administrator. School admins may manage student data through the Eddie admin portal. Upon completion of a deletion request, we will send a written confirmation to the school contact on file.

7. Data Breach Notification

In the event of a security breach that may have exposed covered information, we will notify the affected school or school district within the timeframe required by SOPPA and applicable state law. Notification will include the nature of the breach, categories of data involved, steps taken to contain it, and guidance for affected individuals.

8. Children's Privacy (COPPA)

Eddie is intended for use by teachers and school administrators. The platform does not knowingly collect personal information directly from children under 13 without verifiable parental consent obtained through the school. Schools are responsible for ensuring appropriate consent is in place before enabling student access to the platform.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify the school contact on file at least 30 days before the changes take effect.

10. Contact Us

If you have questions about this Privacy Policy, your data rights, or our SOPPA compliance, please contact us at:

Eddie AI
Privacy & Compliance
privacy@eddieai.net