This Privacy Notice for Cyamate, Inc. (“Cyamate,” “we,” “us,” or “our”) describes how we process personal information when you use Cyamate for Canvas, our verbal assessment tool that runs inside your institution’s Canvas learning environment (the “Service”).
Cyamate for Canvas is provided to educational institutions. Your institution decides whether and how the Service is used in your courses. If you have questions about how your institution handles your educational data, contact your institution. If you have questions about this notice, contact us at stephen@cyamate.com or +1 (839) 293-2058.
Summary of key points
- What we collect
- When you launch the Service from Canvas, your institution’s Canvas environment provides us with your first name, an internal Canvas user identifier, your role (instructor or student), and the course and assignment context. We do not receive your email address, student ID (SIS identifier), or last name. We do not ask you to register, create an account, or set a password.
- What happens during an assessment
- Students complete a spoken conversation with a conversational agent. Audio is processed in real time by our voice provider and is not stored. The conversation transcript is processed to produce a report for your instructor, then automatically deleted from our systems. The report, feedback, and a record that the assessment was completed are delivered into Canvas, which your institution controls.
- Education records
- We process education records on behalf of your institution, at its direction. Your institution and its Canvas environment remain the official custodian of your educational records, including all grades. Cyamate never assigns grades.
- AI
- The Service uses artificial intelligence to draft assessment questions for instructors and to generate advisory feedback on assessment responses. Your data is never used to train AI models, by us or by our service providers.
- No sale, no ads, no tracking
- We do not sell personal information, use it for advertising or analytics, or track you. The Service does not use cookies.
1. What information do we process?
Provided by your institution’s Canvas environment at launch
- First name, used only to personalize the spoken conversation and to label the assessment report
- An internal Canvas user identifier
- Your role (instructor or student), used to determine which screens the Service shows
- Course and assignment context (course name and identifiers, assignment identifiers, allowed attempts)
We do not receive email addresses, SIS identifiers, last names, or passwords. We do not ask users to provide any account information.
Provided by students during an assessment
- Spoken responses, processed in real time as described below
- The conversation transcript, processed to generate the assessment report
Provided by instructors
- Assessment questions and settings
- A grading rubric, where the instructor attaches one in Canvas
- Course materials the instructor selects for question generation (documents or audio recordings such as recorded lectures)
2. Education records
Cyamate processes education records on behalf of your institution and at its direction. Assessment responses, transcripts, reports, and feedback relating to an identifiable student are part of the student’s education record under the Family Educational Rights and Privacy Act (FERPA). Your institution remains the custodian of these records. All permanent assessment outputs are stored in your institution’s Canvas environment, not by Cyamate. Cyamate never assigns grades; all grading is performed by your instructor in Canvas.
Where an institution designates Cyamate as a “school official” under FERPA, Cyamate performs an institutional function at the institution’s direction, operates under its control with respect to the use and maintenance of education records, and uses education records only for the purposes described in this notice. Cyamate does not redisclose education records except to the service providers described in this notice, acting on our behalf.
To exercise rights regarding your education records, including access and correction, contact your institution, which controls those records.
3. How do we process your information?
- To deliver the Service: conducting the spoken assessment, generating the assessment report and advisory feedback, and delivering them into Canvas for your instructor’s review.
- To help instructors prepare assessments: drafting questions from instructor-selected course materials, which the instructor reviews and confirms before anything becomes part of an assessment.
- To enforce assessment settings: checking a student’s remaining attempts before a session begins, so no student is recorded for a submission that cannot be accepted.
- To operate the Service securely: maintaining operational logs that contain pseudonymous identifiers only (no names, no conversation content, no credentials).
We do not use personal information for marketing, advertising, analytics, or profiling. We do not use personal information to train artificial intelligence or machine learning models.
4. Who processes your information on our behalf?
We use three service providers:
Amazon Web Services (AWS). Our application and data processing run in our AWS environment in the United States. AI processing (question drafting and transcript evaluation) uses Anthropic’s Claude model through AWS Bedrock, within our AWS environment. Bedrock does not retain inference data or use it for model training, and inference data is not sent to Anthropic.
ElevenLabs. Our conversational voice provider. During an assessment, audio flows directly between the student’s browser and ElevenLabs over an encrypted real-time connection. ElevenLabs operates in Zero Retention Mode for the Service: audio and conversation data are processed in real time and deleted once processing completes. No recordings are stored, and no transcripts or call metadata containing personal information are retained by ElevenLabs after the call. Instructor-selected course materials are retained by ElevenLabs in a course-scoped knowledge base so the conversational agent stays grounded in actual course content; for audio uploads, the transcript rather than the recording is retained.
Anthropic (via AWS Bedrock). Anthropic’s Claude model performs question drafting and transcript evaluation. This processing occurs within our AWS environment through AWS Bedrock. Data is not sent to Anthropic directly and is not used for model training.
We do not share personal information with any other third party, except as required by law or in connection with a business transfer (such as a merger or acquisition), in which case this notice would continue to apply to previously collected information.
5. How long do we keep your information?
Cyamate retains no durable copies of student assessment data.
| Data | Retention |
|---|---|
| Voice audio | Never stored, by Cyamate or by our voice provider. Processed in real time only. |
| Conversation transcripts | Transient processing copies, deleted automatically once the assessment report is generated and delivered. |
| Assessment reports (PDF) | Automatically deleted from our storage one day after creation. The copy delivered to Canvas is retained by your institution. |
| Failed processing messages | Retained at most 14 days for remediation, then deleted automatically. |
| Question-generation records | Deleted automatically within 24 hours. |
| Instructor questions and course configuration | Retained for the life of the course configuration. |
| Instructor-selected course materials | Retained in the course-scoped knowledge base for the life of the course configuration. |
| Operational logs | Pseudonymous identifiers only, retained for 30 days. |
Your institution may direct the deletion of instructor-selected course materials and course configuration at any time, and we will execute that deletion.
6. How do we keep your information safe?
The Service runs in our AWS environment with compute and data stores in private network subnets. Every request to our systems is authenticated: in-app requests require a short-lived cryptographically signed session token issued only after a verified Canvas launch, and all service-to-service communication is verified by shared secrets or cryptographic signatures. Each institution’s deployment is fully separated from any other, with its own databases, storage, and credentials. Data in transit is encrypted.
If we become aware of a security incident affecting institutional data, we will notify the affected institution without undue delay.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Where is your information processed?
The Service is operated from the United States. If you access the Service from outside the United States, your information will be processed in the United States.
8. Your privacy rights
For education records (assessment responses, reports, feedback, grades), contact your institution, which is the custodian of those records.
For questions about Cyamate’s processing, or to make a privacy request regarding data Cyamate holds, contact us at stephen@cyamate.com or +1 (839) 293-2058. We will acknowledge and respond to verified requests within 30 days unless a longer period is permitted by law. Because Cyamate retains minimal personal data by design, many requests are satisfied by the automatic deletion practices described above.
We do not sell or share personal information for advertising purposes and have not done so. We do not use personal information for targeted advertising or profiling. We do not respond to Do-Not-Track signals because we do not track users.
9. Updates to this notice
We may update this notice from time to time. The updated version will be indicated by the “Last updated” date above. Material changes will be communicated to institutions using the Service.
10. Contact us
Cyamate, Inc.
280 S Mangum St, Suite 330
Durham, NC 27701
United States
Email: stephen@cyamate.com
Phone: +1 (839) 293-2058