Privacy Policy

Instudi (“Instudi,” “we,” “us,” or “our”) provides an AI-powered college-counseling and education-operations platform, including our advising product Ivy and an AI meeting assistant. This policy explains what we collect, how we use it, how we share it, and the choices you have. It covers data we access through Google APIs and meeting data captured by our meeting assistant. We aim to collect the minimum necessary.

Instudi is used by educational organizations (“Organizations”) and their staff. Where an Organization uses Instudi to process information about its students, guardians, and meetings, the Organization is the controller of that information and Instudi acts as its processor under the Organization’s instructions and agreement.

• Account & profile. Name, email, role, Organization membership, and authentication details.
• Information from Google. When you connect Google, we access only the data permitted by the scopes you grant (see Section 4).
• Meeting information. When recording is enabled, our meeting assistant (provided through Recall.ai) joins the meeting and captures audio, video, transcripts, participant details, and machine-generated summaries, chapters, and action items.
• Education & advising data. Lessons, sessions, plans, notes, action items, and related records you or your Organization create or import.
• Usage & device data. Log data, IP address, browser/device information, and product interactions used to operate and secure the service.

We request the narrowest Google scopes needed for features you initiate, and you can decline or revoke them at any time.

• Email & basic profile (userinfo.email, openid) — to identify your connected Google account.
• Google Calendar (calendar.events and/or calendar.events.readonly) — to read your events so we can match them to sessions, schedule the meeting assistant for qualifying meetings, and (where you use scheduling) create or update events.
• Gmail (gmail.compose, gmail.modify) — to draft, prepare, and send communications (such as session follow-ups and parent updates) from your mailbox only when you or your Organization configure or approve those actions. We do not read your mailbox for any other purpose.
• Google Drive (limited file access, where enabled) — to attach or retrieve documents you explicitly associate with the service.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized AI/ML models.

Instudi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described here; we do not transfer or sell it for serving ads, and we do not allow humans to read it except (a) with your affirmative consent, (b) as necessary for security purposes, (c) to comply with applicable law, or (d) where the data has been aggregated and de-identified.

• Provide, operate, maintain, and secure the platform.
• Record qualifying meetings (when enabled) and generate transcripts, summaries, chapters, action items, and follow-up drafts.
• Classify meetings (e.g. student, parent, or other) to route the right workflow.
• Schedule and manage sessions and reminders; process billing.
• Provide support, detect and prevent abuse, and comply with legal obligations.

We use automated systems and third-party large-language-model providers to generate summaries, action items, classifications, and draft communications. Outputs are assistive and may be inaccurate; a human reviews and approves outward-facing actions (such as parent emails) before they are sent. We instruct our AI providers not to train their models on your content, and we do not use Google user data to train models.

We do not sell personal information. We share it only as needed to run the service:

• Your Organization — authorized administrators and staff may access data created within their workspace.
• Sub-processors — vendors who process data on our behalf under contract: Google (calendar/email/identity), Recall.ai (meeting recording and transcription), large-language-model providers, our cloud hosting and database providers, our transactional email provider, and our payment processor. A current list is available on request.
• Legal & safety — where required by law or to protect rights and the integrity of the service.
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to this policy.

We retain information while your account or your Organization’s workspace is active and as needed to provide the service or meet legal obligations. Recordings, transcripts, and derived artifacts are retained per your Organization’s configuration, after which they are deleted or de-identified.

We use administrative, technical, and organizational measures including encryption in transit, encryption of stored OAuth credentials, access controls, and least-privilege scoping of third-party permissions. No method of storage or transmission is completely secure.

• Revoke Google access in-product (disconnect) or via your Google Account permissions.
• Access, correction, deletion, and export, subject to applicable law and your Organization’s instructions.
• Recording controls — meetings can be excluded from recording per meeting or by Organization/mentor preference.

To exercise these rights, contact [email protected].

Where you enable recording, you are responsible for ensuring that all participants are notified and that any consent required by applicable law (which varies by jurisdiction) is obtained. We provide controls to disable recording for any meeting.

Instudi is not directed to children for direct sign-up. Where the service processes information about students who may be minors, that information is provided and controlled by the Organization, and we process it as a processor consistent with the Organization’s instructions and applicable education-privacy laws.

Instudi is based in Beşiktaş, İstanbul, Türkiye. If you are in Türkiye, we process personal data in accordance with the Turkish Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu, Law No. 6698 — “KVKK”), and where the EU GDPR applies, in accordance with it. We rely on the legal bases of performing our contract, your consent (e.g. connecting a Google account), our legitimate interests in operating and securing the service, and compliance with legal obligations. We may process data in countries other than where you are located, with appropriate safeguards where required.

We may update this policy and will post the revised version with a new “Last updated” date. Questions or requests: [email protected] · Instudi, Beşiktaş, İstanbul, Türkiye · Governing law: the Republic of Türkiye.