ComplianceStatute by statute

Engineered into the substrate. Not bolted on.

ArthurAI™ ships across four institutional buyer types, each with its own statutory overlay. This page documents the posture per statute and per edition. Eve-Education, LLC, the operating entity, is the data processor; the institution remains the data controller. Eve-Grid™ is the underlying Azure-native infrastructure substrate against which every claim below is engineered.

FERPA — Family Educational Rights and Privacy Act

Applies to: SLE · ULE · CLE workforce education at FERPA-receiving institutions

ArthurAI™ operates as a school official under FERPA when deployed inside an institution that receives U.S. Department of Education funds. Education records are processed under direction from the institution; we do not redisclose personally identifiable information from education records to third parties without institutional authorization. Eve-Education, LLC executes Data Privacy Agreements at institutional onboarding and supports parental and student access requests through the institution's registrar of record.

COPPA — Children's Online Privacy Protection Act

Applies to: SLE learners in the United States

COPPA is a U.S. law: a child is a person under 13. For U.S. deployments serving children under 13, ArthurAI™ School Learning Edition relies on the model described by the Federal Trade Commission in which the school consents on the parent's behalf, limited to the educational context; enrolling a learner whose date of birth shows they are under 13 is blocked until the school has recorded that authorization. Outside the United States, consent follows the learner's jurisdiction (see the table below): where the law does not let a school consent for a parent, ArthurAI does not treat a school's consent as parental consent. No personal information collected from a child is used for behavioral advertising, profile-building outside the educational context, or third-party marketing. Parents may inspect, correct, or delete their child's information through the institution's registrar.

ADA · Section 504 · Section 508

Applies to: every edition

Section 504 and ADA Title II obligations sit with the school, college or university. Section 508 refers to WCAG 2.0 Level AA, and the US Department of Justice’s ADA Title II rule refers to WCAG 2.1 Level AA, with compliance dates of 26 April 2027 for public entities serving 50,000 people or more and 26 April 2028 for smaller ones. ArthurAI™ is designed to WCAG 2.2 Level AA. W3C states that content conforming to WCAG 2.2 also conforms to 2.0 and 2.1, so once we meet it, it covers both. Each edition’s tested status and known issues are published on the accessibility conformance page; we do not claim conformance beyond what testing shows.

WCAG 2.2 AA

Applies to: every edition · marketing site

Every ArthurAI™ edition is designed to WCAG 2.2 AA; none has been independently audited yet. Testing so far (automated axe-core checks plus recorded manual checks) shows every tested edition is partially conformant, with known issues being fixed. The per-edition Accessibility Conformance Reports are published on the accessibility conformance page. We do not claim AAA conformance.

AI disclosure

Applies to: every edition, every jurisdiction

Every ArthurAI™ edition tells learners when AI is used, on every AI surface. The notice is chosen by the learner's jurisdiction: where a jurisdiction-specific requirement has been confirmed against the official statute or regulator page, that wording is used; everywhere else a plain AI-use notice is shown. Schools and organisations can add their own text below the notice but cannot remove it or switch it off. As of October 2026 we have not confirmed a US state statute that prescribes the wording of an AI-in-instruction notice to students. In the EU, the AI Act's transparency rules apply from August 2026 (European Commission, checked October 2026).

GDPR — General Data Protection Regulation

Applies to: any deployment processing personal data of EU/EEA learners or educators

For deployments inside the European Economic Area or processing personal data of EU/EEA data subjects, Eve-Education, LLC operates as a data processor under Article 28 GDPR with the institution as data controller. A data processing agreement incorporating the European Commission's Standard Contractual Clauses for international transfers is offered to every institution (see the DPA page). All ArthurAI data is hosted in the United States; see the data-handling page for where each part is. Sub-processor engagement is disclosed and gated by the controller. Data-subject rights (access, rectification, erasure, restriction, portability, objection) are supported through the institution.

CCPA / CPRA — California Consumer Privacy Act

Applies to: California consumers interacting with the marketing site or a public-tier deployment

For California residents whose personal information is collected by the marketing site or by a non-school deployment, MindHYVE.ai operates as a covered business under the CCPA as amended by the CPRA. We disclose the categories of personal information collected and the purposes for collection in the privacy policy. California residents have rights to know, delete, correct, and opt out of the sale or sharing of personal information; the analytics consent banner on this site implements opt-in for Microsoft Clarity. Education-record deployments are exempt from the CCPA personal-information definition where the institution is a public agency.

Jurisdictions: the rules we apply, with their sources

Applies to: every edition · rules follow each learner's location, with the institution's location as fallback

ArthurAI™ keeps a legal register covering all 50 U.S. states and the District of Columbia, the European Union and its 27 member states, the United Kingdom, Pakistan, the United Arab Emirates, Saudi Arabia and Qatar. A rule is applied only when we have confirmed it on the official statute or regulator page, and the register records that page and the date we checked it. It is re-checked every month. Where we have not confirmed a rule, or for any other country, we apply the strictest-common default: consent from a parent or guardian for anyone under 16, privacy-protective settings by default, data minimisation, and an AI-use notice on every AI surface.

From our legal register, last checked against official sources on 2026-10-09.
JurisdictionWho consents for a childLegal deadline for data requestsOfficial sources (date checked)
United States (federal)Under 13: parent, or the school for educational useFERPA education-records access: no more than 45 days (other request types: generic default).
www.ecfr.gov (2026-10-08)
www.ftc.gov (2026-10-08)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
CaliforniaUnder 13: parent, or the school for educational useCCPA (where it applies to the business): respond to a request to know within 45 calendar days, extendable by 45 days with notice.
www.ecfr.gov (2026-10-08)
www.ftc.gov (2026-10-08)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
oag.ca.gov (2026-10-09)
TennesseeUnder 13: parent, or the school for educational useTennessee Information Protection Act: respond within 45 days (Attorney General guidance) (applies where the state's consumer data privacy law covers the business; non-profits, FERPA-covered data and others may be exempt).
wapp.capitol.tn.gov (2026-10-09)
www.ecfr.gov (2026-10-08)
www.ftc.gov (2026-10-08)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
www.tn.gov (2026-10-09)
DelawareUnder 13: parent, or the school for educational useDelaware Personal Data Privacy Act: respond within 45 days (applies where the state's consumer data privacy law covers the business; non-profits, FERPA-covered data and others may be exempt).
www.ecfr.gov (2026-10-08)
www.ftc.gov (2026-10-08)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
ConnecticutUnder 13: parent, or the school for educational useConnecticut Data Privacy Act: respond within 45 days, extendable once (Attorney General guidance) (applies where the state's consumer data privacy law covers the business; non-profits, FERPA-covered data and others may be exempt).
www.ecfr.gov (2026-10-08)
www.ftc.gov (2026-10-08)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
portal.ct.gov (2026-10-09)
New YorkUnder 13: parent, or the school for educational useFERPA education-records access: no more than 45 days (other request types: generic default).
www.ecfr.gov (2026-10-08)
www.ftc.gov (2026-10-08)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
TexasUnder 13: parent, or the school for educational useTexas Data Privacy and Security Act: respond within 45 days, extendable once by 45 days (applies where the state's consumer data privacy law covers the business; non-profits, FERPA-covered data and others may be exempt).
www.ecfr.gov (2026-10-08)
www.ftc.gov (2026-10-08)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
www.ecfr.gov (2026-10-09)
European Union (GDPR, AI Act)Under 16: a parent or guardian, directlyGDPR Art. 12(3): respond within one month, extendable by two further months with reasons given within the first month.
www.edpb.europa.eu (2026-10-09)
www.edpb.europa.eu (2026-10-09)
FranceUnder 15: a parent or guardian, directlyGDPR Art. 12(3): respond within one month, extendable by two further months with reasons given within the first month.
www.edpb.europa.eu (2026-10-09)
www.cnil.fr (2026-10-09)
www.edpb.europa.eu (2026-10-09)
SpainUnder 14: a parent or guardian, directlyGDPR Art. 12(3): respond within one month, extendable by two further months with reasons given within the first month.
www.edpb.europa.eu (2026-10-09)
www.boe.es (2026-10-09)
www.edpb.europa.eu (2026-10-09)
ItalyUnder 14: a parent or guardian, directlyGDPR Art. 12(3): respond within one month, extendable by two further months with reasons given within the first month.
www.edpb.europa.eu (2026-10-09)
www.normattiva.it (2026-10-09)
www.edpb.europa.eu (2026-10-09)
IrelandUnder 16: a parent or guardian, directlyGDPR Art. 12(3): respond within one month, extendable by two further months with reasons given within the first month.
www.edpb.europa.eu (2026-10-09)
www.edpb.europa.eu (2026-10-09)
United KingdomUnder 13: a parent or guardian, directlyUK GDPR: respond to a subject access request within one month (ICO); applied as 28 days.
ico.org.uk (2026-10-09)
ico.org.uk (2026-10-09)
EnglandUnder 13: a parent or guardian, directlyUK GDPR: respond to a subject access request within one month (ICO); applied as 28 days.
ico.org.uk (2026-10-09)
ico.org.uk (2026-10-09)
PakistanUnder 16: a parent or guardian, directlyPakistan: no federal personal-data-protection law is in force. The Ministry of IT & Telecom lists the Personal Data Protection Bill as a Draft; the Prevention of Electronic Crimes Act 2016 is the approved cyber-crime law. The strictest-common default applies (parental consent under 16, data minimisation, 1-year retention, 30-day requests).
moitt.gov.pk (2026-10-09)
United Arab EmiratesUnder 16: a parent or guardian, directlyNo jurisdiction-specific deadline confirmed
u.ae (2026-10-09)
Saudi ArabiaUnder 16: a parent or guardian, directlySaudi Arabia (PDPL Implementing Regulation): act on a data subject's request within 30 days, extendable by up to 30 days with advance notice and reasons.
sdaia.gov.sa (2026-10-09)
sdaia.gov.sa (2026-10-09)
QatarUnder 16: a parent or guardian, directlyQatar (Law No. 13 of 2016; National Cyber Security Agency guidance): respond to individuals' requests within 30 calendar days.
ncsa.gov.qa (2026-10-09)
Everywhere else (strictest-common default)Under 16: a parent or guardian, directlyNo jurisdiction-specific deadline confirmedProduct default — no jurisdiction-specific rule confirmed