No customer data is ever used for training.

Processing roles

For institutional deployments, the institution is the data controller for personal data and the holder of education records under FERPA. Eve-Education, LLC is the data processor under Article 28 GDPR (and analogous state-law constructs) and the school official under FERPA, processing data only on documented instructions from the controller.

Categories of data

• Identity data. Names, institutional email addresses, role within the institution, identifiers issued by the institution. Provided by the institution; not collected from the learner directly.
• Educational records. Course enrollment, lesson progress, assessment artifacts, learning-profile data, AI-assisted output reviewed by the educator. Held under FERPA where applicable.
• Reasoning telemetry. Aggregated structured-workflow telemetry required to operate the platform — error rates, latency, queue depth, and workflow completion. No content of educational records is collected as telemetry.
• Marketing-site form submissions. Talk-to-Sales and PLE waitlist submissions on arthurgrid.ai. Stored only as long as needed to respond and route to the appropriate person.
• Marketing-site analytics. Microsoft Clarity (consent-gated) for aggregate visitor behavior. Microsoft Application Insights (operational) for performance and errors. Neither is used for behavioral profiling.

Subprocessors

ArthurAI^™ uses a deliberate, minimal subprocessor stack. Each subprocessor is engaged under a contract that includes appropriate technical and organizational measures. The full list is disclosed at institutional onboarding and updated under change-control.

• Microsoft Azure — infrastructure substrate (Eve-Grid^™). Hosting region selected per institution data-residency requirement.
• Microsoft Clarity — consent-gated visitor analytics on the marketing site only; not used inside the SaaS edition portals.
• Microsoft Corporation — Azure AI Foundry — the processing entity for AI inference. Hosts and executes the compact classifier, the fine-tuned Small Reasoning Model, and the general-purpose generation, vision, and long-context components composed into Eve-Education^™ F5/reasoner, including the long-context vision path used for diagram and handwritten-work analysis. Inference runs on Microsoft-operated Azure infrastructure inside the institution’s deployment region, with no use of inputs or outputs for model training, under the Microsoft Online Services DPA (aka.ms/dpa).
• Frontier reasoning models (provider names withheld) — three frontier reasoning, generation, and vision models composed per request on high-stakes reasoning paths, under enterprise agreements with data-not-used-for-training terms. This page names the entity that processes the data rather than the model SKU: a subprocessor obligation attaches to the processor, and SKUs are revised without changing who processes what, where, or under which agreement. Model-level detail — including the frontier provider identities — is disclosed to each institution under its signed data processing agreement. Where an institution or jurisdiction prohibits a specific provider, that provider is swapped out without rebuilding the agent.
• Microsoft Communication Services — for transactional email delivery (account notifications, password reset, certificate delivery) where configured.

Regional data residency

Eve-Grid^™ supports residency-aware deployment. North American institutions are deployed in U.S. Azure regions. European institutions, if any, are deployed in EU Azure regions with EU-Standard-Contractual Clauses for any necessary international transfer. African institutions are deployed in the closest applicable Azure geography (Africa or EMEA), aligned with local data-protection regimes including the Kenya Data Protection Act 2019, Nigeria Data Protection Act 2023, and the East African Community member-state frameworks. Pakistani institutions deploy under Pakistan's national data-handling regime.

Retention

Educational records are retained per the institution's contracted retention period, in line with the institution's record-retention policy and applicable statute. Audit logs are retained for a minimum of 7 years for FERPA-covered deployments. Marketing-site form submissions are retained for the period required to respond and route to the appropriate person, then deleted on a defined cadence unless the submission becomes a customer record.