VEYAY

Veyay Privacy Notice

Version: 2026-10-14.3 Effective: When this version is identified as published in Veyay's public legal notice receipt and, for an account holder, after the holder affirmatively accepts this exact version in an authenticated Veyay session.

This candidate describes Veyay's demonstration, the independent-adult account service, classes run by adults, parent-managed learners of every age, and personal-study uploads. Each of these opens only on its own approval; an implemented screen is not evidence that its lane is open. School and district lanes are not covered by this version. Each enabled lane separately requires its applicable acceptance or a parent's consent. No adult's own acceptance is reused as a child's consent.

Public demonstration

The interactive demonstration does not create a Veyay account or durable Veyay conversation record. The browser holds the current demonstration state; closing the tab or clearing site data removes the copy under the visitor's control. Web-delivery and security providers necessarily receive ordinary request metadata such as IP address, timestamp, browser or device information, requested URL, and response status under their operational policies. Veyay uses no third-party advertising trackers on these pages and does not sell or share demonstration data for targeted advertising.

When a visitor sends a demonstration message, Cabildo sends the selected source excerpt, the visitor's message, bounded instructions, and bounded session context to the dedicated Microsoft-operated Azure OpenAI United States Data Zone deployment described below.

Independent-adult account service

If Cabildo activates accounts, Veyay processes:

An adult who runs a class for other adults, such as a professor, tutor or co-op teacher, also creates class, membership, assignment and teacher-feedback records for that class. A co-educator such as a teaching assistant can see the class's work until they stop teaching it. Do not use an account to impersonate another person or institution or to submit another person's private records.

AI processing

For the independent-adult coach and other explicitly Azure-pinned turns, Cabildo sends the current authorized source envelope, the account holder's message, bounded instructions, and bounded session context to Cabildo's dedicated Microsoft-operated Azure OpenAI United States Data Zone deployment. The coach has no model fallback. Microsoft, not OpenAI, operates the deployment. Microsoft states that prompts and completions are not available to OpenAI, are not used to train foundation models without the customer's permission, and are processed to provide the service and enforce applicable product terms. Automated abuse review does not store the prompt; content flagged for potential abuse may be selected for access by authorized Microsoft personnel. Microsoft does not state a fixed public maximum for that flagged-content store, so Veyay does not promise one or describe the service as zero-retention.

For individual under-13 coaching, the consent and school certification name OpenAI-hosted AI models and Microsoft Azure OpenAI-hosted AI models. The server binds one reviewed, eligible route in each family, uses the strictly cheaper route first and permits only the other family as fallback. Missing or stale price/eligibility evidence refuses the turn. A parent, school or learner cannot choose the provider or redirect it through a personal API key. Both receive only the authorized source, instructions, learner turn and that session's own conversation; Cabildo does not send a behavioral profile, the learner's other conversations, or anything Veyay has stored about the learner outside that session, and builds no memory or profile from a learner's turns.

On a direct OpenAI hop, OpenAI processes API content for delivery and abuse monitoring; it does not use API content to train foundation models by default. Its standard abuse-monitoring logs may retain content for up to 30 days, with applicable exceptions. This notice does not claim Cabildo has Zero Data Retention. On an Azure hop Microsoft operates the service; OpenAI does not receive that hop's content. Microsoft applies its disclosed abuse-monitoring controls; this notice promises no fixed maximum for content selected for human review. Exact reviewed deployment and custody evidence govern every dispatch.

Under-13 speech remains Azure Speech-only. Under-13 OCR and other auxiliaries and shared multi-user book-room coaching retain their separately reviewed Azure-only routes. An individual learner's receipt cannot authorize a shared room's other participants. Mistral is not an under-13 fallback.

For a learner aged 13 to 17, speech may be transcribed by Mistral AI's speech service or Microsoft Azure Speech, and some supporting steps such as safety checks use the reviewed age-13-plus routes listed on the Security and Subprocessors page, which include Mistral AI.

Speaking instead of typing (adults). An adult in a class can press the microphone and speak instead of typing. Veyay sends the recording to Mistral AI's speech service, which returns the words; only if that service is unavailable does Veyay use Microsoft Azure Speech instead. Veyay keeps the words (the transcript) with the adult's work and does not keep the recording. Mistral AI's API terms state that it does not train on API content by default; Mistral keeps content for about 30 days for abuse monitoring and Cabildo has not enabled its zero-retention option, so this notice does not describe the Mistral route as zero-retention. Microsoft's documentation states that Azure Speech does not retain or store the audio or the transcript from this service. The microphone is the adult's own choice each time and typing always works. An independent adult outside an institution controls their own microphone; when the class belongs to a school, college or district, the institution decides whether the microphone is available to its adults. A learner under 18 uses the microphone only as the parent-managed and school sections of this notice describe, and a learner under 13 never uses Mistral.

(Not available yet: study shelves are closed with personal-study uploads, and an adult's document reading through Mistral AI is closed until Veyay records the adult's permission for it.) When a page or photo is added to a study shelf, its text is read by Microsoft Azure for any learner under 18, with no fallback, and by Mistral AI's document service for an adult's own shelf. An adult's document reading is charged to that adult's seat or balance and is covered by the AI-processing permission the adult gives for it. Mistral AI's API terms state that it does not train on API content by default; Cabildo has not enabled Mistral's zero-retention option, so standard abuse-monitoring retention applies. The provider route for class material is identified before the material is accepted; the adult-shelf Mistral route does not, by itself, authorize Mistral processing of class material or another learner's material.

Parent-managed learners

Not available yet: parent-managed learner accounts are closed until Veyay separately identifies the applicable age band, jurisdiction, consent version, provider routes and activation record; publication of this notice does not activate them.

An adult who heads a Veyay household may create a learner account, of any age, for a child who lives in their home, full-time or part of the time, and whom they care for as a parent, stepparent, grandparent or other relative, or legal guardian; the Terms call that adult the child's parent for account-management purposes only. For a child under 13, the required consent must come from a parent or legal guardian within COPPA's meaning; residence, caregiving status and a paid seat alone do not establish that status. Veyay processes:

The parent sees a summary of the child's work by default, not every conversation; the child may share a specific session. A parent who also teaches their child in a family learning room sees that class's work and conversations as its teacher, without the extra classroom signals other teachers see. Siblings do not see each other's work. A homeschool co-op or organizer gains no access to another family's child by organizing.

Apple age assurance, where present, provides an age range and permission signals rather than an exact birthday. Those signals are separate from the date of birth the parent enters, the payment verification, the consent and the seat.

Post-class vaults

Not available yet: post-class vaults are closed until Veyay's activation record identifies this version for the adult lane or the family lane. When active, Veyay copies a learner's own written work and reflections from a class that is not run by a school, with the class title and dates, into a personal vault that belongs to the learner. For an adult, the authority is the adult's own acceptance of a Terms version carrying the post-class vault section. For a child, it is the acceptance of the parent who is linked to the child by Veyay's live guardian record, made before the class ended. That acceptance is recorded apart from the parent-notice consent. Nothing an AI model produced, no grade or teacher feedback, and no one else's posts are copied. No AI model is given the vault's contents, and they are not used for training or to build a profile. A parent's access, and any future copying, ends when the guardian link ends, the child is no longer the parent's dependent, the parent withdraws that acceptance, the child turns 18, or the payment for the child's seat is refunded, reversed or lost in a dispute. Retention and deletion follow the retention schedule's post-class vault row.

Seats and payments

An adult buys a Veyay learner seat through Stripe's hosted checkout page; Veyay never sees the full card number. Cabildo records bounded purchase evidence: the payer and household, the product, the amount and currency, the paid period, the transaction reference, and any refund, reversal or dispute. For a parent, that paid transaction is also how Veyay verifies the parent; it is recorded with the consent. A full refund, a payment reversal, or a payment dispute decided against the payer ends the seat and the verification it funded (an open dispute, or one decided for the payer, does not); the historical consent record is kept as history, not rewritten as a withdrawal.

Personal-study uploads

Not available yet: personal-study uploads are closed until the upload lane's activation notice identifies this version and confirms that the rights, abuse-material, storage, deletion and provider controls are active; publication of this notice does not activate them.

An adult may add material to their own private study shelf; a parent adds material to their child's. Veyay keeps the text read from the file, not the file itself, along with the rights record the person adding it makes. The shelf is private to its owner and the managing parent. Cabildo does not review, screen or monitor what is on a shelf; it acts on a specific complaint, as the Uploaded-Material Rights and Takedown Notice describes.

Purposes and disclosures

Cabildo uses account data to deliver and resume the requested reading experience, authenticate and authorize the account holder, record required acceptance, provide export and deletion controls, support and secure the service, respond to verified rights and legal requests, and evaluate service quality without creating a durable learner trait.

Cabildo discloses bounded data to the service providers listed in the security and subprocessor sheet for those purposes, or where law requires. Cabildo requires a service provider receiving personal data to protect it consistently with the same or equivalent protections described in this notice and required for the service. A future new purpose, processor, route, population, or jurisdiction requires a new review and, where required, notice and consent.

Veyay does not sell personal data, use it for targeted advertising, use saved reading to train a foundation model, or profile a person to make a legal or similarly significant decision. Veyay does not create a composite learner score, percentile, rank, mastery level, character score, risk score, or durable cross-context ability profile for any learner. Veyay may use learner content and activity to provide the enabled reading, discussion, continuity, export, security and support functions; that operational use is separate from training a foundation model, and Veyay does not use saved reading or learner conversations to train a foundation model.

Retention, export, deletion, and survivors

Veyay retains a child's personal information only for as long as reasonably necessary for the specific purpose for which it was collected. An active account, class, seat or guardian relationship does not by itself justify continued retention. Cabildo deletes information when that purpose no longer requires it, subject only to the separately disclosed, necessary and documented survivor purposes and retention criteria. Veyay does not retain a child's personal information indefinitely.

Saved reading records, study-shelf material and learning records remain while the account is active unless the account holder deletes them, Cabildo completes a verified deletion request from the managing parent, or Cabildo applies a shorter disclosed schedule. When Veyay's parent deletion control is active for the family lane (not available yet), a managing parent may delete a learner either recoverably, which stops the learner's sign-in and use at once and removes the records after 30 days unless the parent restores them, or permanently, which requires a recent sign-in and removes the records at once. Until then Cabildo processes a verified request manually. The owner-scoped export includes saved-reading sessions and reader/tutor transcripts, study-shelf material with its rights records, and, for a parent, the learner's household, provisioning, verification and seat records, in the documented format. Anything else Veyay holds about an account or a learner, and corrections and deletion, are provided on a verified request to the contact below. The parent export is not a promise that every internal record, provider copy, backup, security record or legally retained record appears in the immediate download. The account-deletion flow removes active Veyay content and then the authentication identity, while preserving only the limited records Cabildo must keep for a documented security, legal-hold, dispute, or other lawful purpose.

Supabase's connected Pro plan exposes a rolling seven days of daily database backups; Storage objects are not part of those database backups. A deleted row may remain recoverable inside that rolling window. If Cabildo restores a backup inside the window, recorded deletions must be replayed before user access reopens. Provider monitoring copies and a copy an account holder downloads are outside the active Veyay account store and follow their separately disclosed controls. The retention and data-lifecycle pages give the object-level detail.

Rights and requests

An independent adult may ask whether Cabildo processes their data and request access, correction, a portable copy, or deletion. A parent may do the same for their child, and may withdraw consent, which stops the child's use; withdrawal does not by itself delete records. Virginia residents may also appeal a denied consumer-data request.

An adult may withdraw permission for new AI processing by no longer sending coach turns. Because provider processing is necessary to generate a coach reply, Veyay cannot provide that reply after permission is withdrawn. The adult may still export or delete the account through the enabled account controls.

Send privacy requests to support@veyay.app. Cabildo verifies identity and claimed authority before disclosure or change. Do not email a transcript, password, card number, recording, or sensitive record; begin with a safe reference and Cabildo will identify a secure method if one is available.

Lanes this version does not cover

School and district lanes, rostering through a learning-management system, retained oral assessment, and sharing study-shelf material with others are not covered by this version and stay closed. No school, college or district may rely on an adult's or a family's account as institutional authority.

Changes and contact

A material change requires a new version, publication hash, and notice and acceptance path appropriate to the affected population. Account, demonstration, support, and accessibility questions may be sent to support@veyay.app, by mail to Cabildo Companies LLC, 2014 Electric Rd, #249, Roanoke, VA 24018, United States, or by calling +1 (762) 438-3539 (calls are forwarded to Cabildo; if nobody answers, you can leave a voicemail, but do not leave a child's personal details in it). None of these is an emergency or safeguarding channel.