How Zyra Protects Your Data

Whose data?

This is not only about students. Zyra holds personal data for anyone using the platform.

Student education records (often involving minors) remain a high-sensitivity subset under frameworks like FERPA—but the same privacy design applies to counselor and staff accounts too.

The promise

What AI sees vs never sees

We separate who someone is from what the AI needs to reason about. AI providers (such as OpenAI and others named in our Privacy Policy) may still process prompts on our behalf—but in the ideal design, those prompts carry tokens and non-identifying guidance context, not raw identity.

Instead of raw PII, the AI sees tokens

Academic facts needed for advice (e.g. “GPA ≈ 3.7”, “interested in CS”) can remain as non-identifying attributes when they do not uniquely identify the person outside context.

Hard rules — never sent to AI

• Vault passwords / secret notes — excluded from Advisor, Copilot, RAG, and tool search (in place today)
• Payment card data — handled by Stripe; not in Zyra AI paths
• Raw auth tokens — never placed in prompts or logs
• Other people's records outside your scope — counselors only see assigned / org-authorized students

How it works

Raw personal data stays inside Zyra. The AI lane only receives tokenized prompts; answers are detokenized for authorized eyes in the UI.

Worked example

A user says:

“Can you help Maya Chen (maya.chen@school.edu) plan SAT dates? Her mom Priya is at priya@email.com.”

What leaves Zyra toward the LLM:

“Can you help [PERSON1] ([EMAIL1]) plan SAT dates? Her mom [PERSON2] is at [EMAIL2].”

What the authorized user sees after detokenization: the original names and emails restored in the answer—inside Zyra, never required to live at the model vendor.

Who can see what

Your rights in practice

Whether you are a student or a counselor (or another account holder), you can exercise rights over your personal data.

• Access & portability — export profile, chats, forms, and guidance artifacts
• Rectification — edit profile / roster fields; tokens refresh on the next AI call
• Erasure — delete or anonymize app records; wipe token maps and provider memory by user ref in the ideal design
• Object / restrict — where offered: disable AI memory or related features

When a student leaves your practice: counselors can remove or request deletion of that student's records from the roster so they are no longer active in your workspace. For a full flush (app data, chats, and related AI memory in the ideal design), use account settings where available, or submit a deletion request via our GDPR request form / info@zyra-ai.com. Retention and auto-deletion schedules for school contracts are finalized in the DPA or service agreement—not as open-ended indefinite storage of departed students.

To submit a formal request, use our GDPR request form or email info@zyra-ai.com.

For counseling practices & firms

Zyra serves both students (B2C) and counseling practices / schools (B2B). Your firm's client data is not a shared pool for other practices or consumer users.

• Isolation: tenancy is keyed per user and organization. Another firm cannot see your roster, notes, templates, or chats. Consumer students on Zyra do not get access to your practice's private workspace.
• Proprietary templates & process maps: materials you upload or build for your practice stay in your org scope. They are not used to train Zyra's models—or model vendors—so that other customers inherit your IP. Ideal vendor terms forbid training on customer content; Zyra product improvement, if any, uses anonymized / aggregated signals with opt-out where offered—not your named playbooks shared to competitors.
• Confidentiality to your clients: counselors only see assigned / org-authorized students; AI paths are designed to avoid raw PII egress; Vault secrets never go to AI.
• Import / export: you can export portfolio and guidance artifacts for portability and backup. Importing existing firm templates, process maps, or roster data is supported through onboarding / product workflows—contact info@zyra-ai.com or contact us for help moving your materials in.
• University & program data (separate from personal privacy): deadlines, requirements, and international program facts come from Zyra's curated education data layer (institutional sources and ongoing research updates)—not from scraping your clients' private files. If something is missing or outdated, flag it via in-product feedback or info@zyra-ai.com so we can correct it. Personal student data and university catalog data are different systems.

Frameworks we design against

This section is architecture alignment—not a claim of completed certification.

• GDPR / UK GDPR — minimization, privacy by design, processor DPAs, pseudonymization as a technical measure
• FERPA (US) — education records; school as controller; Zyra as school-official processor under agreement where applicable
• COPPA — under-13 collection; age gates and parental / school authority paths
• ISO/IEC 27001 & 27701 themes — access control, logging, vendor risk, encryption, PII inventory
• SOC 2 Type II — target posture as the organization decides; not claimed as certified here

Today vs where we're going

Counselors and partners deserve transparency. A short honest snapshot:

• Already in place: auth and counselor–student scoping; Vault excluded from AI paths; third-party AI vendors disclosed in the Privacy Policy
• Destination architecture (this page): full PII tokenize → model → detokenize gateway; pseudonymized long-term memory; PII-redacted production logs
• Buyer pack: DPAs and sub-processor schedules available through commercial / legal (under NDA where required)—not published as a living schedule on this page yet

Use this page to explain the destination architecture. Pair it with the Privacy Policy for current legal terms. Do not treat every ideal control as already shipped unless Product or Legal confirms.

FAQ

If the AI doesn't see the name, how can it write a personalized essay?

It sees stable tokens and non-identifying story facts (activities, interests, achievements). Detokenization restores names in the editor for the student or counselor. Where a true name is essential inside the draft, it appears only after return to Zyra.

Does this cover my counselor account too?

Yes. The same design applies to counselor and staff personal data when AI features are used—not only student records.

Is the AI “feeding off everything we do,” including our templates?

No. AI is invoked for specific guidance features—not as a continuous scrape of your entire practice. Your proprietary templates and process maps stay in your org scope and are not used to train models for other customers. Model vendors are engaged under terms that aim to forbid training on customer content; any Zyra product improvement uses anonymized / aggregated signals, with opt-out where offered.

You serve students and counselors—can another user see our clients?

Zyra is both B2C (students) and B2B (practices / schools). Those worlds are separated by tenancy and authorization. Your firm's roster, notes, and files are not visible to other practices or to unrelated consumer students. Within your org, counselors only see assigned / org-authorized students.

When a student leaves, can we delete or flush their data?

Yes. Remove them from your active roster, export anything you need to keep for your own records, then request deletion (settings and/or GDPR request). Contractual retention and any auto-deletion windows are set in your DPA or school agreement.

Can we import our existing data and export a backup?

Export / portability covers portfolio and guidance artifacts for backup. Importing firm templates, process maps, or roster data is handled during onboarding and ongoing support—email info@zyra-ai.com and we'll help you move materials in.

Where does university / program data come from, and how do you keep it current?

That is Zyra's education knowledge layer (institutional sources and research updates)—separate from your clients' personal files. International deadlines and requirements are refreshed on an ongoing basis rather than a single global calendar. If you spot a gap or outdated fact, tell us and we correct it. Personal privacy controls on this page do not replace that product data pipeline.

Are prompts used to train ChatGPT / Gemini?

Ideal commercial terms forbid vendor training on customer content. Combined with tokenization, vendors neither receive raw identity nor gain rights to train on it. Zyra product improvement from anonymized or aggregated signals is a separate path, with opt-out where offered—see also the FAQ.

What about parents' emails on the roster?

Treated as high-sensitivity PII—tokenized for any AI path; used in cleartext only for authorized messaging or export features inside Zyra.

Can another school's AI context leak into ours?

Tenancy and memory are keyed per user and organization. The ideal design adds strict logical isolation (and single-tenant options where contracted) for institutional deployments.

Who do we contact for a DPA?

Reach Zyra commercial / legal through your account contact, or contact us. Technical architecture questions can reference this page alongside the Privacy Policy.