AI Governance

Why AI governance matters to us

We live in the era of AI and data. The data we hold belongs to a future generation. The speed of change is high. A small mistake today can cause harm that we cannot yet see. We know this. We accept the responsibility.

As parents, we want the best for our children. Our team are parents with strong enterprise solutions background from around the world. We found this need for our own children. We hold ourselves responsible to provide the best solution, with all consideration and care. AI governance is not a feature for us. It is a duty.

How we reduce personal data in AI responses

When you ask the Paxaver AI assistant a question, we do our best to send only the data that the assistant needs to answer your question. We do not send your full profile, your full order history, or your full student record to the AI model.

We use these methods to reduce personal data in AI responses:

• Data minimization: We send only the fields that the question requires. For example, if you ask "What is for lunch today?", we send the menu date and items, not student names or wallet balances.
• PII stripping: Before we send data to an AI model, we remove names, email addresses, phone numbers, and other direct identifiers when the AI does not need them to answer.
• Aggregation: When a question is about statistics or reports, we send aggregated numbers instead of individual records.
• Scope limiting: AI requests are scoped to the school and user that made the request. We do not mix data across schools, regions, or users.
• No training on your data: Paxaver AI features do not train on your school's data. Your data is not used to improve AI models.
• Fair-usage controls: AI features are gated by fair-usage controls to prevent abuse and to keep the service stable for all users.

These methods reduce the risk that personal data reaches an AI model or is stored in an AI system outside our control. They do not eliminate the risk. The next section explains why.

How we govern data inside Paxaver

Paxaver governs data with these controls:

• Data separation by country: Canadian data stays in the Canadian region. United States data stays in the United States region. Where a province or state law requires it, data is separated by province or state.
• Role-based access control: Only authorized school staff can access student data. Parents can access only their own students' data.
• Audit logs: Every access to personal data is logged. Logs are retained for 2 years.
• Encryption: Data is encrypted in transit with TLS and at rest in Cloudflare D1 and R2.
• Human oversight: AI output is reviewed by the user before it takes effect. AI does not make automated decisions about students without human review.
• AI logging: AI inputs, outputs, model version, and timestamps are logged for audit and incident response.
• Incident response: If an AI system fails or exposes data, we follow our incident response plan to contain, investigate, and report the incident.
• Privacy by design: Every new AI feature goes through a privacy and AI impact assessment before release.

For the full list of privacy laws we comply with, see the Compliance Regulations page.

Third-party AI assistants — your responsibility

Paxaver connects to third-party AI assistants so you can use tools you already know. These include:

• ChatGPT (OpenAI)
• Claude (Anthropic)
• Siri (Apple)
• Alexa (Amazon)
• Google Assistant (Google)
• Other AI assistants that integrate with Paxaver through MCP or other connectors

Each of these services has its own privacy policy, data retention policy, and AI governance practices. They do their best to secure your children's data. We follow their best practices when we integrate with them.

But this does not mean you do not need to do anything.

When you connect a third-party AI assistant to Paxaver, that assistant may receive data from Paxaver and store it on its own servers. The assistant's privacy policy governs that data, not Paxaver's policy. You must read and understand the assistant's privacy policy before you connect it.

Be careful about your children's future and data. What seems harmless today may have consequences tomorrow. Take the time to understand where your data goes and who controls it.

What you can do to protect your children

• Read the privacy policy of every AI assistant you connect to Paxaver. Know what data it collects, how long it keeps it, and whether it uses it to train AI models.
• Disable training in the assistant's settings when the option is available. Most major AI assistants let you opt out of model training.
• Limit what you share. Do not ask the AI assistant for more personal data than you need. For example, ask "What is for lunch?" instead of "Show me the full student directory."
• Review connected apps regularly. Remove any AI assistant connection that you no longer use.
• Talk to your children about AI. Help them understand that AI is a tool, not a person, and that the data they share with AI can persist.
• Report concerns. If you believe an AI assistant exposed your data, contact us and contact the assistant's provider.
• Use school-managed accounts when available. School-managed accounts give the school control over data retention and AI access.

Our commitment

We promise to do our best to make a better life for your children. That means:

• We will keep AI governance at the center of every feature we build.
• We will reduce personal data in AI responses as far as we can.
• We will never train AI models on your school's data.
• We will be transparent about what data we send to AI models and why.
• We will follow the best practices of every third-party AI service we connect to.
• We will tell you when we find a problem, and we will fix it.
• We will listen to your concerns and act on them.

AI governance is not a one-time task. It is a continuous process. We will update this page as our AI features change and as the law and best practices change.

Contact

For questions about AI governance, contact Paxaver at feedback@paxaver.com. For security reports, see the Security Policy. For the full privacy policy, see the Privacy Policy. For the list of privacy laws we comply with, see the Compliance Regulations page.

Trademarks

All product names, logos, and brands referred to on this page are property of their respective owners. Use of these names does not imply endorsement, sponsorship, or affiliation with Paxaver.

• ChatGPT and OpenAI are trademarks of OpenAI.
• Claude and Anthropic are trademarks of Anthropic.
• Siri and Apple are trademarks of Apple Inc.
• Alexa and Amazon are trademarks of Amazon.com, Inc.
• Google Assistant and Google are trademarks of Google LLC.
• Microsoft is a trademark of Microsoft Corporation.
• Stripe and Stripe Connect are trademarks of Stripe, Inc.
• Cloudflare is a trademark of Cloudflare, Inc.

Paxaver is a trademark of Smartoire Inc. All other trademarks are the property of their respective owners.