Skip to main content
NewWhy your meeting data belongs on your deviceData on your deviceRead the post

AI Meeting Notes for Schools: Why the Safest Student Data Agreement Has Almost Nothing to Cover

A FERPA-friendly AI note taker for schools. Meetily transcribes on the staff computer, with no bot, so student data never reaches us. California DPA signed.

Sandeep Zachariah
CEO, Zackriya Solutions
8 min readPrivacy & SecurityEnglish
A note from Meetily's CEO: the safest student data agreement has almost nothing to cover. Meeting notes stay on the staff computer, no bot joins the call, Meetily receives license information only, and the student data privacy agreement is signed in California

TL;DR

Most AI note takers used in schools send meeting data to their own servers, and that's where the FERPA questions start. Meetily keeps recordings, transcripts and summaries on the staff member's own computer by default. We've signed California's student data privacy agreement through CITE, and Meetily never receives student meeting content. Less data shared means fewer privacy concerns for schools.

There's no FERPA certification, so no AI note taker is "FERPA certified". Your district's counsel makes the final call.

In September, a data and systems analyst at a California school district sent us an 18-question review. It was one of the most thorough vendor questionnaires I've seen. Does the tool join meetings on its own? Are notes sent to every participant automatically? Is district data ever used to train AI models? Who are your subprocessors? Can it be used in a confidential IEP meeting?

These are exactly the right questions. Schools have watched AI note-takers join meetings uninvited, send summaries to everyone on the invite(opens in new tab), and quietly keep recordings on servers nobody in the district chose. A parent-teacher conference, a disciplinary review or a special education meeting is not the kind of conversation anyone wants on a vendor's server.

Answering that questionnaire made something clear to me. For most AI tools, a student data privacy agreement is a long list of promises about what the vendor will do with student data. For Meetily, it is a short list, because student data never reaches us in the first place. I've come to believe that is the better standard. The safest agreement isn't the one with the strongest promises. It's the one with almost nothing to cover.

What FERPA and state student privacy laws require of AI note takers

FERPA and the "school official" rule

FERPA(opens in new tab) protects students' education records, and it applies to K-12 districts and to colleges and universities that receive funding from the US Department of Education. When a school lets an outside vendor access those records, the vendor typically has to act as a "school official" under the school's direct control(opens in new tab), with limits on how the data can be used and shared(opens in new tab).

State student privacy laws and the NDPA

States add their own layer. California's Education Code section 49073.1(opens in new tab) sets out what a contract with a third party handling student records must say, and its Student Online Personal Information Protection Act(opens in new tab) prohibits using student data for targeted advertising or profiling. New York(opens in new tab), Illinois and many other states have similar laws. To make all of this manageable, thousands of districts now use standard agreements from the Student Data Privacy Consortium(opens in new tab), such as the National Data Privacy Agreement(opens in new tab) and its California version(opens in new tab).

Universities: HECVAT and research reviews

Universities face the same FERPA obligations, plus their own security reviews, often using the Higher Education Community Vendor Assessment Toolkit (HECVAT)(opens in new tab), and research rules. A recorded research interview with a human subject is data an institutional review board expects to be protected(opens in new tab), not uploaded to whichever note-taker a researcher happened to install.

When a meeting recording becomes an education record

Now think about what a typical AI note-taker does in a school meeting. A teacher, a counselor and a parent discuss a student's progress, behavior or disability. The tool records it and sends the audio to the vendor's servers to be transcribed and summarized. That conversation is now very likely part of an education record(opens in new tab), sitting in a system the district has to vet, contract for, audit and eventually ask to delete.

How an on-device AI note taker keeps student data off vendor servers

Meetily works differently. It is a private application installed on the staff member's own Windows or Mac computer, with Linux support on the way, and it does its work there.

No bot, no calendar access, no automatic sharing

Meetily detects that a meeting has started and asks the user whether to record. Nothing starts on its own unless the user chooses to turn that on. It doesn't join the call as a bot, it doesn't read calendars, and it doesn't send anything to the other participants. Speech is transcribed on the device. Summaries are written by Meetily's built-in AI, or by any AI model the school chooses to use. Recordings, transcripts and summaries are saved on the user's own computer, or in a shared folder the school chooses. Nothing is distributed automatically. When a teacher wants to share notes, they export a normal document, and the recipient doesn't need an account to read it.

What does Meetily receive?

So what does Meetily actually receive? Only what we need to manage a license: the license holder's name, email address and organization, the license key, the number of seats, a device identifier used to enforce seat limits, and the app version. No audio. No transcripts. No summaries. No voiceprints. No student data. And no usage analytics from paid installations either.

How Meetily works in a school: a staff, parent or IEP meeting starts, Meetily asks whether to record, the transcript and summary are written on the computer by default, and notes are saved on the computer or a school folder. Meetily only sees who holds the license, the organization, the license key and seats, and the device ID and app version. It never sees recordings, transcripts, summaries, voiceprints or student data, and nothing is used for AI training, advertising or resale
Everything about the meeting stays on the staff member's computer by default. The only thing Meetily ever sees is who holds the license.

That is why, when the district's questionnaire asked about subprocessors, retention and deletion, the honest answer was that there was almost nothing to describe. No subprocessor ever receives meeting content. There is no meeting data on our side to retain or delete, because it lives on the district's own devices under the district's own policies. And when it asked whether district data would ever be used to train AI models, for advertising or for resale, the answer was simple, and we put it in writing: never.

The student data privacy agreement

When the district asked whether we would sign a California student data privacy agreement, we said yes, and we have signed it through CITE, the California IT in Education organization(opens in new tab). But the scope of that agreement tells the real story. Its schedule of data, the list of student data a vendor receives, is essentially empty, because the only information we hold is about the license holder, not about students. And because the agreement includes a General Offer of Privacy Terms, other California districts can sign on to the same terms through the Student Data Privacy Consortium instead of starting from scratch.

That changes the conversation for a district or a university. Instead of trusting a vendor to protect student records, you're choosing software that never receives them. Your counsel will always make the final determination about FERPA and state law for your own situation, and we don't claim any certification we don't hold. What we can offer is an architecture where most of the hard questions don't apply, and contract language that says so.

Being honest about the edges

Accuracy: AI summaries are drafts

A thorough review deserves honest answers, including the less comfortable ones. AI transcription is very good but not perfect, and it varies with audio quality, accents and background noise. AI summaries can contain mistakes, so we recommend treating them as drafts that a person reviews before they become an official record. That matters most in the meetings schools care about most, like IEP meetings.

Consent is also a human responsibility. Because Meetily runs on the user's own computer rather than as a bot in the call, other participants don't see a notice unless the person recording tells them. We'd encourage every school to make "ask before you record" part of its meeting policy, whatever tool it uses.

Meetily Enterprise for districts and universities

And for districts and universities that want to go further, Meetily Enterprise runs entirely on the institution's own servers, with no connection to us at all. IT can install Meetily silently on staff computers, set policies once that users can't change, choose which AI model everyone uses, and manage licenses without anything being sent to us.

Why this matters for schools

Schools are being asked to adopt AI faster than they can review it. Teachers want help with meeting notes. Administrators want to save time. IT and privacy teams are left saying no to tools that would genuinely help, because the data path is wrong.

It doesn't have to be a choice between AI and student privacy. When the AI runs on the school's own devices, the school keeps the benefit and the vendor never gets the data.

We started Meetily on one belief. We want to bring the power of technology to our customers, but not their data to us. In a school, that belief protects the people who matter most.

If your district, college or university is reviewing AI note-takers, I'm happy to walk your IT and privacy team through how it works and the agreement. US schools can buy online or raise a purchase order through our authorized US reseller. You can book a time with me here(opens in new tab).

Frequently Asked Questions

There's no FERPA certification, so no AI note taker can honestly call itself FERPA certified. FERPA sets duties for schools, and a vendor that receives student records has to work as a school official under the school's direct control. The safest setup is a tool that never receives student data at all. Meetily transcribes on the staff member's own computer by default and only receives license information, and we've signed a California student data privacy agreement. Your district's counsel makes the final call for your situation.
No. SOC 2 and HIPAA are about how a vendor protects the data it holds. FERPA asks a different question: should the vendor hold student records at all, and under what contract. A vendor with strong security still has to act as a school official under the school's direct control, with limits on how it uses and shares the records. The simplest way to meet that duty is a tool that never receives the records. Meetily transcribes on the staff member's computer by default and only receives license information.
Federal law doesn't say yes or no. The US Department of Education says no federal law authorizes or prohibits recording an IEP meeting, and states and districts may regulate it (64 FR 12477, Appendix A, question 21(opens in new tab)). In California, the parent and the district both have the right to audio-record an IEP meeting with at least 24 hours' notice to the team, and if the district wants to record and the parent objects, the meeting isn't recorded (Education Code 56341.1(g)(opens in new tab)). If the school keeps the recording, it's an education record under FERPA and IDEA. Check your district's policy first, tell everyone in the meeting, and treat any AI summary as a draft a person reviews.
It can be. Under FERPA, an education record is a record directly related to a student and kept by the school or by someone acting for it (34 CFR 99.3(opens in new tab)). A transcript or summary of a meeting about a student that's saved in a school system, or on a vendor's servers working for the school, usually fits. There's a narrow exception for notes kept only by the person who wrote them as a memory aid and never shown to anyone else, but notes that are shared or stored in a school system lose it.
Generally not in K-12 schools. The HIPAA Privacy Rule excludes records covered by FERPA, and IEP records are education records under FERPA and IDEA (HHS and Department of Education joint guidance, 2019(opens in new tab)). So the document that matters with a vendor is usually a student data privacy agreement, not a HIPAA business associate agreement (BAA).
Often, yes. California, for example, makes it an offense to record a confidential conversation without the consent of everyone in it (Penal Code 632(opens in new tab)), and several other states have similar all-party rules. Your district may also have its own policy. Since Meetily doesn't put a bot in the call, other people won't see a recording notice, so say you're recording at the start and make sure everyone agrees. Our guide to compliant meeting notes without a bot covers how to tell people.
Ask where the audio, transcripts and summaries go, and who stores them. Ask whether the tool joins meetings on its own or reads calendars, and whether it sends notes to participants automatically. Ask whether district data is ever used to train AI models, for advertising or for resale, and get the answer in writing. Ask for the list of subprocessors that receive meeting content, how retention and deletion work, and whether the vendor will sign your state's student data privacy agreement. Then look at the agreement's schedule of data: the shorter it is, the less there is to protect.
If the vendor will receive student data, your district will almost always want one, and many states require certain terms in the contract. California's Education Code section 49073.1 is one example. Most districts use their state's version of the National Data Privacy Agreement. Ask your district's privacy or IT team before you start: many keep a list of approved tools that already have a signed agreement. Meetily has signed the California version, and its schedule of data is almost empty because we only receive license information.
Only what's needed to manage the license: the license holder's name, email address and organization, the license key, the number of seats, a device ID used to enforce seat limits, and the app version. Meetily doesn't receive audio, transcripts, summaries, voiceprints or student data. By default, transcription and summaries run on the staff member's computer. If a school chooses an outside AI model for summaries, the transcript text goes to that provider under the school's own account, not to Meetily.
No. Meetily never receives meeting content, so there's nothing for us to train on. We've also put it in writing for schools: district data is never used to train AI models, for advertising or for resale.
Yes. Our California agreement includes a General Offer of Privacy Terms, so another California district can sign on to the same privacy terms through the Student Data Privacy Consortium registry instead of negotiating a new agreement. It covers the privacy terms only; pricing and the service agreement are separate.
AB 1159, signed in September 2026, expands California's student privacy laws. It bars covered ed tech companies from using student information to train generative AI or develop AI models, and it adds a new law for colleges and universities. The K-12 changes take effect on January 1, 2027, and the higher education rules on July 1, 2027 (Venable summary(opens in new tab), CalMatters(opens in new tab)). For a tool that sends meetings to a vendor, that's a rule the vendor has to follow. Meetily never receives meeting content, so there's no student data on our side to train on, and our California agreement already says district data is never used to train AI models.
COPPA covers online services that collect personal information from children under 13. Meetily is installed and used by staff on their own computers, and it doesn't collect personal information from students. The FTC's 2025 update to the COPPA Rule(opens in new tab) didn't add a new school-consent rule; it kept its existing guidance for schools and ed tech.
Often, if your IRB protocol allows it. IRBs approve research only when there are adequate provisions to protect participants' privacy and keep the data confidential (45 CFR 46.111(opens in new tab)). A tool that uploads interview audio to a vendor adds a third party your data plan has to cover. With Meetily, transcription runs on the researcher's computer by default, so recordings stay under your study's own storage rules. Two things to check in your approved protocol before you start: some IRBs want research data only on a university-managed computer, not a personal laptop, and some want the consent form to say how recordings are transcribed.
Most districts start in the admin settings of their meeting platform, by limiting which third-party apps staff can connect and who can join meetings without being let in. Then they write down which AI tools are approved for which meetings, and give staff an approved option, so people aren't tempted to sign up for a bot on their own. A tool that runs on the staff member's computer, with no bot and no calendar access, never shows up in the meeting to begin with.
Meetily runs on Windows and Mac. Linux users can build it from the open-source code today, and a Linux installer is in development. Meetily Enterprise can run on the institution's own servers, and IT can install the app silently on staff computers.
Get started

Ready to try Meetily?

Join 599,000+ users who use Meetily for private meeting transcription. No bots, privacy first. Community Edition free.

No meeting bots
100% local transcription
Free & open source
Download Free

Star on GitHub (31K+) · Open source & self-hostable

Get Started with Meetily

Meetily Pro

Advanced features for individuals and teams.

Download

Get Meetily for Mac or Windows. Free and open source.

Download
Star on GitHub (31K+)

Recent Articles

Under the EU AI Act, a meeting tool's risk depends on how you use it: summarizing calls is not high-risk, scoring employees is high-risk from December 2027, reading emotions at work is banned since February 2025, and EN 18286 is the first standard
Privacy & Security

Your Meeting Tool's Risk Level Under the EU AI Act Isn't Set by the Vendor. It's Set by You.

The EU AI Act's four risk categories cover uses, not products. The same meeting tool can be low-risk, high-risk or banned. Plus the 2027 timeline and EN 18286.

Cover: Record a Teams meeting without a bot. Record and transcribe on your own computer.
Guides

How to Record and Transcribe a Teams Meeting Without a Bot

Record and transcribe a Teams meeting with Teams itself, or on your laptop with a free, open-source app. No bot joins. Tell people first.

Cover reading Why We Built Meetily - a note from our CEO - with first commit December 2024, no bot joining the call, on-device by default, and MIT open source
Build in Public

Why We Built Meetily When Every Meeting Tool Already Existed

A client told us they weren't comfortable with a bot in the meeting. We looked for a tool that kept the audio on our own machines, found none, and built one.