Viva

How Viva handles student data

Viva by NYU Stern runs oral exams with a voice examiner and grades them with a council of language models. This page says what student data Viva holds, which services receive it, how long it is kept, and how it is deleted. Vendor terms were last read on 8 November 2026.

What Viva holds

  • The roster: each student's Net ID, name, email address, student ID and assigned topics.
  • For each attempt: the transcript, Viva's copy of the call recording with its turn timings, ElevenLabs' own record of each call (its transcript, analysis and charge), the grade with each council member's scores, the feedback, the instructor's review, when the results were released, and the safeguarding check's result.
  • Calls that no current exam holds, copied whole from ElevenLabs before they were deleted there: those from before each student had their own examiner (the fall 2025 final, November and December 2025), the calls members of the public made to that examiner's open demonstration (December 2025 to September 2026), from exams since deleted, and from demonstrations.
  • The exam itself: its topics, rubric, materials and exhibits, and any submission imported for one student.
  • Instructor accounts: name, email address and sign-ins; their conversations with the assistant and the files uploaded to it.
  • For each demo call from the front page, its transcript and grade, for the period under Demo calls, then an anonymized copy; never a recording.
  • A record of what each call and grading run cost, by exam.
  • An audit log of who opened, changed, exported or deleted student records.
  • Application logs, kept 365 days. They name a student by a keyed reference, not the Net ID; lines written before November 2026 can still carry Net IDs until they age out.

Viva's records are stored in Google Cloud's us-central1 region (Iowa, United States).

What never goes to the examiner or the graders

The student's Net ID, email address and student ID are never sent to ElevenLabs or to a grading model. ElevenLabs gets the student's first name, so the examiner can greet them. The grading council and the safeguarding check get the transcript with every roster student's name and identifiers removed, and each prompt is checked for them before it is sent. A student who says their Net ID aloud discloses it in the conversation itself.

The instructor's assistant is different: it reads what the instructor asks it to, the roster and a student's transcript included, and sends that to Anthropic as it is.

Who receives what

ElevenLabs

Runs the voice examiner the student talks to.

Receives:

  • The student's voice during the exam, and what the student and the examiner say
  • The student's first name, so the examiner can greet them
  • The exam's topics, its rubric's dimensions (what the examiner probes), the examiner's instructions and the exhibits shown in the exam, which can include a submission imported for one student

By feature:

  • Setting up each student's examiner: the exam's name, description, topics and examiner instructions; the exhibits shown in the exam, which can include a submission imported for one student; the exam's rubric; the student's first name; an opaque reference to the student (never the Net ID).
  • The exam call, from the student's browser: the student's voice; what the student and the examiner say; the student's first name; an opaque reference to the student (never the Net ID).
  • A demo call from Viva's front page, which no student takes (see Demo calls): a demo visitor's voice; what the visitor and the examiner say; the ids of calls, examiners and files, to read or delete them.
  • Copying each call and deleting it, and the account's credit balance: the ids of calls, examiners and files, to read or delete them.

Kept: Viva deletes each call from ElevenLabs once the attempt is graded and Viva holds its own copy, and deletes the student's examiner once nothing of theirs is left on it. Examiners created since 6 November 2026 keep a call 30 days at most. ElevenLabs keeps deleted data in its backups for up to 30 days. Its terms let it use customer content to improve its models unless the account opts out; Viva's account opted out on 8 November 2026, which does not reach calls made before then.

Terms of service · Data processing addendum

Anthropic (Claude)

The examiner's language model, reached through ElevenLabs; a member and the chair of the grading council; the safeguarding check; the instructor's assistant; and drafting topics and rubrics.

Receives:

  • The exam conversation, as the examiner's language model
  • Transcripts with the student's Net ID, email address and student ID and every classmate's removed, for grading and the safeguarding check
  • The exam's rubric and content
  • The exhibits the examiner had, which can include a submission imported for one student
  • As a council member and the chair, the other members' scores and comments
  • The instructor's conversations with the assistant, and what its tools read for them: the roster (Net IDs, names, email addresses and student IDs), a student's whole transcript, unredacted, and their grades and feedback
  • The files instructors upload to the assistant and the web pages it reads for them, and the sources they draft topics and rubrics from (their uploads and the text of web pages they name)

By feature:

  • The examiner's language model, reached through ElevenLabs: what the student and the examiner say; the exam's name, description, topics and examiner instructions; the exhibits shown in the exam, which can include a submission imported for one student; the exam's rubric; the student's first name.
  • Grading council member and chair: the transcript, with every roster student's name and identifiers removed (JB9); the exam's rubric; the exhibits shown in the exam, which can include a submission imported for one student; grades and feedback (for the council, each other member's scores and comments).
  • The safeguarding check: the transcript, with every roster student's name and identifiers removed (JB9).
  • The instructor's assistant: the instructor's messages; files the instructor uploads, which can hold anything they contain; the text of web pages the instructor points it to; the exam's name, description, topics and examiner instructions; the exam's rubric; the exhibits shown in the exam, which can include a submission imported for one student; the student's whole transcript, as stored; grades and feedback (for the council, each other member's scores and comments); the student's Net ID; the student's full name; the student's first name; the student's email address; the student's university ID number.
  • Files uploaded to the assistant: files the instructor uploads, which can hold anything they contain.
  • Deleting those files: the ids of calls, examiners and files, to read or delete them.
  • Drafting topics and rubrics, and describing exhibit images: the exam's name, description, topics and examiner instructions; the exam's rubric; the exhibits shown in the exam, which can include a submission imported for one student; files the instructor uploads, which can hold anything they contain; the text of web pages the instructor points it to.
  • A rehearsal's prepared student, in an instructor's test of their own exam (no student takes part): the exam's name, description, topics and examiner instructions; the exhibits shown in the exam, which can include a submission imported for one student; the exam's rubric.

Kept: Anthropic's commercial terms say it does not train its models on API inputs and outputs. It deletes them within 30 days, or keeps them up to two years when its safety systems flag a request as breaking its usage policy. Files uploaded to the assistant are deleted when their conversation, or the exam they were used for, is deleted.

Commercial terms · Data processing addendum

OpenAI (GPT)

A member of the grading council.

Receives:

  • Transcripts with the student's Net ID, email address and student ID and every classmate's removed
  • The exam's rubric
  • The exhibits the examiner had, which can include a submission imported for one student
  • The other council members' scores and comments on the same transcript, in deliberation

By feature:

  • Grading council member: the transcript, with every roster student's name and identifiers removed (JB9); the exam's rubric; the exhibits shown in the exam, which can include a submission imported for one student; grades and feedback (for the council, each other member's scores and comments).

Kept: OpenAI's business terms say it does not train its models on API inputs and outputs; its abuse-monitoring logs keep them up to 30 days.

Services agreement · Data processing addendum

Google (Gemini API)

A member of the grading council.

Receives:

  • Transcripts with the student's Net ID, email address and student ID and every classmate's removed
  • The exam's rubric
  • The exhibits the examiner had, which can include a submission imported for one student
  • The other council members' scores and comments on the same transcript, in deliberation

By feature:

  • Grading council member: the transcript, with every roster student's name and identifiers removed (JB9); the exam's rubric; the exhibits shown in the exam, which can include a submission imported for one student; grades and feedback (for the council, each other member's scores and comments).

Kept: Viva's key belongs to a Google Cloud project with an active billing account, which Google's Gemini API terms treat as a paid service: Google does not use its prompts or responses to improve its products. It keeps them up to 55 days for abuse monitoring.

Gemini API additional terms

Postmark

Sends Viva's emails: the ones instructors send to students, the results links students ask for, instructors' sign-in links, and the notice to an exam's owner before its student data is deleted.

Receives:

  • Student email addresses and names
  • The student's personal exam link, and the link to their results
  • The exam's id and an opaque reference to the student, to trace a message (never the Net ID)
  • On the emails an instructor sends students, the instructor's name and the reply-to address they set
  • Instructors' email addresses, with their one-time sign-in links and the notice naming the exam whose student data is to be deleted

By feature:

  • Emails to students: the links instructors send, and the results links students ask for: the student's email address; the student's full name; the student's personal exam link or results link; an opaque reference to the student (never the Net ID); the exam's name, description, topics and examiner instructions; the instructor's name; the instructor's email address.
  • Sign-in links instructors ask for: the instructor's email address; a one-time link that signs the instructor in.
  • The notice to an exam's owner before its student data is deleted: the instructor's email address; the exam's name, description, topics and examiner instructions.

Kept: Postmark keeps sent messages 45 days by default. Viva turns its open and link tracking off.

Terms of service · Data processing addendum

Google Cloud

Hosts Viva and stores its records, and signs instructors in.

Receives:

  • Everything Viva holds, listed below

By feature:

  • Hosting and storage: every record listed under What Viva holds.

Kept: Viva's records are stored in Google Cloud's us-central1 region (Iowa, United States). A deleted file is kept 7 days before it is gone, and the database keeps an earlier version of a record for one hour.

Cloud data processing addendum

Who can see it

  • Instructors see the exams they own or co-own, and nothing else.
  • A student opens their exam with the personal link their instructor sends. There is no student sign-in: the link is the student's access, so it should not be shared.
  • A student's results open from a link sent to their email address, which works once and then for 24 hours in that browser, and only after the instructor releases them. There the student can read their transcript and hear their recording.
  • Viva's operator at NYU Stern can reach every record, for support and operations.

How long it is kept, and how it is deleted

  • Each exam shows the date its student records are kept until: 365 days after its last activity, or later if the instructor extends it. Deletion at that date is not automatic yet; until it is, records are kept until an instructor deletes them.
  • An instructor can delete a student's session or the whole exam. That deletes the student's transcripts, recordings, grades, feedback and reviews from Viva, removes the assistant's replies that quoted them, and, with the exam, the files uploaded to the assistant for it.
  • Before student records are deleted, Viva keeps an anonymized copy of each attempt, for debugging, benchmarks and quality assurance. It holds the transcript with the name, Net ID, email address and student ID of every student on the roster removed, and email addresses, phone numbers, links, ID numbers and exact dates removed wherever they appear, with the rubric and topics, the grades and feedback, and the month of the exam. A name of someone not on the roster, such as a student's supervisor, is not recognized and can remain. The copy never holds the audio, the exam's name or course, or the instructor. Nothing maps a copy back to an exam, a session or a student, and an exam with fewer than five attempts leaves none. An institution whose agreement does not allow the copy can have it turned off for its exams.
  • Viva keeps a record of what each call and grading run cost, by exam, after a deletion, without the student's Net ID.
  • An instructor's account is deleted on request, with the exams it owns (each keeping its anonymized copy) and its conversations with the assistant. Viva keeps how many students the account added, filed under a keyed hash of each sign-in it proved (its email address, its Google or Microsoft account) rather than the sign-in itself, so its usage limits stay with the person.
  • The calls Viva holds that no current exam does are reached by no exam's deletion and no 365-day date. They are kept until Viva sets a period for them.
  • A deleted file in Viva's storage is kept 7 days before it is gone.

Demo calls from the front page

Anyone can try a short demo exam from Viva's front page without signing in. A demo is no course's exam: its calls are kept apart from every class's records. The demos are for adults, their cases are fictional, and the page asks visitors not to share personal details.

  • The call goes to ElevenLabs, which runs the examiner with Claude, by Anthropic, as its language model. The transcript then goes to the grading council (Anthropic, OpenAI and Google) for the grade the visitor sees.
  • Viva keeps the transcript and the grade for 30 days, to show the visitor their results, to look into misuse and to improve the examiner, and a daily sweep then deletes them. Viva keeps no recording of a demo call.
  • Before it deletes them, Viva keeps an anonymized copy of the call, for quality assurance and to improve Viva: the transcript and the grade with email addresses, phone numbers, links, long numbers, dates finer than the month, and a name the visitor gives (after "my name is", "I'm" or "call me") taken out, with the demo it came from and the month. It holds nothing that leads to the visitor, their cookie or their address. A name said any other way can remain, which is why the demo page asks visitors not to share personal details. The copies are kept apart from Viva's other records, with the anonymized copies of exam attempts.
  • ElevenLabs' copy of the call is deleted once the call is graded, and after 30 days if it is not. ElevenLabs keeps deleted data in its backups for up to 30 days.
  • The results open from a link the demo page gives the visitor when the call ends. Whoever holds the link can open them, for 30 days.
  • The demo page sets one cookie, viva_demo_visitor: a random value, kept a year, that lets Viva count the demos a browser starts. Viva stores a keyed hash of it, and of the visitor's internet address, for the current day only, to hold each visitor to a few demos a day and to count how many visitors each demo had; the next day keeps only the counts.
  • Viva keeps what each demo call and its grading cost, naming no visitor. As for every page, Google Cloud's request logs, kept 365 days, record each request with the internet address it came from.

Requests and questions

For a request to inspect a student's records, the instructor can download everything Viva holds about that student on an exam from the student's page. Students should ask their instructor first. For anything else on this page, write to ipeirotis@gmail.com. What Viva collects about instructors and visitors, and the cookies it sets, are in the privacy notice.