Data Processing Agreement

Roles & scope

The institution (or instructor) is the controller of student assessment data; GradeLogic™ is the processor. The DPA covers all assessment content processed through paid cloud operations. Most student data never leaves the controller's browser and is therefore outside the processing scope entirely.

Purpose limitation

GradeLogic™ processes data only on the controller's documented instructions and solely to provide the requested service. We do not use assessment content for advertising, for indefinite analytics, or to train AI models, and we do not re-disclose it.

Confidentiality & security

Personnel are bound by confidentiality obligations. We maintain technical and organizational measures appropriate to the risk, including encryption in transit and restricted, content-free logging. See our Security Overview. We notify the controller without undue delay after becoming aware of a personal-data breach.

Subprocessors

We engage the subprocessors listed on our Subprocessor List, impose equivalent data-protection obligations on them, and remain responsible for their performance. We give notice of changes so the controller may object.

Assistance & rights

We assist the controller, taking into account the nature of processing, in responding to data subject (and, where applicable, parent/eligible-student) requests and in meeting security, breach-notification, and assessment obligations.

Retention & deletion

GradeLogic does not create a persistent server-side copy of approved assessment payloads or AI results. Redacted payloads are processed only to complete the requested operation and return its result. On termination, we delete or return remaining controller data except where retention is legally required, such as billing, credit-ledger, attestation, and operation-usage records.

FERPA addendum

For institutions subject to FERPA, the DPA includes terms under which GradeLogic™:

• acts as a "school official" with a legitimate educational interest, under the institution's direct control;
• uses education records only to perform the contracted service;
• does not re-disclose education records except as permitted by FERPA and authorized by the institution;
• does not use education records to train AI models or for any unrelated purpose;
• returns or destroys education records on the institution's request.

See the FERPA Support Overview for context.

How to execute

To request the executable DPA for signature, contact privacy@gradelogic.ai with your institution's details.