Privacy Policy

What we process

Account data (your Google profile basics), subscription and billing data (via Stripe), and — only when you explicitly authorize cloud processing — the redacted exam artifacts needed for an AI operation. The required payload is sent for synchronous processing and the result is returned in the same request.

Local-first architecture

Student identities, rosters, original exam files, identity mappings, and accepted grading records remain in your browser's storage (IndexedDB). Before any cloud processing you review a local preview of redacted or excluded regions and explicitly authorize the transfer. We do not maintain a permanent repository of assessment content.

See our FERPA Support Overview and Privacy & security page for how this supports your education-privacy obligations.

How we use data

To authenticate you, run the AI operations you request, meter Grading Credits, and provide support. We do not use assessment content for advertising or indefinite analytics, and we do not sell personal data. See our Responsible AI Policy for how AI is applied.

Processors we use

We rely on a small set of subprocessors, each processing data only to provide its function. The current list is maintained on our Subprocessor List.

Retention

GradeLogic does not create a persistent server-side copy of assessment payloads or AI results. Redacted payloads are processed only to complete the requested operation and return its result. Billing, credit-ledger, attestation, and operation-usage records are retained as required for service operation, security, accounting, and legal compliance; they do not contain the uploaded assessment content.

Your rights

Subject to applicable law (including GDPR and CCPA), you may request access, correction, export, or deletion of your account data. Deleting your account soft-deletes the billing record and clears your session; locally-stored exam data is removed from your device by you. See our GDPR Support Overview for details.

Security & transfers

Transport is encrypted (HTTPS). Where data is processed outside your region, appropriate safeguards apply. For more, see our Security Overview.

Contact