Privacy Policy

1. Our Commitment to Privacy

At Grade Orbit, we take data privacy seriously. This Privacy Policy explains how we handle your data. We operate two distinct tiers with different postures:

• Solo / individual teacher tier: we do not handle student personal data. Student work is redacted in your browser before upload; we are a “Service Provider” under a PII-Free Zone architecture.
• School tier: under our Article 28 Data Processing Agreement, which forms part of our Terms, we act as a Processor for the school. The school remains the Controller. We process real student names, uploaded student work, and the outputs of marking and AI-detection checks under the DPA, with strict tenant isolation and explicit retention controls. Where a school chooses to give pupils their own logins, we also process pupil email addresses so those pupils can sign in to view their own marked work. Uploaded work is retained so teachers can return to a student’s results, then deleted automatically once a run’s retention window passes or when the school account is closed. If a school’s free trial ends and it never subscribes, we delete all of its data 90 days after the trial ended, warning the school’s owner and admins 14 days and 3 days beforehand. See our Transparency Pack for the full school-tier breakdown.

2. Student Data & PII Protection

For the Solo / individual teacher tier, to ensure compliance with GDPR and UK GDPR:

• Client-Side Redaction: All redaction of student names, IDs, and signatures happens entirely within your browser. The unredacted image never leaves your device.
• Anonymous Data Transfer: Only anonymous, redacted data is sent to our servers and AI providers (Google Gemini). Students are identified only by generic placeholders (e.g., “Student 1”) or your own local reference systems that we cannot decrypt.

3. Data We Collect

We collect only the minimum data necessary to provide our service to you (the teacher/school):

• Account Information: Your email address and encrypted password.
• Google Profile Picture: If you sign in with Google, we show the profile picture from your Google account to you, to colleagues in your team or school, and to GradeOrbit staff when providing support. We use the link Google gives us when you sign in; we never copy the picture itself. Pupil accounts never show one. To change or remove it, change your Google account’s picture.
• Payment & Referral Records (Individual accounts): Card payments are processed by Stripe, and your card number never reaches us. We keep a record of each payment (amount, date and plan) and a card fingerprint — a code Stripe creates that recognises a card without revealing its number. If you joined through someone’s referral link, we also record who referred you. We use the fingerprint and referral link only to pay referral credits and to prevent the scheme being misused (for example, the same card paying for several referred accounts), on the basis of our legitimate interest in preventing fraud.
• Usage Data: Anonymous statistics about feature usage to help us improve the platform (handled via our Cookie Policy).
• Content: The grading criteria, exam board specifications, and reference texts you upload to configure the AI.
• Lesson planning content: Schemes of work, lesson ideas, and generated lesson PowerPoints are your own teaching material, not student data. We store them with your account so you can return to them; they are deleted when your account is deleted (for schools: when the school’s account closes). Please don’t include student personal information in them — lesson planning sits outside the redaction flow.
• Redacted Student Work (Solo / Team): The anonymous image data and text transcriptions generated after you have performed redaction in your browser.
• Marking Quality Feedback (Solo / Team): When you choose to rate an AI marking result (“Was this mark right?”), we store only your verdict, optional short comment, and the model used alongside the assessment reference to monitor marking quality. We never store student work, student names, or transcriptions in feedback records.
• School Student Work & Results (School tier): For schools on a Data Processing Agreement, the un-redacted student work uploaded for marking or AI-detection, the real student names (and optional nicknames) it is matched to, and everything we generate from it — the transcription of the work, AI and teacher feedback, grades, on-page annotations, and AI-detection results. This is stored as a Processor for the active life of the assessment run and then for the school’s chosen retention window, and is deleted automatically once that window passes or when the school account is closed. For a school that trials GradeOrbit and never subscribes, everything is deleted 90 days after its trial ends.
• School Topic Lists (School tier): When a department uploads its scheme of work or personal learning checklist, we keep the file as uploaded, including any pupil names or marks it holds, so the department can download or edit it. Only the topic columns it chooses are used for marking, and our AI sees only a few rows of the file, with pupil columns removed. The file is kept until the department replaces or deletes the list, or the school account is closed.
• School Calibration Scripts (School tier): When a teacher uses calibration, the scripts they upload are marked like any other school work. Each script is labelled with the pupil’s name so the teacher can pair it with their marked copy, but it is never added to the pupil’s record, never shown to pupils, and kept out of class results. To suggest that name, we read the script’s cover page against the class list; the text we read is not kept, only the label the teacher chooses. The label is replaced with a script number when the set is archived, and is deleted with the set, including when the school’s account is closed. The teacher’s hand-marked copies are kept only until the teacher confirms the marks we read from them, then deleted; we keep the confirmed marks and comments, under the same retention window. What calibration learns from them is grading guidance only, never pupil content.
• School Pupil Logins & Email (School tier): Where a school chooses to give pupils access to their own marked work, we collect each pupil’s email address (supplied by the school — typed in or imported from a spreadsheet) and create a login for them. The pupil sets their own password, which is stored only as a securely hashed value — we never see or keep the password itself. We send a pupil two kinds of message: a one-time “set your password” email and a “your result is ready” notification when a teacher shares feedback. Grades and feedback are never included in these emails — they are shown only after the pupil signs in, and a pupil can only ever see their own approved results, never another pupil’s. Pupils are never sent marketing of any kind. Pupils cannot use any AI feature themselves.
• Operational Logs: To maintain and improve service quality, GradeOrbit keeps a short-term technical log of each AI request. Logs are retained for up to 30 days, used solely for debugging and service improvement, and accessible only to GradeOrbit staff. No student images are stored in these logs. For Solo and Team accounts, the log of any request that involves student work (marking, feedback, spelling checks and the Teaching Assistant) records only usage details — the AI model used, timings, token counts and whether the request succeeded — and never the student work, its transcription, or the grades and feedback generated from it. The one addition is the Teaching Assistant: its log also keeps the messages you type to it (never its replies), to show us where teachers need help. Please don’t type a pupil’s name into it. Logs of requests about your own materials, such as reading a mark scheme you upload, may include that material. So that a marking result can still reach you if your connection drops, a copy of it is held for up to 30 minutes and then deleted. For School accounts, logs may also include the AI-generated outputs (grades, feedback and transcriptions), under the school’s Data Processing Agreement.
• Team Membership & Usage (Teams only): Where you join a Team, the Team Owner can see the email address of every member of their team and per-member credit usage statistics (credits consumed, marking and AI-detection counts, and a recent transaction history). Team Owners cannot see the content of any student work or AI outputs — only aggregate usage figures. Each team’s data is isolated from other teams via database row-level security.
• Joining your school (individual accounts): If your verified email address is on the domain of a school that has a GradeOrbit school account, we may show you that school’s name on your dashboard. Only if you choose to request access do we share your email address with that school’s GradeOrbit owners and admins, so they can invite you. We never tell a school that you use GradeOrbit unless you ask.

3a. Marketing Emails

Marketing emails — product updates, tips, and activity-based reminders — are sent only to users who have explicitly opted in. You can choose to opt in at signup, and you can change your choice at any time from Account → Email Preferences. Not opting in does not affect transactional emails such as welcome messages, password resets, or billing notifications — we still need to send those to operate the service.

4. Your Roles & Responsibilities

In every tier, you (the teacher or the school) are the Data Controller and are responsible for having a lawful basis to process student work. Our role depends on your tier:

Solo / Team: Grade Orbit acts as a Service Provider. Because student work is redacted in your browser before it reaches us, we provide the tools to process data but do not see or hold the underlying student personal data.

School: Under our Data Processing Agreement, which forms part of our Terms, Grade Orbit acts as your Data Processor. The school remains the Controller; we process real student names, student work, pupil email addresses, and the results strictly on the school’s documented instructions and only for the purposes set out in the DPA.