1. Who we are and our role

GradeOptics (“GradeOptics,” “we,” “us”) provides an AI-assisted grading service for instructors at schools, colleges, and universities at gradeoptics.com (the “Service”). This policy applies to instructors, the graders and teaching assistants they invite, and students whose work is graded with the Service.

For course records and student work, we act on behalf of the school or instructor who uploads them (“the institution”). The institution decides what is uploaded and why; we process it only to provide the Service to them. In privacy-law terms, the institution is the controller or “business,” and we are its processor or “service provider.”

For account information and for running and securing the Service, we decide how information is used, as described below.

2. Information we collect

• Account information. Your name, email address, and sign-in details, handled by our sign-in provider, Clerk. If you sign in with another account, such as Google, we receive your name and email address from it.
• Course information. Course names, numbers, terms, descriptions, entry codes, and who teaches and grades each course.
• Rosters. Student names, student ID numbers, and email addresses that an instructor enters or uploads.
• Learning management system connections. When a school connects GradeOptics to its learning management system (such as Canvas or Moodle): the school’s install details; for each person who opens GradeOptics from it, their LMS user ID, name, email address, role in the course, and, where the school shares it, their student ID; and the course’s roster from the LMS, with the same details for each member.
• Assignment materials. Question papers, answer keys, rubrics, and the outline of each assignment.
• Student work. Scanned exams and uploaded files, every page as uploaded, and the text read from them.
• Grades and feedback. Suggested marks and their reasons, changes and approvals by instructors and graders, notes on scans, regrade requests and replies, published grades, and a record of who did each piece of work: the AI, the instructor, or a named grader.
• Licenses and payments. For a school’s or department’s license: the buyer, its billing contact’s name and email address, the purchase order number, the term, the students and price agreed, and the professors it covers, each by email address with a name and their number of students for the term; and, for each professor, the students and AI use counted against it. Invoices go to the billing contact through Stripe. If seats are bought for a course, a record of each purchase: who bought them, for which course, how many, the amount, and Stripe’s reference. Payment details are entered on Stripe’s pages and go to Stripe; we never receive or store them.
• Usage and technical information. For each AI request, the model, the amount of text processed, the outcome, and the time taken, without any student work. Our server logs record events with counts and timings only; they do not record student work or error messages that could quote it. When something fails, an error report goes to Sentry: the kind of error, where in our code it happened, the page’s address with every identifier removed, and the browser and system type. Quoted text, email addresses, form contents, cookies, and sign-in details are removed before a report leaves our servers or your browser. Our hosting and sign-in providers also process standard request details, such as IP addresses and browser type, to deliver and protect the Service.
• Requests for access. When you ask for access on our Request access page: your name, school email address, school, course, about how many students take it, your next exam date if you give one, and any note. We use them only to answer your request: to confirm by email that it reached us, to decide on it, to send your invitation, and to write to you about it.
• Messages you send us, for example to support@gradeoptics.com.

We do not use advertising trackers or collect precise location, and we never receive your card details. We count visits to our pages with Plausible Analytics, which uses no cookies and stores no information that identifies you; see Cookies, local storage, and visit counts.

3. How we use information

• To provide the Service: set up assignments from their papers, separate scans into students, read answers, suggest marks, and show results to instructors, graders, and, once published, to each student.
• To operate and protect it: enforce usage limits, prevent abuse, find and fix failures, and keep backups.
• To bill for it: count each professor’s students and AI use against their license, tell them where they stand, and send invoices, take payments, and give refunds through Stripe.
• To communicate: invitations sent at an instructor’s request; an email to each student, at their roster address, when an instructor publishes grades and chooses to tell the class (it links to the graded exam and never contains the score); notices about the Service or your account; and replies to your requests.
• To improve it, using usage figures such as counts, timings, and kinds of errors.
• To meet legal obligations.

We do not sell or rent personal information, share it for targeted advertising, or use it to build profiles of students. We do not use student work or rosters to train AI models. We look at the contents of a course only when you ask us for help with it, when needed to keep the Service secure, or when the law requires it.

4. How AI is used

Reading scans and suggesting marks are done by an AI model from a provider chosen in the Service’s settings, currently Anthropic or OpenAI. To do that work, the Service sends the provider:

• the question paper and answer key, to outline the assignment and write any missing answers;
• each student’s scanned pages, including the name and ID box, to read the answers and match the roster;
• the answers read, with the questions, answer key, and rubric, and a picture of the answer’s box when an answer includes a drawing, to suggest marks;
• a question’s answers across the class, to group similar answers; and
• answers an instructor has already approved on the same assignment, without names or IDs, as marked examples.

The providers process this under their commercial terms, which do not allow them to train their models on it. They may keep it for a limited time for abuse and safety monitoring under their own policies.

AI output is a suggestion. Every grade stays provisional until an instructor or grader approves it, instructors can change any mark, and students can ask for a regrade. The Service never approves a grade by itself, so final grades are decisions made by people.

5. How we share information

• Within a course. Instructors and graders see the course’s roster, submissions, and grades. Students see only their own exam and their published grades.
• With service providers who handle information on our behalf, listed below. They may use it only to provide their services to us.
• For legal reasons, when required by law or legal process, or to protect the safety and rights of people or the Service. For student records, we notify the institution first where the law allows.
• In a business transfer, such as a merger or sale of assets, under this policy’s protections and with notice to you.
• With the institution’s learning management system, when an instructor connects their course: each student’s published grade, with each question’s points and a link to their graded exam, goes to the course’s gradebook there. Nothing is sent before the instructor publishes the grades.
• At the institution’s direction or with your consent.

6. Student records and FERPA

When a school or its instructors in the United States use the Service, we act as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA). That means we:

• perform a service the school would otherwise use its own staff for;
• are under the school’s direct control in how we use and keep its education records;
• use education records only to provide the Service to the school; and
• do not disclose them to anyone else, except our service providers to run the Service, or as the school directs or the law requires.

Students and parents who want to see or correct education records should contact the school, and we will help it respond. Schools that need a data privacy agreement can write to support@gradeoptics.com.

7. How long we keep information

• We keep course information for as long as the instructor keeps it in the Service.
• Instructors can delete a course or an assignment with everything in it, one student’s submission, or an uploaded file at any time. Records are removed at once, and files normally within minutes.
• You can delete your account yourself from Your account in the account menu, or email support@gradeoptics.com and we delete it within 30 days. It removes your sign-in, every course you own with everything in it, and your access to other courses at once. A student’s exams and grades stay with their course, because the school keeps those records, and grading work done in someone else’s course stays with that course under your name. When an institution stops using the Service, we delete its information within 30 days of its request.
• We keep a request for access after answering it, so we know who asked and what we replied, and delete it 90 days after the answer. Email support@gradeoptics.com and we delete it sooner, within 30 days.
• A homework upload that was never submitted, and can no longer be, is deleted 30 days after it was uploaded. Submitted work stays with the course.
• Deleted information can remain in our daily backups for up to 14 days, after which it is gone.
• We keep usage records (the model, amount processed, outcome, and time of each AI request, with no student work) after deletion, to enforce usage limits and run the Service.
• We keep licenses, invoices, and records of purchases and refunds after a course or account is deleted: a license is the school’s agreement and names its professors by email, and tax and accounting law requires the rest. They hold no student work.
• AI providers keep what they receive only for the limited time their policies allow. Files you exported are yours and are not affected.

8. Security

All traffic uses HTTPS. Every page and file checks who is asking, so people see only the courses they belong to. Files are served through short-lived signed links that also require signing in, and accounts are created by invitation only. Information is stored in Ashburn, Virginia, in the United States, on encrypted disks.

No system is perfectly secure. If a breach affects your information, we will notify the affected institutions and people as the law requires, without undue delay. To report a security problem, email support@gradeoptics.com.

9. Your rights and choices

Depending on where you live, including California, other US states, the European Union, and the United Kingdom, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict some uses of it. We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of.

• Everyone with an account: download a copy of your information, or delete your account, yourself from Your account in the account menu. The download is a ZIP file with a README that explains each file.
• Students: your records in the Service belong to your course, so ask your instructor or school about anything else. You can also write to us and we will help them respond.
• Instructors and graders: for anything else, email support@gradeoptics.com. We will confirm who you are and answer within 30 days.

We will not treat you differently for using these rights. Where the GDPR applies, we rely on performing our contract with the institution, on our legitimate interest in keeping the Service secure and working, and on legal obligations. You may also complain to your local data protection authority.

10. Cookies, local storage, and visit counts

We use only the cookies needed to keep you signed in securely, set by Clerk. There are no advertising or analytics cookies. When an invoice is paid, Stripe’s payment page, on Stripe’s own site, uses Stripe’s cookies to take the payment and prevent fraud. While files upload, your browser’s local storage keeps their names so that an interrupted upload can be picked up again; that stays on your device.

To learn how the Service is used, we count visits with Plausible Analytics, which sets no cookies and stores nothing on your device. For each page viewed it receives the page’s address, with every course, assignment, student, and invitation identifier removed first, the site you came from, and your browser, device type, and country. It also counts a few actions, such as a course being created, scans being added, or grades being published, without who did them or what they contained. Plausible tells visitors apart only within a day, with a code it cannot link from one day to the next, and stores no IP address. We see only totals.

11. Children

The Service is made for higher education and is not directed to children under 13. If a school uses it with students under 13, the school is responsible for any notice and consent the law requires. If you believe we hold information about a child under 13 without that consent, email support@gradeoptics.com and we will delete it.

12. Where information is processed

We store the Service’s information in Ashburn, Virginia, in the United States. Our providers may process it in the United States and other countries where they operate. Where the law requires it for information from outside the United States, we rely on safeguards such as the standard contractual clauses our providers offer.

13. Changes to this policy

When we update this policy, we change the date at the top. Before a material change takes effect, we will tell instructors by email or in the Service.

14. Contact

Questions or requests: support@gradeoptics.com. GradeOptics, Michigan, United States. Use of the Service is also governed by our Terms of Service.