GradeThis.ai
Legal
This policy explains what information GradeThis.ai collects, how we use it, who we share it with, and the choices and rights you have.
Last updated: June 17, 2026
GradeThis.ai is operated by GradeThis, Inc. ("GradeThis", "we", "us"). This Privacy Policy describes how we handle personal information when you use our AI-assisted grading platform. It applies to educators, institutional users, and the student work processed through the service. For institutional deployments, the institution is the controller of student educational records and GradeThis acts as a service provider/processor on its behalf.
We collect: • Account data — name, email address, password or OAuth profile information (for example from Google sign-in), and role. • Institutional and roster data — institutions, departments, courses, sections, and student records such as names, identifiers, and email addresses. • Student work and grading data — uploaded submissions (including scans and PDFs of handwritten work), extracted (OCR) text, rubrics, grades, rationales, revisions, and reviewer notes. • Billing data — subscription and payment identifiers processed by Stripe; we do not store raw payment card numbers. • Usage and device telemetry — log data, performance, and session information collected through our observability tools.
We use information to: provide and operate the grading service, including OCR, rubric application, AI-assisted grading, and feedback; manage accounts, organizations, and permissions; process billing and credits; provide support; maintain security and prevent abuse; and comply with legal obligations. We use student data only to provide the service to the relevant educator or institution.
To perform AI-assisted grading, OCR, and related operations, content you submit (which may include student work) is processed by third-party large language model and AI providers, which may include Anthropic, OpenAI, Google (AI Studio and Vertex AI), Microsoft Azure OpenAI, Amazon Bedrock, and OpenRouter. These providers process data under their own terms and on our instructions to return results to you. We work to limit processing to what is necessary to provide the service and do not authorize these providers to use student submissions to train their general models except where permitted by you or your institution.
We also rely on service providers to operate GradeThis, including: Google (OAuth sign-in); Resend and Postal (transactional email); Twilio (SMS where applicable); Stripe (payments); Google Ads (advertising measurement and conversion tracking on our public pages); object storage for uploaded files; and Grafana, Prometheus, and OpenTelemetry-based tooling for observability. Most of these providers process data on our behalf under contractual confidentiality and security obligations; Google Ads is described further in the Cookies and Tracking section below.
Children under 13 may use GradeThis only with verifiable written consent from a parent or guardian, consistent with the U.S. Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from a child under 13 without that consent. If we learn that we have collected personal information from a child under 13 without appropriate consent, we will delete it. Parents, guardians, or institutions can contact us at [email protected] with any concerns, or to review, manage, or revoke their consent.
GradeThis is committed to compliance with the U.S. Family Educational Rights and Privacy Act (FERPA). When we process student education records for an institution, we do so under the FERPA "school official" exception: FERPA permits a school to disclose education records, without separate consent, to a third party performing an institutional service or function for which the school would otherwise use its own employees — and grading is exactly such a legitimate educational function. GradeThis uses student education records only to provide grading services to the institution, does not use them for any other purpose, and operates under the direct control of, and subject to the direction of, the institution.
We retain personal information for as long as your account or your institution's account is active and as needed to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. Institutions may request deletion or export of their data, and we honor verified deletion requests subject to legal and contractual retention requirements.
Depending on your location and role, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at [email protected]. Where the data is student education records held for an institution, we will direct your request to that institution, which controls those records.
If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect, to request access and deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information for monetary consideration. However, because we use Google Ads advertising and conversion tools on our public pages, our use of those tools may be considered a "sale" or "sharing" of certain identifiers for cross-context behavioral advertising under California law. If you are a California resident and wish to opt out, contact us at [email protected]. We will not discriminate against you for exercising these rights. Residents of other U.S. states with comparable privacy laws (such as Virginia, Colorado, and Connecticut) may have similar rights.
GradeThis is operated from the United States, and information we process is stored and processed in the United States and by the AI and service providers described above. If you use GradeThis from outside the United States, you consent to the transfer of your information to the United States and other countries that may have different data-protection laws than your own. We aim to honor the data-protection rights available under applicable laws, including the EU/UK GDPR and the data-protection laws of the Gulf region — including the Saudi Personal Data Protection Law (PDPL), the UAE Personal Data Protection Law, Qatar's Personal Data Privacy Protection Law, the Bahrain Personal Data Protection Law, and Kuwait's data-protection regulations. Some of these laws impose data-residency or cross-border-transfer requirements; we continue to review our practices for the Gulf region and will work with institutional customers to meet applicable local requirements.
We use technical and organizational safeguards designed to protect personal information, including encryption in transit, access controls, and role-based permissions that limit access by organization and role. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
We use cookies and similar technologies. Some are strictly necessary to operate the service, such as authentication cookies that keep you signed in and a session identifier used by our observability tooling to diagnose performance and errors. On our publicly accessible pages we also use Google Ads (Google's global site tag, "gtag") to measure advertising performance and conversions, which may set third-party advertising cookies from Google. You can control cookies through your browser settings, and you can opt out of personalized Google advertising at https://adssettings.google.com.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.
For privacy questions or to exercise your rights, contact GradeThis, Inc. at [email protected].