1. Roles
Your school is the controller of student personal information. Elevate Grade is the processor, acting only on your documented instructions: namely, to grade, review and export the work you upload.
2. Scope of processing
- Subject matter: AI-assisted grading of student work.
- Duration: for the term of your subscription.
- Categories of data: student submissions and identifiers you include, the name and email address of each student who joins a class, marking schemes, and teacher account details.
- Data subjects: your students and staff.
3. Subprocessors
We use a short, current list of subprocessors to deliver the Service:
- Hosting & database: Supabase, on cloud infrastructure in Canada (ca-central-1).
- AI grading: Anthropic (the Claude API), United States, to generate marks and feedback. Data submitted to the Claude API is not used to train Anthropic’s models.
- Payments: Stripe, for subscription billing and the customer billing portal.
- Transactional email: Resend, for account and receipt emails.
Processing by the AI subprocessor occurs in the United States; that transfer is made under Anthropic’s data-protection commitments and its standard contractual protections. We will give reasonable notice before adding or replacing a subprocessor so you can object.
4. Security
- Each school runs in an isolated environment. Cross-tenant access is denied and verified in automated testing.
- Access to production data is restricted and the platform is the sole writer of school data.
- Data in transit is encrypted. Application data is hosted in Canada.
5. Data location
Application and student data are stored at rest in Canada (ca-central-1). During grading, submissions are transmitted to the AI subprocessor in the United States to generate results, which are returned to your Canadian environment. Payment processing may occur in other jurisdictions under appropriate safeguards.
6. Data subject requests & breach
We will assist you in responding to data subject requests and will notify you without undue delay after becoming aware of a personal data breach affecting your data.
7. Return & deletion
On termination, we will delete or, on request, return your school’s personal data within a reasonable period, except where retention is required by law.
8. Contact
Data protection enquiries: support@elevategrade.com.