Skip to content
Back to home

Data Processing Addendum

Last updated July 2026

This addendum forms part of the agreement between your school (the controller) and GradingMate (the processor) for personal data processed to provide the Service.

Working template. This document is a starting point for GradingMate and is not yet legal advice. Have it reviewed by counsel before public launch.

1. Roles

Your school is the controller of student personal information. GradingMate is the processor, acting only on your documented instructions — namely, to grade, review and export the work you upload.

2. Scope of processing

  • Subject matter: AI-assisted grading of student work.
  • Duration: for the term of your subscription.
  • Categories of data: student submissions and identifiers you include, marking schemes, and teacher account details.
  • Data subjects: your students and staff.

3. Subprocessors

We use a short, current list of subprocessors to deliver the Service:

  • Hosting & database — Supabase, on cloud infrastructure in Canada (ca-central-1).
  • AI grading — Anthropic (the Claude API), United States, to generate marks and feedback. Data submitted to the Claude API is not used to train Anthropic’s models.
  • Payments — Stripe, for subscription billing and the customer billing portal.
  • Transactional email — Resend, for account and receipt emails.

Processing by the AI subprocessor occurs in the United States; that transfer is made under Anthropic’s data-protection commitments and its standard contractual protections. We will give reasonable notice before adding or replacing a subprocessor so you can object.

4. Security

  • Each school runs in an isolated environment; cross-tenant access is denied and verified in automated testing.
  • Access to production data is restricted and the platform is the sole writer of school data.
  • Data in transit is encrypted; application data is hosted in Canada.

5. Data location

Application and student data are stored at rest in Canada (ca-central-1). During grading, submissions are transmitted to the AI subprocessor in the United States to generate results, which are returned to your Canadian environment. Payment processing may occur in other jurisdictions under appropriate safeguards.

6. Data subject requests & breach

We will assist you in responding to data subject requests and will notify you without undue delay after becoming aware of a personal data breach affecting your data.

7. Return & deletion

On termination, we will delete or, on request, return your school’s personal data within a reasonable period, except where retention is required by law.

8. Contact

Data protection enquiries: hello@gradingmate.com.