Privacy Policy

We Commit To:

We will not:

• ✕ Collect, maintain, use or share Student PII beyond that needed for authorized educational/school purposes, or as authorized by the parent/student.
• ✕ Sell student PII.
• ✕ Use or disclose student information collected through an educational/school service (whether personal information or otherwise) for behavioral targeting of advertisements to students.
• ✕ Build a personal profile of a student other than for supporting authorized educational/school purposes or as authorized by the parent/student.
• ✕ Make material changes to School Service Provider education privacy policies without first providing prominent notice to the users and/or account holder(s) (i.e., the institution/agency, or the parent/student when the information is collected directly from the student with student/parent consent) and allowing them choices before data is used in any manner inconsistent with terms they were initially provided; and not make material changes to other policies or practices governing the use of Student PII that are inconsistent with contractual requirements.
• ✕ Knowingly retain Student PII beyond the time period required to support the authorized educational/school purposes, or as authorized by the parent/student.

We will:

• ✓ Collect, use, share, and retain Student PII only for purposes for which we were authorized by the educational institution/agency, teacher or the parent/student.
• ✓ Disclose clearly in contracts or privacy policies, including in a manner easy for institutions and parents to find and understand, what types of Student PII we collect, if any, and the purposes for which the information we maintain is used or shared with third parties.
• ✓ Support access to and correction of Student PII by the student or their authorized parent, either by assisting the educational institution in meeting its requirements or directly when the information is collected directly from the student with student/parent consent.
• ✓ Maintain a comprehensive security program that is reasonably designed to protect the security, confidentiality, and integrity of Student PII against risks, such as unauthorized access or use, or unintended or inappropriate disclosure, through the use of administrative, technological, and physical safeguards appropriate to the sensitivity of the information.
• ✓ Provide resources to support educational institutions/agencies, teachers, or parents/students to protect the security and privacy of Student PII while using the educational service.
• ✓ Require that our vendors with whom Student PII is shared in order to deliver the educational service, if any, are obligated to follow these same commitments for the given Student PII.
• ✓ Allow a successor entity to maintain the Student PII, in the case of our merger or acquisition by another entity, provided the successor entity is subject to these same commitments for the previously collected Student PII.
• ✓ Incorporate privacy and security when developing or improving our educational products, tools, and services and comply with applicable laws.

Introduction

CoGrader ("we," "us," or "our") is committed to protecting the privacy of the people who use our service ("you" or "your"). This Privacy Policy explains how we collect, use, share, and protect information when you use CoGrader.

By using CoGrader, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use our services.

1. Information We Collect

• Teacher information: When a teacher creates an account, we collect information such as name, email address, and school affiliation.
• Student information: We do not collect personal information directly from students. Teachers and schools provide student work to CoGrader, which may include student names or identification codes for grading purposes. We process this information on behalf of the school, in accordance with FERPA, COPPA, and other applicable laws.
• Grading data: Teachers provide assignment questions, rubrics, and student work to CoGrader for grading. This data may include text, images (such as photos of handwritten work), or other media. We treat this data as education records under FERPA.
• Google user data: When a teacher connects Google Classroom, we access only the data needed to import assignments and student submissions and to return grades and feedback, such as course lists, assignments, rosters, and submissions. Our use of this data follows the Google API Services User Data Policy, including its Limited Use requirements. See our Google API Disclosure.
• Usage information: We collect technical information about how you use CoGrader, such as IP address, device information, browser type, and usage patterns. We use it to operate, secure, and improve the service.

2. How We Use Information

• Providing and improving the service: We use teacher and grading data to provide grading and feedback, operate the service, and keep it secure. We may use aggregated and de-identified data to improve feedback quality and features.
• No AI model training: CoGrader does not use customer data, including student work, assignment questions, rubrics, prompts, or AI outputs, to train, fine-tune, or develop any AI model. Our AI service providers are contractually prohibited from using this data to train, improve, or develop their models.
• Communications: We may use your email address to send service notices, updates, and other relevant information about CoGrader.
• Legal compliance: We may disclose information if the law requires it, or to protect the rights, property, or safety of CoGrader, our users, or others.

3. Data Security and Retention

• Security: We protect information with encryption in transit and at rest, secure storage, access controls, and regular updates to our security practices. CoGrader holds a SOC 2 Type 1 attestation from an independent auditor.
• Data location: CoGrader stores customer data in the United States on Google Cloud Platform.
• Retention: We keep personal information only as long as needed for the purposes in this policy, or as the law requires. We delete data when a teacher or school asks, or when the contract ends, unless the law requires us to keep it.

4. How We Share Information

• Service providers: We use trusted service providers to operate CoGrader, such as cloud hosting, data analysis, and customer support. They receive only the information they need to perform their work, and they must keep it confidential and secure.
• AI service providers: To provide grading and feedback, we share assignment questions, rubrics, and student work with the AI service providers listed below. We do not send student names or other direct student identifiers to these providers, except where a teacher includes them in the content itself (for example, a student writes their name in the essay).

Each AI service provider processes data only to return results to CoGrader, under a data processing agreement and terms that prohibit using our data to train their models. Providers may keep a temporary copy of the data for abuse and safety monitoring (up to 30 days), and then delete it. For more detail, see our AI Transparency Note.

• Aggregated data: We may share aggregated and de-identified data for research or statistical purposes. This data does not identify individuals.
• We do not sell personal information.

5. Your Rights and Choices

• Access and update: Teachers can access and update their information in their CoGrader account.
• Opt out of emails: You can opt out of non-essential emails by following the instructions in those emails.
• Deletion: To ask us to delete your information, contact us at the address below. We may need to keep some information for legal reasons.
• Parents and students: Parents and eligible students can ask the school to access, correct, or delete student information. We help schools respond to these requests.

6. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will give notice of material changes by posting the updated policy on our website and, where required, by notifying schools and account holders before the changes take effect.

7. Contact Us

If you have questions, concerns, or requests about this Privacy Policy, including data deletion, please contact us at privacy@cograder.com.