Privacy Policy

This Privacy Policy applies to information processed when an educational institution, school district, charter school, or authorized individual (collectively, the "School") uses Gradebox to digitize, grade, give feedback on, and share physical student assignments. It also applies to parents, guardians, teachers, and administrators who interact with the Platform.

The School is the data controller for all student information submitted to the Platform. Gradebox acts as a service provider operating under the "school official" exception of FERPA (34 C.F.R. § 99.31(a)(1)(i)(B)). We access education records only at the direction of the School, use them only for the educational purposes the School has authorized, and are subject to the School’s direct control with respect to that use.

Gradebox does not direct its services to children under 13 and does not knowingly collect personal information directly from children. Students do not create Gradebox accounts, upload information themselves, or interact with the Platform. Where the Platform processes information about a child under 13, it does so only at the School’s direction and only for the School’s legitimate educational purposes. We rely on the School to provide any parental notices and consents required by COPPA, consistent with longstanding Federal Trade Commission guidance permitting schools to authorize the collection of personal information from students for school-authorized educational purposes.

• "Platform" — The Gradebox web application, mobile application, APIs, scanning workflow tools, and all associated services at gradebox.ai.
• "Student Data" — Any personally identifiable information ("PII") related to a student that is submitted to, processed by, or stored within the Platform. Student Data may constitute "education records" under FERPA.
• "Accommodation Data" — Instructional accommodation requirements derived from a student’s Individualized Education Program ("IEP") or Section 504 Plan — for example, extended time, preferential seating, or read-aloud requirements.
• "De-identified Data" — Data from which all personally identifiable information has been removed such that there is no reasonable basis to believe the information, alone or in combination with other reasonably available information, could be used to identify an individual student, consistent with 34 C.F.R. § 99.31(b).
• "Aggregate Data" — Statistical or summary information derived from De-identified Data across multiple students, schools, or cohorts.
• "Sub-Processor" — Any third-party service provider engaged by Gradebox to process Student Data on our behalf.

When a School creates or provisions an Authorized User account, we collect professional account information such as name, work email address, role, and school affiliation. We also collect Authorized Users’ authentication credentials, login history, and activity logs for security and audit purposes.

Student Data enters the Platform in two ways — never directly from the student:

• Through an authorized integration with the School’s Student Information System ("SIS") or Learning Management System ("LMS"), limited to the fields the School’s administrator has enabled.
• Through manual entry or assignment capture performed by an Authorized User acting in their professional capacity on behalf of the School.

Student Data may include the student’s name, student ID number, grade level, course enrollment, captured assignment images, handwritten or typed assignment work product, optical-character-recognition ("OCR") output derived from that work, teacher annotations, rubric scores, AI-generated feedback, and Accommodation Data.

Parents and guardians do not create Gradebox accounts. When a School chooses to use Gradebox’s view-only parent portal, we process the parent or guardian’s name, the delivery address (email or phone number) designated by the School, session authentication tokens, and access logs tied to each view-only session. Parents and guardians receive a secure link from the School and authenticate with a PIN or two-factor code at each session.

Like most web and mobile applications, Gradebox automatically collects limited technical information when anyone uses the Platform: IP address, device and browser type, operating system, referring URL, pages accessed, timestamps, and similar diagnostic data. We use this information for security, abuse prevention, debugging, and service reliability. We do not build behavioral profiles of students from this information.

Gradebox does not collect biometric identifiers, precise geolocation data, social-media contacts, or information about students’ activity on other websites or services. We do not permit third-party advertising networks to track users through the Platform.

We use the information described above only for the following educational and operational purposes:

• To provide, operate, and improve the Platform and its core features, including assignment capture, OCR processing, AI-assisted feedback, rubric scoring, and parent view-only access.
• To authenticate Authorized Users and parents and guardians, and to protect accounts against unauthorized access.
• To communicate with Authorized Users about service changes, security notices, and administrative matters.
• To support the School’s responses to parent, guardian, or eligible-student requests for access to or correction of education records under FERPA.
• To comply with legal obligations, enforce our Terms of Service, and protect the rights and safety of users.

We do not use Student Data for advertising, to build marketing profiles of students, or for any purpose unrelated to the educational services the School has engaged us to provide.

FERPA (20 U.S.C. § 1232g; 34 C.F.R. Part 99) gives parents — and "eligible students" aged 18 or older — specific rights in education records. Gradebox supports School compliance with those rights as follows:

• We process Student Data only as directed by the School under the "school official" exception, and only for the legitimate educational interests the School has authorized.
• We will not disclose personally identifiable information from education records to any third party except as permitted by these practices, as directed by the School, or as required by law.
• We maintain reasonable methods — including role-based access controls and audit logging — to ensure that Gradebox personnel who access education records do so only with a legitimate purpose.
• We cooperate with the School in responding to parent, guardian, or eligible-student requests to inspect, review, or correct education records.
• We follow the FERPA de-identification standard at 34 C.F.R. § 99.31(b) before using any data for product improvement or aggregate analysis.

The School is the custodian of record. Parents, guardians, and eligible students should direct formal FERPA requests to the School, which retains primary responsibility for FERPA compliance. Gradebox will support the School in fulfilling those requests.

The Platform is not directed at children under 13, and children under 13 do not create accounts or interact directly with Gradebox. Any information about a child under 13 that enters the Platform is submitted by an Authorized User acting on behalf of the School.

Consistent with longstanding FTC guidance on the use of online services in schools, Gradebox relies on the School to authorize the collection of student information for the limited educational purposes described in its agreement with Gradebox. The School is responsible for providing any parental notices and obtaining any parental consents required under COPPA prior to directing Gradebox to process data pertaining to students under 13.

We do not use Student Data, including any data pertaining to children under 13, to serve targeted advertising, for behavioral profiling, or for any commercial purpose unrelated to providing the Platform. We do not sell Student Data. We do not permit Sub-Processors to use Student Data for their own commercial purposes.

A parent or guardian who wishes to review or delete information about their child that is stored in the Platform should contact the School. Because the School is the FERPA-designated custodian of the record and the party that authorized our collection under COPPA, verified requests are routed through the School. Gradebox will honor verified deletion requests forwarded by the School within thirty (30) days, except where a longer retention period is required by law.

Accommodation Data requires heightened protection because it reflects a student’s disability status. Gradebox handles it as follows:

• Gradebox does not store or retain IEP or Section 504 source documents. When accommodation information is ingested through SIS/LMS integration or manual entry, we capture only the specific instructional accommodations required for the student (e.g., extended time, preferential seating, read-aloud). The underlying source record is deleted immediately upon ingestion and is not retained in any Gradebox system, including backups, once the deletion process is complete.
• Accommodation Data is used only to inform AI-generated feedback so it reflects the student’s applicable accommodations, to assist Authorized Users in delivering differentiated instruction, and to support School compliance with the student’s IEP or 504 Plan.
• Accommodation Data is never used in Aggregate Data analysis, product training, research disclosures, or any external sharing — even in de-identified form — without the School’s explicit written consent.
• Accommodation Data is permanently excluded from AI model training, regardless of any other opt-in election the School makes under Section 9.

Gradebox may produce and use De-identified Data and Aggregate Data for purposes including improving the accuracy of our AI-generated feedback, refining instructional strategies and rubrics, researching educational outcomes, and internal product development and quality assurance.

Before any Student Data is used for these purposes, we apply the FERPA de-identification standard at 34 C.F.R. § 99.31(b): we must have no reasonable basis to believe the data, alone or in combination with other reasonably available information, could be used to identify an individual student. We maintain reasonable administrative, technical, and physical safeguards against the re-identification of De-identified Data, and we do not share De-identified or Aggregate Data with any third party on terms that would permit re-identification.

The Platform uses optical character recognition and large language models to read captured assignments, generate instructional feedback, and suggest rubric-aligned scoring. AI-generated output is a support tool for Authorized Users. It is advisory only: all final decisions about grades, placement, academic standing, or other matters that materially affect a student remain with the School and its Authorized Users, not with Gradebox or any AI system.

Student Data is not used to train, fine-tune, or otherwise improve Gradebox’s AI models or any third-party AI model by default. A School may expressly opt in to model training through the Platform’s administrative settings. A School that opts in may disable model training at any time; future Student Data will not be used for training once consent is withdrawn, though Student Data already incorporated into a trained model cannot be retroactively removed from that model’s weights.

We do not permit any third-party AI provider, Sub-Processor, or partner to use Student Data to train their own AI models. This applies whether or not the School has enabled model training for Gradebox’s own models.

As described in Section 7, Accommodation Data is permanently excluded from any AI training activity, regardless of a School’s opt-in election.

Authorized Users at the School may access Student Data that falls within the scope of their role in the Platform (for example, a teacher may see their assigned classes; an administrator may see a wider scope). We share information back to the School as part of normal product operation.

We engage a limited set of Sub-Processors to deliver the Platform. Each Sub-Processor is contractually bound to process Student Data only as directed by Gradebox, to maintain appropriate security measures, and to comply with applicable data-protection law. Our current Sub-Processors include:

• Google Cloud Platform (including Google Cloud OCR and Gemini API) — Hosting of AI processing, OCR services, and cloud infrastructure.
• Firebase — Application data storage and authentication.
• Netlify — Web hosting and content delivery.

We maintain a current Sub-Processor list and provide it to Schools on request. Schools may subscribe to notifications of material changes. We give Schools at least thirty (30) days’ advance notice before adding a new Sub-Processor that will process Student Data.

Where the School enables the parent portal, a parent or guardian may view — but not modify or download — their own child’s submitted assignments, associated teacher feedback, and scores. Parents cannot view other students’ data.

We may disclose information when required by law, valid legal process, or court order. If we receive a subpoena, court order, or similar demand requiring disclosure of Student Data, we will, to the extent permitted by law, promptly notify the School before disclosing, cooperate with the School in seeking a protective order, and disclose only the minimum data required.

If Gradebox is involved in a merger, acquisition, or sale of substantially all of its assets, Student Data may be transferred as part of that transaction. Any acquirer will be bound to protect Student Data on terms no less protective than those described in this Privacy Policy. We will notify the School of any such transfer.

Gradebox does not sell Student Data. We do not share Student Data with third parties for the third party’s own commercial purposes, for advertising, or for behavioral profiling of students.

Parents, guardians, and eligible students have rights under FERPA to inspect, review, and request correction of education records. Because the School is the custodian of record, those rights are exercised through the School. Gradebox supports the School’s compliance by:

• Providing Schools with tools to export, correct, and delete records in response to verified requests.
• Offering a secure, view-only parent portal (where enabled by the School) through which parents and guardians can see their own child’s submitted assignments and feedback.
• Routing deletion requests that come to us directly from a parent or guardian to the School for verification, and completing verified deletions within thirty (30) days.

If you are a parent or guardian and have questions or concerns about how your child’s information is handled in Gradebox, please contact your child’s school. You may also contact us at privacy@gradebox.ai for general questions.

We maintain administrative, technical, and physical safeguards designed to protect Student Data against unauthorized access, disclosure, alteration, and destruction. These include:

• Encryption of Student Data in transit using TLS 1.2 or higher.
• Encryption of Student Data at rest.
• Role-based access controls that limit Platform access to Authorized Users and to Gradebox personnel with a legitimate need.
• Regular security assessments and vulnerability testing.
• Access logging and audit trails for sensitive operations.

If we confirm a security incident involving unauthorized access to or disclosure of Student Data, we will notify the affected School without unreasonable delay and in any event within seventy-two (72) hours of confirming the incident. We will provide reasonably available information about the nature, scope, and impact of the incident and cooperate with the School’s own breach-notification obligations. No online system is perfectly secure, and Schools, Authorized Users, parents, and guardians share responsibility for protecting account credentials.

We retain Student Data only for as long as needed to provide the Platform to the School, comply with legal obligations, resolve disputes, and enforce our agreements.

• During an active subscription or pilot, we retain Student Data for the duration of the engagement. At the end of each academic year, we offer Schools the option to archive, export, or delete prior-year records.
• Upon termination or expiration of the School’s agreement with Gradebox, we will delete or return Student Data within sixty (60) days, unless a longer retention period is required by law. Schools may request written confirmation of deletion.
• A School may submit a deletion request for specific students or all Student Data at any time to privacy@gradebox.ai. We complete verified deletions within thirty (30) days.
• IEP and 504 source records are deleted immediately upon ingestion (see Section 7). Accommodation Data logs are retained only while the student’s record is active and are deleted in accordance with the retention schedule above.
• Student Data present in operational backups at the time of a deletion request is purged from backup systems within ninety (90) days, consistent with our backup rotation schedule.
• De-identified Aggregate Data generated prior to deletion is not subject to deletion obligations, provided it continues to meet the FERPA de-identification standard and cannot reasonably be reverse-engineered to identify individual students.

Many states have enacted student data privacy laws that supplement FERPA and COPPA. Gradebox is designed to comply with applicable state student data privacy laws. Where a state law imposes obligations beyond those required by federal law — for example, stricter limits on advertising, additional parent rights, or shorter deletion windows — we apply the more protective standard. Schools in states with additional or more restrictive requirements may contact privacy@gradebox.ai to discuss any applicable adjustments to data-handling practices.

We use a limited set of cookies and similar technologies to keep Authorized Users signed in, remember preferences, and measure Platform reliability and performance. We do not use advertising cookies, cross-site tracking pixels, or third-party advertising networks in connection with the Platform. Any analytics we use for product improvement are configured to avoid sending Student Data to the analytics provider.

We recognize that giving an outside company access to information about your child is a serious matter. Our job is to help teachers mark and return student work faster and with higher-quality feedback — not to profile your child, sell your child’s information, or use it for advertising. You can expect the following from us:

• Your child’s information is used only for the educational purposes your School has authorized.
• We do not sell your child’s information, ever.
• We do not use your child’s information to show ads or to build a marketing profile.
• Sensitive information from your child’s IEP or 504 Plan is handled with extra care: we log only the specific accommodations, delete the underlying document, and exclude accommodation information from AI training.
• You have the right to ask your School to see or delete your child’s records. We will cooperate with your School to honor verified requests.

We may update this Privacy Policy from time to time. When we make material changes, we will give Schools at least thirty (30) days’ advance written notice — by email to the account administrator or by in-Platform notification — before the changes take effect. We will also post the updated Privacy Policy at gradebox.ai with a revised "Effective Date" at the top. Continued use of the Platform after the notice period means the School accepts the updated Privacy Policy; a School that objects to a material change may terminate its agreement under the process set out in our Terms of Service.

For questions about this Privacy Policy, to submit a data deletion or access request, to request our current Sub-Processor list, or to raise any other privacy-related matter, please contact us:

Gradebox, Inc. Attn: Privacy and Data Compliance Email: privacy@gradebox.ai Website: gradebox.ai

Parents and guardians seeking access to or correction of their child’s education records should direct those requests to the School, which is the FERPA-designated custodian of record. Gradebox will cooperate with the School in responding to verified requests.

Schools or parents and guardians who believe Gradebox has violated applicable student data privacy law may also file a complaint with the appropriate regulatory authority — including the U.S. Department of Education’s Student Privacy Policy Office with respect to FERPA matters, and the Federal Trade Commission with respect to COPPA matters.