Privacy Policy
Last updated: July 2025
1. Who we are
Gradeio (“we”, “us”) is an AI-powered grading tool for Irish Leaving Certificate examinations. Our contact email is hello@gradeio.ie.
We are subject to the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.
2. What data we collect
- Account data: your name, email address, county, and role (teacher/student). For OAuth sign-in (Google, GitHub): your provider ID and profile name.
- Student exam work: images of handwritten exam pages uploaded by you, and the OCR-derived text extracted from them.
- Grading results: AI-generated marks, band labels, and justification text for each question graded.
- Usage data: number of free grading runs used, timestamps of sessions.
3. Why we collect it (lawful basis)
- Contract (Article 6(1)(b)): to provide the grading service you signed up for.
- Legitimate interests (Article 6(1)(f)): to improve grading accuracy, detect abuse, and maintain security of the service.
4. Sub-processors
To deliver the service, your data is processed by the following third parties. We hold Data Processing Agreements with each.
| Processor | Purpose | Data sent | Location |
|---|---|---|---|
| Turso (ChiselStrike) | Database hosting | Account data, grading results | EU |
| Mistral AI | OCR (handwriting recognition) | Student exam page images | EU |
| Groq | AI grading (LLM inference) | Exam images, OCR text, rubric data | USA |
| Anthropic | AI grading (LLM inference) | Exam images, OCR text, rubric data | USA |
| Resend | Transactional email | Name, email address | USA |
| Vercel | Hosting & CDN | All request data (IP, headers) | EU/USA |
Where processors are based in the USA, transfers are covered by Standard Contractual Clauses (SCCs) or an equivalent transfer mechanism.
5. How long we keep your data
- Account data: until you delete your account.
- Grading sessions: 24 months from the date of grading, then automatically deleted.
- Auth sessions: 30 days, or until you sign out.
- Email addresses (waitlist): until you ask to be removed.
6. Your rights
Under GDPR you have the right to:
- Access the data we hold about you.
- Portability — download all your data as a JSON file from your account menu (Download my data).
- Erasure — delete your account and all associated data from your account menu (Delete account).
- Rectification — contact us to correct inaccurate data.
- Restriction or objection — contact us to restrict processing.
To exercise any right, email hello@gradeio.ie. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission (Ireland).
7. Student data
When you upload a student’s exam work, you are responsible for ensuring you have the appropriate basis to do so (e.g. as the student’s teacher). We process this data solely to provide the grading result to you. We do not use student exam content for any other purpose, including AI model training.
8. Cookies
We use a single HttpOnly session cookie (cl_session) to keep you signed in. No third-party tracking or advertising cookies are used.
9. Changes to this policy
We will notify you by email if we make material changes to how we process your data. The “Last updated” date at the top of this page always reflects the most recent version.