GDPR-compliant AI for schools, hosted in the EU
GradeAid is built in Copenhagen and runs on Google Cloud in Belgium. Schools get a data processing agreement, pupils never chat with an AI, and nothing you upload is used to train models. Here is exactly how your data is handled.
- Data in the EU (Belgium)
- DPA available on request
- No AI training on your data
How GradeAid handles your data
Hosted in the EU
The application, database and file storage run in Google Cloud's europe-west1 region in Belgium. Uploaded materials and the text extracted from them stay there, and AI processing with Google Gemini happens in the EU/EEA where available.
A data processing agreement on request
When a school or municipality deploys GradeAid, the institution is the data controller and GradeAid ApS is its processor (GDPR Art. 28). A data processing agreement can be provided on request.
Nothing is sold, nothing is tracked
We never sell data, and we never share pupil data with advertisers or data brokers. The teacher and pupil apps contain no analytics, tracking or advertising services at all.
No training on your data
Uploaded materials and pupil work are never used to train our own or any third party's AI models. They are processed only to create teaching content for you.
Built for children
Pupils never chat with an AI. They open the work their teacher assigned, in their own profile, after the teacher has reviewed it. Parental consent is verified for users under 15.
Security by default
Encryption in transit and at rest, hashed passwords, role-based access, per-account isolation of uploaded materials and rate limiting — with security logs kept only briefly.
What we keep, and for how long
- Accounts
- Kept while the account is in use and deleted when it is closed. A user or parent can delete their account at any time.
- Pupil work
- Submitted homework answers, and any photos attached to them, are kept while the account is active so pupils and teachers can revisit past work, and deleted when it is closed.
- Uploaded materials
- Kept for as long as your account is active or until you delete them. Delete a file and it, its page images and its extracted text are removed immediately, and in any event within 30 days.
- Security logs
- Kept for a limited period for security and abuse prevention, then deleted.
Transfers outside the EU
Some of our processors are established in the United States. Where data reaches them, it does so under the EU–U.S. Data Privacy Framework for DPF-certified recipients, with the EU Standard Contractual Clauses as a supplementary safeguard. Any transfer of uploaded materials outside the EU/EEA is covered by the SCCs and Google's Data Processing Addendum. The full list of processors is in our privacy policy.
Your rights
You can access, correct, export and delete your data, and object to or restrict its processing, by writing to us. You can also complain to the Danish Data Protection Agency (Datatilsynet). GradeAid ApS, CVR 45882411, is registered in Frederiksberg, Denmark.
Frequently asked questions
Find answers about plans, features and using GradeAid.
Questions about compliance?
We answer compliance questions from schools and municipalities directly, and can provide a data processing agreement on request. Our privacy policy is the definitive statement of how we handle data and is kept up to date.
Join our Discord community
Want to be on top of updates and talk to us in real time? Join our Discord community.
Join Discord communityBecome a GradeAid Ambassador
Three months free, then three months at half price — plus 50 trials to hand out to colleagues.
Become an Ambassador