Privacy Policy

GradeAid ApS, CVR 45882411 (“we,” “us,” or “our”) is the Data Controller responsible for processing your personal data. We are committed to protecting your privacy and to complying with the General Data Protection Regulation (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven).

Where a school or municipality has deployed GradeAid for its teachers and pupils, that institution is the Data Controller and we act as its Data Processor under a data processing agreement (GDPR Art. 28).

Address: Porcelænshaven 26, 2. sal, 2000 Frederiksberg, Denmark
Contact: privacy@gradeaid.ai

We process personal data about you when this is relevant and in accordance with applicable legislation. If we need to collect personal data beyond what is listed here, we will inform you at the time of collection.

About teachers

• Name, email address and a securely hashed password. If you sign in with Google, we store the identifier Google returns for your account instead of a password.
• Your teaching setup: classes you create, grade levels, subjects, curriculum goals and interface language.
• Where you hold a paid subscription, billing and subscription status. Card details are handled by Stripe and never reach our servers.

About parents

• Email address — used for account verification, consent records and safety alerts.

About children and pupils

• Username and display first name, and where provided at sign-up, date of birth, which we use to determine whether parental consent is required.
• Grade or class level, chosen subjects and interests — used by their teacher to theme the material they generate for the class.
• Presentation preferences: reading-font style, and a stored sound setting and voice choice left over from a read-aloud feature that is not currently offered.
• The answers a pupil submits to assigned homework, and any photo they upload with a submission. Pupils have no chat, no AI tutor and no other AI feature available to them.
• Pupils added by a teacher using a class join code do not have an email address collected. They sign in with a username and password issued through the class.

Uploaded materials

• If you have a teacher account, you may upload books, excerpts, worksheets, images and other teaching materials (“Uploaded Materials”) so that GradeAid can generate lessons, worksheets and tasks based on them.
• We store the file itself, an image rendering of each page, the text transcribed from each page, the file name, page count and upload date, and we link these to your account.
• Do not upload materials containing personal data about pupils or other people — see section 10.

About visitors to our public website

You do not need an account to browse gradeaid.ai, and we ask for nothing until you choose to contact us or sign up for something.

• Your cookie choice and interface language, stored in your own browser. These stay on your device and are never sent to us.
• If, and only if, you accept cookies: Microsoft Clarity records an anonymised replay of your visit — mouse movement, clicks, scrolling and the pages you view. Google Analytics records page views, engagement and how you arrived. The Meta pixel records that you visited, which Meta may link to a Facebook or Instagram account in order to target advertising. If you decline, none of these load at all.
• Your IP address and browser details reach those providers while they are active, and reach our image host whenever a blog image loads.
• Whatever you type into a form on the site. The contact form takes your name, email and message. The newsletter and waitlist forms take an email address, and the waitlist also takes a name. A webinar registration takes your name, email, chosen date and time, which AI tools you already use, which you would like to learn about, what you hope to get from the session, and a record of the two consent boxes you tick.

Technical data

• Cookies, and equivalent browser storage, used to keep you signed in and to remember interface preferences such as your chosen language and whether the navigation sidebar is expanded. In the teacher and pupil applications these are strictly necessary and we set no marketing or tracking cookies.
• IP address. Our servers record the IP address of incoming requests in security logs, and use it to apply rate limits that protect the service from abuse.
• When a page in the teacher application loads, your browser also requests fonts, and — only where you use those features — Google Sign-In, embedded video and search-result thumbnails, directly from the providers listed in section 5. Those requests carry your IP address to the provider.

• To generate lesson plans, worksheets, quizzes, presentations and project tasks for teachers, themed where relevant to the interests recorded for their class.
• To deliver the material a teacher has assigned to their pupils, and to record and return the answers those pupils submit.
• To verify parental consent for users under 15 years of age.
• To send transactional email — address verification, password resets and account notices.
• To take payment and manage subscriptions for paid teacher accounts.
• To keep the service secure and available, including rate limiting and abuse prevention.
• To improve our service, including AI safety guardrails, and to provide customer support.
• To process uploaded materials solely in order to generate teaching content for you, and to store them so that you can reuse them. When you upload a PDF, each page is rendered to an image and transcribed automatically so the material is searchable and usable straight away — this happens on upload, not only when you later generate something from it.
• To answer you when you use a form on our website, and to send you the newsletter or webinar link you asked for.
• To understand how our website is used and how our advertising performs, but only for visitors who have accepted cookies. This is measurement of our public marketing, and never touches teacher or pupil accounts.

We do not use uploaded materials or pupil work to train our own or any third party’s AI models. No AI feature is available to pupils — every use of AI in GradeAid is started by a teacher, in the teacher application.

We only process your personal data where we have a lawful basis under the GDPR.

• Consent (Art. 6(1)(a) / Databeskyttelsesloven § 6, stk. 3). Users aged 15 or older may consent independently. For users under 15, consent must be given by the holder of parental responsibility (forældremyndighedsindehaver). You may withdraw consent at any time by contacting us; data processed on that basis will then be deleted unless we are required by law to retain it.
• Performance of a contract (Art. 6(1)(b)). Providing the service to teachers and account holders, including processing and storing uploaded materials, and taking payment for paid plans.
• Legitimate interest (Art. 6(1)(f)). Improving AI safety and service quality, and protecting the service against abuse through security logging and rate limiting.
• Legal obligation (Art. 6(1)(c)). Retaining accounting records for payments as required by Danish bookkeeping law.
• School deployments. Where a school has deployed GradeAid, we process uploaded materials and pupil data on the school’s behalf as its data processor under a data processing agreement (Art. 28), and the school is the data controller.
• Consent, for website analytics and advertising (Art. 6(1)(a), and § 10 of the Danish Executive Order on cookies). The analytics and advertising services described in section 12 are placed only where a visitor has accepted them in the cookie banner, and are not loaded at all otherwise. Consent can be withdrawn at any time through the cookie settings link in the website footer.
• Legitimate interest, for answering enquiries (Art. 6(1)(f)). Handling what you send us through a website form so that we can reply. Where you tick a box to receive the newsletter or a webinar link, that specific use rests on your consent instead.

We share personal data only where this meets the requirements of the GDPR. The table below is the complete list of the companies involved, and it states our relationship with each one, because that relationship decides what protects your data.

• Processor — handles data on our instructions and for no purpose of its own. Each is engaged under a written data processing agreement meeting the requirements of GDPR Art. 28.
• Joint controller — decides jointly with us how the data is used (GDPR Art. 26), so an Art. 28 processing agreement does not apply. This covers the Meta pixel; the essence of that arrangement is set out below.
• Independent controller — receives the data and also uses it for its own purposes under its own terms, which we do not control.
• Contacted by your browser — not processing anything for us. Your browser requests a font, an embed or a thumbnail from them, and that request carries your IP address.

Rows marked Website apply to gradeaid.ai only. Everything else is the teacher or pupil application.

We do not sell your data to any third party, and we do not share pupil data with advertisers or data brokers. We use no analytics, tracking or advertising services in the teacher or pupil applications. The measurement and advertising services on our public marketing website are described in section 12, and load only where a visitor has accepted them.

Our application, database and file storage run in Google Cloud’s europe-west1 region in Belgium. Uploaded materials and the text extracted from them are stored there, and are sent to Google Gemini for processing in the EU/EEA where available.

Some processors listed in section 5 are established in the United States. We transfer personal data to the United States on the basis of the EU–U.S. Data Privacy Framework (DPF) where the recipient is DPF-certified, and use the EU Standard Contractual Clauses (SCCs) as a supplementary safeguard where applicable. Any transfer of uploaded materials outside the EU/EEA is covered by the SCCs and Google’s Data Processing Addendum.

Where your browser contacts a provider directly — fonts, the Google sign-in library, an embedded video or a search-result thumbnail — that request carries your IP address to the provider on the same DPF basis.

The measurement and advertising services on our public website transfer data to the United States on the same basis: Microsoft, Google and Meta each receive your IP address and browser details, and this happens only where you have accepted cookies. Website form submissions are received at Make’s European endpoints. Withdrawing consent stops collection by Microsoft, Google Analytics and Meta in every tab you have open, within about a second, and clears the identifiers they had set. A small amount of data already gathered before you withdrew may still reach the provider as the session closes, and what was collected while you had accepted is not retracted.

Contact us for more information, including to receive a copy of the documentation for the transfer basis.

• Account data is retained for the duration of use and deleted when the account is closed. A user or parent can delete their account at any time, after which the data associated with that account is deleted.
• Pupil work — submitted homework answers and any photos attached to them — is retained while the account is active, so that pupils and teachers can revisit past work, and is deleted when the account is closed. We hold no chat logs, because pupils have no chat feature.
• Uploaded materials are retained for as long as your account is active, or until you delete them from your library. When you delete a file, the file, its page images and its extracted text are deleted immediately, and in any event within 30 days — except where we must retain a copy to respond to a legal claim or a notice of infringement.
• Consent records — the timestamp and method of consent — are retained for the duration of the account and for up to 3 years after closure, to demonstrate compliance with GDPR Art. 7(1).
• Accounting records for payments are retained for 5 years as required by the Danish Bookkeeping Act (bogføringsloven).
• Security logs, which include IP addresses, are retained for a limited period for security and abuse-prevention purposes and then deleted.
• What you send us through a website form is kept for as long as we need it to deal with your enquiry, and newsletter subscriptions until you unsubscribe.
• Website analytics and advertising records are retained by Microsoft, Google and Meta according to the retention configured on each account.

Protecting children’s data is our top priority. In accordance with Databeskyttelsesloven § 6, stk. 3, users under 15 cannot create an account independently. A parent or guardian (forældremyndighedsindehaver) must create an account and add a child profile. Users aged 15 or older may consent independently. Where a school deploys GradeAid, pupils are added by their teacher under the school’s own legal basis.

We collect only the data necessary to run the service, and we remove personal identifiers before sending educational content to AI providers. Pupils added through a class join code have no email address collected at all.

The measurement and advertising services described in section 12 run on our public marketing website only. They are not present in the pupil application, and no pupil is measured, profiled or advertised to. Our marketing site is addressed to teachers, parents and schools rather than to children, and pupils do not reach their work through it — they sign in directly, with the username and password issued through their class.

GradeAid uses artificial intelligence to draft teaching material — lesson plans, worksheets, quizzes, presentations and project tasks — at a teacher’s request, in the teacher application. A teacher reviews and edits what is drafted before assigning it. Where they ask for material themed to their class, the subjects and interests recorded for that class inform the draft.

Pupil data is not subject to automated processing. We do not profile pupils, and no AI adapts content in response to a pupil’s answers or behaviour. No decisions with legal or similarly significant effects are made by automated means. Personal identifiers such as names and email addresses are removed before content is sent to AI providers.

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you, unless the decision is necessary for a contract, authorised by law, or based on your explicit consent (GDPR Art. 22).

Private to you

Uploaded materials are stored at your request, are private to your account, and are not made available to the public or to other users. GradeAid does not review, select, organise or promote them. GradeAid acts as a hosting provider under Article 6 of Regulation (EU) 2022/2065 (Digital Services Act) and section 16 of the Danish E-Commerce Act (e-handelsloven).

When you preview a book in the app, the pages are drawn in your own browser from the file we hold for you. Previewing a material does not send it to any third party.

No personal data in uploads

Do not upload pupil assignments, grades, names, photographs or other personal data about pupils, parents or colleagues. If you are a teacher at a school, follow your school’s rules and the Ministry of Children and Education’s guidance on the lawful use of AI. We may delete uploaded materials that contain personal data we are not authorised to process.

Automatic processing on upload

When you upload a PDF, we render each page to an image and use Google Gemini to transcribe the text on it, so that the material becomes searchable and usable immediately. This happens automatically when the file is uploaded, rather than only when you later ask for content to be generated. The transcribed text is stored alongside the file in our EU storage.

Copyright and your responsibility

Your rights and obligations regarding uploaded materials — including your confirmation that you are entitled to upload them, the licence you grant us to process them, our notice-and-takedown procedure and your responsibility for infringing uploads — are set out in section 7 of our Terms of Service.

Reporting illegal content

Notices about infringing or otherwise illegal material can be sent to privacy@gradeaid.ai, which is also our single point of contact under Articles 11 and 12 of the Digital Services Act. The Danish Digital Services Coordinator is the Danish Competition and Consumer Authority (Konkurrence- og Forbrugerstyrelsen).

GradeAid does not display advertising or sponsored content to children. We do not use personal data about children for profiling or targeted marketing, we set no tracking or marketing cookies in the teacher application or the pupil application at app.gradeaid.ai, and we do not make direct purchase calls to children through the platform.

Two exceptions are worth stating plainly.

• A teacher can add a YouTube video to a presentation, and pupils view the presentations their teacher assigns. When such a slide is shown, the player is loaded from YouTube, which may set its own cookies in the viewer's browser — including a pupil's. This is the only third-party embed in the product, it appears only where a teacher has inserted one, and it is not advertising.
• We do advertise our own product to adults. Our public marketing website carries a Meta advertising pixel, which loads only for visitors who accept cookies, and which lets us measure how our advertising performs and reach teachers and schools who may find GradeAid useful. It is not present anywhere a pupil goes. Section 12 sets out what it receives and how to refuse it.

This section covers gradeaid.ai, the marketing site where you read about GradeAid, browse the blog and get in touch. It is separate from both applications — teacher.gradeaid.ai and app.gradeaid.ai — holds no accounts and no pupil data, and involves different third parties. It is written for teachers, parents and schools rather than for children, and it is not where pupils sign in: the only account link on the site goes to the teacher application.

Nothing loads until you decide

On your first visit you are asked whether to accept cookies. Until you accept, the site loads no measurement or advertising services whatsoever — not in a limited form, but not at all. If you decline, that stays true for as long as your choice is remembered. You can change your mind either way through the cookie settings link in the footer of every page.

Two things are stored in your browser regardless, because the site cannot work sensibly without them: your cookie choice itself, and the language you picked. Both stay on your device and are never transmitted to us.

What runs once you accept

• Microsoft Clarity records an anonymised replay of your visit — where you moved the pointer, what you clicked, how far you scrolled, which pages you saw. This is session recording, and it is more than counting page views, so it is worth knowing about specifically. We use it to find parts of the site that confuse people.
• Google Analytics, across two measurement properties, records page views, how long you stayed and how you arrived.
• The Meta pixel records that you visited. Meta may link this to your Facebook or Instagram account and use it to measure our advertising and to show our ads to people like you. This is the one service here whose purpose is advertising rather than improving the site.

All three receive your IP address and browser details.

When you fill in a form

The contact form, the newsletter box, the waitlist and the webinar registration all deliver what you typed to Make.com, an automation service, at its European endpoints, which passes it on to us. Webinar registration is the most detailed: alongside your name and email it records your chosen date and time, the AI tools you already use, the ones you would like to learn about, what you hope to get from the session, and the two consent boxes you ticked. Nothing is sent until you press the button.

Things your browser fetches from elsewhere

• Blog images come from Sanity, where we keep our articles, so Sanity sees your IP address when you read one.
• The demo video on our home page is a YouTube embed in no-cookie mode, and only contacts YouTube once you press play.
• Booking a demo takes you to Calendly, on Calendly's own site, where the details you enter are received by Calendly.
• Fonts are served from our own domain. They are downloaded when we build the site, so browsing it sends nothing to a font provider.

What we never do here

We do not sell what we learn about visitors, we do not buy visitor data from anyone else, and we do not use the marketing site to build profiles of children. Nothing measured on this website is connected to a teacher’s account, a pupil’s work, or anything inside the applications.

Our separate Cookie Policy lists each cookie by category and links to each provider’s own terms.

As a data subject you have the following rights. There may be conditions or limitations attached to them; please contact us at privacy@gradeaid.ai if you wish to exercise any right.

• Access — request a copy of the data we hold about you and the purposes of processing.
• Rectification — correct inaccurate data.
• Erasure — request permanent deletion of your account and data.
• Restriction — in certain cases, request that we only store your data for a given period.
• Portability — receive your data in a machine-readable format (JSON/PDF).
• Objection — object to processing based on legitimate interest, including for direct marketing.
• Withdraw consent — at any time, without affecting the lawfulness of prior processing. For website analytics and advertising, the cookie settings link in the footer of every page does this immediately.
• Automated decisions — not to be subject to a purely automated decision without human involvement (Art. 22).
• Complain — lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, hashed passwords, role-based access controls, per-account isolation of uploaded materials, rate limiting, and regular security assessments.

We may update this Privacy Policy from time to time. The version number and date are shown at the top of this document. In the case of significant changes we will notify you by email or through a visible notice in the app. Where consent is the legal basis for processing, material changes to the scope of data processing will require renewed consent.