No Data Selling
We never sell, license, or monetize student or personal data, and we never use it for advertising or commercial profiling.
No AI Training
Student submissions are never used to train, fine-tune, or improve any AI model.
FERPA School Official
Your institution owns its student records. Gradebot™ processes them only as a School Official acting on your behalf — never for our own purposes.
1. Introduction
Gradebot™, operated by Wave AI Solutions, Inc. ("Gradebot™," "we," "our," or "us"), is an AI-assisted grading and evaluation platform designed for higher education institutions.
This Privacy Policy explains:
- What information we collect;
- How we use and protect that information;
- How information may be shared with trusted service providers;
- Your privacy rights; and
- Our commitments regarding FERPA compliance and student data protection.
Additional information regarding Gradebot™'s privacy and FERPA commitments is available atgradebot.ai/privacy and in ourTrust Center.
2. Our Role & FERPA Commitment
Educational Institutions as Controllers
When Gradebot™ is deployed by a college or university, the educational institution remains the owner and controller of student educational records. Gradebot™ acts solely as a service provider processing data on behalf of the institution.
FERPA School Official Designation
For institutions subject to the Family Educational Rights and Privacy Act (FERPA), Gradebot™ operates as a School Official under 34 CFR §99.31(a)(1)(i)(B). In this role, Gradebot™:
- Performs services that institutions would otherwise perform internally;
- Operates under the institution's direct control;
- Uses student records only for authorized educational purposes;
- Is subject to FERPA redisclosure restrictions; and
- Does not acquire ownership rights in student records.
Student data is never sold, licensed, or used for commercial marketing purposes.
3. Information We Collect
Instructor & Administrative User Information
- Name
- Email address
- Institution affiliation
- Role information
- Authentication information
- LMS integration credentials
- Audit and usage records
- Consent and acceptance records
Student Information
When submitted by an institution or instructor, Gradebot™ may process:
- Student assignments and coursework
- Uploaded documents
- Extracted document text
- Evaluation results
- Rubrics and grading criteria
- Submission metadata
Students do not typically create Gradebot™ accounts directly.
Technical Information
We may automatically collect:
- IP addresses
- Device and browser information
- Authentication events
- Audit logs
- Error and diagnostic information
- Performance and operational metrics
4. How We Use Information
We use information only to:
- Deliver grading, evaluation, and feedback services.
- Process and analyze submitted educational materials.
- Authenticate users and manage access controls.
- Support LMS integrations and institutional workflows.
- Maintain security, auditability, and compliance.
- Detect and investigate misuse or security incidents.
- Improve platform performance using de-identified operational metrics.
- Comply with legal and contractual obligations.
5. What We Do Not Do
Gradebot™ does not:
Sell student data or personal information.
Use student data for targeted advertising.
Create commercial student profiles.
Share student information with advertisers or data brokers.
Use student submissions to train, fine-tune, or improve any AI model.
Student data is processed solely to provide services requested by educational institutions.
6. Data Retention
Gradebot™ applies retention periods designed to balance educational needs, operational requirements, and privacy obligations.
Retention Schedule
| Data Type | Retention Period | Action |
|---|---|---|
| Student Documents (grading content) | 180 days by default* | Auto-purge on expiry |
| Raw Upload Files | Same schedule as documents* | Auto-purge on expiry |
| Original Filenames | Same schedule as documents* | Auto-purge on expiry |
| Evaluation Results | Per institution settings | Auto-purge on expiry |
| Audit Logs | Up to 7 years | Compliance retention |
| User Accounts | Account lifetime + | Standard retention |
*Platform default for grading-session content is 180 days (six months), configurable per institution up to 730 days, with a minimum configurable retention floor of 30 days.
Raw upload-session files and original filenames are Student Data and are retained on the same uniform per-institution schedule as other grading-session content (platform default 180 days, 30-day minimum floor, configurable up to 730 days), then removed by the automated purge. Personal identifiers in application logs are obfuscated; this is a logging control, distinct from the deletion of stored student data. Audit logs supporting compliance, security investigations, and institutional accountability may be retained for up to seven years, subject to institutional requirements and applicable law.
7. Security Measures
Gradebot™ implements administrative, technical, and organizational safeguards, including:
All personnel with access to systems processing educational records are required to maintain confidentiality and comply with privacy and security obligations.
8. Third-Party Service Providers & Subprocessors
Gradebot™ uses carefully selected service providers to support delivery of the platform. These providers may include services for:
Cloud infrastructure and hosting
AI processing and inference
Document extraction and OCR
Identity and authentication services
Learning Management System integrations
Transactional email delivery
Operational monitoring and observability
Gradebot™ requires service providers to implement appropriate security safeguards and contractual protections. A current list of subprocessors and privacy commitments may be provided to institutional customers upon request and is reflected in Gradebot™'s institutional agreements.
9. Student, Parent & User Rights
FERPA Rights
Students and parents should direct requests regarding educational records to their educational institution, which remains the official record holder under FERPA. Gradebot™ will assist institutions in fulfilling such requests where appropriate and technically feasible.
User Rights
Depending on applicable law and the nature of your relationship with Gradebot™, you may have rights to:
- Access personal information;
- Correct inaccurate information;
- Request deletion of personal information;
- Request information regarding processing activities; and
- Submit privacy-related inquiries.
Requests may be submitted to the contact information listed below.
10. California Privacy Rights (CCPA/CPRA)
This section supplements the rest of this Privacy Policy and applies to California residents, to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), applies to Gradebot™.
Categories of Personal Information
In the preceding 12 months, Gradebot™ has collected the following categories of personal information, as those categories are defined by the CCPA:
| Category | Examples | Sources | Business Purposes | Disclosed To |
|---|---|---|---|---|
| Identifiers | Name, email address, institution affiliation, account identifiers | Directly from you; from your institution | Providing the service, authentication, support, security, compliance | Service providers (cloud hosting, transactional email) |
| Professional or education-related information | Role, institution, course and rubric configurations | Directly from you; from your institution | Providing the service, institutional workflows | Service providers (cloud hosting) |
| Education records (student data) | Student submissions, uploaded documents, extracted text, evaluation results | From your institution and its instructors | Processing on the institution’s behalf as a service provider and FERPA School Official | Service providers (cloud hosting, AI processing, document extraction) |
| Internet or other electronic network activity | IP address, device and browser information, authentication events, audit logs | Collected automatically | Security, auditability, service operation, incident investigation | Service providers (cloud hosting) |
Gradebot™ does not collect biometric information, precise geolocation, or inferences used to build consumer profiles. Retention periods for each category are described in Section 6 (Data Retention).
No Sale or Sharing of Personal Information
As those terms are defined by the CCPA, Gradebot™ does not “sell” personal information and does not “share” personal information for cross-context behavioral advertising, and has not done either in the preceding 12 months. Gradebot™ does not use or disclose sensitive personal information for purposes that would trigger a right to limit under the CCPA. Because Gradebot™ does not sell or share personal information, no “Do Not Sell or Share My Personal Information” link is provided.
Your California Rights
Subject to applicable exemptions, California residents have the right to:
- Know and access the personal information collected about them;
- Correct inaccurate personal information;
- Delete personal information;
- Receive personal information in a portable format;
- Opt out of the sale or sharing of personal information (not applicable, as Gradebot™ does not sell or share personal information);
- Limit the use of sensitive personal information (not applicable, as described above); and
- Not receive discriminatory treatment for exercising these rights.
Submitting and Verifying Requests
California residents may submit requests by emailing admin@gradebot.ai with the subject line “California Privacy Request,” describing the request and your relationship to Gradebot™. An authorized agent may submit a request on your behalf with signed written permission.
Gradebot™ verifies requests by matching the information provided against its records, including verification through the email address associated with your account. Gradebot™ responds within 45 days, extendable by an additional 45 days with notice where reasonably necessary.
Student Records
Personal information contained in education records is processed on behalf of educational institutions as a service provider and FERPA School Official. Students and parents should direct requests concerning education records to their institution, as described in Section 9; Gradebot™ supports institutions in responding to such requests.
11. International Data Transfers
Gradebot™ processes information using trusted cloud service providers and may transfer information across jurisdictions where necessary to provide services.
Where required by applicable law, Gradebot™ and its institutional customers will implement appropriate safeguards for international data transfers, including contractual protections and recognized transfer mechanisms.
12. Security Incident Notification
If Gradebot™ confirms a security incident involving unauthorized access to protected data, we will notify affected institutions without unreasonable delay and consistent with applicable contractual obligations and legal requirements.
Institutions remain responsible for determining any required notifications to students, parents, regulators, or other affected parties.
13. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in:
- Legal requirements;
- Platform functionality;
- Security practices;
- Data processing activities; or
- Service providers.
Material changes will be communicated in accordance with applicable agreements and legal requirements. The latest version will always be available atgradebot.ai/privacy.
14. Contact Us
For privacy questions, data requests, or security concerns, contact the Gradebot™ Privacy Team. For questions regarding educational records maintained by an institution, students and parents should contact their institution directly.
1 League #62257
Irvine, CA 92602, United States