Privacy Policy

Version: 1.1

Effective date: 5 October 2026

Language: English

1. Introduction

This Privacy Policy describes how Gradewing collects, uses, stores, and protects Personal Data when Clients and authorised Users use the Gradewing Service.

This Privacy Policy applies exclusively to Personal Data processed through the Gradewing Service and does not apply to any third-party websites, platforms, or services.

This Privacy Policy forms an integral part of the Terms & Conditions governing the use of the Service. The current version of these Terms & Conditions is available on the Gradewing website at https://www.gradewing.com/terms/ and may be accessed, downloaded, and reviewed at any time.

Gradewing processes Personal Data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation - "GDPR") and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD").

This Privacy Policy applies to the processing of Personal Data relating to registered educational institutions ("Clients") and their authorised staff members ("Users"), including where GDPR applies pursuant to Article 3.

Capitalised terms used in this Privacy Policy have the same meaning as in the Gradewing Terms & Conditions unless otherwise stated.

2. Data Roles

For the purposes of GDPR:

• The Client (the school) acts as the Data Controller in respect of all Personal Data entered into or processed through the Service.
• Gradewing acts as the Data Processor, processing Personal Data solely on behalf of and in accordance with the documented instructions of the Client, pursuant to Article 28 GDPR.

Gradewing does not act as a joint controller under any circumstances and does not determine the purposes of the processing of Personal Data.

Gradewing determines only those technical and organisational means of processing that are necessary to provide the Service, and does so solely in its capacity as a Data Processor, in accordance with the documented instructions of the Client and the GDPR.

3. Personal Data We Process

Gradewing processes only the Personal Data that is necessary to provide, operate, and maintain the Service in accordance with the documented instructions of the Client.

Gradewing does not collect Personal Data directly from students or parents. Personal Data processed through the Service is entered or uploaded by the Client and its authorised Users, or received from a connected email provider as described in Section 17. Depending on the Client's configuration and use of the Service, this Personal Data may include:

3.1 User Data (School Staff Members)

• Name and surname.
• Email address.
• Role or position within the educational institution.
• Login credentials (securely hashed authentication data; passwords are never stored in plain text).
• Activity logs and audit trails related to use of the Service.

3.2 Student Data

• Name and surname.
• Date of birth.
• Academic information (including enrolled subjects, grades, assessment results, predicted grades, expected grades, target grades, official examination results and performance indicators).
• School-specific identifiers (such as internal student identification numbers or reference codes assigned by the Client for record-keeping purposes).
• Educational support indicators and student tags defined by the Client, which may include information relating to learning support needs, disabilities, or health-related conditions (such as ADHD, autism, dyslexia, physical or sensory impairments, or chronic medical conditions), where entered by the Client for educational and administrative purposes. Gradewing does not generate, infer, diagnose, or assess such indicators and processes them solely as provided by the Client, under the Client's responsibility as Data Controller.
• Any additional information uploaded by the Client, provided that such information is necessary for the Client's educational and administrative purposes and is processed in compliance with applicable data protection requirements. The Client remains responsible for ensuring that any such additional information is lawful, relevant, and proportionate.

3.3 Technical Data

• IP address and basic device information.
• System and security logs.
• Metadata related to access to and use of the Service.

Technical Data is processed solely for purposes of ensuring the security, integrity, availability, and proper functioning of the Service.

4. Purposes of Processing

Gradewing processes Personal Data solely for the purposes determined by the Client, acting as Data Controller, and exclusively for the following purposes:

• Providing and operating the Service, including the management of grades, assessments, reports, and user accounts.
• Supporting AI-assisted analysis and text-based outputs, including statistical and predictive insights, strictly within the educational and administrative context defined by the Client and subject to meaningful human oversight.
• Maintaining, securing, and improving the Service and Platform, including the implementation of security measures, updates, bug fixes, and performance optimisation, without using Personal Data for independent research or unrelated analytics purposes.
• Managing Client Accounts and User Accounts.
• Ensuring the security, integrity, and availability of the Service, including fraud prevention, access control, logging, and incident detection.
• Providing technical and customer support to Clients and authorised Users.
• Complying with Gradewing's legal and regulatory obligations, where applicable.

Personal Data is not processed for advertising, marketing, profiling unrelated to the Service, or any form of commercial resale.

5. Legal Basis for Processing

The legal basis for the processing of Personal Data through the Service is determined by the Client, acting as Data Controller, in accordance with Article 6(1) GDPR.

Where the Personal Data processed includes special categories of data within the meaning of Article 9 GDPR, the Client is solely responsible for ensuring that an appropriate legal basis and any required conditions for such processing are satisfied.

Gradewing acts exclusively as a Data Processor and processes Personal Data solely on the documented instructions of the Client, in accordance with Article 28 GDPR. Gradewing does not determine the legal basis for the processing of Personal Data and does not process Personal Data for its own purposes.

6. Sub-processors

To operate and support the Service, Gradewing engages third-party service providers that act as sub-processors in accordance with Article 28 GDPR:

All sub-processors are engaged under written agreements that impose data protection obligations no less protective than those set out in Article 28 GDPR, including confidentiality, security, and sub-processing restrictions.

Gradewing will inform Clients in advance of any intended addition or replacement of sub-processors and will allow Clients to raise reasonable objections on data protection grounds. Where an objection is raised, Gradewing will use commercially reasonable efforts to address the concern, including by providing additional information or implementing appropriate safeguards.

An up-to-date list of sub-processors is available upon request.

7. International Data Transfers

Personal Data processed through the Service is primarily stored and processed within the European Economic Area (EEA).

Where necessary for the provision of the Service, Personal Data may be processed by sub-processors or service providers located outside the EEA. In such cases, international data transfers are carried out in accordance with Chapter V of the GDPR and subject to appropriate safeguards.

Such safeguards may include an adequacy decision adopted by the European Commission, the use of Standard Contractual Clauses approved under the GDPR, or other lawful transfer mechanisms recognised under the GDPR.

8. Security Measures

Gradewing implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, taking into account the nature, scope, context, and purposes of the processing of Personal Data.

Such measures include, where appropriate:

• Encryption of Personal Data at rest and in transit.
• Role-based access controls and access management.
• Secure authentication mechanisms.
• Regular data backups and recovery procedures.
• Infrastructure hardening and intrusion detection or monitoring.
• Logging and system audit trails for security, integrity, and compliance purposes.
• Access restrictions ensuring that Personal Data is accessible only to authorised personnel.
• Confidentiality obligations applicable to all personnel and sub-processors authorised to process Personal Data.

9. Client Responsibilities

As Data Controller, the Client is responsible for complying with its obligations under the GDPR and applicable data protection law, including:

• Ensuring that it has a valid and lawful basis for the processing of Personal Data, including, where applicable, special categories of data within the meaning of Article 9 GDPR.
• Informing Data Subjects, including students, parents or legal guardians, and staff members, about the processing of Personal Data through the Service, and providing appropriate privacy notices.
• Ensuring that Personal Data entered into or processed through the Service is accurate, complete, and kept up to date.
• Managing and controlling User access within the educational institution, including authorising Users, assigning appropriate roles and permissions, and removing access where no longer required.
• Implementing and maintaining appropriate internal data protection policies, procedures, and safeguards within the school environment.
• Handling and responding to Data Subject rights requests in accordance with GDPR, with Gradewing providing reasonable assistance where required in its capacity as Data Processor.
• Determining whether a data protection impact assessment (DPIA) is required for the Client's use of the Service and carrying out such assessment where necessary, with support from Gradewing upon request.

10. Audit and Compliance Support

Gradewing will make available to the Client, upon reasonable request, information reasonably necessary to demonstrate compliance with its obligations as a Data Processor under Article 28 GDPR.

Such information may include relevant policies, descriptions of technical and organisational security measures, and confirmations regarding the use of sub-processors, and shall be limited to what is proportionate and necessary for the Client's compliance.

Any audits or inspections shall be subject to prior agreement between the parties, reasonable prior notice, confidentiality obligations, and measures designed to minimise disruption to the Service and to other Clients.

11. Data Subjects Rights

Under the GDPR, Data Subjects have the following rights, subject to the conditions and limitations set out in applicable law:

• The right to access their Personal Data.
• The right to request rectification of inaccurate or incomplete Personal Data.
• The right to request erasure of Personal Data.
• The right to request restriction of the processing of Personal Data.
• The right to data portability of Personal Data, where applicable.
• The right to object to the processing of Personal Data in certain circumstances.
• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects.
• The right to lodge a complaint with a competent supervisory authority.

Requests relating to the exercise of Data Subject rights should be submitted primarily to the Client, acting as Data Controller.

Gradewing, acting as Data Processor, will provide reasonable assistance to the Client in responding to such requests, where required and to the extent applicable, and within the timeframes required under the GDPR.

12. Profiling and Automated Decision-Making

Gradewing performs limited profiling within the meaning of Article 4(4) GDPR, insofar as the Service applies statistical and analytical models to student academic Personal Data in order to generate indicative and non-binding insights, such as suggested expected grades, in accordance with the Client's educational and administrative context.

Gradewing does not perform automated decision-making within the meaning of Article 22 GDPR. The outputs generated by the Service are intended solely to support human decision-making by the Client and do not constitute decisions based solely on automated processing, nor do they produce legal effects or similarly significant effects on Data Subjects.

All academic and administrative decisions, including grading, assessment, progression, and reporting, remain under the sole responsibility and control of the Client and its authorised staff.

13. Data Retention & Deletion

Gradewing retains Personal Data only for as long as necessary to provide the Service and in accordance with the principles of purpose limitation and storage limitation under the GDPR.

Personal Data processed on behalf of the Client is retained for the duration of an active Subscription or Free Trial.

Following termination of a Subscription or expiry of a Free Trial, Personal Data is retained in an inactive and restricted state for a period of up to twelve (12) months solely for the purpose of enabling Client Account reactivation, where requested by the Client.

Upon expiration of this retention period, all Personal Data is securely deleted or irreversibly anonymised. Deletion is performed using secure, industry-standard methods designed to prevent data recovery.

Personal Data may be retained for a longer period only where required to comply with applicable legal obligations or to establish, exercise, or defend legal claims.

The Client is solely responsible for exporting its Personal Data prior to termination of the Service or expiry of the applicable retention period. Gradewing has no obligation to provide access to or recovery of Personal Data after deletion or anonymisation.

14. Data Breach Notification

In the event of a Personal Data breach affecting Personal Data processed on behalf of a Client, Gradewing will, in its capacity as Data Processor:

• Notify the Client without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the Personal Data breach, in accordance with Article 33 GDPR.
• Provide the Client with information reasonably necessary to enable the Client to comply with its obligations under Articles 33 and 34 GDPR, including information on the nature of the breach, the categories and approximate number of Data Subjects concerned (where available), and the measures taken or proposed to address the breach.
• Document the Personal Data breach, its effects, and the remedial actions taken, in accordance with Article 33(5) GDPR.

The Client, acting as Data Controller, remains solely responsible for assessing whether notification to the competent supervisory authority and affected Data Subjects is required and for carrying out such notifications where applicable.

15. Children's Data

The Service processes Personal Data relating to students (children) solely under the direction and responsibility of the Client, acting as Data Controller.

Gradewing does not provide services directly to children and does not independently collect Personal Data from minors. All student Personal Data processed through the Service is provided by the Client or its authorised Users.

Where the processing of children's Personal Data relies on consent or other specific legal requirements, the responsibility for obtaining and managing such consent or authorisation rests exclusively with the Client. Gradewing does not obtain consent directly from children or their parents or legal guardians.

16. Cookies and Tracking

At present, the Service does not use cookies or similar tracking technologies.

Gradewing may implement cookies or similar technologies in the future where necessary to support the secure operation, functionality, or performance of the Service, such as for authentication or session management. Any such use will be limited to what is necessary and proportionate.

Gradewing does not use cookies for advertising, marketing, or third-party tracking purposes.

Where cookies or similar technologies are implemented, Gradewing will provide appropriate information to Users and, where required under applicable law, obtain the necessary consent. A dedicated Cookie Policy will be made available on the Gradewing website if and when such technologies are used.

17. Google and Microsoft Email Connections (OAuth 2.0)

17.1 Purpose and Authorisation

Authorised Users may connect a Google Gmail or Microsoft email account to Gradewing using OAuth 2.0. This optional connection enables Gradewing to send school communications and report-related emails from the connected account on behalf of the User and the Client. A connected mailbox may be used by authorised school staff in accordance with the Client's permissions and configuration.

Users grant access through Google's or Microsoft's authorisation screen. Gradewing does not receive or store the User's Google or Microsoft account password. Authorisation allows Gradewing to carry out sending actions initiated or configured through the Service, including background processing of authorised email sends, without requiring the User to sign in to the provider for each message.

17.2 Permissions and Data Accessed

In addition to the information described in Section 3, Gradewing receives limited account information directly from the selected provider to verify and identify the connected mailbox:

• Google: The openid and email permissions identify the Google account and its verified email address. The https://www.googleapis.com/auth/gmail.send permission allows Gradewing to send emails on the User's behalf. Offline access allows Gradewing to refresh this authorisation for background sending.
• Microsoft: The openid, profile, email, and User.Read permissions identify and verify the connected account, including its account identifier, email address or user principal name, and tenant identifier where applicable. The Mail.Send permission allows Gradewing to send emails on the User's behalf. The offline_access permission allows Gradewing to refresh this authorisation for background sending.

Gradewing also receives access tokens, refresh tokens, granted permission details, token expiry information, and provider responses to email submissions, such as message identifiers or submission errors. The connection is used to identify the sending account and send email; Gradewing does not use it to read inbox messages, download existing mailbox contents, access contacts or calendars, or modify or delete existing mailbox messages.

17.3 Use and Sharing of Data

Gradewing uses connected-account information and OAuth tokens only to establish, maintain, secure, and operate the email connection and provide the email features described above.

To send an email, Gradewing transmits the sender and recipient addresses, subject, message content, and any included attachments to Google or Microsoft through the provider's email API. The provider processes and delivers the message to the selected recipients under its own terms and privacy policy. Authorised school staff may access communication content and sending history within Gradewing according to their permissions. Infrastructure providers described in Section 6 may process stored connection and communication data on Gradewing's behalf to operate the Service, subject to the restrictions in this section.

Gradewing does not sell connected-account data or use it for advertising, unrelated profiling, or credit assessments. Google and Microsoft account data, OAuth tokens, and data received through these email APIs are not supplied to AI providers or used to train general-purpose AI or machine-learning models. Gradewing personnel may access provider-derived data only with the User's affirmative permission for specific support needs, where necessary for security investigations, or where required by law.

17.4 Storage, Retention, and Security

Gradewing stores the connected account's provider, account and tenant identifiers where applicable, email address, granted permissions, connection status, and token expiry information. Access and refresh tokens are encrypted before storage. Requests to the provider's authorisation and email APIs use HTTPS. Access to connected mailboxes is restricted by school context and authorised roles.

Gradewing stores outgoing communication content, recipient information, and submission records to provide sending history, retries, and auditability. This includes provider message identifiers where returned. These records are subject to the retention and deletion provisions in Section 13. Tokens are retained to maintain the connection until it is disconnected or deleted, or the associated data is deleted under Section 13.

17.5 Disconnecting, Revoking Access, and Deletion

An authorised school administrator can disconnect or delete a mailbox in Gradewing's mailbox settings. Disconnecting disables sending through that connection and removes its stored access and refresh tokens. Deleting also removes the mailbox and its stored provider connection. Gradewing attempts to revoke the Google authorisation with Google when either action is taken. Microsoft app permissions may also need to be removed in the User's Microsoft account or organisation settings.

Users can independently revoke Gradewing's access through their Google Account connections or their Microsoft account or organisation's app-permission settings. Revocation prevents continued authorised access through the revoked grant; it does not itself delete data previously stored by Gradewing.

Disconnecting or deleting a mailbox does not delete previously sent messages, copies held by the provider or recipients, or the school's communication history in Gradewing. Retained records remain subject to Section 13. Requests to delete retained connection information or communication data should be directed to the Client or to Gradewing at support@gradewing.com, as described in Sections 11 and 19.

17.6 Google API Services Limited Use

Gradewing's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace API User Data and Developer Policy.

If Gradewing changes how it accesses, uses, stores, or shares Google user data, it will update this policy and notify affected Users. Where a change introduces new data access or a new purpose, Gradewing will obtain the User's consent before applying that change.

18. Changes to the Privacy Policy

Gradewing may update this Privacy Policy from time to time to reflect changes in legal requirements, regulatory guidance, or the operation of the Service.

Updates to this Privacy Policy will take effect upon publication on the Gradewing website. Where changes are material, Gradewing will notify Clients through the Platform or by email prior to or at the time such changes take effect.

Continued use of the Service following the effective date of an updated Privacy Policy indicates acknowledgement of the updated terms. Clients remain responsible for reviewing the Privacy Policy and informing Data Subjects, where required under applicable law.

19. Contact Information

Gradewing has not appointed a Data Protection Officer.

For privacy-related inquiries, data protection questions, requests for assistance in connection with data subject rights, or to obtain an updated list of sub-processors, Clients may contact Gradewing at:

Email: support@gradewing.com