Data Protection & Signed DPA
Last updated: September 17, 2026
Contract-backed protections
InsightGrade has a signed Data Processing Agreement with Lovable. It requires Lovable to process customer personal data only under documented instructions and expressly prohibits using that data to train, retrain, fine-tune, or develop AI or machine-learning models.
InsightGrade and Lovable
Customers receive the InsightGrade service and maintain their relationship with InsightGrade. InsightGrade determines the educational purpose and instructions for processing submitted content. Lovable is a contracted subprocessor that supplies the application hosting, database, authentication, and AI inference infrastructure used to deliver InsightGrade.
In practical terms, InsightGrade remains responsible to its customers for the service and its data practices. Lovable processes customer personal data on InsightGrade's behalf and under the signed DPA. Lovable does not become the owner of customer transcripts, reports, or student records.
AI Gateway protections
- No model training. Sections 10.1–10.3 of the signed DPA prohibit using customer personal data, including identifiable content submitted for processing, for AI or machine-learning training, retraining, fine-tuning, or development.
- Purpose limitation. Customer personal data may be processed only to provide, maintain, secure, and support the contracted service under documented instructions.
- No sale or unrelated use. The DPA prohibits selling or sharing customer personal data and prohibits using it for unrelated commercial purposes.
Retention and deletion
The signed DPA does not make a blanket “zero retention” promise. Customer personal data may be retained as necessary during the service term. Following termination, InsightGrade may instruct Lovable in writing to return or delete it within the DPA's thirty-day request period, subject to legal exceptions; deleted data may remain in backups for a limited period before permanent removal.
This distinction matters: the contractual assurance is no training on customer personal data, together with purpose-limited processing and defined deletion rights—not immediate zero retention of every AI Gateway payload. For institutional data, InsightGrade also follows the retention and deletion commitments in its signed Institutional Agreement.
Questions and requests
Institutions may request further documentation, submit processing instructions, or ask about deletion by contacting think@insightgrade.app. See the current Subprocessors page for the providers involved in delivering the service.