Privacy Policy

1. Who we are

InsightGrade is the data controller for the personal data collected through this service. We are responsible for deciding how and why your personal data is processed.

2. What personal data we collect

We collect and process the following categories of personal data:

• Account information: name, email address, and login credentials used to create and manage your account.
• Usage and telemetry: how you interact with the service, feature usage, device identifiers, and IP address.
• Support messages: communications you send us for help, feedback, or troubleshooting.
• User content: transcripts, discussion posts, and other material you upload for analysis.
• Payment information: payment details are collected and processed by Paddle, our Merchant of Record. We do not store full payment card numbers.

3. Why we collect it and legal basis

4. Who we share data with

We do not sell your personal data. We share it only where necessary and with appropriate safeguards:

• Service providers and subprocessors: hosting, analytics, email delivery, and customer-support tooling.
• Paddle: our Merchant of Record, which processes payments, manages subscriptions, handles tax compliance, and issues invoices on our behalf.
• Professional advisers: legal, accounting, and compliance professionals when required.
• Authorities: when required by law or to protect our rights.

5. FERPA Compliance

InsightGrade analyzes academic discussion posts that may constitute education records under the Family Educational Rights and Privacy Act (FERPA). When providing services to an educational institution, InsightGrade acts as a school official with a legitimate educational interest and operates under the institution's direct control. InsightGrade uses student information solely for authorized educational purposes, does not redisclose personally identifiable information, and maintains strict data-security and retention controls. Any evaluations or analytics generated by InsightGrade become part of the student's education record. Where appropriate, InsightGrade may use de-identified data for research or product improvement in accordance with FERPA regulations.

Optional in-browser de-identification

For pasted transcripts and text-based PDFs, InsightGrade offers an optional de-identification step that runs entirely on your own device. You supply a class roster, and matching student names are replaced with consistent pseudonyms (Student A, Student B…) before anything is sent to us. For PDFs, the text is extracted in your browser and only the scrubbed text is uploaded — the original file is never transmitted or stored. The roster and name mapping are kept only in your browser and are never sent to InsightGrade. Scanned PDFs (images of pages without selectable text) cannot be processed this way; we ask you to paste the text instead.

Institutional Use & FERPA Compliance

InsightGrade analyzes academic discussion posts and related instructional materials that may constitute education records under FERPA. To ensure compliance and maintain required institutional control, a signed Institutional Agreement must be in place before any institution activates or subscribes to a paid InsightGrade analysis plan. Please contact think@insightgrade.app to establish an agreement, or review and download the Institutional Agreement page.

Evaluation trials and trial data

Educators may request a no-cost evaluation trial through our trial request form. That form collects professional contact information only — name, institutional email, institution, and optionally role, discipline, and what you would like to evaluate. It never collects student names, coursework, or education records, and the information is used solely to review and administer your trial request, and to contact you about it. Trial request records are retained for up to 24 months and then deleted.

Every requester must accept an attestation confirming that, during the trial, they will analyse only InsightGrade's built-in synthetic sample transcripts, or material they have fully de-identified and are authorised to share, and that they will not submit student education records until a signed Institutional Agreement is in place. This is enforced technically as well as contractually: trial accounts can only run the built-in exemplars, transcript upload is disabled, and free-text notes are limited so posts cannot be pasted in. Uploading real transcripts unlocks only after the institution's signed agreement has been reviewed and approved. Analyses of built-in exemplars are stored in your account, contain no student data, and can be deleted by you at any time.

Subprocessors

InsightGrade uses only the following vetted subprocessors to deliver the service. No other third party receives institutional or student data:

• Lovable (including Lovable Cloud) — application hosting, database, authentication, and AI inference gateway. Customer content is not used to train models.
• Paddle — payment processing as Merchant of Record; receives billing details only, never transcripts, reports, or student data.
• Fastmail — transactional email delivery (notify.insightgrade.app).

This list is also published in the Institutional Agreement, and InsightGrade will notify institutions before engaging any additional subprocessor that would handle education records.

InsightGrade is the service provider accountable to customers; Lovable processes data on InsightGrade's instructions as its hosting and AI-infrastructure subprocessor. Our signed DPA expressly prohibits using customer personal data for model training and sets purpose, retention, and deletion limits. Read the explanation and download the signed DPA.

6. International transfers

Your personal data may be processed in countries outside your own, including the United States. Where data leaves the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Data retention

We keep your personal data only as long as necessary for the purposes described above, including to comply with legal obligations, resolve disputes, and enforce agreements. When no longer needed, we delete or anonymise it.

8. Your rights

Depending on your location, you may have the right to access, rectify, erase, restrict, or port your personal data, and to object to or withdraw consent for certain processing. You also have the right to complain to a supervisory authority. We aim to respond to requests within one month.

9. Security

We implement appropriate technical and organisational measures, including encryption and access controls, to protect your personal data. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Cookies and similar technologies

We use essential cookies to operate the service and analytics cookies to understand usage. You can manage your cookie preferences through your browser settings.

11. Children's privacy

InsightGrade is not directed at children under 16. We do not knowingly collect personal data from children under 16.

12. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will be posted on this page with the updated date.

13. Contact

For privacy-related questions or to exercise your rights, contact us at support@insightgrade.app.