Privacy Policy

Second layer - detailed information

This section provides detailed information about how TurboGrading collects and processes personal information. If you have questions, contact us at info@turbograding.com.

1. Controller and scope

TurboGrading Inc. ("TurboGrading", "we", "us", "our") is the controller for personal information processed through our website, Chrome extension, APIs, and related services (collectively, the "Services").

When TurboGrading is provided through a school or institution, we may process information on behalf of that organization. The institution controls student data use and may define additional policies or terms; students should contact their institution to exercise data rights or ask questions about institutional practices.

2. Information we collect

• Account information such as name, email, password hash, role, and account settings.
• Assessment content including submissions, rubrics, scores, feedback, and uploaded files (which may include student information).
• Usage and device data such as feature interactions, log files, browser type, device identifiers, IP address, and security events.
• Billing data processed by payment providers; we do not store full card numbers.
• Communications you send to us, including support requests, security inquiries, surveys, and demo inquiries.
• AI-assisted feature inputs and outputs (for example, prompts, uploaded content, and generated feedback) when you choose to use AI-assisted grading features.

3. Sources of information

We collect personal information from several sources:

• Directly from you (for example, when you create an account, upload content, or contact support).
• From your institution or administrators when the Services are used through an institutional relationship.
• From service providers (for example, payment confirmations from Stripe or fraud signals from reCAPTCHA).
• Automatically from your device/browser (for example, cookies and usage logs).

4. How we use information

We use information to:

• Provide, operate, maintain, and improve the Services (including grading workflows and analytics).
• Deliver AI-assisted features (for example, generating suggested scores or feedback for educator review).
• Authenticate users, manage accounts, and provide customer support.
• Process payments and administer subscriptions.
• Protect the Services, prevent fraud/abuse, and enforce our policies and terms.
• Comply with legal obligations and respond to lawful requests.
• Send product, security, and administrative communications. Where required, we send marketing communications only with appropriate consent and you can opt out at any time.

5. Legal bases for processing (where applicable)

Depending on your location and how you use the Services, we process personal information based on one or more of the following:

• Providing the Services (for example, to create and manage your account and deliver requested features).
• Legitimate interests (for example, to secure the Services, prevent fraud/abuse, and improve product performance), where permitted by law.
• Consent (for example, for optional marketing communications or certain cookies), where required by law.
• Legal obligations (for example, tax, accounting, and responding to lawful requests).

6. How we share information

We share information only as needed to operate TurboGrading:

• With service providers that support hosting, storage, logging, email delivery, and payment processing.
• With fraud and security providers (for example, Google reCAPTCHA Enterprise) to protect the Services.
• With AI model providers (for example, OpenAI) when you use AI-assisted features. This may involve sending content you submit (including assessment content) to generate outputs.
• With institutions and authorized administrators for reporting, support, compliance, and account management when the Services are used through an institution.
• When required by law, legal process, or to protect the rights, safety, and security of our users and the Services.
• As part of a merger, acquisition, financing, or asset transfer, subject to applicable confidentiality protections.

Cookies and analytics

We use cookies and similar technologies for authentication, security, preferences, and analytics. You can adjust your browser settings to control cookies, but some features may not function as intended. Some third-party services (such as fraud prevention) may also set or read device identifiers to assess risk.

Data retention

We retain information for as long as needed to provide the Services and meet legal, accounting, security, or reporting requirements. Retention periods may vary based on institutional agreements and regulatory obligations. Where possible, we delete or de-identify information when it is no longer needed.

Security

We use administrative, technical, and physical safeguards designed to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

International transfers

We may process information in countries where we or our service providers operate. We take steps to ensure appropriate safeguards are in place for cross-border transfers.

Your choices and rights

Depending on your location, you may have rights regarding your personal information, including access, correction, deletion, portability, restriction, or objection. You may also withdraw consent where we rely on consent.

You can exercise these rights by contacting us at info@turbograding.com. We may need to verify your identity and/or your authority to make the request.

Where available, you can opt out of marketing communications using the unsubscribe link in our messages.

Children's privacy

TurboGrading is intended for use by higher education institutions and is not directed to children under 13. If we learn we have collected information from a child under 13, we will delete it.

Updates to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do and, if the changes are material, we may provide additional notice through the Services.

Institution checklist / placeholders (for institutional rollout)

To be confirmed in institutional agreements / deployment. Use this list to document agreed data handling details.

• [Placeholder] Data retention
• [Placeholder] Encryption
• [Placeholder] Processing locations
• [Placeholder] Third-party AI usage
• [Placeholder] Deletion policy