1. Who this policy covers
TurboGrading Inc. (“TurboGrading”, “we”, “us”, or “our”) provides a website, Chrome extension, APIs, dashboards, and grading services (the “Services”). This policy covers personal information we handle through those Services.
We manage information used to operate accounts, billing, support, and service security. When an educator or institution submits assessment content, we process it to provide the requested grading service. The educator or institution is responsible for its authority to share that content and for its own privacy notices and assessment decisions.
TurboGrading is designed for educators and educational staff and is not directed to children under 13. Student information may appear in work submitted by an authorized educator. Contact us if you believe information has been submitted without appropriate authority.
2. Information we collect
We receive information you provide, information sent from supported LMS grading pages through the extension, and records generated when you use the Services. This can include:
- Account details: your name, email address, password hash, account role, preferences, and records of policy acknowledgement, along with optional profile details such as organization, phone number, or address if you provide them.
- Assessment context: course and assessment identifiers, student identifiers and name fields, assignment requirements, questions, rubrics, instructor instructions, and links to the relevant LMS records.
- Submissions and results: student answers, uploaded files, extracted text and images, suggested marks, feedback, grading evidence, and saved evaluation history.
- Billing records: customer and subscription identifiers, purchases, invoices, payment status, and limited payment-method details. Stripe processes payment information; TurboGrading does not store full card numbers.
- Operational information: IP address, browser information, request and error records, security events, and usage counts.
- Communications: information you send through contact forms, email, and support requests.
Files and free-text fields may contain personal information beyond the dedicated name fields. Review what you submit and include only what is needed for the grading task.
3. How we use information
- Authenticate users, manage permissions and settings, and maintain accounts.
- Process submissions, generate suggested marks and feedback, and provide grading history and reporting.
- Apply results in supported LMS workflows according to your actions and extension preferences, including automatic saving or publishing where enabled.
- Process payments, administer subscriptions and credits, and send account, billing, and security communications.
- Respond to support requests, investigate errors, monitor performance, and protect against fraud or misuse.
- Meet legal and accounting obligations and respond to lawful requests.
We process information to provide the service you request, with consent where required, and on other grounds permitted by applicable law, such as security and legal obligations. We do not sell personal information.
If you choose to allow testimonial use, we may publish your feedback with the display name and role or institution you provide.
4. AI processing and service providers
AI grading uses OpenAI. When you request an evaluation, we send the assessment instructions and relevant submission content to OpenAI’s API. Depending on the workflow, this may include extracted text, images, files, rubric criteria, and prior grading context. Personal information inside that content may be included.
OpenAI states that API data is not used to train its models by default unless the API customer opts in. Its retention rules vary by feature and account settings; abuse-monitoring records and uploaded files can have separate retention. See OpenAI’s API data controls. This is not a promise that grading data is never stored by an AI provider.
Other providers support specific parts of the Services:
- Stripe processes payments and billing information. See the Stripe Privacy Policy.
- Google reCAPTCHA Enterprise helps assess fraud and abuse on protected forms. See Google’s Privacy Policy and Terms of Service.
- Hosting, storage, and email providers support application operation, stored records, uploaded materials, and delivery of service communications.
Information is also available to users authorized to access the relevant account or assessment. We may disclose information when required by law, to protect users and the Services, or in a business transfer subject to applicable privacy obligations. Separate institutional agreements apply only where they have been agreed with TurboGrading.
5. Student-name privacy
Account owners can use Student name privacy settings to choose how dedicated student-name fields are stored:
- Do not store names: remove existing saved name fields and stop saving incoming names.
- Store names: keep readable names in assessment records.
- Store encrypted names: protect those fields with a PIN or account password and unlock them when needed.
These settings do not anonymize a submission. Student identifiers, names inside uploaded files, answers, feedback, and other free text are unaffected. They may still be processed and sent to the AI provider as part of the grading content.
Removing saved name fields is permanent. Encrypted names may become inaccessible if the protecting PIN or password is lost; resetting your account password does not recover names encrypted with the old password.
7. Retention and deletion
Different kinds of information have different retention needs:
- Account and grading records are retained to provide account access, evaluation history, reporting, and support. Completing an evaluation does not automatically delete its stored result or assessment context.
- Uploaded files and processing copies can be stored while submissions are processed. Temporary processing files have cleanup routines, while retained submission files and assessment records have separate lifecycles. Cleanup of a temporary file does not delete every copy of its content.
- Billing, security, and operational records may be kept as needed for accounting, legal obligations, fraud prevention, and investigation of service issues.
- Provider-held data is also subject to the provider’s retention rules and applicable service settings.
To request account closure or deletion of personal information, contact info@turbograding.com. We may need to verify your identity and authority. Legal obligations and the rights of others can limit what can be deleted. We will explain relevant limits when responding to your request.
Cancellation of billing, removal of the extension, and deletion of a record in your LMS do not automatically delete the corresponding TurboGrading records. Requests concerning institutional assessment records may need to be handled with the educator or institution.
8. Security and processing locations
We use safeguards including password hashing, authenticated access, account permissions, and security logging. Student-name encryption is available for dedicated name fields as described above. No method of transmission or storage can guarantee absolute security.
TurboGrading is based in Canada. Information may be processed in other countries where our service providers operate, including the United States, and may be subject to those countries’ laws. Using TurboGrading does not imply that all data remains in Canada.
Contact us before submitting data if your institution requires particular processing locations, retention periods, or contractual protections.
9. Your rights and choices
You can update available profile information, adjust extension preferences, manage student-name storage, and use available grading-result exports through your account. You can also request access to, correction of, or deletion of personal information by contacting us.
Depending on applicable law, you may have additional rights to portability, restriction, objection, or withdrawal of consent. Withdrawing consent may affect our ability to provide a feature that requires the information. We may verify your identity and, for institutional data, your authority before acting on a request.
If you are a student, contact your educator or institution about your assessment records; you may also contact us for help directing the request. If a privacy concern is not resolved, you may contact the Office of the Privacy Commissioner of Canada or the privacy authority responsible for your location.
10. Updates and contact
We will revise the date above when this policy changes. For material changes, we will provide notice and seek consent where required by applicable law.
For privacy questions or requests, contact TurboGrading Inc. in Waterloo, Ontario, Canada at info@turbograding.com or through our contact form. Please describe your request without including unnecessary student information.