Privacy Policy

Last updated 8 October 2026. This page is information, not legal advice.

1. Who we are

Graidable is operated by Lukas Thrane (sole proprietorship), reg. no. 936 043 925, Vegamot 1N, 7049 Trondheim, Norway ("we"). For questions about privacy, contact [email protected]. We have not appointed a Data Protection Officer (not required for this business).

2. Our role

When a teacher uses Graidable for their students, the school or institution responsible for those students is the data controller and Graidable is the data processor. We act on the institution's documented instructions under the Data Processing Agreement (GDPR Art. 28). Teachers accept that agreement, together with the Terms and this policy, when they create their account, on behalf of the institution whose students' work they upload.

For visitors to our website and for account holders, we are the controller of account, billing and usage data.

3. What we process

• Account data: name, email, role and institution. If you sign in with Google, Google shares your name, email and profile picture with us. If you sign in with Feide (the Norwegian education login, run by Sikt), your school shares through Feide your name, your email, a random user ID and your affiliation (staff, student or pupil, and which school or university). We use the affiliation only to decide who is let in: staff and students in higher education, not pupils in school. We do not store it. The school's name is stored on your profile. We also store the sign-in token from Feide, so that signing out here signs you out of Feide too. We do not get class lists, national identity numbers or photos from Feide. See Graidable with Feide.
• Class lists: students' names and, where the teacher adds them, their email, student number and candidate label.
• Students' work and the teacher's files: the files uploaded (typed or handwritten, in any subject), images of their pages, and the text read from them. They may contain personal data, such as a name written on a page.
• Assessment data: points, the AI's draft results, the teacher's approved results, and feedback.
• Billing data: the plan, payments and the gradings used. You enter your card details at Stripe; we never see or store them.
• Technical data: logs, for security and operation.

4. Purposes and legal basis

We process data to deliver the Service (reading the work, sorting it to students, drafting criteria and assessments, feedback), to bill for it, to secure and operate the platform, and to communicate with users.

Marketing communications (for example product news) are sent only to users who opted in at registration. You can withdraw that consent at any time under Account settings ("Product news") or by contacting us.

For processing on behalf of an institution, the institution sets the legal basis (typically GDPR Art. 6(1)(e) or (f), or (a)). For our own account, billing and usage data, the basis is the performance of our contract with you and our legitimate interest in operating the Service.

5. How the AI is used, and what it receives

The AI makes drafts. The teacher reviews them, can change anything, and approves each result. We do not use customer or student content to train AI models.

Graidable chooses the AI models. There is no choice of model or data policy per account. Every AI request goes from our servers to OpenRouter (a US company), which passes it to the model provider. There are four AI steps:

What our code requires of every AI request. The routing is fixed in our code, and no setting changes it:

• only the endpoints listed above, and no fallback to any other provider;
• only endpoints that OpenRouter lists as zero data retention;
• only providers that, under OpenRouter's data policies, do not store or train on the requests (data_collection: deny);
• a request whose routing differs from the fixed one is refused before it is sent;
• our servers do not log the content of AI requests or replies.

These rules bind the model providers OpenRouter sends a request to. What OpenRouter itself keeps of a request is governed by its own terms and our account with it.

Outside the EU. Two processors work outside the EU:

• OpenRouter (USA): every AI request passes through it, with the text and page images it carries;
• TypeSafe (USA): Jev sorts the work, and so receives students' names and the text of their work.

For both we rely on the EU Standard Contractual Clauses (section 7).

Our code lists one more grading model, Gemini 3.8 Flash, which runs on Google's global endpoint outside the EU. We use it only in our own test runs, never on customers' data. Before that changes, we will update this policy and notify controllers (section 6).

6. Sub-processors

We call TypeSafe, Microsoft and Google only through OpenRouter, and have no direct contract with them: OpenRouter passes our requests to them.

We keep this list up to date and notify the controller of changes to it.

7. International transfers

Storage, the database, email and reading (OCR) run in the EU/EEA, and so do the models for finding questions, criteria and grading. Two things happen outside the EEA: every AI request passes through OpenRouter in the USA, and Jev runs at TypeSafe in the USA (section 5). Railway is a US company that stores our data in the EU. For these transfers we rely on the EU Standard Contractual Clauses.

8. Retention and deletion

We keep data for as long as the class or the account exists. There is no automatic end date: the data stays until the teacher deletes it, or we delete it on request.

• Deleted classes and assignments stay in "Recently deleted" for 30 days, then are erased with their files.
• Deleting your account (Account settings) erases your classes, students, files, results and account data at once and ends your plan. Our worker removes the stored files shortly after.
• When a plan or a pilot ends, the data stays until it is deleted.

You or the controller may ask us to delete data at any time.

9. Security

We use encryption in transit (HTTPS), access control and logging, and host in the EU. Files in storage are encrypted at rest. We notify the controller without undue delay on becoming aware of a personal-data breach.

10. Your rights

Data subjects have rights of access, rectification, erasure, restriction, objection and portability under the GDPR. Under Account settings you can ask for a copy of your data (we email it within a month) and delete your account. Where the institution is the controller, requests go to it, and we help it fulfil them. You may also complain to the Norwegian Data Protection Authority (Datatilsynet).

Cookies and analytics

The website uses strictly necessary cookies only, for login, session and language. We currently use no marketing or tracking tools (such as Meta Pixel). If we introduce such analytics later, tracking cookies will be set only with your consent, which you can withdraw at any time. We use no tracking inside the assessment tool or on students' work.

11. Changes and contact

We may update this policy, and we will notify material changes. Contact: Lukas Thrane (Graidable), [email protected].