Data Processing Addendum

1. Roles

Your school is the controller of student personal information. Ontario Grading AI is the processor, acting only on your documented instructions — namely, to grade, review and export the work you upload.

2. Scope of processing

• Subject matter: AI-assisted grading of student work.
• Duration: for the term of your subscription.
• Categories of data: student submissions and identifiers you include, marking schemes, and teacher account details.
• Data subjects: your students and staff.

3. Subprocessors

We use a short, current list of subprocessors to deliver the Service:

• Hosting & database — cloud infrastructure in Canada (ca-central-1).
• AI grading — our AI subprocessor (a leading North-American AI provider), to generate marks and feedback.
• Payments — our payments provider, for subscription billing.

We will give notice before adding or replacing a subprocessor so you can object.

4. Security

• Each school runs in an isolated environment; cross-tenant access is denied and verified in automated testing.
• Access to production data is restricted and the platform is the sole writer of school data.
• Data in transit is encrypted; application data is hosted in Canada.

5. Data location

Application and student data are stored in Canada. Payment processing may occur elsewhere under appropriate safeguards.

6. Data subject requests & breach

We will assist you in responding to data subject requests and will notify you without undue delay after becoming aware of a personal data breach affecting your data.

7. Return & deletion

On termination, we will delete or, on request, return your school’s personal data within a reasonable period, except where retention is required by law.

8. Contact

Data protection enquiries: hello@ontariogradingai.com.