Student Data (FERPA) Addendum.

1. Scope and definitions

1.1 Addendum. This Student Data (FERPA) Addendum (the “Addendum”) is part of the Institutional Terms of Service between GridGrade and the Institution. Capitalized terms not defined here have the meanings in those Terms.

1.2 Student Data. “Student Data” means information that GridGrade receives or maintains for the Institution through the service and that is directly related to an identifiable student. It includes education records protected by the Family Educational Rights and Privacy Act (“FERPA”) when FERPA applies.

1.3 Examples. Depending on how the Institution uses the service, Student Data may include student account and roster information, submitted workbooks, assignment and submission records, grades, grading evidence and feedback, accommodations, support records, and payment-entitlement records. Student Data does not include information that has been de-identified so that a student is not reasonably identifiable.

2. FERPA role and direct control

2.1 School official. For FERPA-covered Student Data, the Institution designates GridGrade as a “school official” performing an institutional service or function for which the Institution would otherwise use its own employees. GridGrade has a legitimate educational interest in Student Data only to the extent needed to provide that service. The parties intend this designation to fit 34 C.F.R. § 99.31(a)(1)(i)(B).

2.2 Direct control. GridGrade is under the Institution’s direct control with respect to the use and maintenance of education records through this Addendum. GridGrade will use Student Data only as this Addendum and the Institution’s documented directions permit.

2.3 No independent student authorization. GridGrade relies on the Institution’s agreement and school-official designation as the basis for this processing. The product does not ask students to authorize that institutional processing. The Institution remains responsible for determining whether FERPA applies and for any notice or authorization its own policies or another law require.

3. Permitted use

3.1 Educational purpose. GridGrade may use Student Data only to receive and grade assignments, provide grading evidence and feedback, support instructor review and grade administration, operate student access and payments, secure and troubleshoot the service, respond to support requests, and comply with the agreement or law.

3.2 Restrictions. GridGrade will not sell Student Data, use it for targeted advertising, build advertising profiles, or use it to market to students. GridGrade will not use Student Data to develop an unrelated commercial profile of a student.

3.3 Human decisions. GridGrade supplies grading output and evidence. The Institution’s instructor remains the grader of record and is responsible for reviewing and acting on that output.

4. Rubric-authoring AI assist

4.1 What the AI path uses. AI assist uses Anthropic’s Claude to help an instructor draft a rubric. For that path, GridGrade downloads the instructor’s assignment solution workbook, removes answer-key sheets before mining it, and sends Anthropic a scrubbed structural representation of gradeable workbook artifacts, the instructor’s assignment instructions if provided, the assignment point total, and the rubric output schema. The scrub removes literal data values, answer-key figures, source paths, and connection strings before the representation leaves GridGrade.

4.2 What the AI path does not use. The rubric-authoring path does not send the raw workbook file to Anthropic. It does not send student submissions or instructor-uploaded calibration workbooks to Anthropic. Calibration workbooks are graded by the deterministic grading engine.

4.3 Default and switch-off. AI assist is enabled for classes by default. On request, GridGrade can switch AI assist off for the Institution’s class; when switched off, the rubric-authoring worker stops before making an Anthropic call. Spreadsheet grading itself is deterministic and does not require an Anthropic call.

5. Subprocessors and disclosures

5.1 Current subprocessors. GridGrade uses the following providers to operate the service:

• Google Cloud / Firebase — hosting, compute, database, file storage, sign-in, task processing, and logging.
• Anthropic — the Claude API for instructor rubric-authoring AI assist, with the limited input described in Section 4.
• Resend — transactional email, such as invitations, verification, and password-reset messages.
• Stripe — hosted checkout and payment processing for student purchases.

5.2 Conditions. GridGrade will give each subprocessor access only to information needed for its assigned service and will require it to protect that information under applicable contractual and legal obligations.

5.3 Other disclosures. GridGrade may disclose Student Data when the Institution directs it, when necessary to provide the service through the listed subprocessors, or when law requires it. When legally permitted, GridGrade will notify the Institution before a compelled disclosure and will disclose only what is required.

5.4 No browser advertising trackers. GridGrade does not place third-party advertising or analytics trackers in the client-side application. Product analytics are emitted by the server under a restricted event-and-field catalog.

6. Security

6.1 Safeguards. GridGrade will maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature of Student Data. Current safeguards include tenant-scoped access controls, authenticated access, restricted service identities, encrypted transport, encryption at rest through Google Cloud, and controls limiting personal information in diagnostic logs.

6.2 Access. GridGrade will limit access to Student Data to people and service providers who need it to provide, secure, support, or maintain the service, and who are subject to confidentiality obligations.

6.3 Security incidents. GridGrade will notify the Institution without unreasonable delay after confirming unauthorized access to or acquisition, use, or disclosure of Student Data. Notice will describe the known nature of the incident, affected data, steps taken, and reasonable steps the Institution can take, as that information becomes available. GridGrade will cooperate with the Institution’s reasonable investigation and notification obligations.

7. Retention and deletion

7.1 Requests. The Institution may request deletion of Student Data by emailing hello@gridgrade.app. After validating the request, GridGrade uses an operator-run erase process that removes the student’s linked database records and stored file generations across the identified classes. The operational process includes separate steps for student-linked analytics and, when requested, the authentication account.

7.2 Termination. At the end of the Institution’s use of the service, GridGrade will use the same process to delete Student Data at the Institution’s request. GridGrade may first provide a reasonable period for the Institution to retrieve records it needs.

7.3 Backup and log windows. Data deleted from active systems may remain temporarily in protected recovery or operational stores. Daily Firestore backups are retained for 14 days. If a break-glass Firestore export is ever made, it goes to a restricted backups bucket with a 90-day lifecycle. Diagnostic log buckets retain entries for 30 days. Those copies expire under their retention settings rather than through an immediate record-level deletion.

7.4 Audit records. The erase process pseudonymizes student references in tenant audit events rather than deleting the events. Objects placed in the protected audit-export bucket are subject to a 400-day retention policy. GridGrade may also retain records that law requires, payment providers retain independently, or that are needed to establish that an access code was already used, but will minimize and isolate retained identifiers.

8. Student and parent requests

8.1 Institution channel. The Institution controls education records and handles requests to inspect, correct, export, or delete them. If GridGrade receives such a request directly from a student or parent, GridGrade will route the requester to the Institution and will not independently decide the requester’s rights.

8.2 Assistance. GridGrade will provide reasonable assistance so the Institution can locate, access, correct, export, or delete Student Data in the service.

9. Re-disclosure and return

9.1 Limits. GridGrade will not re-disclose FERPA-covered Student Data except as permitted by this Addendum, the Institution’s documented direction, or law. A permitted recipient may use the data only for the purpose for which it was disclosed.

9.2 Return. On a reasonable request before deletion, GridGrade will make Student Data available to the Institution in the form in which the service can provide it. This does not require GridGrade to create a new export format or disclose another institution’s data.

10. Institution responsibilities

10.1 Administration. The Institution is responsible for deciding which users and classes may use the service, keeping rosters and roles accurate, and giving GridGrade enough information to authenticate and complete a request.

10.2 Lawful directions. The Institution represents that its directions and provision of Student Data comply with applicable law and that it has authority to place the data in the service. The Institution will not direct GridGrade to use Student Data outside the educational purpose described here.

11. General

11.1 Conflict and duration. This Addendum controls over the Institutional Terms for Student Data. It remains in effect while GridGrade holds Student Data for the Institution, including any applicable retention period after termination.

11.2 Changes. A material change to this Addendum will receive a new version identifier and require acceptance under the versioning process in the Institutional Terms.

11.3 Governing law. [Governing law: to be completed by counsel]