Privacy & Security Policy

1. Introduction & Scope

ScoreWise AI ("we," "us," or "our") operates the ScoreWise AI platform at scorewise-ai.com, an AI-powered grading tool designed for K–12 teachers, university professors, and tutoring centers.

This Privacy & Security Policy explains what information we collect when you use ScoreWise AI, how we use it, who we share it with, and the steps we take to keep it safe. We've written it in plain English because we believe educators deserve straightforward answers — not dense legal language — when it comes to their data and their students' data.

This policy applies to everyone who visits our website or uses our platform, including educators who register for an account and institutions that subscribe on behalf of their staff.

Our Terms of Service is a companion document that governs your agreement with us, including our FERPA school official designation, COPPA compliance obligations, Data Processing Addendum availability, and our commitment to never use student data to train AI models. Please read both documents together.

2. What Information We Collect

We collect only what we need to provide the service to you.

Account Information

When you register, we collect your name, email address, and password (stored as a secure hash — we never store your password in plain text). If you tell us your institution or subject area, we store that too. This information is used to create and manage your account.

Uploaded Files & Submissions

To use ScoreWise AI, you upload assignment files (rubrics, answer keys, instructions) and student submission files. These files are stored securely in our infrastructure so the platform can process and return graded results to you. You control these files and can delete them at any time.

Usage & Log Data

Like most web services, our servers automatically log technical information when you use the platform: your IP address, browser type, pages visited, and actions taken (such as uploading a file or viewing a graded result). We use this data to operate, troubleshoot, and improve the platform. We do not use it to build advertising profiles.

Payment Information

Payments are processed by Stripe, a PCI DSS–certified payment processor. When you subscribe, you enter your card details directly into Stripe's secure form — we never see or store your raw card number, CVV, or full billing details. We receive only a non-sensitive token and the last four digits of your card, which we store for billing reference purposes.

3. How We Use Your Information

We use the information we collect for the following purposes only:

• To provide the service. We process your uploads, run AI-assisted grading, and deliver results to you.
• To manage your account and subscription. We use your email and payment token to handle billing, renewals, and plan changes.
• To communicate with you. We may send you transactional emails (receipts, password resets, service alerts) and occasional product update announcements. You can opt out of non-essential communications at any time.
• To improve the platform. Aggregated, non-identifiable usage patterns (e.g., which features are used most) help us prioritize improvements.
• To ensure security and prevent abuse. We analyze log data to detect unauthorized access, fraud, or misuse of the platform.

4. Student Data & FERPA

We understand that student data carries special responsibilities. Here's how we handle it:

Anonymization Before AI Processing

Before any student submission content is sent to an external AI service for grading analysis, student names and personally identifiable information (PII) are automatically anonymized. The AI service receives anonymized text only — it cannot identify whose work it is grading.

No AI Training on Student Data

Student data is never used to train AI models — neither our own systems nor any third-party AI provider's models. This is a firm, contractual commitment, not just a policy preference.

FERPA — School Official Role

Under FERPA, ScoreWise AI acts as a "school official" — a service provider with a legitimate educational interest — when it processes student education records on behalf of an institution. Our Terms of Service describe this designation in full detail, along with the conditions that govern how we may and may not use education records.

Data Processing Addendum (DPA)

Institutions that require a formal Data Processing Addendum for FERPA, GDPR, or other regulatory purposes may request one by contacting us at durellej@scorewise-ai.com. Our DPA details the specific technical and organizational measures we apply to student data.

5. How We Share Your Information

We do not sell your data. We do not share your personal information with advertisers, data brokers, or any third party for their own commercial purposes.

We share data with the following service providers — and only to the extent necessary for them to perform their specific function:

We may also disclose information if required by law, court order, or government authority, or to protect the rights and safety of ScoreWise AI, our users, or the public — and only to the extent required by that legal obligation.

6. Data Security

We take security seriously and apply multiple layers of protection:

• Encryption in transit. All data transferred between your browser and ScoreWise AI is encrypted using TLS (Transport Layer Security). This protects your data from interception while it's in motion.
• Encryption at rest. Data stored in our Render-managed PostgreSQL database and file storage is encrypted at rest. This means your files and account data are protected even at the storage layer.
• Access controls. Access to production systems and user data is restricted to authorized personnel only, on a need-to-know basis. We use strong authentication and audit logging for all administrative access.
• Payment card security. We never handle raw card data. All payment card information is entered and stored exclusively within Stripe's PCI DSS–compliant environment. Stripe maintains the highest level of PCI DSS certification (Level 1 Service Provider).
• Password hashing. Your account password is stored as a one-way cryptographic hash. We cannot recover or read your password.

No system is 100% immune to attack. While we work hard to protect your data, we encourage you to use a strong, unique password and to contact us immediately at durellej@scorewise-ai.com if you suspect unauthorized access to your account.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the service.

Active Accounts

Your account information, uploaded files, and grading history are retained for the duration of your active subscription so you can access your records and continue using the platform.

Canceled or Expired Accounts

When your subscription is canceled or expires, we retain your data for a 30-day grace period. During this window, you can reactivate your account and recover your files. After 30 days, your account data — including all uploaded files and grading records — is permanently deleted from our systems.

Early Deletion

You don't have to wait for the grace period to expire. You can request immediate deletion of your account and all associated data at any time by contacting durellej@scorewise-ai.com. We will confirm deletion within 5 business days. Note that we may retain minimal transaction records (such as billing history) for the period required by applicable financial regulations.

8. Your Rights & Choices

You have meaningful control over your data. Here's what you can do:

• Access. You can view the information in your account at any time by logging in and visiting your account settings.
• Correction. If any of your account information is inaccurate, you can update it in your account settings or by contacting us.
• Deletion. You can request deletion of your account and all associated data at any time. See Section 7 for details.
• Data export. Before canceling, you can export your grading history and uploaded files from your account dashboard. We recommend doing this before canceling, as data is deleted after the 30-day grace period.
• Communication preferences. You can opt out of non-essential emails (such as product newsletters) by clicking "unsubscribe" in any such email. Transactional messages (receipts, security alerts) cannot be disabled as they are part of providing the service.

To exercise any of these rights, contact us at durellej@scorewise-ai.com. We respond to all requests within 30 days.

9. Cookies & Tracking

We keep our cookie use minimal and purposeful.

Session Cookies

We use session cookies to keep you logged in while you use the platform. These cookies are essential to the service — without them, you would be logged out on every page. They expire when you log out or close your browser session.

No Advertising Trackers

We do not use advertising trackers, cross-site tracking pixels, or third-party behavioral analytics tools (such as Google Analytics, Meta Pixel, or similar). We do not track you across other websites.

No Data Selling via Cookies

We do not share cookie data with data brokers or advertising networks. We do not sell data derived from your use of ScoreWise AI.

10. Children's Privacy

ScoreWise AI is designed for use by educators — not directly by children.

Children under 13 do not create accounts on ScoreWise AI. Our platform is used by teachers, professors, and tutoring center staff to grade student work. Students do not log in to ScoreWise AI directly.

When educators upload student submissions that may include the work of children under 13, those institutions are responsible for ensuring they have the appropriate authority and consents required under the Children's Online Privacy Protection Act (COPPA) and applicable state law. Our Terms of Service addresses the institutional COPPA responsibilities in more detail.

As described throughout this policy, any student content processed through our AI grading pipeline is anonymized before it leaves our systems. If you believe we have inadvertently collected personal information about a child under 13 without appropriate authorization, please contact us immediately at durellej@scorewise-ai.com and we will take prompt action.

11. Changes to This Policy

We may update this Privacy & Security Policy from time to time as the platform evolves or as legal requirements change.

When we make a material change — one that meaningfully affects how we collect, use, or share your data — we will notify you in advance by:

• Email to the address associated with your account, and/or
• A notice on your dashboard when you next log in.

Minor changes (such as clarifications, formatting improvements, or correcting typos) may be made without notice. The "Last updated" date at the top of this page always reflects the date of the most recent revision.

Your continued use of ScoreWise AI after a policy change takes effect constitutes your acceptance of the updated policy. If you do not agree with the changes, you may cancel your account before the effective date and request deletion of your data.

12. Contact Us

If you have any questions about this Privacy & Security Policy, want to exercise your data rights, or have a privacy or security concern, please reach out — we're here to help.

For Data Processing Addendum requests or FERPA-related inquiries, please include "DPA Request" or "FERPA Inquiry" in the subject line of your email so we can route it to the right team quickly.