Privacy Policy

1. Who controls the data

AutogradeX is deployed for an institution (a university or examination board). That institution decides what examination data is processed and is the data controller. AutogradeX processes it only to run the institution's evaluation workflow.

2. What is processed

• Staff accounts: name, institutional email, role, department, sign-in activity and authenticator enrolment.
• Examination records: answer-book barcodes, the student codes the institution assigns, scanned page images, marks, annotations, moderation decisions and results.
• Custody and audit records: bundle receipts, handovers, scanning and QC decisions, and activity logs.

3. AI processing

When the institution enables AI for a subject, scanned pages and the marking scheme are sent to the Azure OpenAI deployments configured by that institution, in its own Azure subscription. One vision deployment transcribes the pages and two or more grader deployments propose marks. AI output is a proposal only: an evaluator reviews the script and submits every final mark.

4. Where data is stored

Records are stored in the institution's PostgreSQL database and page images in its private S3-compatible storage. Page images are served only through the authenticated application, and only to roles allowed to see them.

5. Retention

Each examination cycle has a retention period set by the institution. Deleting data after that period is managed by the institution's administrators and backup policy.

6. Security

Access requires multi-factor authentication. Permissions are role-based and checked on every request, and handovers are recorded in a hash-chained custody ledger whose integrity can be verified.

7. Your rights and contact

Students and staff should contact their institution's examination office or data protection officer about access, correction or other data rights.