Last updated: 24 October 2026 · Version 1.3 · Entity: GraidLens
1. Our role
GraidLens is software that teachers and schools use to mark tests. Our role depends on the kind of data:
- Processor — for data a school or teacher processes through GraidLens, such as test photos, answers, scores and student labels. The school is then the controller; we only process on its instructions, as set out in the data processing agreement.
- Controller — for data we decide on ourselves, such as account and contact details, billing, and conversations with the chatbot on this website.
2. Sub-processors
We only use sub-processors that are needed to provide GraidLens. We don't sell data or use it for advertising. We don't train AI models on student work, unless a teacher chooses to (see improving handwriting recognition).
| Party | Purpose | Data | Region | Safeguard |
|---|---|---|---|---|
| Supabase | Database, sign-in and file storage | Data entered by schools and teachers, account and sign-in details | EU · Frankfurt | Data processing agreement; storage in the EU |
| Render | Application hosting (backend) | Data while it is being processed | EU · Frankfurt | Data processing agreement; hosting in the EU |
| Vercel | Website hosting | Technical data, IP address | EEA / US | Data processing agreement; standard contractual clauses and EU-US Data Privacy Framework |
| Cloudflare (Turnstile) | Bot protection on the sign-in, sign-up, forgotten-password, contact and chatbot forms | IP address, user agent and browser characteristics, only to recognise bots | US / global | Data processing agreement; standard contractual clauses and EU-US Data Privacy Framework |
| Anthropic (Claude) | AI processing for grading, reading tests and the chatbot | Photos and text submitted to an AI feature | US / global | Data processing agreement; standard contractual clauses; no training on submitted data |
| Resend | Sending email from the app | Email address, message content | EEA / US | Data processing agreement; standard contractual clauses |
| Zoho | Business email | Contact and correspondence details | EU data centre | Data processing agreement; storage in the EU |
| Stripe | Payments and invoices | Name, email and payment details of the teacher or school; never student data | EU (Ireland) / US | Data processing agreement; standard contractual clauses and EU-US Data Privacy Framework |
| Sentry | Error reporting and monitoring | Technical logs, without IP addresses or request contents | EU region | Data processing agreement; EU region |
| PagerDuty | Outage alerts for our own team | Contact details of our team | US | Data processing agreement; standard contractual clauses and EU-US Data Privacy Framework |
| Instatus | Public status page | Email address of anyone who subscribes to status updates | US | Data processing agreement; standard contractual clauses |
Before we add or replace a sub-processor, we inform schools in good time so they can object. The current list is always on this page.
3. Transfers outside the EEA
Database, sign-in and file storage are in the EU. Where a sub-processor may process data outside the EEA, the transfer relies on appropriate safeguards:
- the European Commission's standard contractual clauses (SCCs);
- the EU-US Data Privacy Framework, where the party concerned is certified.
Note on AI processing. For grading, photos and answers go to Anthropic. That processing currently takes place in the US or globally, not only in the EEA. Moving AI processing to within the EU is planned; this page will be updated once it is live.
4. Retention periods
We keep personal data no longer than needed for the purpose it was collected for.
| Category | Retention period |
|---|---|
| Account details | The term of the agreement plus a reasonable period after it |
| Data entered by schools and teachers | Until the agreement ends; then deleted within 30 days |
| Uploaded photos and scans | 90 days after upload; 365 days for school exams (SE), for inspection and appeals |
| Chat and support conversations | 90 days after the last message or after closing; open conversations at most 180 days |
| Contact details of prospects (contact form, chatbot) | 24 months after the last contact; if you unsubscribe from our emails, we keep only your address and the opt-out, so we never email you again |
| Send records of our mailings | 12 months after sending |
| AI usage and cost logs | 180 days |
| Technical logs and error reports | 30–90 days |
| Audit logs (access, export, deletion) | 12 months |
| Consent for handwriting recognition (opt-in) | 24 months; the latest consent is kept for as long as it applies |
| Backups | At most 30 days after the original deletion |
| Billing and accounting records | 7 years (statutory tax retention) |
When a retention period ends, data is deleted or anonymised. Deletions are logged, without the content, so that we can demonstrate them.
5. Data breaches
We follow a fixed procedure for detecting, assessing and reporting (possible) data breaches:
- As a processor: for a breach involving a school's data, we inform that school within 24 hours of discovery, so the school has enough time to report to the Dutch Data Protection Authority within the statutory 72 hours.
- As a controller: for a breach of our own data, we report it to the Dutch Data Protection Authority within 72 hours, and to the people concerned if the risk is high.
6. Rights of data subjects
Data subjects have the right of access, rectification, erasure, restriction, objection and portability.
- Requests about data we process as a processor go through the school; we help the school with them.
- Requests about data we are responsible for ourselves, we handle directly.
We respond within one month of receiving a request. For complex or numerous requests this can be extended by at most two months; we let you know within the first month.
7. Termination and deletion
When an agreement ends, we return or delete the data, as the school chooses, within 30 days, with a confirmation of deletion. Copies in backups disappear with the backup cycle (at most 30 days).
8. Changes and contact
We update this page when our service or our sub-processors change. The date at the top shows the latest change.
GraidLens
Email: privacy@graidlens.eu
Website: graidlens.eu
Not happy with how we handle your data? You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
This page is for information and does not replace the data processing agreement.