Legal
Privacy Policy
Controller and processor
For a teacher account — your name, email and billing — we are the data controller.
For student work, the school (or the teacher acting for it) is the controller and decides what is submitted and why. We are a processor acting on their instructions, and we do not use student work for any purpose of our own. Schools needing a signed data processing agreement can request one at hello@workpaddle.com, or see our data processing agreement.
What we collect
Teachers: name, email address, and either a password (stored hashed, never in readable form) or a Google sign-in identifier. Plan, mark balance, and payment records.
Students: the name entered on the submission form, the work submitted, and any file a teacher attaches to an assignment. The form asks for a first name. Students do not create accounts, and we do not collect email addresses, dates of birth, year groups or any school identifier. Teachers should ask students not to include personal details in their work beyond the name on the form.
Usage: anonymous product analytics (which screens are used, whether a mark was published) through PostHog on its EU servers, configured without cookies or browser storage. If you allow analytics cookies, Google Analytics also records how the website is used: pages viewed, approximate location, device and browser, and how you arrived. It is off until you allow it in the cookie notice, it never runs on student submission or mark pages, and you can withdraw at any time from the “Cookies” link at the bottom of the page. Google’s advertising features are switched off. We do not run advertising or cross-site tracking of any kind.
Legal basis
Teacher accounts and billing: performance of our contract with you. Student work: processed on the school's instructions, under whichever basis the school relies on for assessment — usually public task or legitimate interests. Product analytics: our legitimate interest in knowing whether the service works, balanced against a design that identifies nobody. Google Analytics: your consent, given in the cookie notice and withdrawable at any time. Security and fraud prevention: legitimate interests.
How marking works
To produce a mark, the submitted work and the teacher's mark scheme are sent to Anthropic's Claude API. Anthropic does not use API inputs or outputs to train its models, and processes the text only to return the mark. Nothing is sent to any other AI provider, and Paddle never searches the web with a student's work.
A mark is a proposal. It is visible only to the teacher until they publish it.
Who can see what
Only the teacher who owns a class can see its submissions and marks. A student can see only their own published mark, through the link they were given. Uploaded assignment files are held in a private store and opened through links that expire within the hour.
Where your data is
Accounts, submissions, marks and files are stored with Supabase on EU infrastructure. The application runs on Railway and the website is served by Netlify.
Three transfers leave the EEA: marking, which is processed by Anthropic (United States); payments, handled by Stripe; and, only if you allow analytics cookies, website analytics processed by Google. These are covered by the European Commission’s Standard Contractual Clauses or, for Google, the EU–US Data Privacy Framework.
Who else processes it
Supabase (database, authentication, file storage), Anthropic (marking), Railway (application hosting), Netlify (website hosting), Stripe (payments — card details go directly to Stripe and never reach us), PostHog EU (anonymous analytics), Google (website analytics, only with your consent and never with student work). We do not sell data or share it with anyone else, and we will tell account holders before adding a processor that handles student work.
How long we keep it
Submissions, marks and classes are kept until a teacher deletes them or closes their account; deleting a class, assignment or submission removes it permanently. Files attached to an assignment are deleted automatically twelve months after the due date. Payment records are kept for as long as Belgian accounting law requires. PostHog analytics events carry no identifier and are retained in aggregate. Google Analytics data is kept for the retention period set in our Google Analytics account, currently two months.
Closing your account deletes your classes, assignments, submissions and marks. Email us and it is done within 30 days.
Children
Student work is submitted at a teacher's instruction, through a school, identified only by the name entered on the form. Paddle is for teachers: we do not offer accounts to students and do not knowingly collect data directly from children. A parent or school wanting a student's work removed should contact the teacher, who can delete it immediately, or us.
Your rights
You have the right to access your data, correct it, have it erased, restrict or object to its processing, and receive it in a portable form. Email hello@workpaddle.com and we will answer within one month.
Requests about a student's work should go to the school, which is the controller for it; if one reaches us directly we will pass it on and help the school answer it.
You can also complain to a supervisory authority — in Belgium the Data Protection Authority (dataprotectionauthority.be), or in the UK the ICO (ico.org.uk).
Automated decisions
No mark reaches a student automatically. A teacher reviews every mark and publishes it, so nothing here is a decision made solely by automated means.
Security
Traffic is encrypted in transit and data is encrypted at rest. Access is scoped so a teacher can reach only their own classes. If a breach ever affects your data, we will tell you and the relevant authority within the time the law allows.
Storage in your browser
We keep a sign-in token so you are not logged out on every visit, and a small preference value so a student returning to their link sees their own work. Neither is used for advertising or tracking. If you allow analytics in the cookie notice, Google Analytics also sets its own cookies (named _ga), which expire after up to two years or when you withdraw consent.
Changes
We will update this page when the service changes and move the date at the top. Material changes affecting student data will be notified to account holders by email.
Contact
Questions, data requests, or a data processing agreement for your school: hello@workpaddle.com