1. Who we are and our role
GradeWise (“we”, “us”), at gradewise.com.ng, provides a web application that helps lecturers and examiners mark handwritten examination scripts. This policy explains how we handle personal data when you use the application, visit this website or contact us. We follow the Nigeria Data Protection Act 2023 (NDPA) and guidance from the Nigeria Data Protection Commission (NDPC).
Our role depends on the data:
- Examination data (scripts, extracted answers, marks and student reference numbers): the educational institution that uploads it is the data controller. GradeWise is a data processor acting only on the institution’s documented instructions, under a data processing agreement.
- Account and website data (staff accounts, contact enquiries, security logs): GradeWise is the data controller.
Students who want to exercise their rights over examination data should contact their institution first. We will help the institution respond.
2. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Staff account data | Name, work email, institution, role, hashed password | You or your institution’s administrator |
| Examination content | Scanned answer scripts, page images, extracted answer text, questions and rubrics | Uploaded by lecturers |
| Student identifiers | Examination or registration number and, if the lecturer adds it, the student’s name | Entered by lecturers |
| Assessment records | AI suggestions, approved marks, score changes, reasons and approver identity | Generated in the application |
| Audit and security data | Sign-in events, actions taken, timestamps, request identifiers | Generated automatically |
| Billing records | Plan bought, amount, payment status, payment channel, Paystack reference and the paying administrator’s email | Paystack and you |
| Enquiries | Name, email, institution and message from the contact form | You |
Every script needs an examination or registration number. Adding the student’s name is optional; it lets lecturers export named result sheets, and institutions that prefer data minimisation can leave it out. Scripts can also contain details written by students. Those are processed only as part of the script and are not extracted into separate records.
We do not collect special-category data on purpose. We do not perform biometric processing: handwriting is read only to transcribe answers and is never used to identify, verify or profile a person.
3. How we use personal data
- To provide the service: storing scripts, extracting answers, producing marking suggestions, recording approved marks and producing result exports, including class-wide Excel workbooks with student names where lecturers have added them.
- To keep an audit trail of uploads, corrections, approvals and score changes, so institutions can account for every mark.
- To secure the service: authentication, access control between institutions, abuse prevention and incident investigation.
- To respond to enquiries, pilot requests and support requests.
- To meet legal obligations.
We do not sell personal data, and we do not use it for advertising.
4. Lawful basis
- Examination data: processed for the institution, which relies on its own lawful basis, typically the performance of a task in the public interest or legitimate interests in assessing students.
- Staff accounts: performance of our contract with the institution, and our legitimate interest in running a secure service.
- Audit and security logs: legitimate interests and legal obligations.
- Enquiries: legitimate interests in responding to you, or steps you ask us to take before entering a contract.
5. AI processing and human review
GradeWise uses automated tools to transcribe handwriting and to suggest criterion-by-criterion marks against the lecturer’s own rubric. Every suggestion shows the extracted answer, the supporting evidence and a short rationale, and is clearly labelled as a suggestion.
- A person makes every decision. A suggestion becomes a grade only when an authorised lecturer approves it. Lecturers can edit or reject any suggestion. GradeWise therefore does not make decisions based solely on automated processing.
- Uncertainty is flagged, not hidden. Unreadable text, low-confidence extraction and missing answers are flagged for the lecturer. They are never converted to a zero automatically.
- No model training on student work. We do not use scripts, answers or marks to train or fine-tune AI models. Where an institution enables an external AI provider, we use the provider’s commercial terms that prohibit training on our customers’ data.
- Traceability. Each suggestion records the provider, model and prompt version used, and AI suggestions are stored separately from approved marks.
7. International transfers
Some sub-processors, including AI model providers, may process data outside Nigeria. We transfer personal data abroad only where the NDPA permits it: for example, to a destination with an adequate level of protection, or under appropriate safeguards such as contractual clauses. Institutions can ask to restrict processing to providers and regions that meet their own requirements.
8. How long we keep data
| Data | Retention |
|---|---|
| Original scripts, page images and extracted text | For the period agreed with the institution, then deleted. Institutions can delete a script and its derived pages earlier, provided no approved mark depends on it. |
| Approved marks and audit records | For as long as the institution requires them for academic records and appeals, as set out in our agreement. |
| Staff accounts | While the account is active, then deleted or anonymised within 90 days of the institution closing it, unless needed for audit records. |
| Security logs | Up to 12 months. |
| Billing records | As long as tax and accounting law requires, typically six years. |
| Contact enquiries | Up to 24 months after our last exchange, unless they lead to a contract. |
9. How we protect data
- Encryption in transit (HTTPS), and encryption of storage and backups where the hosting platform supports it.
- Passwords stored only as Argon2 hashes, and HttpOnly session cookies.
- Strict separation between institutions, enforced on every request on the server.
- Uploaded files are validated, stored under random identifiers and kept unchanged. Derived images are stored separately.
- Application logs exclude answer text, passwords and access tokens.
- Least-privilege staff access, and a documented incident response process. If a breach is likely to put people at risk, we will notify the affected institution without undue delay so that it can meet its notification duties to the NDPC and data subjects. Where we are controller, we will make those notifications ourselves.
10. Your rights
Under the NDPA you have the right to:
- be informed about, and get access to, personal data about you;
- have inaccurate data corrected and incomplete data completed;
- have data erased where there is no longer a lawful reason to keep it;
- restrict or object to processing, including processing based on legitimate interests;
- receive your data in a portable format;
- not be subject to a decision based solely on automated processing that significantly affects you;
- withdraw consent where processing relies on consent.
For examination data, send requests to your institution. For anything else, use our contact form and choose “Privacy or data request”. We respond within the time limits set by law, and we may need to verify your identity first.
11. Students and minors
GradeWise is used by staff, not students. Students do not have accounts. Where an institution processes scripts written by students under 18, the institution is responsible for having an appropriate lawful basis and for any required parental or guardian notice. We apply the same safeguards to all scripts.
13. Changes to this policy
We will update this policy when our practices change, and revise the date at the top. We will tell institution administrators about material changes before they take effect.
14. Contact and complaints
Send questions or requests about privacy through our contact form, choosing “Privacy or data request”, or message us on LinkedIn. GradeWise operates from Nigeria.
If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission (NDPC).