Student Data Privacy, Security, and Compliance

Student submission files are held in server memory for the duration of a single grading call, uploaded to a private Google Cloud Storage bucket controlled by ClassLens, referenced by Google Cloud Vertex AI via a gs:// URI for inference, and best-effort deleted from Cloud Storage after grading. A 24-hour bucket-level lifecycle policy serves as the failsafe.

Google Cloud Vertex AI under the Google Cloud Data Processing Addendum does not use submitted data to train Google's foundation models. Google formally approved Zero Data Retention (a no-prompt-logging exception) for our Vertex AI project on April 30, 2026. Eligible jobs may cache shared assignment, rubric and grading context for up to five minutes, limited to that job. Google separately caches inference inputs, outputs and derived data in project-isolated memory with a 24-hour expiry. This memory cache is not stored at rest. See Privacy Policy Section 6.1 for scope and deletion details.

During an active grading job, student names and email addresses from the selected class are held in memory so the AI can address students by first name and feedback delivery can reach the correct mailbox, and in an encrypted job cache. That cache is cleared once the job finishes successfully; a job that ends incomplete keeps its cache so the work is recoverable, and either way the 48-hour expiry is the outer bound. In Grade & Review mode they also remain in the short-lived review queue alongside the drafted grades until the teacher releases them, with a 24-hour failsafe expiry. They are not written to the database, where students are identified only by opaque Google Classroom identifiers.

In Grade & Review mode, ClassLens keeps the drafted results for teacher review, with each student's name and email address and the names, links and version details of their files. It does not keep a copy of the submission files: the review screen loads each file in the teacher's browser directly from Google Drive. This review copy is deleted when the teacher releases the grades or keeps them as drafts, with a 24-hour expiry as the failsafe. In Draft Only mode, a separate read-only copy of student display names, submission identifiers, scores, criterion results and generated feedback is available to the teacher who ran the job for up to 24 hours from the start of the job. Account deletion removes access to the Draft Only copy and attempts to delete it; if that deletion fails, the copy still expires on its own 24 hours from the start of the job. Opening it does not extend the window, and returning grades in Google Classroom does not delete it. It contains no separate student email-address field, submission files or attachment links. Generated feedback may itself include a student's name or details from their work. Sheet Export jobs do not create either teacher-review copy. The encrypted job-processing cache retains its separate 48-hour expiry failsafe. Email, provider caches and recipient mailboxes follow the separate retention periods in Section 7 of the Privacy Policy.