Data Processing Addendum — Fairgrade LLC
Effective: 1 October 2026
Version: 2026-10-01 (first version)
This Data Processing Addendum ("DPA") is part of the agreement between Fairgrade LLC ("Fairgrade", the processor) and the institution, department or instructor that holds a Fairgrade account (the "Customer", the controller) under the Terms of Service or an order form (the "Agreement"). It governs how Fairgrade handles personal data on the Customer's behalf. Where this DPA and the Agreement conflict on personal data, this DPA wins.
Cover page
| Term | Value |
|---|---|
| Agreement | The Fairgrade Terms of Service accepted by the Customer, or the Customer's order form |
| Approved subprocessors | Those listed in Annex III and at /subprocessors on the effective date |
| Subprocessor change notice | 30 days, by email to the Customer's owners and administrators and on /subprocessors |
| Security contact | info@fairgrade.com |
| Security measures | Annex II, and www.fairgrade.com/trust |
| Security incident notice | Without undue delay, and no later than 72 hours after Fairgrade confirms a Security Incident affecting Customer Personal Data |
| DPA liability cap | The same as the Agreement's cap, applied once across the Agreement and this DPA together; an order form may set a different cap |
| Governing law and courts | Delaware, as the Agreement; for the EU Standard Contractual Clauses, the Republic of Ireland; for the UK Addendum, England and Wales |
| Restricted transfers | EU: Standard Contractual Clauses (2021/914) Module Two, with Module Three where Fairgrade's subprocessors are engaged; UK: the International Data Transfer Addendum to the EU SCCs; Switzerland: the SCCs with the FDPIC's amendments |
| CCPA | Fairgrade is a "service provider"; Annex V |
| FERPA | Fairgrade is a "school official"; Annex IV |
Standard terms
1. Roles and subprocessors
- The Customer is the controller (or, where the Customer itself acts for a controller, a processor) of Customer Personal Data, and Fairgrade is its processor. Fairgrade processes Customer Personal Data only on the Customer's documented instructions, which are: the Agreement, this DPA, and the settings the Customer's users choose in the Service (Annex I(B)).
- Fairgrade may use the approved subprocessors. Each is bound by a written contract with data-protection obligations no less protective than this DPA, and Fairgrade remains responsible for them.
- Before adding or replacing a subprocessor, Fairgrade gives the subprocessor change notice. The Customer may object in writing within that period on reasonable data-protection grounds. If the parties cannot resolve the objection within 30 days, the Customer may end the affected part of the Service and receive a refund of prepaid fees for the unused period.
2. Processing
- Fairgrade processes Customer Personal Data only to provide, secure and support the Service as described in Annex I(B), and for no other purpose. It does not sell it, use it for advertising, combine it with data from other customers except in de-identified aggregate as the Agreement allows, or use it to train AI models, and it forbids its AI providers from doing so.
- If Fairgrade believes an instruction breaks data-protection law, it will tell the Customer and may pause the affected processing.
- Fairgrade ensures that its personnel with access to Customer Personal Data are bound to confidentiality and access it only when needed.
- Fairgrade will help the Customer meet its own obligations: responding to data subject requests (Section 6), security (Annex II), incident notification (Section 4), and data protection impact assessments and consultations with regulators where the Customer reasonably needs Fairgrade's input.
3. International transfers
- Customer Personal Data is hosted in the United States (Annex I(B)). Where the Customer's data protection law restricts a transfer to the United States, the transfer mechanism on the cover page applies and is incorporated into this DPA, with Annexes I and II serving as its annexes. Where the mechanism's text and this DPA conflict, the mechanism wins for the transfer it governs.
- Fairgrade will tell the Customer if it can no longer comply with the transfer mechanism, and the Customer may then suspend the transfer or end the affected part of the Service.
- If a public authority requests access to Customer Personal Data, Fairgrade will, unless legally prohibited, tell the Customer, direct the authority to the Customer, and challenge requests it believes are unlawful.
4. Security incidents
- Fairgrade keeps the security measures in Annex II and will not lower them materially during the term.
- A "Security Incident" is a confirmed accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data on systems Fairgrade or its subprocessors control.
- Fairgrade will notify the Customer's owners and administrators by email within the security incident notice period, with what is then known: what happened, which data and people are affected, the likely consequences, and what Fairgrade has done and will do. It will update the notice as it learns more and will cooperate with the Customer's own notifications to individuals and regulators.
- Fairgrade will not name the Customer in any public statement about a Security Incident without its permission unless the law requires it.
5. Audits and reports
- On request no more than once a year, Fairgrade will answer the Customer's reasonable written security questionnaire and provide the documentation it maintains: this DPA, Annex II, the trust page, its internal readiness assessments under a confidentiality agreement, and third-party audit reports once they exist.
- If that is not enough to meet a legal requirement, the Customer may conduct, or have an independent auditor conduct, an audit of Fairgrade's relevant systems once a year, on 30 days' notice, during business hours, under confidentiality, at the Customer's cost, in a way that does not disrupt the Service or expose other customers' data. Fairgrade will address findings that show a breach of this DPA.
6. Cooperation on requests from individuals
- If Fairgrade receives a request from a student or other individual about their Customer Personal Data, it will, unless the law requires otherwise, refer the person to the Customer and tell the Customer within 5 business days.
- Fairgrade will help the Customer respond within the time the law allows. Today the Service lets staff correct their own details and lets any person delete their own login; other requests (access copies, portability, restriction, objection) are handled by Fairgrade on the Customer's request, at no charge for reasonable volumes.
- Fairgrade will tell the Customer if it receives a complaint or regulatory inquiry about Customer Personal Data.
7. Return and deletion
- During the term, the Customer may request a copy of its Customer Personal Data in a commonly used electronic format; Fairgrade provides it within 30 days.
- At the end of the Agreement the retention rules in the Terms apply: a 30-day cancellation window, read-only, then permanent deletion 12 months after closure or right after the window if the Customer asks. Every member is told where to get an export 30 days before deletion.
- Fairgrade keeps only what the law requires it to keep (billing and acceptance records) and copies in backups for up to 7 days, and continues to protect them under this DPA. On request, Fairgrade confirms deletion in writing.
8. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, and the DPA liability cap on the cover page is the total for the Agreement and this DPA together. Nothing limits liability that the law does not allow to be limited, and nothing limits an individual's rights under the transfer mechanism.
9. Conflicts
Order of precedence: the transfer mechanism for the transfers it governs; this DPA; the order form; the Terms of Service.
10. Term
This DPA lasts as long as Fairgrade holds Customer Personal Data, including the retention period in Section 7, even if the Agreement ends first.
11. Definitions
"Customer Personal Data" means personal data that Fairgrade processes on the Customer's behalf under the Agreement: the data in Annex I(B). "Personal data", "controller", "processor", "data subject" and "processing" have the meanings in the GDPR, and their equivalents under the UK GDPR, the CCPA and FERPA where those apply. "Data protection law" means every law that applies to the processing of Customer Personal Data under the Agreement, including the GDPR, the UK GDPR, the CCPA, FERPA and the U.S. state privacy laws.
Annex I(A) — Parties
| Data exporter (controller) | Data importer (processor) | |
|---|---|---|
| Name | The Customer, as identified in its account or order form | Fairgrade LLC |
| Address | As in the account or order form | Delaware, United States; details from privacy@fairgrade.com |
| Contact | The account owner's email | privacy@fairgrade.com |
| Role | Controller | Processor |
| Signature | Acceptance recorded in the Service, or the order form | Acceptance recorded in the Service, or the order form |
Annex I(B) — Description of the processing
| Subject matter | Providing the Fairgrade for Education service: peer assessment of student work under the Customer's rubrics, weighted by the Marciano Method, with optional AI features, results, and integration with the Customer's LMS and sign-on |
| Duration | The term of the Agreement plus the retention period in Section 7 |
| Nature | Hosting, storage, conversion of files to PDF, distribution of submissions to peer reviewers, scoring, generation of summaries and, where enabled, AI second opinions, display to authorised users, email notifications, export and deletion |
| Purpose | To deliver, secure and support the Service on the Customer's instructions |
| Categories of data subjects | Students enrolled in the Customer's classes; the Customer's instructors, teaching assistants and administrators |
| Categories of personal data — students | Name, email, login identifier; LMS user identifier and role where launched from an LMS (which may be a student number if the Customer's LMS sends it); enrolment; submitted files and text, comments, attempt numbers, timing events for timed assessments; scores and feedback from peers, instructor and (where enabled) AI; Fairgrade Score and confidence; AI summary of peer feedback; reviewing assignments, reviews written and reviewing preferences; anonymity-check result where enabled; product-analytics events under an internal identifier and, during Fairgrade's beta, masked session recordings (all text and inputs masked); name and email shared with the support-chat provider when the chat widget loads |
| Categories of personal data — staff | Name, email, login identifier, time zone, optional profile picture; role and workspace membership; notification preferences; content created; activity log; legal acceptances; for owners, billing contact and plan (card details held by Stripe only); product-analytics events and a profile (name, email, role, plan, institution domain) and, during Fairgrade's beta, masked session recordings |
| Sensitive data | None is required or requested. The Customer must not upload special-category data; if a student includes it in their work, it is processed as part of the submission under the same protections |
| Frequency | Continuous, for the duration |
| The Customer's instructions in the Service | Who is enrolled; what is assigned and with which rubric; whether anonymous grading is on; whether AI scoring is enabled per assignment; whether feedback (including the AI summary) is shown to students; whether grades sync to the LMS; retention actions (archive, close) |
| Location | Amazon Web Services, US-East-1 (N. Virginia). Support chat: European Union. Enterprise customers may contract for a dedicated deployment in another region |
| Retention | Section 7 |
Annex I(C) — Supervisory authority
For EU data exporters, the supervisory authority of the Member State in which the Customer is established; for UK exporters, the Information Commissioner's Office.
Annex II — Technical and organisational measures
Fairgrade maintains the following. The trust page at www.fairgrade.com/trust records the current state and what is planned.
| Area | Measure |
|---|---|
| Encryption | Databases, file storage and backups encrypted at rest with AWS-managed keys (AES-256). TLS 1.2+ between users and the Service, with HTTP Strict Transport Security. TLS between the application and the database, verified against Amazon's root certificates, with the database refusing unencrypted connections. TLS to every subprocessor |
| Network | Application and database in a private network; the database is not reachable from the internet; only the load balancer reaches the application tier |
| Identity and access | Sign-in through Auth0; short-lived signed tokens verified on every request; server-side permission checks on every action; per-organisation multi-factor policy available to the Customer; SAML/OIDC single sign-on on Organization and Enterprise plans |
| Tenant isolation | Every record belongs to exactly one workspace; a session is bound to the workspace it was issued for; enforcement audited across the API (September 2026) |
| Peer anonymity | Reviewers and authors are anonymous to each other, enforced by the API |
| Files | Stored privately; downloaded only through short-lived links the server issues after authorising the request |
| Secrets | In a managed, encrypted vault; never in code or images |
| Fairgrade staff access | Separate staff identity boundary with enforced multi-factor authentication; access only for support and operations; every administrative call written to an audit log |
| Logging and monitoring | Request-level server logs; CloudWatch alarms on every service to an on-call address; external uptime monitoring and a public status page |
| Backups and recovery | Automated daily database backups with point-in-time recovery, 7-day retention in production; deleted files retained as storage versions for up to 30 days; infrastructure defined as code |
| Change management | Every change reviewed through pull request and automated tests; release by explicit approval |
| Vulnerability management | Dependency vulnerability alerts on every repository; security headers on the web application |
| Data minimisation | Product analytics carry an internal identifier and an approximate location derived from the IP address (not retained), never content; no name or email for students; staff have a profile with name, email, role, plan and institution domain; AI requests carry no identifiers; the in-house scoring service holds only opaque identifiers |
| Deletion | Documented lifecycle: cancellation window, anonymisation of identity, scheduled purge, each step recorded |
| Subprocessors | Written data-processing terms with each; listed publicly with 30-day change notice |
| Planned (not yet in place) | Independent penetration test; SOC 2 examination; formal log-retention schedule; customer-managed encryption keys on request; WCAG 2.1 AA audit |
Annex III — Approved subprocessors
| Company | What it does for us | What it sees | Where |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting: servers, database, file storage, queues, email delivery, logs; and the AI models (Anthropic's Claude, run through Amazon Bedrock inside Fairgrade's own AWS account, so Anthropic never receives the data) | All data in the Service. For AI features: submission content, rubric, brief and reference material, peer feedback text, and instructor-uploaded assignment or rubric documents for the readiness check; never a name, email or identifier; not retained, not used for training | United States (N. Virginia) |
| Okta, Inc. (Auth0) | Sign-in, single sign-on, multi-factor authentication | Name, email, password or your institution's identity assertion, role, sign-in times and addresses | United States |
| Stripe, Inc. | Billing and invoices | Account owner's name and email, plan and invoices. Card details are entered on Stripe's own form and never reach Fairgrade | United States |
| Mixpanel, Inc. | Product analytics and, during our beta, masked session replay | An internal identifier, which features are used, and page layout with all text and inputs masked. An approximate location (country, region, city) derived from the IP address, which is not kept. For staff, a profile with name, email, role, plan and institution domain. Never content or scores, and never a student's name or email | United States |
| Crisp IM SAS | Support chat | Your name, email, login identifier and analytics identifier, shared when the chat widget loads so a conversation can be matched to your account, and what you type. For staff, also your role, plan and institution name | European Union (France) |
| Google LLC (Google Workspace) | Our email and documents: privacy@fairgrade.com, info@fairgrade.com and correspondence about requests | What you put in an email to us: your name, address and the content of your request. Nothing from inside the Service is exported to it | United States |
Current list: /subprocessors.
Annex IV — FERPA addendum (United States institutions)
- School official. The Customer designates Fairgrade as a "school official" with a "legitimate educational interest" under 34 CFR 99.31(a)(1)(i)(B). Fairgrade performs an institutional service the Customer would otherwise perform with its own employees, is under the Customer's direct control over the use and maintenance of education records through the Agreement, this DPA and the Service's settings, and is subject to 34 CFR 99.33(a) on re-disclosure.
- Use. Fairgrade uses education records only to provide the Service. It does not re-disclose personally identifiable information from education records except to its subprocessors as needed to provide the Service, as the Customer directs, or as FERPA permits or the law requires.
- Access. The Customer controls who among its staff sees which records through roles in the Service. Fairgrade's own staff access records only for support and operations, under Annex II.
- Requests. Fairgrade refers requests from parents or eligible students to inspect, review or amend records to the Customer, and helps the Customer respond.
- Directory information. Fairgrade does not designate or disclose directory information; that is the Customer's to decide.
- Deletion. At the end of the Agreement, records are returned or deleted under Section 7; the Customer may ask for deletion after the 30-day window instead of the 12-month period.
- Annual notification. The Customer remains responsible for its annual FERPA notification to students and for any consents it requires; Fairgrade's Privacy Notice is available to support it.
- No commercial use. Fairgrade does not use education records for advertising, marketing, or to build profiles for any purpose other than the scoring the Service provides.
Annex V — United States state privacy laws
Where the CCPA or another U.S. state privacy law applies, Fairgrade is a "service provider" or "processor". Fairgrade: processes personal information only for the business purposes in Annex I(B); does not sell or share it; does not retain, use or disclose it outside the direct business relationship or for any purpose other than those purposes; does not combine it with personal information from other sources except as the law allows a service provider to; complies with the applicable law and gives the Customer the same level of privacy protection it requires; notifies the Customer if it can no longer meet its obligations; and allows the Customer to take reasonable steps to stop and remediate unauthorised use. The Customer may audit under Section 5. Fairgrade certifies that it understands these restrictions.