Your information deserves careful handling.

SudoStudy is operated by GitCode Limited, registered in Hong Kong (company number 2989521), at Rm 7B, One Capital Place, 18 Luard Road, Wan Chai, Hong Kong. Contact our privacy team at contact@sudostudy.com.

For school-directed assessments, the school normally decides why and how student information is used and acts as controller. We process that information on its instructions. The school supplies its own privacy information and determines its lawful basis; our agreement with the school governs those instructions.

GitCode Limited acts as controller for its own account administration, billing, communications, security and service-management purposes, and for services provided directly to individual account holders. A student is not automatically a controller simply because they have an account.

Account and school information: names, email addresses, profile images, contact details, roles, school and class or group membership, and subject choices.

Assessment information: questions, papers, mark schemes, assignments, typed answers, uploaded images and scanned scripts, marks, feedback, progress and completion times.

Authentication and integrations: login and session information, password hashes where password login is used, and permissions or tokens needed for connected services.

Service and commercial information: device/browser details, IP addresses, usage events, diagnostics, support messages, feedback, subscription and invoice records, and transaction references. Stripe processes card payments; the application does not store full payment-card details.

Information comes from you, your school, your activity and integrations you or your school authorise. Upload only information needed for the assessment. Avoid including health information or unrelated private details unless specifically agreed with your school and us.

We use information to create and secure accounts; manage classes and assignments; extract document content; provide AI-assisted marking, feedback and progress reports; connect authorised integrations; provide support; manage subscriptions; diagnose problems; and protect the service. We do not sell personal information or rent it for marketing.

Where we act as controller, our lawful bases depend on the purpose: performing our contract with an individual account holder; legal obligations such as accounting; and legitimate interests in administering school relationships, operating and securing the service, resolving problems and responding to enquiries. We must assess those interests against people's rights, with particular care for children.

Where consent is required, including for non-essential tracking or certain communications, it must be obtained and people must be able to withdraw it. Accepting our terms does not replace consent. School-directed assessment processing follows the school's instructions and lawful basis.

Relevant questions, mark schemes, responses, images and PDFs are sent to AI and OCR (text-recognition) providers for extraction, matching scripts to students, marking, question generation and feedback. Some workflows also send student names, identifiers or email addresses to match work to the correct account.

Our current integrations include Google's Gemini API, Mathpix for document extraction and Z.ai for certain OCR workflows. Processing, retention and any provider improvement use depend on the service, applicable contract and account settings. Google's paid Gemini API terms distinguish paid-service data from unpaid-service data. Mathpix provides a configurable quality-improvement setting. Contact us for the provider arrangements applicable to your school before uploading personal information.

SudoStudy does not currently train or fine-tune its own foundation model. Assessment examples are used in internal quality evaluation, which is different from model training. Evaluation involving school personal information must be covered by the school's instructions or another valid legal basis and appropriate safeguards. No-model-training does not mean content is never processed or retained by a provider.

AI output can be inaccurate. Teachers should review marks and feedback and retain responsibility for assessment decisions. AI output should not be the sole basis for decisions with legal or similarly significant effects on a student.

We share information needed for the features in use. Providers may act as our processors or, for some purposes such as payment services, under their own responsibilities. A school's processing agreement should identify its authorised subprocessors.

Hosting, storage and delivery: Fly.io, Amazon Web Services and Cloudflare. AI and document processing: Google Gemini, Mathpix and Z.ai, depending on the workflow. Diagnostics and usage analysis: Sentry and PostHog. Billing, communications and feedback: Stripe, AWS email services, Pipedrive and Canny, as applicable.

Optional integrations include Google sign-in, Google Classroom/Drive, Microsoft sign-in and Meta/WhatsApp where enabled. Connected services share information according to the permissions granted. You can revoke an integration through its account settings; revocation does not itself erase information already imported.

We may disclose information to professional advisers, authorities where legally required, or a successor if the business is transferred, subject to applicable safeguards. School assessment information may be available to authorised teachers and administrators within the school.

GitCode Limited is based in Hong Kong. Our core application and production database are hosted in Frankfurt, Germany. Hosting in Germany does not mean all processing stays there: providers, support access, AI processing, email delivery and monitoring may involve other countries, including the United States and India.

International transfers require protections appropriate to the information and organisations involved. UK school agreements must identify the transfer route and safeguards, such as an applicable adequacy decision or the UK International Data Transfer Agreement or UK Addendum, together with any required transfer assessment. Contact us to request the arrangements and relevant safeguards for your school.

Our technical measures include HTTPS/TLS for platform connections, hashed passwords where password login is used, authenticated access and role-based permissions, backups and operational monitoring. Staff may need access to provide support, investigate incidents or maintain the service. Access must be appropriate to the task and subject to applicable confidentiality obligations.

When acting as a processor, we notify the affected school without undue delay after becoming aware of a personal-data breach and provide information to help it meet its obligations. Where we act as controller, we assess and meet our own regulator and individual notification duties. Those duties depend on the circumstances and applicable law.

We retain information for the purposes described above, taking account of the school's instructions, account or contract duration, support and security needs, and legal requirements. Retention differs across assessment records, uploaded files, diagnostics, payment records and provider systems.

Contact us or use the account-deletion function to request deletion. For school-managed records, we coordinate with the school to confirm scope and authority. We explain any information that must be retained and the applicable period. Account deletion does not guarantee that every related file or provider copy is erased immediately.

Production database backups operate on a rolling retention period of up to 30 days. Deleted live records can remain in restricted backups until expiry. If a backup is restored, applicable deletion instructions must be reapplied. Provider retention periods and lawful retention exceptions are addressed separately when responding to a request.

The service uses cookies or similar storage for sign-in, security and preferences. Depending on configuration, monitoring and analytics tools collect usage, error and session information. Non-essential cookies or similar technologies require consent where applicable. Browser settings can restrict storage, although blocking essential cookies may prevent sign-in. Contact us about your options.

We send service messages such as account, assignment and billing notifications. You can opt out of marketing through an unsubscribe option or by contacting us. Messages needed to operate your account may still be sent.

Depending on the circumstances and applicable law, you may request access, correction, deletion, restriction or portability of personal information, object to certain processing, and withdraw consent where processing relies on it. Rights have conditions and exceptions.

For school-managed information, contact your school first. If you contact us, we help route the request to the appropriate school. We may need proportionate information to confirm identity or authority. Parents and guardians can assist children, taking account of the child's rights and ability to act for themselves.

Email contact@sudostudy.com with the subject 'Privacy request', identifying the account and school involved. Do not send passwords or unnecessary student documents. Where we are responsible for a UK GDPR request, we normally respond within one month, subject to the applicable rules on clarification, identity verification and extensions.

You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or your relevant local authority. You do not have to contact us before exercising that right.

Your school uses SudoStudy to help with assessments and feedback. Your answers and work may be processed by AI services and seen by your teachers. Ask your teacher if you want to know what is saved, who can see it, or how to correct it. Never put your password or private information unrelated to the assessment in an answer or upload.

We publish updates on this page and change the date above. We communicate material changes as required by law or our school agreements. This notice explains processing; it does not replace the school's own notice or its data-processing agreement with us.