Last revised: 5-10-2026
TL;DR:
At Eduface, your privacy comes first. We never use student work, institutional data or personal data to train our AI models. Not by default, not on request.
All data is securely stored and encrypted, and processed exclusively on cloud infrastructure within the EU. We never sell your data. When your institution uses Eduface, the institution stays in control: we only process your data on its instructions, and only to provide feedback and assessment support.
Questions? Reach out to us at info@eduface.me.
Eduface, a trade name of Blockbook B.V. (Chamber of Commerce number: 89149033), with its office at Europalaan 93, 3526 KP Utrecht, the Netherlands, respects the privacy of its users and ensures that the personal information you provide to us is treated confidentially. This privacy statement explains how we collect, use, protect, and share your personal data. We process personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
Who Is Responsible for Your Data?
When your educational institution uses Eduface, for example through its learning management system, the institution is the data controller and Eduface is the data processor. We process personal data only on the institution’s instructions and under a data processing agreement. Your institution’s privacy statement explains how it handles your data.
When you create an account yourself through our website, visit our website, or contact us, Eduface is the data controller for that data.
Contact Information of Eduface
Name: Eduface (Trade name of Blockbook B.V.) · Address: Europalaan 93, 3526 KP Utrecht, the Netherlands · Email: info@eduface.me
For any questions regarding this privacy statement or the processing of your data, you can contact us.
Eduface processes various types of personal data depending on how you use our services. Below is an overview:
1. Identification and Contact Information: first and last name; email address; address details and phone number, if you provide them. 2. Account Information: username; password (encrypted storage); profile information such as role, preferences or settings. 3. Technical Data: IP address; browser information; cookies. 4. Usage Data: activity logs, frequency and duration of your sessions, and pages and features you use. 5. Content Data: student submissions, rubrics, assessment forms and course materials, and AI-generated feedback and grade suggestions with educator edits and approvals. 6. Communication Data: emails you send us, contact form information, and phone calls where recorded with consent.
Submissions can contain personal data, such as a name on a title page. Our AI models do not add personal data to the feedback they generate. We do not ask for special categories of personal data. If a submission contains such data, it is only processed to provide the service.
Eduface uses its own purpose-built AI models to generate feedback and grade suggestions on submitted work. We process your data for that purpose only.
No training on your data. Student work, institutional data and personal data are never used to train our AI models. Anonymous quality ratings. Educators can rate AI-generated feedback, for example with a thumbs up or down. These ratings are anonymous, contain no personal data, and are only used to improve the quality of our service. The AI assists, the educator decides. Institutions choose how much human oversight they want, for example whether educators review and approve feedback before students see it. Eduface does not make decisions with legal or similarly significant effects on students on its own. Final grading decisions remain with the educator and the institution.
Eduface is a Software-as-a-Service platform and does not manage physical infrastructure itself. We work with established cloud providers for hosting, AI processing, text recognition of scanned documents, and database services. All of them process data for Eduface exclusively on infrastructure within the EU. Your data is not transferred outside the European Economic Area.
Data is encrypted both in transit and at rest. Data of different institutions is kept separate. Our providers act as sub-processors under written agreements and are bound by the same obligations as Eduface. Institutions receive the current list of sub-processors as part of the data processing agreement. We never sell your data and do not share it with third parties, other than the providers we need to run the service or where the law requires it.
In case of a security incident, you can contact info@eduface.me. If a data breach affects an institution’s data, we inform that institution promptly, as agreed in the data processing agreement.
When Eduface acts as processor, the institution determines the purposes and legal basis for processing. Where Eduface is the data controller, we process personal data only for legitimate purposes and based on a legal basis:
1. Performance of a contract (Article 6(1)(b) GDPR): creating and managing your account; providing AI-based feedback and grading support on submitted work; storing and making submissions, rubrics and assessment forms available. 2. Compliance with legal obligations (Article 6(1)(c) GDPR): meeting tax and administrative obligations; responding to requests from regulatory authorities. 3. Legitimate interest (Article 6(1)(f) GDPR): securing our services and protecting them against abuse or fraud; improving our services and user experience, based on usage data and anonymous quality ratings; managing customer relationships. 4. Consent (Article 6(1)(a) GDPR): sending newsletters and marketing communications if you have given consent; placing non-essential cookies, where consent is required.
Eduface is not the rightholder of student work. The copyright remains with the author (the student), and institutions keep ownership of their data. Eduface uses submissions solely to provide feedback and assessment support, and never to train its AI models.
Your personal data is collected through your institution, for example via the integration with its learning management system; when you create an account or use our services; when you enter data, such as submissions, rubrics or assessment forms; when you contact us via email, phone, or contact forms; and through the use of cookies on our website.
We apply the following retention periods for different types of data: Identification and Contact Information: retained as long as your account is active or as necessary for customer management. Account Information: retained as long as your account is active; upon termination, data is deleted within 30 days unless legally required otherwise. Technical Data and Usage Data: retained for up to 12 months after collection for security and analytical purposes. Content Data: retained for the period agreed with your institution, by default 8 years, to meet record-keeping requirements for assessments. When a submission is deleted in Eduface, we delete it from our systems as well. When the agreement with an institution ends, we delete or return its data within one month. Backups are kept for a limited period and are removed when that period ends. Communication Data: retained for up to 12 months after the last correspondence unless legally required otherwise.
Eduface implements extensive security measures to protect your data: Encryption: All data is encrypted in transit and at rest. Access Control: Access is granted on a least-privilege and need-to-know basis. Only authorized personnel, bound by confidentiality, have access to personal data. Separation: Data of different institutions is kept separate. Network Protection: Firewalls and protection against malware and misuse. Monitoring: Logging and monitoring of our systems, with action on any unauthorized use. Vulnerability Management: Continuous checks for vulnerabilities and timely updates.
Under the GDPR, you have the following rights: right to access, rectify, and erase data; right to restrict processing and data portability; right to object to processing based on legitimate interest; right to withdraw consent for specific processing activities; and right not to be subject to a decision based solely on automated processing. You can exercise your rights by sending an email to info@eduface.me. We will respond within one month. If you use Eduface through your institution, the institution handles your request. Contact your institution directly or send your request to us, and we will forward it and help the institution respond.
If you are not satisfied with how we process your data, we encourage you to reach out to us first. After that you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the data protection authority in the country where you live or work.
Eduface may update this statement. The latest version is always available on our website, and the date of the last revision is stated at the top. We will inform you of significant changes via email or a notification on the platform.
Email: info@eduface.me · Address: Europalaan 93, 3526 KP Utrecht, the Netherlands