Privacy and security, by design

Antoinette is built around a simple principle: student data should be handled with at least as much care as the classroom itself. This page is a plain-language summary; the legal documents below are the binding commitments.

Our commitments

• Student data is held on the school’s behalf. We use it only to provide Antoinette to the school or instructor who created the account.
• We never sell student data or use it for advertising.
• We do not train AI on student work. Antoinette does not send student data to any AI or large-language-model provider.
• No third-party analytics or error-tracking services receive student data.
• Instructors create student accounts. Students cannot sign themselves up.

How we protect data

Data residency. EU users’ data is hosted in Frankfurt, Germany, and US users’ data in Oregon, USA. Student submissions, grades, course records and uploaded files stay in your region and are not copied to the other one. Two services are US-based: Stripe (instructor billing only, never student data) and GitHub (bug-report issues, with the reporter’s name and email excluded). See Subprocessors.

Encryption. All traffic to Antoinette is encrypted in transit (TLS). Our databases are encrypted at rest with managed keys.

Access controls. Access to student data is restricted to what’s needed to operate the service. Every access path is scoped to a school’s own data, and for our most sensitive tables the database itself enforces that separation as a second layer (Postgres row-level security). Multi-factor authentication is mandatory for our staff and for school administrators, using self-hosted authenticator codes with no third-party MFA vendor.

Audit log. Sensitive actions are written to an append-only audit log that records opaque IDs rather than names or emails.

Vendor oversight. Where we rely on third-party infrastructure providers, we hold them to data processing agreements consistent with our own commitments.

Student data and schools

• Roles. For student data, the school (or the instructor acting for it) is the data controller and Antoinette is the processor, under our Data Processing Addendum. For instructor account, billing and security-log data, Antoinette is the controller.
• Before an instructor adds students, they accept the Data Processing Addendum.
• Students’ own copies. Students can download a copy of their own account data, submissions and feedback from their profile page.
• Complete record of one student. For example, for a parent’s request: contact privacy@antoinette-official.com.
• Deletion. Deletion of student data is available on request: contact privacy@antoinette-official.com.
• Agreements. Schools with questions about agreements or procurement requirements can contact us.

GDPR (EU)

EU schools and instructors are served from our EU region in Frankfurt, kept separate from the US region.

• Roles. As above: the school or instructor is the controller of student data and we are the processor under our DPA.
• Your rights.
  • Access and portability: any user can download their own data as JSON from their profile page.
  • Rectification: users can edit their profile, and instructors can correct their students’ profile data.
  • Restriction: users can restrict activity tracking from their profile page. This is narrow in scope: login, submissions and grading continue.
  • Erasure: account deletion clears identifying information (name, email, contact details, photo, billing references), revokes sessions and disables second-factor credentials. Academic records such as submissions and grades are retained by the school as educational records.
• Retention. By default, the text and files of submitted work and the related integrity signals are cleared three years after submission, with a per-school override. Grades and the academic record remain. Instructor feedback and comments are not covered by this schedule today.
• Breach notice. We commit to notify the relevant supervisory authority within 72 hours where required, and to notify the instructor or school as controller without undue delay.
• AI. The platform does not use AI or third-party models to process your data. The plagiarism and integrity signals are produced by non-AI heuristic analysis on infrastructure we operate.

Subprocessors

These are the third parties that process personal data on our behalf.

We do not send personal data to any AI or large-language-model provider, analytics platform, error-tracking service or customer-support SaaS. If that changes, this list is updated first. AWS and Stripe rely on their own subprocessors under their published lists and agreements.

Legal documents and contact

• Privacy Policy
• Terms of Service
• Data Processing Addendum

Questions about privacy or security: privacy@antoinette-official.com.