Data processing agreement

Roles

For student data, the institution is the data controller and Learnaway is the data processor. Learnaway processes data only on the institution's documented instructions.

Processing activities

By default, Learnaway processes the final submitted text and behavioural telemetry to produce homework-integrity signals, storing only the final text and the analysis results. The timing of the writing process is scored in memory and then discarded.

Process Replay is an optional processing activity enabled at the controller's instruction, per assignment. When enabled, Learnaway additionally retains a content-free timeline of the writing process (timing and event metadata only, never the characters typed). The controller is responsible for informing students; Learnaway surfaces a plain-English notice on every submission page.

Sub-processors and residency

We use vetted infrastructure sub-processors (e.g. hosting and database providers). EU data residency is available for European institutions.

Security and breach notification

We apply appropriate technical and organisational measures, including data minimisation (no keystroke content), access controls, and encryption in transit. We will notify the institution of any personal-data breach without undue delay.

Requesting a signed DPA

Licensed institutions can request a counter-signed DPA at hello@learnaway.ai.