How Qalami handles your pupils’ data

The school is responsible for the pupil data, for deciding that an assessment happens, for the relationship with parents, and for the records that result. They are the school’s records.

We process that data on the school’s instructions, to mark the work the school uploads and give it back. We do not use it for anything else, we do not sell it, and we do not use it to train AI models.

• The pages teachers upload: photographs or scans of pupils’ handwritten work, and typed work uploaded as PDF or Word files.
• What was written on them, transcribed, so the marking can quote the evidence.
• Pupil names and, if the school adds them, pupil numbers.
• If a teacher hands pupils a student link: the name a pupil types, and their student number and work if the link asks for them. A name that is not on the class list waits for the teacher to add it, and is deleted after 30 days if they do not.
• Marks, per-criterion judgments, written feedback, teachers’ own comments, and class reports. Some reports name individual pupils when they group them for support.
• A copy of a pupil’s approved report, in English and Arabic, when a teacher shares it with the family.
• A teacher’s private notes about a pupil, and a record of extra support the pupil was given (a small group, one to one, reteaching). Only that pupil’s teacher can see either, and neither is printed or sent to the family.
• Excerpts of approved writing that a teacher chooses to share with colleagues as examples of a level. An excerpt carries no pupil name and nothing that links back to the pupil or the paper.
• Teacher names, email addresses, and the picture each teacher chooses from a fixed set of colors and icons. No photographs are uploaded.

We do not ask for parent contact details, addresses, dates of birth, or photographs of faces.

Teachers may sign in with a Google account instead of an emailed link. When they do, we receive their email address and name from Google. Signing in asks for no access to Gmail, Drive, Contacts, Calendar or any other Google service.

The email address identifies the teacher and matches them to their school. It is stored alongside their name in the teacher record described above, is deleted when the school is deleted, and is never sold, shared for advertising, or used to train AI models.

A teacher can choose to import a class list from Google Classroom. Google then asks them to let Qalami read their Classroom classes and class lists, and nothing more: no email addresses, coursework, grades or files. Their browser reads the student names of the one class they pick, and the permission is withdrawn as soon as the names are read. Only the names the teacher then saves reach Qalami, just as if they had typed them.

Qalami's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google is never sold, used for advertising, or used to train AI models.

A teacher can choose a rubric or pupils' work from Google Drive or OneDrive instead of their computer. Google or Microsoft asks them first. Google's permission covers only the files the teacher picks, and Google remembers it until the teacher removes Qalami under "Third-party apps" in their Google account. Microsoft's covers reading the teacher's own files, and is dropped straight after they are chosen. The chosen files are fetched by the teacher's browser and uploaded exactly as if chosen from the computer. Nothing else in their Drive or OneDrive is read.

A teacher can choose to import a class list from a Microsoft Teams team. Microsoft asks them, and their school's IT admin, to let Qalami read which teams they belong to and who is in the one they pick. Their browser reads the names of the team's students, not its teachers or guests, and the permission is dropped as soon as the names are read. Only the names the teacher then saves reach Qalami.

Only the school’s own teachers, and each teacher sees their own classes. The database enforces this row by row, so one school cannot read another’s data even in principle. Four things go further, and only when someone at the school uses them: the school’s admin can read a small sample of colleagues’ approved papers to check that marking is consistent; a teacher can ask a colleague to second-mark a sample of their approved papers, and the colleague sees the pages but not the pupil’s name, or the first marks until their own are in; an exemplar a teacher shares is visible to every teacher in the school, with no name on it; and a teacher can share one pupil’s report with the family.

Teachers in the same school can see each other's name, email address and chosen picture on the school page, so they know who else teaches there. Nobody outside the school can.

A family link shows that one report to whoever holds the link, without signing in. The link is long and random, it expires after 90 days, and the teacher can stop it at any time, which deletes the copy. Later changes to the marks do not reach a link already sent.

The scans live in private storage and are never on a public address. A page is served through a link that expires within the hour.

• Scans: 90 days from the day the teacher approves the marking. The image has done its job by then; keeping it longer only adds risk. Papers reopened for a query keep their scans until the query is settled.
• Marks, feedback and reports: 3 years from when the assessment was set. This is the part a school actually uses across terms and years. After that the assessment is deleted automatically, with its marks, feedback, reports and any scans still attached. If one of its papers is reopened for review at the time, it waits until the review is closed. They are also deleted when your school leaves (see below), and we will delete them sooner whenever you ask.
• Family links: 90 days. The copy is deleted when its link expires or is stopped, or when the paper is deleted.
• Billing records are kept as financial records. They contain no pupil data at all, only token counts and costs.

When something is deleted, the images go with it. Deleting a class, a pupil or a paper removes the scans from storage in the same operation.

• Anthropic — the pages and the rubric are sent to its models to produce the draft marking, and the results come back to us. Anthropic does not use them to train its models, and deletes them within 30 days.
• Supabase — hosts the database, the sign-in accounts and the image storage, in Frankfurt, Germany.
• Railway — runs the application, in Amsterdam, the Netherlands. Pages and marks pass through it between the browser, the database and Anthropic. It does not store pupil work, though an error log can occasionally include a pupil’s name.
• Cloudflare — carries every request to the site, uploads included, and checks the free trial for automated use. It does not store pupil work.
• Resend — delivers the sign-in emails and account notices, such as trial reminders, renewal notices and colleagues asking to join. It handles teachers’ names and email addresses and never touches pupil work.
• Paddle — sells and takes card payments as merchant of record. It holds the payer's name, email address and card as its own customer record, and never touches pupil work.

Nobody else receives this data.

Nothing the AI produces is final. Every paper is a draft until a teacher reviews it and approves it, and the system records whether each mark was accepted or changed. The AI does not make a decision about a pupil on its own.

Access becomes read-only instead of disappearing. Everything already marked stays readable, and the school can export every record and every scan for 90 days. After that we delete it.

The school can take a complete export at any time from the account page, without asking us, and can also ask us for one. It can ask us to delete everything. Deletion covers the scans, the marks, the reports and the sign-in accounts, and we keep a dated record that it happened, with no pupil data in it.

This is a plain account of what the software does, and accepting it records that someone at the school was shown it. It is not a signed data processing agreement. If your school needs one, as many will for a formal procurement, ask us and we will provide one for your legal advisers to review.