When a centre uploads learner work to a platform, it transfers personal data with it. The short answer: written work, recordings and scores are all personal data, and responsibility does not transfer with the file.
Which data is sensitive
- Speaking recordings: voice is treated as biometric data under many regimes.
- Written responses: may contain personal circumstances, family details, private opinions.
- Scores and feedback: affect a learner's opportunities.
- Learner lists: names, emails, phone numbers, sometimes dates of birth.
Six questions to ask before signing
- Is my centre's data separated from other centres' at the data layer, or only in the interface?
- Who can see submissions and scores — is access role-based, or can any signed-in staff member see everything?
- Where are recordings stored, for how long, and can they be deleted on request?
- Is data sent to any AI model provider, and can that content be used for further training?
- Is there an access log showing who viewed which learner's work?
- When we leave, in what format is data returned and how soon is it deleted?
The fourth is the one most often skipped and the hardest to undo if answered badly.
Three minimum protections
- Tenant separation. Every business record belongs to an organisation and every query filters by it. This is an isolation boundary, not a display filter.
- Role-based access. Teachers see their classes, administrators see the organisation, learners see only their own work and only released results.
- Unreleased means invisible. Scores and feedback awaiting review must not appear in any learner-facing endpoint, not even indirectly through a status field.
LinguaGrade is built on these three: data scoped by organisation, permissions by role, and results reaching learners only after passing the release gate. See How far you can trust AI marking.
The centre's own half
Technology covers half of this. The other half is process:
- Collect consent from learners, and from parents where learners are minors.
- State in your terms how long work is kept and what it is used for.
- Never send submissions or scores through group chats.
- Review the list of administrator accounts each term and remove people who have left.
Frequently asked questions
Does consent have to be in writing?
It depends on the rules that apply to your centre. Even where it is not required, clear written consent is the cheapest way to avoid disputes.
How long should recordings be kept?
Long enough to handle appeals and verify results, typically to the end of the term. Indefinite retention adds risk without adding value.
The vendor says data is encrypted. Is that enough?
No. Encryption protects data in transit and at rest; it says nothing about who inside the system is allowed to look.
Sources
Internal evidence: LinguaGrade architecture and access-control notes.