No.

We have agreements with our subprocessors establishing that the content being processed is not used to train or improve models. With the AI provider we use (Google Vertex AI), this is contractually guaranteed. A student text entered into Evalo is used to generate the feedback it is intended for - and nothing else. It does not become part of a training dataset, and it does not reappear anywhere else.

No. The student remains the owner of their own text.

The AI processing takes place at Google Vertex AI under Google's data processing agreement (Cloud Data Processing Addendum). It establishes that Google does not own the content being processed, and does not train on it. Nothing in Evalo transfers any rights away from the student - the text is used solely to produce the feedback, and the student retains the copyright to their own work.

Within the EEA.

All our subprocessors store data in databases within the EEA - including Google (Belgium) for the AI processing and Feide for login (Norway). In practice, this means that the parties processing your data are subject to GDPR, and all processing takes place in accordance with the regulations.

The academic text of the submission - but not the student's name, email, phone number or national ID number.

The de-identification happens locally: before a submission is sent, direct identifiers such as name, email, phone number and national ID number are removed from the text on your own device. Evalo recognizes the student name from the school directory (Microsoft or Google), so that it is removed accurately. It is the de-identified text that is sent to the AI model.

Norwegian education authorities (Udir) are clear that schools adopting AI should limit which personal data is shared with the model. The de-identification in Evalo does exactly this: direct identifiers are removed before the text reaches the model.

Evalo assists. The teacher does the assessing.

This is a deliberate design choice, not a detail: the tool is built to support the teacher's work, not to automate it. The workflow in the application is designed so that the teacher is genuinely involved in the assessment - the AI provides a foundation, and the teacher applies their professional judgment.

We believe this is essential for two reasons. One is legal: data protection law places limits on decisions made solely by automated means, without a human in the loop. The other is pedagogical, and it has been with us from the start - feedback is about the relationship between student and teacher, and that relationship disappears if the assessment is handed over to a machine.

Evalo falls into the high-risk category under the AI Act, and we are already building according to its requirements.

High-risk is the strictest category that is permitted. The requirements have not yet entered into force, but we are already following their principles.

Two of the central requirements are transparency and human oversight. Transparency is built into the tool itself: the teacher can see what the AI has emphasized in the assessment, and can override choices it has made. Evalo is not a black box - the teacher can follow the reasoning behind every piece of feedback. And the human oversight will be familiar from the previous question: that the AI assists and the teacher assesses is not just our pedagogical stance - it is the core of what the regulation requires of high-risk systems.

No.

We have agreements with our subprocessors establishing that the content being processed is not used to train or improve models. With the AI provider we use (Google Vertex AI), this is contractually guaranteed. A student text entered into Evalo is used to generate the feedback it is intended for - and nothing else. It does not become part of a training dataset, and it does not reappear anywhere else.

No. The student remains the owner of their own text.

The AI processing takes place at Google Vertex AI under Google's data processing agreement (Cloud Data Processing Addendum). It establishes that Google does not own the content being processed, and does not train on it. Nothing in Evalo transfers any rights away from the student - the text is used solely to produce the feedback, and the student retains the copyright to their own work.

Within the EEA.

All our subprocessors store data in databases within the EEA - including Google (Belgium) for the AI processing and Feide for login (Norway). In practice, this means that the parties processing your data are subject to GDPR, and all processing takes place in accordance with the regulations.

The academic text of the submission - but not the student's name, email, phone number or national ID number.

The de-identification happens locally: before a submission is sent, direct identifiers such as name, email, phone number and national ID number are removed from the text on your own device. Evalo recognizes the student name from the school directory (Microsoft or Google), so that it is removed accurately. It is the de-identified text that is sent to the AI model.

Norwegian education authorities (Udir) are clear that schools adopting AI should limit which personal data is shared with the model. The de-identification in Evalo does exactly this: direct identifiers are removed before the text reaches the model.

Evalo assists. The teacher does the assessing.

This is a deliberate design choice, not a detail: the tool is built to support the teacher's work, not to automate it. The workflow in the application is designed so that the teacher is genuinely involved in the assessment - the AI provides a foundation, and the teacher applies their professional judgment.

We believe this is essential for two reasons. One is legal: data protection law places limits on decisions made solely by automated means, without a human in the loop. The other is pedagogical, and it has been with us from the start - feedback is about the relationship between student and teacher, and that relationship disappears if the assessment is handed over to a machine.

Evalo falls into the high-risk category under the AI Act, and we are already building according to its requirements.

High-risk is the strictest category that is permitted. The requirements have not yet entered into force, but we are already following their principles.

Two of the central requirements are transparency and human oversight. Transparency is built into the tool itself: the teacher can see what the AI has emphasized in the assessment, and can override choices it has made. Evalo is not a black box - the teacher can follow the reasoning behind every piece of feedback. And the human oversight will be familiar from the previous question: that the AI assists and the teacher assesses is not just our pedagogical stance - it is the core of what the regulation requires of high-risk systems.