Privacy Policy

What reaches Steletta through a connector

When you ask Steletta to review material in ChatGPT or Codex, OpenAI reads the source and retains the conversation and original attachment according to your account settings. Steletta receives the task-level content and structured review data needed for the review, but it does not receive the original attachment, file-download link, complete extracted document, or full chat history.

When you request a review in Muse, Muse sends the original PDF to Steletta through your connected Steletta account. Steletta temporarily stores that PDF while the review runs and keeps the completed report in your connected workspace. Steletta does not receive your full Muse conversation history.

Depending on the connector, Steletta receives the information needed to perform and display the review:

• basic material metadata, such as title, subject, grade, purpose, page count, and question count
• a compact inventory of questions or tasks and the unabridged original printed stem or instruction for every learner task, including shared directions when needed to understand it
• structured item checks, such as item identifiers, answerability, independently solved and supplied answer positions, option counts, skills, and risk flags
• answer choices, keys, explanations, visual details, or additional source excerpts when needed to support a finding, source check, or targeted verification step
• item-level conclusions, findings, evidence, recommendations, coverage assessments, strengths, confidence information, and score inputs
• for ChatGPT and Codex, a pseudonymous identifier supplied by OpenAI, which we immediately hash and use for rate limits, job ownership, abuse prevention, and continuity during the review
• for Muse, the original PDF, any purpose or grade information you provide for the review, the connected Steletta workspace, and technical request information used to authenticate the connector, apply account limits, prevent abuse, and keep the review together; the connector does not send your Meta profile name, email address, or profile identifier to Steletta

For documents with 101–250 learner tasks in ChatGPT or Codex, the connector may first send only the task count so Steletta can ask whether you want to continue. Steletta does not use connector identifiers to obtain your name, email address, platform profile, contacts, or other conversations.

We cannot delete a conversation or attachment held by OpenAI or Meta; use the controls in ChatGPT, Codex, or Muse for that data. See OpenAI’s privacy policy and Muse’s privacy policy.

Connector retention and controls

ChatGPT and Codex review state remains for up to 6 hours after the last update while a review is active and up to 2 hours after completion. Short-lived duplicate-request records expire after about 10 minutes.

ChatGPT and Codex state is tied to a hashed connector identifier rather than your email address. We normally cannot connect an email request to that short-lived state. It expires automatically under the schedule above; you can manage the original conversation and attachment through OpenAI.

Muse PDF copies follow the website and API source-file deletion schedule below. Completed Muse reports in a personal workspace remain until you delete them or close the workspace. Reports in an organization workspace follow its selected retention setting or written agreement. You can manage the Muse conversation and its attachment through Muse.

Steletta’s connector servers do not place analytics or advertising cookies in your ChatGPT, Codex, or Muse conversation.

Data collected through the website and API

Depending on the feature you use, we collect:

• Account data: name, email address, profile image, authentication provider, workspace membership, and session information
• User content: files, pasted text, document metadata, instructions, learning goals, and other material submitted for review
• Review data: processing status, verdict, scores, findings, quoted evidence, suggested fixes, strengths, and report history
• Shareable review pages: if you choose to publish one, the public title, optional publisher name, review date, pass result, selected strengths, review scope, and a non-secret reference code
• Organization and API data: organization name, member roles, API-key records, webhook configuration, usage, and customer-supplied identifiers used to reconcile requests
• Billing data: plan, subscription status, usage, Stripe customer and subscription references, and transaction records. Stripe receives payment-card details directly; Steletta does not store complete card numbers
• Communications: support requests, pilot inquiries, email preferences, and service messages
• Technical data: IP address, browser and device information, request time, pages viewed, security events, errors, and diagnostic records created by our hosting and security systems

If you sign in with Clever, we use your Clever user identifier, role information to confirm teacher access, and your name and email address when provided. We store your Clever account link and available name and contact email to create and maintain your Steletta account. Other profile fields supplied in Clever’s identity response are discarded. This sign-in integration does not sync class rosters or student records, and Steletta does not receive your Clever password. These account records follow the account and workspace retention schedule below.

You may paste text or choose a file before signing in. Until you sign in, obtain access, and submit the review, that draft remains in the memory of your browser tab and is not uploaded to Steletta.

Retention and deletion

Deleting a source removes it from the active private file store rather than moving it to an account trash folder. Steletta does not offer source-file recovery, so keep your original. Deletion jobs retry after temporary failures, and provider caches may take a short time to clear.

Cookies and analytics

We use essential cookies to keep you signed in, protect sessions, and remember necessary service state. Google Analytics may use cookies or similar technology to measure visits and product usage. We do not use advertising cookies. You can block or delete cookies in your browser; blocking essential cookies may prevent sign-in.

How we use data

We use data to provide requested reviews, authenticate users, keep workspaces and reports available, calculate usage, process billing, send requested service messages, provide support, secure the Services, prevent abuse, diagnose failures, comply with law, and improve reliability.

We do not use source materials, pasted assessment text, report evidence, or tutor conversations to train generative AI models. We may use content-free or de-identified measurements, such as document-size bands, processing times, score ranges, error counts, and review-route outcomes, to evaluate capacity and quality. These measurements do not include source text, filenames, report prose, account details, network data, or job identifiers.

Legal bases

Where data-protection law requires a legal basis, we process data as needed to perform our contract with you or your organization, for legitimate interests such as security and service improvement, with consent where requested, and to meet legal obligations. You may withdraw consent at any time, without affecting earlier processing.

Who receives data

We disclose data only as needed to operate the Services, follow your instructions, protect users, complete a business transaction, or comply with law. Our main recipient categories and providers are:

Additional model providers may be used for a defined review step when they offer appropriate business data protections. We will update this policy and provide any notice required by law before a new provider processes user content.

We do not sell personal data. We do not share source material or review content for targeted advertising. We may disclose information to professional advisers, authorities, or a successor in a merger, financing, acquisition, or sale, subject to appropriate confidentiality and legal safeguards.

Operational and legal retention

Security

We use access controls, private storage, encryption in transit, scoped credentials, expiring upload permissions, rate limits, and deletion workflows designed to protect data. No system can guarantee absolute security. If we learn of a breach that requires notice, we will notify affected users and authorities as required by law.

Your choices and rights

You can delete personal reports in History, manage email preferences and close a personal workspace in Settings, manage billing in Usage, and control connector conversations and attachments through OpenAI or Muse.

Depending on where you live, you may ask to access, correct, export, delete, restrict, or object to our use of personal data, or appeal a decision about a request. You may also complain to your local data-protection authority. We may need to verify your identity and authority before completing a request. Authorized agents may contact us on your behalf where permitted by law.

International processing

Steletta and its providers may process data in the United States and other countries. Where required, we use contractual and organizational safeguards for international transfers.

Changes to this policy

We may update this policy as the Services or legal requirements change. We will change the effective date above and provide additional notice when a change materially affects how we use personal data.