Privacy Policy

Last updated: 10 October 2026 · Version 2026-10-10-v2

1. Who we are

TeamShape is a process-based assessment platform for education. When your instructor uses TeamShape for a course, the instructor (and their institution) acts as the data controller — they decide why and how your data is processed. TeamShape operates as the data processor, handling your data on the instructor’s behalf to provide the service.

For questions about how your data is used in a specific course, contact your instructor. For questions about the platform itself, contact us at privacy@teamshape.org.

2. What we collect

When you use TeamShape, the following data is collected:

Account information — your name, email address, and student ID (if provided by your instructor).
Document edits — all changes you make to the team document, including the text before and after each edit, with timestamps.
Chat messages — messages you send in the team chat.
Comments — comments and replies you write on the team document, and when you write or resolve one.
AI conversations — the prompts you send to AI assistants and the responses you receive. This applies to both private AI and team AI.
Private scratchpad — the content of your personal scratchpad and changes to it.
Copy and paste actions — when you copy text from one workspace area to another (e.g., from AI chat to the document).
Navigation and timing — which workspace panel you are viewing and for how long.
File uploads — files you upload to the team workspace.
Course materials opened — which slides and readings from your instructors you open, and when.
Messages with your instructors — the messages your instructors send you on the platform and your replies, and when you read them.
Classroom code scans — when you scan the classroom code for an in-class quiz: the time, whether it was accepted, the network your phone was on (its first part only, such as 193.136.112.0/24, never your full address) and, when the quiz is limited to the classroom and your phone is not on its Wi-Fi, whether your phone was inside the classroom area and how far from it. Your location itself is never stored. The browser asks before sharing it.

3. Why we collect it

Your data is used for two distinct purposes:

Assessment (required for the platform to work)

TeamShape uses your working process — not just the final output — to compute fair individual contribution scores. This requires detailed records of how you worked: what you wrote, how you used AI, and how you collaborated with your team. Without this data, the platform cannot function.

Legal basis: legitimate interest (GDPR Article 6(1)(f)) — processing is necessary for the core service your instructor has chosen to use.

AI-detection checks

Your instructor may send the text of a submitted deliverable to Pangram Labs, an AI-detection service, to obtain a probabilistic assessment of whether the prose reads as machine-generated. Only the deliverable text is sent: never your name, your email address, your chat, your scratchpad, or your AI conversations. The result is stored with your submission and is visible to your instructors.

A detection score is evidence, not a finding. Such services carry documented false positives, and are known to misread writing by people whose first language is not English. TeamShape therefore records the result beside the writing history and never lets it enter a grade or a computed score by itself.

Legal basis: legitimate interest (GDPR Article 6(1)(f)) — academic integrity in assessment. You may ask your instructor what a check found about your own work.

Research (optional — your choice)

With your separate consent, your anonymized data may be used for academic research on AI-assisted learning. Research data is stripped of names, email addresses, and any other identifying information before analysis.

Legal basis: explicit consent (GDPR Article 6(1)(a)). You can decline or withdraw at any time without any effect on your grade, platform access, or course standing.

4. Who can see your data

Your teammates

Teammates see only the shared team document, its comments, and team chat. They cannot see your private AI conversations, your scratchpad, or your individual activity.

Your instructor

Your instructor sees the team document and its writing history (what was typed, pasted and revised, and when), activity counts such as AI calls, chat messages and focus time, contribution scores, and the AI-detection results on submitted work. The instructor's pages do not show your AI conversations (private or team), chat messages, comments on the team document, or scratchpad content.

An instructor of your course may also open TeamShape as you (“preview as student”), for example to see a problem you report or to look into a concern about your work. They then see your workspace in their own course as you see it, including your AI conversations, chat, comments and scratchpad, and nothing of your other courses. They cannot reply to messages or notices, or give consent, for you. What they do there is recorded under their name and never counts as your work.

The platform

TeamShape stores all workspace activity to compute contribution assessments. Platform administrators may access data for technical support and debugging.

Researchers (only with your consent)

If you opt in to research participation, anonymized data — with no names, emails, or identifiable information — may be shared with academic researchers.

5. How long we keep your data

Assessment data is retained for the duration of your course plus 12 months to allow for grade appeals and academic integrity reviews. After that period, data is deleted or irreversibly anonymized.

If you consented to research use, anonymized data (with all identifying information removed) may be retained indefinitely for ongoing and future academic studies.

6. Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

Access — request a copy of all personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — ask us to delete your data (subject to retention requirements for academic records).
Portability — download your data in a machine-readable format. You can do this directly from your assignment page using the “Download my data” option.
Object — object to data processing based on legitimate interest.
Withdraw consent — withdraw your research consent at any time from your assignment page, without affecting your platform access or grade.

To exercise any of these rights, contact privacy@teamshape.org or use the self-service options available in the platform.

You also have the right to lodge a complaint with a data protection authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).

7. Third-party services

When AI features are enabled for your assignment, your prompts and the relevant workspace context are sent to the AI model provider configured by your instructor (e.g., OpenAI). These providers process data under their own terms. For your own AI conversations, TeamShape does not share your name or email with AI providers — only the content of your prompts and workspace context needed to generate a response.

The instructors' assistant

Your instructors can use an assistant inside TeamShape to set up and run the course and to answer their questions about it (for example, who has not submitted, or how the class used AI). To answer, the assistant reads the course data the question needs, which can include your name, email and student number, your section and team, your submitted work, grades and feedback, activity and AI-use figures, and AI-detection results. The assistant runs on an API key the instructor provides, so that data is sent to that key's AI provider (for example OpenAI, Anthropic or OpenRouter), under the instructor's responsibility and the provider's terms. The assistant does not read your private AI conversations, team chat or scratchpad, which instructors cannot see either.

TeamShape keeps an instructor's conversation with the assistant for one year and the files they attach to it (such as a class list) for 90 days, and then deletes them.

8. Security

Your data is transmitted over encrypted connections (TLS) and stored in encrypted databases. API keys used for AI services are encrypted at rest. Access to production systems is restricted to authorized administrators.

9. Changes to this policy

If we make material changes to this policy, you will be asked to review and re-consent when you next access the workspace. The version number and date at the top of this page indicate when it was last updated.

TeamShape · privacy@teamshape.org