Privacy and data notice
What GroupWorks collects and where it is stored
This notice is written to support privacy review and PIA work. It is not a certification of compliance with FERPA, FIPPA, or any other legal framework.
Data We Collect
- 01
Account and course setup
Instructor and student names, email addresses, account roles, course titles, rosters, invitations, and enrollment status.
- 02
Onboarding surveys
Student survey responses used for group formation, such as availability, work preferences, role preferences, skills, and collaboration style.
- 03
Group agreements
Agreement text and structured agreement fields, including roles, communication tools, meeting cadence, response expectations, deadline policies, conflict or escalation plans, contact handles that students choose to enter, signatures, and timestamps.
- 04
Assignment workspace activity
Group-created tasks, deliverables, milestones, meetings, attendance records, minutes, contribution logs, evidence links, and concern reports, with a timestamped history of every change to them.
- 05
Peer evaluation
Peer-evaluation setup, ratings, comments, private comments to the instructor, submission status, and derived review flags shown to instructors. Those flags are worked out each time the review page is opened, are never stored and are never shown to students, and they cover raters who are far apart, a low overall average, a rater who gave every teammate the same score on every question, and a rating that points the opposite way to what the workspace records. When a student rates themselves and a rating points the opposite way to their own workspace record, they are asked to explain it; the rating, the record figures they were shown, their explanation and the time are stored, and only instructors see them.
- 06
Billing and support
Instructor subscription status and billing identifiers. Payment details are handled by Stripe, not stored directly in GroupWorks.
Where Data Is Processed
Browser requests are sent over HTTPS to the GroupWorks application hosted on Vercel. The application validates the user session and authorization before reading from or writing to the database.
Persistent application data is stored in Supabase Postgres. For the Canadian deployment, the Supabase project is configured for database storage in Canada. Vercel still transiently processes application requests before data is written to or read from Supabase.
When email features are enabled, invite emails, reminders, revision notices, and signed agreement copies may pass through the configured email provider (Resend, when configured). Instructor billing is processed by Stripe.
How Agreement Data Is Stored
Group agreements are stored in the database as structured records. The main agreement table stores JSONB fields for agreement sections, role assignments, communication cadence, response expectations, deadline policy, and related structured agreement content. Signatures are stored separately with signer IDs and timestamps.
GroupWorks does not currently encrypt agreement fields in the browser before sending them to the server, and it does not apply application-level field encryption to individual agreement columns before storing them in Supabase. Protection is provided through HTTPS in transit, provider-managed encryption at rest, authentication, server-side authorization checks, and database access controls.
How Workspace History Is Kept
Each change in an assignment workspace — adding or editing a task or deliverable, marking it done, moving a due date, recording attendance, saving minutes, or adding or removing evidence — is stored as a separate step with the person who made it and the time the database recorded it. Steps cannot be edited or deleted through GroupWorks by anyone, instructors included; the database refuses it. They are deleted with their group or course, and a deleted account’s name is removed from the steps it made.
Group members and course staff can see each item’s history. Peer evaluation shows each student’s record from it: deliverables handed in and when, how many were on time, tasks completed, and meetings attended. Instructors also see who else marked a student’s work done and due dates moved after they had passed. Workspace entries are made by students themselves, so the record is context for a conversation, not a grade.
Who Can Access Data
Students can access their own course and group surfaces. Group agreement content is visible to members of that group. Instructors can access data for courses they own, including rosters, group formation data, group agreements, workspace activity, concerns, and peer-evaluation review data.
Operational administrator access is limited to support, security, and account administration needs. Direct browser access uses Supabase row-level security policies where applicable; primary application access is also checked in the server-side code before data is returned or changed.
Retention And Deletion
Course data is retained while the instructor account and course remain active, unless deletion is requested or a separate institutional retention agreement applies. For deletion or privacy questions, contact GroupWorks through the support channel on the contact page.
Contact us about privacy