How WISCA protects students' data
Last updated 29 October 2026
- Two roles
- Consent and who sees what
- The assistant and handwriting reading
- How long records are kept
- Where data is held
- Sign-in and security
- Common questions
Two roles
When a school puts its students into WISCA, the school decides why and how their information is used, and WISCA keeps and processes it on the school's behalf. For people who ask for a demo, and for staff sign-in, WISCA is the controller. The privacy page is the full policy; this page is a summary of it.
Consent and who sees what
A school records whether each student's parent has given or withdrawn consent, and how. Every change is kept with who recorded it and when. Everyone under 18 is treated as a child. A student's teachers see their classes' marks. A student and their parents see a result only after the teacher shares it. Administrators see counts only. Each school's data stays its own, and a school's data is visible only to the people at that school who need it.
The assistant and handwriting reading
Both are optional and off until a school's administrator switches them on. The assistant is given a teacher's sentence and counts, such as how many papers are marked, and is never sent a student's name, answer, mark or identifier. Handwriting reading needs each student's consent to be recorded, sends only cropped answer areas, and every reading is a suggestion that a teacher confirms before it becomes a mark.
| Service | What it does | When |
|---|---|---|
| Cloudflare | Hosts the website, the application, the database and the stored files. | Always |
| Anthropic | Answers the assistant's requests and, if the school chose a Claude model, reads handwriting. | Only when a school switches it on |
| Google Cloud Vision | Reads the text in cropped answer areas. | Only when a school chooses it for handwriting reading |
How long records are kept
| Record | Kept |
|---|---|
| A student's records | 365 days after the school marks the student as having left (a contract can set 30 to 1,825 days). The school is told 30 days before the erasure runs. |
| Scanned images of pages | 365 days after scanning. The page, its marks and its reading stay. |
| Printed papers | 365 days after printing. |
| Uploads that never became pages | 30 days. |
| Pictures made for handwriting reading | Deleted once sent and answered; at most 48 hours otherwise. |
| Assistant run records | 90 days. |
| A demo request and its chat | Up to 24 months after the last contact, or sooner on request. |
Where data is held
WISCA is hosted on Cloudflare's network. The database has an Asia-Pacific location, and the application runs from Singapore, next to the database. Cloudflare can pin a database only to some regions, and Asia-Pacific is a best-effort location, not a guarantee. WISCA does not promise that data stays in India.
Sign-in and security
People sign in with a login their school issues: a school code, a username and a password. Passwords are kept only in a scrambled form that cannot be read back. Two-step sign-in with an authenticator app is available. Every mark and setting change is recorded in an audit trail. Before a release reaches a school it goes through hundreds of end-to-end checks in a real browser, on a desktop and on a phone. No security certification or outside audit is claimed on this page; for a school's security questionnaire, write to ceo@wisca.io. To report a problem, write to the same address and do not include students' personal details.
Common questions
Who is responsible for a student's data in WISCA?
The school decides why and how its students' information is used, as the data fiduciary under India's Digital Personal Data Protection Act, 2023. WISCA keeps and processes it on the school's behalf, as its processor.
Does the AI assistant see student names or marks?
No. The assistant is given the teacher's own sentence and counts, such as how many papers are marked. It is never sent a student's name, answer, mark or identifier.
Where is WISCA's data stored?
WISCA is hosted on Cloudflare's network. The database has an Asia-Pacific location and the application runs from Singapore. WISCA does not promise that data stays in India.
Can a student's records be erased?
Yes. A student's records can be erased on request, and old records are swept on a schedule instead of being kept for ever.