Schools are the data controllers for what they put into SGAF, and the product is built around that. The public privacy notices describe each kind of processing and its lawful basis. The data processing agreement names the approved sub-processors in a schedule, and a school gets notice of any change with fourteen days to object.
AI processing has its own commitments. Customer data is never used to train a model, the provider typically keeps inputs and outputs for no more than thirty days, and a data protection impact assessment covers the AI features.
Records from tools that have been withdrawn stay available to the school that owns them, and a deletion request is completed within thirty days.