Privacy
Privacy policy
What personal information Corrobora handles, why, where it is kept and for how long, and the rights of the people it concerns.
Draft of 23 October 2026, not yet in effect
Who is responsible
Corrobora is operated by [Company legal name]. It acts in two roles.
- For essays and student details uploaded by an institution, Corrobora works on the institution's behalf, as its service provider. The institution decides what is uploaded and remains responsible for that information under the privacy laws that apply to it. We use it only to provide the checks, under our agreement with the institution.
- For website visitors, people who ask to join the pilot, and account holders (instructors and administrators), [Company legal name] is responsible.
What we collect and why
| Information | Why |
|---|---|
| Accounts: name, institutional email, roles, sign-in times. Passwords are stored only as a salted fingerprint, never as written. | To let staff sign in and see only what their role allows. |
| Essays: the file, its text, and the student's last name and student number taken from the file name. | To run the checks and show the results to the course's instructors. |
| Results and corrections: verdicts, findings and the corrections instructors make. | To show reports, and to apply corrections each time the checks run. |
| Audit log: who did what, and when. It does not contain essay text. | Accountability: any result can be traced and explained. |
| Pilot requests: what you send us by email. | To reply to you. |
This website uses no cookies, no analytics and no advertising trackers. The app uses a single cookie to keep you signed in.
What we never do
- Sell or rent personal information.
- Use essays to train AI, or send them to an AI service.
- Use essays to develop Corrobora without the institution's written permission.
- Show one institution's information to another.
Where information is kept
All information is stored on servers located in Canada, operated by [Hosting provider], a Canadian-owned company. It is not transferred outside Canada. We host it only with Canadian-owned companies, which limits, but does not remove, exposure to foreign laws such as the United States CLOUD Act, which can compel American companies to hand over data stored abroad. Each institution has its own database and folder, separate from every other institution's.
What leaves our servers
To check sources, Corrobora looks up the text of each reference in public scholarly catalogues (Crossref, OpenAlex, Unpaywall and the OAPEN Library) and opens the web pages that references point to. Some of these services are outside Canada. These requests contain bibliographic information only: never the essay, the student's name or student number. See Security and data for the full list.
We disclose personal information only if the law requires it. If that happens, we tell the institution concerned unless the law forbids it.
How long we keep it
- Essays, student details and the sentences quoted from them: each institution sets its own period, up to seven years, before any essay can be added. An essay with an academic integrity report is kept as long as the report. Anonymous counts and verdicts may be kept after that.
- Academic integrity reports: each institution sets its own period, up to seven years.
- Accounts: while the account is active, then deleted within 90 days of being closed.
- Audit log: kept for the period the institution sets, up to seven years, without essay text, so decisions can be explained if they are questioned.
- When a contract ends: all of the institution's information is deleted within 90 days, after we return a copy if it asks for one.
Your rights
Students can ask their institution to see or correct information about them; we help institutions answer within 30 days. Account holders and visitors can write to our Privacy Officer, Gabriel Imbeau, to see, correct or delete their information, or to withdraw consent.
You can also complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec, or to your province's privacy commissioner.
If something goes wrong
If information is accessed without authorization, we tell the institutions concerned without delay. Together with them, we notify the privacy regulators and the people affected whenever there is a risk of serious harm, and we keep a record of every incident.
Contact and changes
Privacy Officer, [Company legal name]: Gabriel Imbeau, privacy@corrobora.ca.
We tell institutions about any significant change to this policy 30 days before it takes effect.