Privacy Policy for iAWE

Last Updated: June 2026

iAWE (Intelligent Academic Writing Evaluation Assistant) is an AI-assisted academic writing evaluation system built strictly upon the EASE Framework 1.0 (Evidence-Anchored Scaffolding Evaluation). Distributed as a Google Sheets Add-on via the Google Workspace Marketplace, iAWE is designed to prioritize user data privacy and adhere strictly to Google's User Data Policy. This policy explains what data the Add-on accesses, how it is used, and confirms what data is not collected.

1. Google Workspace Data Access (Scopes Used)

iAWE requests access to the following four OAuth scopes to perform its core function: the automated evaluation of academic writing within the Google Sheets environment. Access is strictly limited to the necessary functions described below, in accordance with Google's Least Privilege principle:

• Google Sheets Access (current spreadsheet only): https://www.googleapis.com/auth/spreadsheets.currentonly

  Justification: The application reads and writes data strictly within the active spreadsheet where the Add-on is invoked. This is necessary to retrieve the student's writing sample from Column A and to write the final processed EASE evaluation metrics (D1–D13 scores, NAWL lemma density, Type-Token Ratio, structured feedback) back to columns B–Q of the same sheet. The Add-on cannot access any other spreadsheet in your account.

• Google Drive Access (file-level, user-initiated): https://www.googleapis.com/auth/drive.file

  Justification: This is a restricted scope governed by Google's Limited Use requirements. It is used solely to read the specific student essay file that you explicitly select via the Add-on sidebar file picker, and to save the final evaluation reports (JSON/CSV) generated by the EASE pipeline directly into your Drive. The Add-on cannot browse your Drive or access files you did not explicitly choose.

• External Network Requests: https://www.googleapis.com/auth/script.external_request

  Justification: Required by Apps Script to permit outbound HTTPS calls via UrlFetchApp. This scope is used exclusively to send the student's writing sample (along with pre-computed linguistic metrics) to the Google Gemini 2.5 API for evidence-anchored feedback generation, and to query the Semantic Scholar API for scholarly context retrieval (RAG). No other external endpoints are contacted. The full list of permitted destinations is documented in Section 2.

• Container UI Rendering: https://www.googleapis.com/auth/script.container.ui

  Justification: Required by Apps Script to display the iAWE user interface elements inside the Google Sheets container — specifically: the "✍️ iAWE 1.0" custom menu, the sidebar Control Panel (HTML service), the User Guide modal dialog, and the Contact form modal. This scope grants no data access; it only authorizes the rendering of UI elements within the host spreadsheet. It does not allow the Add-on to read or modify any spreadsheet content beyond what the spreadsheets.currentonly scope already permits.

2. Third-Party Data Processing (External APIs)

To generate evidence-anchored feedback, retrieve scholarly context, and validate linguistic metrics, the Add-on acts as a secure relay by sending the student's writing sample and computed metrics (NAWL lemmas, Type-Token Ratio) to the following research-grade APIs:

• Google Gemini 2.5: Used as a strict JSON-generation engine under a zero-trust architecture. The LLM is restricted to mapping pre-computed evidence against the EAP Knowledge Base and may not generate unverified pedagogical claims or hallucinate linguistic rules.
• Semantic Scholar API: Used to retrieve verified scholarly context and academic paper metadata that grounds the LLM's evaluation in empirical literature, in line with the RAG (Retrieval-Augmented Generation) principle of computational trust.

User Responsibility: Use of the Add-on implies acceptance of the Privacy Policies and Terms of Service of the respective third-party APIs listed above. Users are responsible for providing their own API keys where required.

3. Data Storage & PII

The developer (Dr. Waleed Mandour) maintains a strict data policy aligned with the EASE Framework's zero-trust principle:

• No External Storage: We do not store any of your Google Workspace data (essay contents, email addresses, usage history, evaluation telemetry) on any server controlled by the developer or a third party, with the exception of the transient data processed by the APIs listed in Section 2.
• No PII Collection: The Add-on does not collect or track any Personal Identifiable Information (PII) for advertising, market research, or any purpose unrelated to the function of the Add-on.
• Research Telemetry (DBR compliance): While iAWE natively logs quantitative telemetry (JSON compliance, API latency, NAWL shifts) for Design-Based Research (DBR) iterations, this telemetry is computed and stored locally within your own spreadsheet and is never transmitted to the developer's servers.

4. Data Security & Protection Mechanisms

We employ industry-standard security measures to protect your data:

• Encryption in Transit: All data transmitted between your Google Sheet and the external APIs listed in Section 2 is encrypted using HTTPS (TLS 1.2/1.3) protocols.
• Google Infrastructure: The Add-on's logic is hosted entirely on Google's secure Apps Script servers. We do not maintain separate servers, databases, or cloud buckets for this application, ensuring your data remains within the Google ecosystem and the transient memory of the execution runtime.
• Zero-Trust LLM Processing: The Gemini 2.5 model is restricted to a strict JSON schema and is fed only pre-computed empirical evidence (NAWL metrics, Semantic Scholar data). It cannot act as an authoritative judge and may not generate unverified pedagogical claims.

5. Data Retention and Deletion Policy

iAWE operates on a non-retention basis:

• Ephemeral Processing: Data retrieved from your spreadsheet (essay text, computed linguistic metrics) is processed in the volatile memory of the script runtime and is discarded immediately upon the completion of the execution cycle. We do not retain logs of your specific queries or content on our side.
• Data Deletion: Since we do not store your data on external servers, there is no user data to delete from our side.
• User Control: You maintain full ownership of your data, including student essays, evaluation reports, and DBR telemetry. To permanently "delete" data processed by the Add-on, you simply need to delete the data from your Google Sheet or Google Drive.

6. User Consent and Contact

By installing and using this Add-on, you consent to the data processing methods described in this policy, acknowledging its strict adherence to research-only usage principles and the EASE Framework 1.0 methodology.

Contact: For any questions regarding this Privacy Policy or the Add-on's data handling, please contact the developer, Dr. Waleed Mandour, directly:

Email: w.abumandour@squ.edu.om
Personal Email: waleedmandour@gmail.com
ORCID ID: 0000-0002-9262-5993