Is FeedbackFruits GDPR compliant? What universities should check
FeedbackFruits is a Dutch company whose peer review, assignment review, group evaluation and oral practice tools plug into a university's LMS. Its Acai AI features suggest feedback and rubric ratings on student work, and new oral assessment tools add voice and transcription. This page sets out what FeedbackFruits publicly documents and what that means for a university.
Short answer
FeedbackFruits B.V. is based in Amsterdam and processes institutional data as a processor under a data processing agreement. Its trust centre publishes DPA versions, subprocessor change notices with a right to object, an ISO/IEC 27001:2022 certificate (recertified September 2026), a HECVAT and AI transparency notes. Its Acai features run on Azure OpenAI and can suggest rubric ratings on student submissions, which an educator must approve. New oral assessment and practice tools, launching October 2026, add Claude through Amazon Bedrock, EU-hosted Mistral transcription and speech provider Cartesia, but only when enabled. The full subprocessor list requires an access request.
What FeedbackFruits documents publicly
The table summarises FeedbackFruits' privacy policy, trust centre and help-centre transparency notes, all read on 7 October 2026.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and role | Documented FeedbackFruits B.V., Danzigerkade 17, Amsterdam. The privacy policy (19 September 2025) says processing of institutional users' data is governed by contracts with the institutions, which act as controllers. | Privacy Policy [1] |
| Data processing agreement | Documented DPA versions of 25 September 2025 and 3 April 2026 are listed in the trust centre. An update announced on 28 August 2026 adds processing for the oral assessment tools and took effect on 29 September 2026 for institutions that signed the April version; processing for a new feature starts only once it is enabled at the institution's request. | Trust Center [2] |
| Subprocessors | Partly documented The trust centre lists sub-processor PDFs dated 12 December 2025, 22 July 2026 and 7 August 2026; opening them requires an access request. Public notices added Linear Orbit and Zapier (July 2026), and Mistral AI SAS, Cartesia AI, Inc. and LiveKit Inc. plus changes to AWS EMEA SARL processing (August 2026). Customers may object within 30 days. | [2] |
| International transfers | Partly documented The privacy policy refers to "Standard Contractual Clauses with additional safeguards" for transfers outside the EEA. Which subprocessors process data outside the EEA was not found in public documentation (checked 7 October 2026); the public change notices do not state processing locations. | [1], [2] |
| Where content is stored | Partly documented Recordings and transcripts are stored on Microsoft Azure "like other user-generated content". Azure OpenAI processing for the Grading Assistant takes place "in the region in which you are using FeedbackFruits". The Azure storage region for EU customers was not found in public documentation (checked 7 October 2026). | Transcription note [3], Grading Assistant note [4] |
| Acai Grading Assistant | Documented Reads a student's submission against each Acai-assisted rubric criterion and suggests a rating, a short rationale and a draft review. The educator decides whether to adopt them. Uses Azure OpenAI; inputs are not used to train or fine-tune models; Azure abuse monitoring may store input and output for up to 30 days. Works best with English rubrics. | [4] |
| Oral assessment and practice AI | Documented Every recording is transcribed by Mistral's Voxtral model, hosted in the EU with zero data retention; transcription cannot be switched off separately. A voice agent for practice and reflection uses Claude Opus 5 through Amazon Bedrock with regional hosting and Cartesia for speech; it is never used in oral assessments and never grades. | [3], Voice Agent note [5], Interaction Coach note [6] |
| Training on customer content | Documented "FeedbackFruits does not use your content to train or retrain the underlying Azure OpenAI models." The oral tools' notes say inputs are never used to train, retrain or fine-tune any model. | Acai FAQs [7], [5], [6] |
| Security and AI governance | Documented ISMS recertified against ISO/IEC 27001:2022 by Prescient Security (announced 24 September 2026). The trust centre also lists a HECVAT, technical and organisational measures (September 2025), TX-RAMP Level 2 and an EU AI Pact voluntary pledge. | [2] |
| Retention | Partly documented The privacy policy says data is kept only as long as necessary. Students can download and delete their own oral recordings. A specific retention period for institutional content was not found in public documentation (checked 7 October 2026). | [1], [3] |
What this means for a university
Validemic's analysis
Unusually open about AI. Per-feature transparency notes that name the model, the hosting arrangement, retention at the model provider and known limitations [3][4][5][6] are exactly what a DPIA needs. Change notices with a 30-day objection window [2] give a privacy office real notice. These are clear strengths.
An add-on is a second processor. FeedbackFruits sits beside the LMS and receives student submissions, peer reviews and, with the new tools, voice recordings. Even where the LMS is already assessed, FeedbackFruits needs its own DPA, records of processing entry and student information.
Feature choices drive the subprocessor set. The oral tools add Mistral, Cartesia, LiveKit and Amazon Bedrock [2][5]. A university that enables them takes on voice data, which can reveal more than text, and subprocessors whose processing locations are not stated publicly. Deciding feature by feature, with the subprocessor list in hand, is the practical control.
Read the restricted list. The full subprocessor list is behind an access request [2]. That is common, but it means the assessment cannot be done from public material alone.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask FeedbackFruits before approving or renewing
- Which DPA version have we signed, and have we accepted the September 2026 update?
- Can we receive the current subprocessor list, with processing locations for each, including Cartesia, LiveKit, Zapier and Linear?
- In which Azure region is our institution's content stored, and in which region does Azure OpenAI process our Acai prompts?
- Can Azure abuse monitoring retention be waived for our tenant, or is it covered by an exemption?
- Which Acai features are enabled for us today, including the Grading Assistant, and can they be enabled per course?
- For the oral tools, where does Amazon Bedrock process the conversation, and where does Cartesia generate speech?
- How long are submissions, reviews and recordings kept after a course ends and after our contract ends?
The EU AI Act angle
Annex III point 3(b) covers AI systems "intended to be used to evaluate learning outcomes" [8]. Validemic's analysis The Acai Grading Assistant reads submissions and suggests rubric ratings [4], which is close to that description. Article 6(3) allows an Annex III system to fall outside the high-risk category if it performs a preparatory task for a human assessment and does not profile people [9]. FeedbackFruits' design, where the educator must adopt every suggestion and Acai never rates a student on its own [4], points in that direction, and its trust centre lists the EU AI Act among its compliance topics [2]. The classification is the provider's to document, and a university should keep its own record of how teachers use the suggestions, because routine adoption without review weakens the human role. FeedbackFruits states that its voice agent and conversation assistant never assess or grade [5][6]. Annex III obligations apply from 2 December 2027 under the amended Article 113 [10]. Article 4 applies now: deployers must take measures to support the AI literacy of staff using these tools [11].
Sources
- FeedbackFruits Privacy Policy (last updated 19 September 2025), retrieved 7 October 2026
- FeedbackFruits Trust Center, including updates of 22 July, 7 August, 28 August and 24 September 2026, retrieved 7 October 2026
- Transparency Note: Transcription in Oral Assessment & Practice (updated 7 August 2026), retrieved 7 October 2026
- Transparency Note: Acai Grading Assistant (updated 3 July 2026), retrieved 7 October 2026
- Transparency Note: Voice Agent (updated 7 August 2026), retrieved 7 October 2026
- Transparency Note: Interaction Coach and Conversation Assistant (updated 7 August 2026), retrieved 7 October 2026
- Acai: FAQs (updated 13 January 2026), retrieved 7 October 2026
- AI Act Annex III, AI Act Service Desk (consolidated text of Regulation (EU) 2024/1689), retrieved 7 October 2026
- AI Act Article 6: Classification rules for high-risk AI systems, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 113: Entry into force and application, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026
About this page
We read FeedbackFruits' privacy policy, its trust centre overview and updates, the Acai FAQs and the transparency notes for the Grading Assistant, transcription, voice agent and interaction coach, and the relevant AI Act texts on 7 October 2026. We did not have access to the restricted subprocessor list or the DPA text. Our own interpretation is labelled as Validemic's analysis. This page is not legal advice and does not say whether any particular use of FeedbackFruits complies with the GDPR. If you spot an error or FeedbackFruits has updated a document, please contact us and we will correct it.
Frequently asked questions
Is FeedbackFruits GDPR compliant?
No tool is GDPR compliant on its own. FeedbackFruits says institutions are controllers and that it processes their data under a data processing agreement, publishes DPA versions and subprocessor change notices in its trust centre, and holds ISO/IEC 27001:2022 certification. Whether a university's use complies depends on its contract, which features it enables and how it informs students.
Does FeedbackFruits AI grade students?
FeedbackFruits says the Acai Grading Assistant suggests a rubric rating, an explanation and a draft review, and that the educator must adopt, change or ignore the suggestion. It states that Acai will never produce a rating or review for a student without an educator's explicit approval.
Which AI models does FeedbackFruits use?
Acai feedback and grading features use Azure OpenAI Service. The oral practice and assessment tools use Claude Opus 5 through Amazon Bedrock for reasoning, Mistral's Voxtral model hosted in the EU for transcription, and Cartesia for the voice agent's speech. FeedbackFruits says inputs are not used to train models.
Does Azure keep FeedbackFruits AI prompts?
The Grading Assistant transparency note says Azure OpenAI's abuse monitoring may store input data and model output for up to 30 days, and that only authorised Microsoft employees may review it if content triggers potential abuse.
Do new FeedbackFruits features add subprocessors?
Yes. On 7 August 2026 FeedbackFruits notified customers that Mistral AI, Cartesia AI, LiveKit and changes to AWS processing would apply if the oral assessment, practice and reflection tools are enabled, with a 30-day right to object.