Privacy Policy

Who we are and how to reach us

• Grademy (grademy.work) is the data controller for the personal data described in this policy. We are based in the United Kingdom and the UK GDPR and Data Protection Act 2018 apply to what we do.
• For any privacy question, request, or complaint, email privacy@grademy.work. We answer within one month, and we will tell you if a request is complex and needs longer.
• If you are not happy with our answer you can complain to the Information Commissioner's Office (ico.org.uk), the UK supervisory authority.

What we collect

• Account details such as your name, email address, login identifiers, date of birth (used only for the age check), role, and profile settings.
• Guardian details where a learner aged 13 to 15 provides a parent or guardian email so consent can be confirmed.
• Study information such as subjects, exam boards, modules, deadlines, streaks, session activity, assessed progress signals, marks, self-reported topic familiarity, corrections you make to inferred teaching preferences, and uploaded learning materials. Familiarity reports and preference corrections are stored separately and are not treated as marks or mastery evidence.
• Tutor conversations: the text of your questions and the tutor's replies, including any text produced during a live voice session.
• Support, billing, and refund-review information, including payment records held by our payment provider, subscription status, messages you send us, and exam-result evidence if you submit it for a claim.
• Technical and usage data such as device information, browser details, IP address, cookies and browser storage, logs, error reports, and (only with your consent) content-free public conversion analytics. Those analytics events use an opaque tab ID and closed event labels; they do not contain your email, name, answers, URLs, referrer, prompts, or transcripts.
• If you join the waitlist, we collect your email address, a closed source label showing which Grademy page opened the form, and delivery status for the access-reopening update you requested. We do not treat joining the waitlist as consent to general marketing.
• We do not ask for special category data. Please do not put health, religious, or similar sensitive details into uploads or tutor chats; if a safeguarding disclosure happens anyway, see the safeguarding section below.

Lawful basis for each purpose

How long we keep things

These are real periods, not estimates. When a period ends the data is deleted or irreversibly aggregated.

Sub-processors we use

Each of these acts on our instructions under a data processing agreement. Grademy does not persist raw voice audio. Before Gemini Live can be enabled, we record the project tier, data-use, retention, transfer, and child-audio approval; provider terms may still allow short safety or abuse retention.

How we use your data

• To run the Grademy tutoring experience: personalise study plans, generate lessons and questions, mark work, and adapt future sessions to what you actually got wrong.
• To manage accounts, subscriptions, trials, payments, customer support, safety, fraud checks, and abuse prevention.
• To review refund requests, promotional claims, complaints, and product quality issues.
• To measure whether the product works — but only aggregate analytics, and only if you consent.
• We do not sell personal data, we do not share it with advertising networks, and we do not build commercial profiles of learners.

AI processing, and what providers may not do with your data

• Your prompts, answers, uploads, and progress data are processed by AI models to deliver tutoring, planning, and marking.
• We use provider and account settings intended to prevent model improvement where available, but provider terms may still permit short safety or abuse retention. Gemini Live is not enabled until its paid-tier, data-use, retention, transfer, and child-audio review is recorded.
• Raw voice audio is never persisted by Grademy. It is streamed to the selected live provider and discarded by Grademy. Our voice tables store operational counters and timestamps only.
• Authorised team members may review limited account, usage, or content data where necessary for support, safety, abuse prevention, refund review, or quality assurance. Access is logged.
• AI output can be wrong. Do not treat it as a final authority on marks, grades, or exam answers.

Safeguarding and crisis disclosures

• Free-text a learner types into the tutor is checked by a deterministic, offline keyword detector before any AI call. It makes no network requests and does not use AI.
• If that check flags a possible crisis, generation stops and the learner is shown UK support resources instead of a lesson.
• A minimal record of the event is logged so we can spot patterns and respond responsibly. It is kept under the safeguarding retention rule above.
• We are not an emergency service. If someone is in immediate danger, call 999, or 111 for urgent health advice.

Children and young people

• Grademy is not available to anyone under 13. An age check runs at sign-up and under-13 accounts are blocked from the product.
• Learners aged 13 to 15 must give a parent or guardian email. AI lessons stay locked until that guardian confirms through their own Grademy account.
• Lawful basis for a child's account is contract for delivering the service, with consent (given or authorised by a guardian, depending on age) for anything optional such as analytics or marketing.
• We do not show behavioural advertising to anyone, and we never profile a child for commercial purposes.
• Settings default to high privacy. Guardian confirmation does not automatically expose a learner's tutor conversations; sharing is a separate, reviewable choice.
• Nudge techniques are not used to push a child into weakening their privacy settings or into extending screen time.
• We follow the ICO Age Appropriate Design Code. Our honest, standard-by-standard self-assessment lives in docs/compliance/childrens-code.md in our repository.

Your rights under UK GDPR, and how to use them

• Access: ask for a copy of the personal data we hold about you. Email privacy@grademy.work from your account address and we will send a machine-readable export.
• Rectification: correct anything wrong. Most profile and study details can be edited in the app directly; email us for anything you cannot reach.
• Erasure: delete your account and its data from account settings, or by email. Deletion runs through our erasure workflow and completes within 30 days, including account-linked conversion events and a waitlist request using the same email, except billing records we must keep for 7 years. If you joined the waitlist without an account, email us from that address so we can verify and erase it.
• Restriction: ask us to pause processing while a dispute about accuracy or lawfulness is resolved. We will keep the data but stop using it.
• Portability: get your account and learning data in a structured, commonly used, machine-readable format, or ask us to send it to another provider where technically feasible.
• Objection: object to processing based on legitimate interests, including profiling of your learning for product improvement. Tell us why and we will stop unless we can show compelling grounds.
• Withdraw consent: turn analytics or marketing off at any time using Cookie settings in the footer, or the unsubscribe link in any email. Withdrawal does not affect processing that already happened lawfully.
• Automated decisions: no decision with a legal or similarly significant effect is made about you by automation alone. AI-generated marks are teaching feedback, not a formal assessment, and you can ask a human to review one.
• Exercising any of these rights is free and will never lead to a worse service.

International transfers

• Some sub-processors listed above process data outside the UK, mainly in the United States and the EU.
• Where data leaves the UK we rely on UK adequacy regulations, or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the provider's own technical safeguards.
• We prefer EU or UK regions where a provider offers them, and our primary database project is EU-hosted.

Security

• Every user-facing table in our database is protected by row-level security, so one account cannot read another account's rows even if application code has a bug.
• Traffic is encrypted in transit, secrets are held in the hosting platform's encrypted store, and service-role credentials never reach the browser.
• Uploaded files are held in access-controlled storage and are removed by the erasure workflow when an account is deleted.
• We keep audit logs of administrative actions for 12 months.

Cookies and browser storage

• Strictly necessary cookies keep you signed in and secure. Everything else is off until you switch it on, and Reject all is as prominent as Accept all.
• The full inventory — every cookie and storage key, its purpose, category, and duration — is on our cookie policy page.
• You can change or withdraw your choice at any time from Cookie settings in the footer.

Changes to this policy

• If we make a material change, we will update the date at the top and, where the change affects how we use your data, tell you in the product or by email before it takes effect.
• Where a change requires fresh consent, we will ask again rather than assume your previous answer still applies.