Privacy Policy

1. Information we collect

Account and profile data

When you create an account, we collect your email address and a password (stored in hashed form by our authentication provider). Your profile may include a display name, username, learning streaks, subscription status, and related account settings.

Learning and usage data

When you solve problems on GRADuateML, we store your code submissions, test results, mastery progress, and AI Mentor usage. If you message the AI Mentor or diagnostics, your submitted code and problem context are sent to our AI provider to generate feedback. We do not send roster or school identifiers to the AI provider.

Resume and career data

If you use the resume tools or the career copilot, we process the resume you upload or paste. A resume typically contains your name, contact details, employment and education history, and anything else you chose to put in it. The text of your resume, together with the target role and any job description you provide, is sent to OpenAI to produce the analysis and the generated drafts. We store the resulting analyses and generated documents in your account so you can return to them, and you can delete them.

Interview practice, including voice

The mock interview loops can be used in text or in voice. If you choose voice, your microphone audio is recorded in your browser for the length of your answer and sent to OpenAI for transcription; we also send the text of the interviewer's turn to OpenAI to synthesise speech. We keep the transcript of the session so you can review your answers and so the feedback can refer to them. We do not keep the audio recording after it has been transcribed, and we do not use your voice to identify you. Voice mode is optional - text mode has the same content, and you are asked before recording starts.

Newsletter

If you subscribe to Signal, we collect your email address and optional marketing attribution data (such as UTM parameters). We use unique tracking tokens in email links to measure opens and clicks. This data is stored in our database, not in browser cookies.

Payments

If you purchase a Pro subscription or school seats, payment processing is handled by Stripe. We receive subscription metadata (such as plan type and billing status) but do not store full payment card numbers on our servers.

Automatic technical data

When you visit our site, we and our analytics providers may automatically collect information such as your IP address, browser type, device type, operating system, pages viewed, and referring URL. See the Cookies section below for details.

School and institutional use

When school or district features are enabled, we may additionally process roster data, course enrollments, assignment submissions, and LTI launch identifiers as needed to operate the classroom product. Schools act as data controllers for student data in those contexts.

2. How we use information

We use the information we collect to:

• Provide, maintain, and improve the GRADuateML learning platform
• Authenticate you and personalize your learning experience
• Execute and grade code submissions, including AI-assisted hints and diagnostics
• Send the Signal newsletter when you have subscribed
• Process payments and manage subscriptions
• Measure product usage and fix bugs
• Protect against fraud, abuse, and security incidents
• Comply with legal obligations

We do not use your learning data or newsletter information for third-party advertising, and we do not sell your personal information for money.

Advertising measurement, and your right to opt out. If, and only if, you accept advertising cookies, we share a limited set of data with Meta so we can measure whether our ads work: the Meta Pixel in your browser, and - when you buy a subscription - a server-side event containing a hashed form of your email address, your IP address and your browser user agent. Under California law this counts as "sharing" personal information for cross-context behavioural advertising, even though no money changes hands.

Declining cookies is the opt-out: it stops the browser pixel and it stops the server-side purchase event, and we honour it for visitors everywhere, not only in California. We also honour the Global Privacy Control signal where your browser sends one. You can also email us and we will apply the opt-out to your account.

3. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or United Kingdom, we process personal data on these bases:

• Contract: to provide the account, learning platform, and paid features you request
• Consent: for newsletter emails and non-essential analytics cookies (where required)
• Legitimate interests: to secure our services, prevent abuse, and improve the product, balanced against your rights
• Legal obligation: where we must retain or disclose data under applicable law

5. Third-party service providers

We use trusted providers to operate GRADuateML. They process data on our behalf and only as needed to deliver the service:

• Supabase - database, authentication, and application data storage (United States)
• OpenAI - our only AI provider. Receives AI Mentor conversations, diagnostics, submitted code and problem context, resume text and target-role details, interview transcripts, and interview audio for transcription and speech synthesis (United States)
• Stripe - payment processing and subscription billing (United States)
• Brevo - newsletter and transactional email delivery (European Union / United States)
• Vercel - website hosting and performance analytics (United States)
• Google Analytics - website usage analytics when you consent (United States)
• Meta - advertising measurement via Meta Pixel and Conversion API (United States)
• Fly.io - code evaluation sandbox and optional LTI service hosting (United States)

Each provider is bound by contractual obligations to protect your data. We do not authorize them to use your personal information for their own marketing purposes.

6. Data retention

We retain account and learning data for as long as your account is active. If you delete your account or request erasure, we anonymize or delete personal data subject to legal retention requirements.

Newsletter subscriber data is retained until you unsubscribe or request deletion. Verified subscribers who unsubscribe are marked as unsubscribed; we do not send further emails.

Payment records may be retained as required for tax, accounting, and fraud prevention. Aggregated analytics data may be retained in de-identified form.

7. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated data
• Object to or restrict certain processing
• Export your data in a portable format, where applicable
• Withdraw consent (for example, newsletter emails or analytics cookies)

You can delete your account yourself at any time from Settings. That removes your account, your submissions and progress, generated resumes and interview transcripts, and your newsletter subscription. It cannot be undone.

For anything else - access, correction, export, or an objection - email graduateadmin@gmail.com, or write to the postal address at the end of this policy. We will respond within a reasonable time and as required by applicable law, and we will not charge you or treat you differently for exercising a privacy right.

Newsletter subscribers can unsubscribe using the link in any email or by contacting us. You can change analytics cookie preferences using the cookie banner or your browser settings.

If you are in the EEA or UK, you may lodge a complaint with your local data protection authority. California residents may have additional rights under the CCPA/CPRA, including the right to know what categories of information we collect and to request deletion.

8. Children

GRADuateML is an educational product. We do not knowingly collect personal information from children under 13 without appropriate parental or school consent (as required by COPPA in the United States). In some jurisdictions, consent may be required for users under 16. If you believe a child has provided us personal information without proper consent, contact us and we will take appropriate steps to delete it.

9. International data transfers

GRADuateML is based in the United States. If you access GRADuateML from outside the United States, your information may be transferred to and processed in the United States and other countries where our service providers operate. Where required, we rely on appropriate safeguards such as standard contractual clauses.

10. Security

We use technical and organizational measures to protect your information, including encryption in transit (HTTPS), access controls, and row-level security on our database. No method of transmission or storage is completely secure; please use a strong, unique password for your account.

11. Changes to this policy

We may update this privacy policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Material changes may be communicated by email or a site notice where appropriate.

12. Contact us

For privacy questions or data requests, contact us at:

Our Terms of Service govern your use of GRADuateML.