Privacy Policy

1. Information we collect

Account and profile data

When you create an account, we collect your email address and a password (stored in hashed form by our authentication provider). Your profile may include a display name, username, learning streaks, subscription status, and related account settings.

Learning and usage data

When you solve problems on GRADuateML, we store your code submissions, test results, mastery progress, and AI hint usage. If you request AI-powered hints or diagnostics, your submitted code and problem context are sent to our AI provider to generate feedback. We do not send roster or school identifiers to the AI provider.

Newsletter

If you subscribe to Signal, we collect your email address, verification status, and optional marketing attribution data (such as UTM parameters). We use unique tracking tokens in email links to measure opens and clicks. This data is stored in our database, not in browser cookies.

Payments

If you purchase a Pro subscription or school seats, payment processing is handled by Stripe. We receive subscription metadata (such as plan type and billing status) but do not store full payment card numbers on our servers.

Referrals

If you arrive via a referral link, we may store a referral code in your browser's session storage for the duration of your visit so we can attribute a subscription correctly.

Automatic technical data

When you visit our site, we and our analytics providers may automatically collect information such as your IP address, browser type, device type, operating system, pages viewed, and referring URL. See the Cookies section below for details.

School and institutional use

When school or district features are enabled, we may additionally process roster data, course enrollments, assignment submissions, and LTI launch identifiers as needed to operate the classroom product. Schools act as data controllers for student data in those contexts.

2. How we use information

We use the information we collect to:

• Provide, maintain, and improve the GRADuateML learning platform
• Authenticate you and personalize your learning experience
• Execute and grade code submissions, including AI-assisted hints and diagnostics
• Send the Signal newsletter when you have subscribed and verified your email
• Process payments and manage subscriptions
• Measure product usage and fix bugs
• Protect against fraud, abuse, and security incidents
• Comply with legal obligations

We do not use your learning data or newsletter information for third-party advertising, and we do not sell your personal information.

3. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or United Kingdom, we process personal data on these bases:

• Contract: to provide the account, learning platform, and paid features you request
• Consent: for newsletter emails and non-essential analytics cookies (where required)
• Legitimate interests: to secure our services, prevent abuse, and improve the product, balanced against your rights
• Legal obligation: where we must retain or disclose data under applicable law

5. Third-party service providers

We use trusted providers to operate GRADuateML. They process data on our behalf and only as needed to deliver the service:

• Supabase - database, authentication, and application data storage (United States)
• OpenAI - AI hints, diagnostics, and content generation from submitted code and problem context (United States)
• Stripe - payment processing and subscription billing (United States)
• Brevo - newsletter and transactional email delivery (European Union / United States)
• Vercel - website hosting and performance analytics (United States)
• Google Analytics - website usage analytics when you consent (United States)
• Fly.io - code evaluation sandbox and optional LTI service hosting (United States)

Each provider is bound by contractual obligations to protect your data. We do not authorize them to use your personal information for their own marketing purposes.

6. Data retention

We retain account and learning data for as long as your account is active. If you delete your account or request erasure, we anonymize or delete personal data subject to legal retention requirements.

Newsletter subscriber data is retained until you unsubscribe or request deletion. Verified subscribers who unsubscribe are marked as unsubscribed; we do not send further emails.

Payment records may be retained as required for tax, accounting, and fraud prevention. Aggregated analytics data may be retained in de-identified form.

7. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated data
• Object to or restrict certain processing
• Export your data in a portable format, where applicable
• Withdraw consent (for example, newsletter emails or analytics cookies)

To exercise these rights, email graduateadmin@gmail.com. We will respond within a reasonable time and as required by applicable law.

Newsletter subscribers can unsubscribe using the link in any email or by contacting us. You can change analytics cookie preferences using the cookie banner or your browser settings.

If you are in the EEA or UK, you may lodge a complaint with your local data protection authority. California residents may have additional rights under the CCPA/CPRA, including the right to know what categories of information we collect and to request deletion.

8. Children

GRADuateML is an educational product. We do not knowingly collect personal information from children under 13 without appropriate parental or school consent (as required by COPPA in the United States). In some jurisdictions, consent may be required for users under 16. If you believe a child has provided us personal information without proper consent, contact us and we will take appropriate steps to delete it.

9. International data transfers

GRADuateML is based in the United States. If you access GRADuateML from outside the United States, your information may be transferred to and processed in the United States and other countries where our service providers operate. Where required, we rely on appropriate safeguards such as standard contractual clauses.

10. Security

We use technical and organizational measures to protect your information, including encryption in transit (HTTPS), access controls, and row-level security on our database. No method of transmission or storage is completely secure; please use a strong, unique password for your account.

11. Changes to this policy

We may update this privacy policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Material changes may be communicated by email or a site notice where appropriate.

12. Contact us

For privacy questions or data requests, contact GRADuateML at graduateadmin@gmail.com.