Privacy Policy

1. Introduction

GradeSpace ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our free tools (such as the QR Code Generator), use our products — TargetGrade (education), CareMaSym (care management), AccountGrade (payroll), and BuildGrade (blueprints and costings) — or engage our digital delivery services.

This policy applies to all users including website visitors, free-tool users, clients, partners, and end-users of our AI products and digital services.

This policy complies with:

• UK GDPR and the Data Protection Act 2018 - our primary framework as a UK company, regulated by the Information Commissioner's Office (ICO)
• EU GDPR (General Data Protection Regulation) - for users in the European Union
• CCPA/CPRA (California Consumer Privacy Act) - for California residents
• PIPEDA (Personal Information Protection and Electronic Documents Act) - for Canadian users
• LGPD (Lei Geral de Proteção de Dados) - for Brazilian users
• FERPA (Family Educational Rights and Privacy Act) - for educational data where applicable

2. Data Controller and Our Roles

Gradespace acts in two different roles depending on the data:

• As controller — for our website, free tools, marketing, customer accounts, and billing. This Privacy Policy describes that processing.
• As processor — for personal data our customers (such as tuition providers, schools, care providers, and employers) submit to TargetGrade, CareMaSym, AccountGrade, and BuildGrade. That processing is governed by our Data Processing Agreement and the customer's own privacy notice. If you are a student, service user, or employee of one of our customers, that organisation is the controller of your data and your first point of contact for privacy requests.

We maintain internal privacy governance led by our Privacy & Data Protection Lead, including a record of processing activities, data protection impact assessments for higher-risk processing (such as CareMaSym care data and TargetGrade children's data), and a Sub-processor Register.

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, password, company/organization details, role designation (client, learner, instructor, administrator)
• Educational Data: Course enrollments, assignment submissions, quiz responses, coding exercises, progress tracking, grades, certificates
• Project Information: Details about your projects, requirements, specifications, and deliverables
• Payment Information: Billing address, payment method (processed securely by Stripe), subscription plan details
• Communication Data: Messages, feedback, support requests, and correspondence

3.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent on platform, course navigation patterns, learning behavior
• Free Tool Interaction Data: For tools such as our QR Code Generator, we may log submitted values, optional titles, selected settings, download actions, and timestamps to deliver the tool and prevent abuse.
• Device Information: Browser type, operating system, device identifiers, IP address
• Location Data: Approximate location based on IP address
• Cookies and Tracking: See our Cookie Policy for details

3.3 Data We Process on Behalf of Customers

Our customers submit personal data to our products, which we process as a processor under our Data Processing Agreement:

• TargetGrade: Student identity and enrolment details, attendance, assessment results, and target/predicted grades, as configured by the school or tuition provider. This includes children's data; pilot deployments are configured to the minimum fields needed.
• CareMaSym: Service-user and staff records, which may include special-category health and social-care information. We apply role-based access and audit logging to this data.
• AccountGrade: Payroll and financial data, including bank, tax, and National Insurance identifiers, treated as restricted information.
• BuildGrade: Names, emails, project details, quote content, and client messages where provided by the customer.

4. How We Use Your Information

We use your information for the following purposes:

5. Legal Basis for Processing (GDPR)

For users in the EU/UK, we process your personal data based on:

• Contract Performance: To fulfill our obligations when you enroll in courses or subscribe to services
• Consent: When you've given explicit consent (e.g., marketing, optional cookies)
• Legitimate Interests: To improve our AI products and services, advance research, prevent fraud, and ensure security
• Legal Obligation: To comply with applicable laws (tax, accounting, educational regulations)

6. How We Share Your Information

We do not sell your personal information. We may share your data with:

7. International Data Transfers

GradeSpace is based in the United Kingdom. Your information may be transferred to, stored, and processed in:

• United States: Firebase/Google Cloud servers, Stripe payment processing, Twilio SMS services
• European Union: Backup servers and content delivery networks

For transfers from the EU/UK to other countries, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where available
• Service provider privacy commitments and certifications

8. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations:

• Account Data: Retained while active + 30 days after deletion
• Educational Records: 7 years for certificate verification and academic records
• Assignment Submissions: 2 years after course completion
• Payment Records: 7 years for tax and accounting compliance
• Communication Data: 3 years for support tickets
• Free Tool Logs: Up to 12 months for security monitoring, abuse prevention, and reliability analysis
• Analytics: Aggregated data retained indefinitely; logs for 2 years

9. Your Privacy Rights

10. Data Security

We implement comprehensive technical and organizational measures to protect your personal information:

11. Children's Privacy

Our AI-powered education products (such as TargetGrade) may be used by minors as part of legitimate educational programmes.

• UK Children's Code: We design services likely to be accessed by children in line with the ICO Age Appropriate Design Code, applying data minimisation and high privacy by default. Grade predictions and study recommendations in TargetGrade are assistive and subject to teacher review; we make no solely automated decisions with legal or similarly significant effects about students, and features that expand children's-data processing require a fresh privacy assessment.
• Under 13 (COPPA): We do not knowingly collect info without verifiable parental consent. Schools must obtain appropriate consent.
• Under 18: Must have parental consent or be under school supervision.
• Parent Rights: Parents can review, delete, or refuse collection of their child's data.
• No AI training: We do not use children's data to train AI models.

12. Third-Party Services and Links

Our platform integrates with third-party services like Firebase, Stripe, Twilio, Brevo, OpenAI, Sentry, and Vercel — see our Sub-processor Register for the full list. Each has its own privacy policy. We are not responsible for the content or privacy practices of external sites.

13. Changes to This Privacy Policy

We may update this policy to reflect changes in our practices. Material changes will be notified via email or posted on our website 30 days before taking effect. Continued use constitutes acceptance.

14. Contact Us