Privacy Policy

GradProcess AI Ltd (“GradProcess AI”, “we”, “us”, or “our”) operates the platform at app.gradprocess.ai. We are the data controller for personal data processed through our services.

Contact: privacy@gradprocess.ai

Account data

Name, email address, university, degree, and graduation year — provided during signup.

Practice session data

Video recordings, audio, and transcripts from interview practice sessions — only collected after you give explicit recording consent. You may opt out of saving recordings or transcripts at any time.

CV and job description data

Documents you upload for CV tailoring and ATS scoring. These are stored encrypted and processed only to provide our services.

Application tracker data

Job opportunities, notes, and stage history you enter into the Application Tracker.

Usage data

Log data, IP address, browser type, pages visited, and feature usage — used to improve the platform and detect security issues.

Payment data

Billing is handled by Stripe. We do not store card numbers or financial credentials. We receive only subscription status and masked card information from Stripe.

• Provide, operate, and improve the GradProcess AI platform
• Generate AI-powered feedback on your CV, interview practice, and applications
• Send transactional emails (account verification, password reset, session reminders)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Analytics cookies — only if you consent
• Marketing communications — only if you opt in separately

We do not sell your personal data to third parties.

Your CV text, job descriptions, practice transcripts, and other content are sent to Anthropic's Claude API to generate feedback and scores. Please see our AI Use Disclosure for full details. We send only the minimum content required; we do not send your name or email to Anthropic.

Your data is stored on Supabase (hosted on AWS in the EU). All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Video recordings are stored in Supabase Storage with private bucket policies — no public URLs are generated.

We apply Row Level Security (RLS) on all database tables so your data is never accessible to other users. We maintain audit logs of security-relevant events.

• Active accounts: data retained while your account is active
• Video recordings: retained until you delete them or your account
• Deleted recordings/transcripts: permanently removed within 30 days
• Deleted accounts: personal data purged within 30 days; anonymised analytics data may be retained
• Audit logs: retained for 12 months for security purposes

If you are in the UK or EEA, you have the right to:

• Access — request a copy of your personal data (Settings → Privacy → Export My Data)
• Rectification — correct inaccurate data via your profile settings
• Erasure — delete your account and all associated data (Settings → Security → Delete Account)
• Restriction — limit processing in certain circumstances
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — for recording consent or marketing at any time

To exercise any right, contact privacy@gradprocess.ai. We will respond within 30 days. You may also lodge a complaint with the ICO (UK) at ico.org.uk.

We use the following categories of cookies:

• Essential: authentication, security, session management — always on
• Analytics: usage statistics to improve the product — opt-in only
• Marketing: personalised advertising — opt-in only

Manage your preferences in Settings → Privacy → Cookie Preferences.

• Supabase — database, authentication, file storage
• Anthropic — AI language model for feedback generation
• Stripe — payment processing
• Google — optional SSO sign-in (if you choose to use it)

Each provider has its own privacy policy and data processing agreements.

GradProcess AI is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child under 16 has provided data, please contact us immediately.

We may update this policy periodically. We will notify you of material changes by email or an in-app notice at least 14 days before the changes take effect.