Privacy Policy

1. Who We Are

GradeAid (DK), CVR 45882411 (“we,” “us,” or “our”) is the Data Controller responsible for processing your personal data. We are committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven).

Address: Porcelænshaven 26, 2.sal, 2000 Frederiksberg, Denmark

Contact: privacy@gradeaid.ai

2. Information We Collect

We process personal data about you when this is relevant and in accordance with applicable legislation.

About parents:

• Email address — used for account verification and safety alerts.

About children:

• Nickname (display name) and grade/class level.
• Content of chat interactions with the AI tutor.

Technical data:

• Cookies for login sessions and preferences.
• Anonymous usage analytics to improve the service.

If we need to collect additional personal data beyond what is listed above, we will inform you at the time of collection.

3. How We Use Your Data

• To provide and personalize the AI tutoring service (Tailored Learning).
• To verify parental consent for users under 13 years of age.
• To improve our service, including AI safety guardrails.
• To communicate important updates about the service.
• To provide customer service and technical support.

4. Legal Basis for Processing

We only process your personal data when we have a lawful basis in accordance with the GDPR.

• Consent (GDPR Art. 6(1)(a) / Databeskyttelsesloven § 6, stk. 2-3): Users aged 13 or older may consent independently. For users under 13, consent must be given by the holder of parental responsibility (forældremyndighedsindehaver). You may withdraw your consent at any time by contacting us. If you withdraw consent, data processed on the basis of that consent will be deleted, unless we are required to retain it by law.
• Legitimate Interest (GDPR Art. 6(1)(f)): Improving AI safety and service quality.

5. Data Sharing & Third Parties

We only share personal data with others when it meets the requirements of the GDPR. The following is a list of our data processors:

• Google Gemini (AI service): Anonymized educational questions. All personal identifiers are stripped before transmission. Google is contractually prohibited from using this data to train its models.
• Google Analytics: Anonymous usage statistics (approximate location such as country, page interactions).
• Supabase (hosting/database): Account information, child profile data, chat logs.

We do not sell your data to any third party.

If our external partners are data processors for us, their processing always takes place pursuant to a data processing agreement that meets the requirements of the legislation. Contact us for more information.

6. International Transfers

Anonymized data may be processed by Google servers located outside the European Economic Area (EEA). We transfer personal data to the United States on the basis of the EU-U.S. Data Privacy Framework (DPF), where the recipient is DPF-certified. Standard Contractual Clauses (SCCs) are used as a supplementary safeguard where applicable.

Contact us for more information, including to receive a copy of the documentation for the transfer basis.

7. Data Retention

Chat logs are retained for a maximum of 90 days before permanent deletion or full anonymization, unless legally required otherwise.

Account data is retained for the duration of use and deleted upon account closure.

A user or parent can at any time delete their account themselves, after which all data associated with the account is deleted.

Consent records (timestamp and method of consent) are retained for the duration of the account and for up to 3 years after account closure, to demonstrate compliance with GDPR Art. 7(1).

8. Children's Privacy

Protecting children's data is our top priority. In accordance with Databeskyttelsesloven § 6, stk. 2-3, users under 13 cannot create an account independently. A parent or guardian (forældremyndighedsindehaver) must create an account and add a child profile. Users aged 13 or older may consent independently.

We collect only the minimum data necessary (nickname, grade level, chat content) and anonymize all data before sending to third-party AI services.

9. Automated Decision-Making

GradeAid uses artificial intelligence to adapt educational content and provide feedback based on your child's interactions. The AI analyzes chat interactions and learning progress to personalize lesson difficulty and topic selection. No decisions with legal or similarly significant effects are made solely by automated means. All personal identifiers are removed before data is sent to AI providers.

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you, unless the decision is necessary for a contract, authorized by law, or based on your explicit consent (GDPR Art. 22).

10. Advertising and Sponsored Content

GradeAid does not display advertising or sponsored content to children. We do not use personal data for profiling or targeted marketing. No tracking or marketing cookies are used in the child's experience. We do not make direct purchase calls to children through the platform.

11. Your Rights (GDPR)

As a registered person, you have the following rights:

• Right to Access: Request a copy of all data we hold about you and the purposes of processing.
• Right to Rectification: Correct inaccurate data.
• Right to Erasure: Request permanent deletion of your account and data.
• Right to Restrict Processing: In certain cases, request limitation of processing so that we only store your data for a given period.
• Right to Portability: Receive your data in a machine-readable format (JSON/PDF).
• Right to Object: Object to processing based on legitimate interest, including for direct marketing purposes.
• Right to Withdraw Consent: Withdraw consent at any time without affecting lawfulness of prior processing.
• Right Regarding Automated Decisions: Not to be subject to a purely automated decision without human involvement (GDPR Art. 22).
• Right to Complain: Lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

There may be conditions or limitations to these rights. Please contact us if you wish to exercise any of your rights.

12. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, and regular security assessments.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The version number and date are shown at the top of this document. In the case of significant changes, we will notify you via email or a visible notice in the app. Where consent is the legal basis for processing, material changes to the scope of data processing will require renewed consent.