Privacy Policy for GradePod Ltd

For School Licences, please visit our Schools & Under-18s Privacy Addendum here.

Last updated: 1 September 2025

1) Who we are

GradePod Ltd, 5 South Charlotte Street, Edinburgh, EH2 4AN, United Kingdom.
Email: [email protected]
Website: https://www.gradepod.com

2) Scope and purpose

This policy explains what personal data we collect, why we collect it, how we use it, and your rights.

GradePod provides online learning to students aged 13+ and to schools that purchase licences for their students. When a school buys licences, the school is the data controller for student data, and GradePod processes data on the school’s instructions.

We comply with UK GDPR (and EU GDPR where applicable). For US schools, we operate in line with FERPA, and for children under 13 in the US we comply with COPPA by relying on verified school or parental consent.

3) Minimum age

GradePod is designed for learners aged 13 and above. We do not knowingly allow under-13 self-registration. If a school uses GradePod with learners under 13, the school confirms it has obtained verifiable parental consent in accordance with COPPA.

4) Data we collect

Account details (name, email, password hash)
Course usage (videos viewed, quiz attempts, progress, support interactions)
Purchase and billing information (processed securely by Stripe)
Technical data (IP address, browser type, device, diagnostic logs)

We do not collect biometric, health, or unnecessary sensitive categories.

5) How and why we use data (lawful bases)

To provide and support the service (contract)
To improve performance and security (legitimate interests)
To meet legal obligations (legal obligation)
With your consent where required (for example, newsletters or marketing)

6) Data ownership and selling

Students and schools retain ownership of their personal data. GradePod does not sell personal data.

7) Third-party processors

We use reputable vendors under written contracts that require confidentiality, security, and processing only on our instructions. We remain responsible for their compliance.

Purpose	Example provider	What they process
Hosting & learning platform	Kajabi	Account data, course activity
Payments	Stripe	Payer name, email, billing details
Email communications & helpdesk	Email/support providers	Name, email, messages
Product monitoring & security	Diagnostic/analytics tools	Technical logs

8) Security

We use encryption in transit (TLS) and at rest where supported by our vendors, role-based access, logging, and staff training. We enforce strong passwords and support SSO/MFA where available.

9) International data transfers

If data is transferred outside the UK/EU, we use lawful transfer mechanisms such as the Standard Contractual Clauses.

10) Retention

Direct accounts: retained while active, then deleted within 12 months.
School cohorts: retained until the student’s exam window ends, then deleted within 12 months, unless the school instructs otherwise.
Billing records: retained as required by law.
Aggregated, de-identified data may be retained for service improvement.

11) Deletion

You can request complete deletion of your personal data by emailing [email protected]. For school cohorts, we accept deletion requests from the school on the student’s behalf.

12) Your rights

You have GDPR rights to access, rectify, erase, restrict, object, and data portability, and to withdraw consent where processing is based on consent. You can also lodge a complaint with your data protection authority.

13) Cookies

We use functional cookies and limited analytics cookies to understand product performance. You can control cookies in your browser.

14) Facebook & Instagram Advertising

We may occasionally use Facebook Custom Audiences and related Meta services (including Instagram) to advertise to adult customers, such as parents or teachers. This involves securely uploading a hashed list of email addresses (for example, from resource downloads). Facebook/Instagram then matches these against existing accounts to deliver ads.

No student data is used for targeted ads.
Ads are not connected to school-licence student accounts.
You can control how Facebook/Instagram uses your data in your Meta account settings.

Further information:

Facebook Privacy: https://www.facebook.com/about/privacy/
Instagram Privacy: https://www.instagram.com/about/legal/privacy/

15) Google Analytics

We use Google Analytics to understand how visitors use GradePod and to improve our services.

Google Analytics sets cookies that collect information such as pages visited, time spent, and general location.
We enable IP anonymisation, so IP addresses are shortened within the EU/EEA before transmission to Google in the US.
Data is aggregated and not used to identify individuals.

You can opt out by installing the browser add-on: https://tools.google.com/dlpage/gaoptout