Privacy Policy

GradeMapAI is an AI-assisted education service for GCSE and A-Level revision, run at grademap.ai, and currently in early access. GradeMapAI is the name of the service; the company details of the operator (registered in England & Wales) will be published here before we leave early access. Privacy questions and data requests go to a real person at privacy@grademap.ai.

Account information — name, email address, and an optional school.

Learning data — year group, subjects, exam boards, grades, weak areas, study minutes and XP earned.

Conversations — chat transcripts with AIRA and the subject tutors, including images you upload (such as photos of homework).

Voice — when voice features are used, audio is processed for transcription and read-aloud. Recordings may be stored. We treat voice data as sensitive data and give it extra protection.

Device data — push notification tokens for devices you opt in on.

Safety checks — the messages you send are screened before they reach the AI (length and personal contact details), and conversations are stored so they can be reviewed for safety.

Use by under-13s will require an account created and linked by a parent or guardian, with parental consent recorded before we process their data. That gate — and the parent notification that goes with it — is part of the safety core we are building now, and we will say so here when it is enforced in the product. Until then GradeMapAI is intended for students aged 13 and over; if you believe we hold data for a child under 13, email us and we will delete it.

Parents can already ask for a summary of everything we hold on their child, and can ask us to delete it, at any time. Voice data from under-18s gets extra protection: it is retained for the minimum period needed and excluded from anything other than the feature that created it.

We use your data to:

• Run the service — your plan, your tutors, your progress.
• Personalise learning around your subjects and weak areas.
• Safeguard students — screening messages before they reach the AI, and keeping conversation history so it can be reviewed.
• Improve the product.
• Send notifications you've asked for.

This is a product for young people, so safety work is disclosed rather than hidden. Here is exactly where it stands today.

Active now: every message is screened before it reaches the AI. Messages that are too long are blocked, and messages containing personal contact details (phone numbers or email addresses) are blocked. Conversations are stored so that they can be reviewed for safety. This is basic protection, and we describe it that way — it is not content moderation.

Coming with the 2.0 safety core: a safety-event log, broader content classifiers, moderation of uploaded images such as homework photos, and parent notifications when a check flags a serious concern. We will not describe any of these as active before they ship, and we will update this page when they do — parents will be notified through the product, not quietly.

We do not use safeguarding data for advertising or profiling beyond safety, and we never sell it.

We rely on contract to run the service you sign up for, on legitimate interests for safeguarding and for improving the product (balanced against your child's rights, with additional protections for children), and on consent for marketing emails and for voice processing where it applies.

• AI providers and speech processors, who process conversations and voice under contract and receive the minimum data necessary.
• Hosting providers, who store the service infrastructure.
• Firebase, for push notifications you've opted into.

We never sell personal data. There are no ad networks and no data brokers anywhere in this product.

Some processors are based outside the UK. Where data leaves the UK, we use recognised safeguards such as the International Data Transfer Agreement or Standard Contractual Clauses, and we limit what is transferred to the minimum needed to run the service.

We keep data only as long as it's needed: account data while the account exists, conversation history while you're learning, safety-review records for as long as they may be needed for a child's protection once the safety core ships, and voice recordings for the minimum period required.

You can delete your account and everything with it at any time from the danger zone in settings, or by emailing privacy@grademap.ai. Parents can request deletion of a child's data on their behalf. See our FAQ on how to delete everything.

You have the right to access, rectify, erase, and port your data, to object to or restrict processing, and to complain to the Information Commissioner's Office (ICO) if you believe we've got something wrong. Parents can exercise these rights for their children.

We use local storage for things that make the product work — your login session, theme and preferences — and nothing else. We don't run third-party trackers, analytics pixels, or advertising cookies.

If this policy changes, we'll update the date at the top and — for anything meaningful — tell you in the product or by email before it takes effect. Material changes to safeguarding practice will never be buried in an update notice.

Questions about privacy, or requests about your data, go to privacy@grademap.ai.