Privacy Policy
Last updated: October 2026 | Version 1.2
Summary: Graduo is an AI-powered educational app. We collect only the data needed to provide the service, protect it under GDPR, and never sell personal data.
1. Data controller
General contact: contact@graduo.app
Privacy contact: privacy@graduo.app
Operator: Graduo (entity in formation, France)
Hosting provider: Firebase / Google Cloud Platform, Google Ireland Limited, Dublin 4, Ireland.
2. Data we collect
- Account data: email address and display name.
- Profile data: optional picture, study level, age or year of birth, and language preferences.
- Learning content: roadmaps, quizzes, flashcards, notes, uploaded documents, homework sessions, and AI conversations.
- Technical data: device type, OS version, app version, crash reports, security events, and usage statistics (Firebase Analytics) linked to the technical identifier of your account.
We do not collect precise geolocation, contact lists, biometric data, health data, or payment card numbers.
3. Legal basis and purposes
| Data | Purpose | Legal basis |
|---|---|---|
| Account and progress | Provide the educational service | Contract |
| AI prompts and outputs | Generate personalized learning content | Contract |
| Analytics and crash logs | Improve reliability and security | Legitimate interest |
| Marketing emails | Send optional product news | Consent |
| Billing identifiers | Manage subscriptions and tax obligations | Contract / legal obligation |
4. AI processing
Important: Graduo uses AI providers, including Google Gemini, to generate educational content. AI can make mistakes, so important information should be checked.
- We do not use your data to train third-party AI models.
- We minimize and protect prompts sent to AI providers.
- You can report incorrect or inappropriate AI output from the app or by email.
5. Sharing, transfers, and retention
We do not sell personal data. We share data only with service providers needed to operate Graduo, such as Firebase, Google Gemini, RevenueCat, Stripe (web payments), Apple, Google Play, Sentry, and email delivery providers.
Some processing runs on Google Cloud servers in the United States, including homework photo analysis, voice features, profile creation, account deletion, and payment events. These transfers outside the European Economic Area rely on the safeguards offered by each provider, such as the EU-US Data Privacy Framework or Standard Contractual Clauses.
| Data | Retention |
|---|---|
| Account and learning data | As long as the account exists; erased as soon as you delete your account |
| Billing records | Up to 7 years when legally required |
| Usage statistics | Up to 14 months |
| Crash reports | Up to 90 days |
6. Your rights
Under GDPR, you can request access, rectification, deletion, restriction, portability, objection, withdrawal of consent, and human review of automated decisions. We respond within 30 days.
You can also lodge a complaint with the CNIL at www.cnil.fr.
7. Security, children, and cookies
- Data is protected in transit with HTTPS/TLS and at rest with managed cloud encryption.
- Backend calls use authentication, rate limits, and abuse monitoring.
- Graduo is intended for users aged 13+; in France and some EU countries, users under 15 may need parental consent.
- The iOS and Android apps do not use cookies. On the web, the app keeps your sign-in session in your browser storage, and the website only sets analytics cookies if you accept them.
8. Contact and account deletion
For privacy requests or account deletion, contact privacy@graduo.app or use the dedicated deletion page.
General contact: contact@graduo.app
Support: support@graduo.app
Privacy contact: privacy@graduo.app
Operator: Graduo (entity in formation, France)
© 2026 Graduo. All rights reserved.