Privacy Notice
This notice explains how GRADPLAN LTD uses personal data in the UK paid Early Access, including what is sent to AI providers, how long data is kept and how to exercise your rights.
1. Controller and contact details
GRADPLAN LTD is the controller for GradPlan account, product, support and legal-acceptance data. We are registered in England and Wales under company number 17348755. Registered office: 56 Fremantle Road, Ilford, United Kingdom, IG6 2AZ.
For access, correction, deletion, objection, restriction, portability, withdrawal or a privacy complaint, email hello@gradplan.uk. Please use the email connected to your account where possible. We may need proportionate information to verify identity.
2. Scope and service boundaries
This notice covers the public website, Early Access application, account and billing journey, support and the five paid Early Access product areas: Tracker, Application Studio, Prep Hub, Insights and Improve Hub. Cappy AI, Group Task Simulation and legacy live/video analysis are not part of the paid Early Access release described here.
GradPlan is for people aged 18 or over. We record an 18+ declaration and its version/time; we do not ask for a date of birth. If you believe a child has provided data, contact us.
3. Personal data, purposes and lawful bases
| Data | Why we use it | UK GDPR lawful basis |
|---|---|---|
| Account identity: user ID, email, display name, sign-in provider, authentication/security state and 18+ declaration | Create, secure and administer the account; enforce eligibility; communicate essential service information | Contract; legitimate interests in security and fraud prevention; legal obligation where applicable |
| Early Access application/invitation, access status, pass dates and entitlement records | Approve testers, provide the purchased pass and enforce scope and allowances | Steps at your request before contract; contract; legitimate interests in operating a bounded Early Access |
| Tracker content: employers, roles, public job URLs/text, recruitment-email text you paste, stages, dates, contacts, interviews, notes, tasks and priorities | Provide Tracker, Smart Import and role-linked workflows | Contract; legitimate interests for security, support and service improvement using minimised operational data |
| Role & Company Intelligence data: the selected application, confirmed company identity, source references and excerpts, generated role/company brief, private notes, saved talking points and feedback | Provide vacancy-specific interview research, preserve your workspace and avoid regenerating unchanged material | Contract for the requested research and storage; legitimate interests in source quality, reliability and cost control |
| Application Studio documents and text: CVs, cover letters, job descriptions, instructions, working copies, versions and accept/dismiss decisions | Store documents; generate requested drafts/reviews; preserve user-controlled version history | Contract |
| Prep data: assigned questions, draft answers, psychometric answers/scores/history, historical recordings and transcripts, interview questions, feedback and scores | Provide deterministic practice and preserve historical workspace data. New Offline Audio Interview uploads and processing are unavailable | Contract; explicit consent only if a special-category element is genuinely required and an approved flow asks for it. The normal product is not designed to require such data. |
| Improve Hub data: career profile context, self-assessments, feedback, goals, weekly actions and completion state | Provide user-controlled improvement planning | Contract |
| Private interview reflections: interview context, questions/topics, optional answer summaries, confidence and performance ratings, follow-up notes, reported interviewer feedback, outcome and generated coaching | Let you keep a private learning record, continue drafts and request personalised post-interview feedback. These records are not contributed to community insights. | Contract for storage and requested coaching. Any future community contribution would require a separate choice and assessment. |
| AI request metadata: request IDs, feature/scope, prompt/schema/model version, hashes, token/cost estimates, status, timing, safety and quota events; limited replay/cache content where implemented | Return requested output, avoid duplicate charges, control quotas, troubleshoot, secure the service and manage provider cost | Contract for the requested result; legitimate interests in reliability, security and cost control |
| Legal acceptance data and payment data: Stripe customer/session/payment IDs, amount, currency, status, billing details returned by Stripe, accepted document versions, immediate-access request, time and source | Take payment, issue/verify access, handle cancellation/refunds, prove the contract and meet tax/accounting/legal duties | Contract; legal obligation; legitimate interests in legal claims and fraud prevention |
| Support, feedback and privacy complaints | Respond, investigate, remedy problems and improve the Early Access | Contract; legal obligation for rights/complaints; legitimate interests for support and improvement |
| Newsletter data: email, name, subscription status, confirmation and suppression evidence | Send the optional GradPlan Briefing only after a separate positive marketing choice; honour unsubscribe and prevent re-contact | Consent for marketing; legal obligation/legitimate interests for a minimal suppression record |
| Device/service data: IP/network-derived signals, browser/device information, authentication storage, reCAPTCHA result, request/security logs and service-worker/cache state | Deliver the site, maintain sessions, prevent abuse, diagnose incidents and keep the service secure | Contract; legitimate interests in secure and reliable operation; legal obligation where applicable |
Where we rely on legitimate interests, we use the data because the processing is necessary for a secure, supportable Early Access and we consider the impact on users. You may object; we will stop unless we have compelling grounds or need the data for legal claims.
Public waitlist — added 6 September 2026
When you ask to join the waitlist, we collect your email, career stage and confirmation that you are 18 or over. Graduation year, broad industry and role interests are optional. We use these details to manage your request for access, understand aggregate demand and plan relevant onboarding. We do not ask for your university, degree, date of birth or documents. The basis for managing your access request is taking steps at your request before a contract; minimised demand analysis supports our legitimate interest in improving the service.
We record the choice and time for optional GradPlan product emails separately. It is not preselected or required to join. We do not treat an unverified email submission as permission to send promotional emails: ownership and consent must be confirmed before a marketing send. You can withdraw your choice or request removal by emailing hello@gradplan.uk. Any future promotional email must offer an unsubscribe option.
We retain a referring hostname and bounded campaign labels when present, not full referrer URLs. reCAPTCHA runs when you submit to prevent abuse. Our waitlist rate limiter keeps a keyed digest of the network address, not the raw address. Waitlist records use our existing Firebase database; the controlled submission function runs in London (europe-west2). Waitlist preferences are not sent to AI providers.
Unconverted waitlist entries expire after 12 months and are targeted by daily deletion. Rate-limit records expire after two days and are also targeted by that cleanup. Copies in provider backups expire under their own recovery policies. You may ask for earlier access, correction or deletion at the email above, subject to proportionate identity checks. Repeating an anonymous submission cannot change an existing entry. If you later create an account, matching must use a verified email and offer you a chance to confirm or change your preferences; this transfer is not automatic in the current release. Linked records are covered by account export and deletion.
4. Special-category, criminal-offence and third-party data
We do not infer special-category attributes or use them to score employability. If a future workflow intentionally requires special-category or criminal-offence processing, it must have a documented Article 9/10 condition and appropriate safeguards before release. The paid Early Access does not treat general contract performance alone as authority for such processing.
Estimated role guidance
GradPlan Intelligence can use an application’s title and your saved role choice to show an estimated role profile when a description is missing or incomplete. This uses an original role library without a model request. It preserves your description and separates supplied details from typical suggestions. Estimates are not verified employer requirements or evidence of your skills. Role corrections and feedback remain private to your account and authorised support.
Limited background company research is currently unavailable. If enabled later, it requires your application-specific choice, repeated preparation activity, permitted public evidence and spending controls. That path sends only permitted employer evidence and the canonical occupation to the provider, not your pasted description, CV, answers, application identity or account identity. We would retain linked demand/deduplication records for up to 30 days, include them in account export and deletion, and stop using expired records before automated cleanup. Shareable company evidence would have a maximum 30-day read limit or the source’s shorter limit.
5. AI and speech processing
AI operates only when you request an enabled feature. Question Cards, psychometric scoring and normal Improve Hub planning are deterministic in this paid Early Access scope. Saving an interview-reflection draft does not use AI; submitting it for personalised feedback does.
| Flow | What leaves GradPlan | What comes back and how it affects you |
|---|---|---|
| Tracker Smart Import | The recruitment email/job-ad text you paste, or text retrieved from a supported public HTTPS job URL, plus limited extraction instructions and context | Google Gemini returns structured role fields as an editable draft. You review and change fields before saving. No employer receives it. |
| Application Studio generation and review | Extracted CV or cover-letter text, relevant job description/role context and your instruction; not payment data | Gemini returns a draft or review suggestions. You can edit, accept or dismiss them. GradPlan does not automatically replace the source document. |
| Role & Company Intelligence | The selected vacancy and employer details, source-labelled public evidence retrieved for that employer, bounded profile/CV context, and any existing Tracker company research or Prep Hub company notes, market briefing and research-vault text relevant to your preparation. Notes added inside the Intelligence workspace are not included in later generation. For recent public reporting, NewsData.io receives only a bounded company-name search—not your identity, CV/profile, private notes, vacancy description or role text. | Gemini returns a source-attributed role/company brief and candidate-specific preparation suggestions only after you select Generate or confirm Refresh. Existing saved research is treated as private, unverified context rather than an official source. Opening the workspace does not call Gemini or NewsData.io. Source classifications distinguish evidence, GradPlan analysis and items to verify; no employer receives the output. NewsData.io free-tier coverage is delayed, limited and not exhaustive. |
| Offline Audio Interview transcription | This flow is disabled. New interview audio is not accepted or sent for transcription; the source retains the historical EU Speech-to-Text configuration | Historical transcripts are subject to the account lifecycle. No new transcription is available, and no video or facial analysis is enabled. |
| Offline Audio Interview feedback | New audio interview feedback is unavailable | Historical feedback remains subject to the account lifecycle. Enabling document uploads does not enable interview audio or its processing. |
| Post-interview reflection feedback | The company/role/interview context and reflection content you choose to submit, including recorded questions, answer summaries, self-assessment, reported immediate feedback and outcome | Gemini returns private structured coaching, possible answer structures, practice topics and possible follow-up questions. GradPlan stores the result so reopening it does not create another request. The output distinguishes self-assessment and user-recorded/reported information from verified fact; it is not a hiring prediction and is not shared with employers or other users. |
| Optional interview-question and Insights coaching | The selected question and limited role context, or aggregate application counts without names or contact details | Only generated on your request. Suggestions are private assistance, not hiring predictions. |
Models and provider use
GradPlan uses Gemini 3.5 Flash through Google Cloud Vertex AI (now documented by Google as Gemini Enterprise Agent Platform), using our billed production project and the London endpoint. Google’s model-specific documentation supports UK machine-learning processing for this configuration. This does not mean that every Google support or service operation is confined to the UK.
Google’s Cloud terms prohibit training or fine-tuning on customer data without our permission or instruction. We do not opt your content into model training or enable optional request/response logging. Google may retain flagged prompts for up to 90 days for abuse monitoring, with authorised review. We therefore do not promise zero provider retention. We disable optional in-memory caching and do not use stored Interactions or Google Search grounding for these features. Avoid unnecessary sensitive or confidential information.
Google states that Speech-to-Text does not retain input audio for service improvement unless the customer opts into data logging, and that batch/asynchronous transcript results may remain available for approximately five days. GradPlan’s source uses the EU endpoint and does not intentionally opt in to service-improvement logging; the current production-account setting still requires release verification.
No solely automated significant decisions
GradPlan does not make employment decisions, rank you for an employer, submit applications or make a solely automated decision that has a legal or similarly significant effect. You control saving Smart Import data and accepting document suggestions. Employers do not receive AI output from GradPlan.
Optional email application import
Where a provider is available, you can connect Gmail or Google Workspace to look for job applications you have already submitted. Connecting does not start a scan. You choose the account and date range and press Scan my inbox. GradPlan requests read-only mail access; it does not send, delete or modify your messages.
GradPlan first filters messages at the email provider, then checks limited metadata and snippets. For likely recruitment messages, it reads the necessary content, removes unrelated material and contact details where practical, and sends a small extract to the existing Gemini service to suggest application fields. No attachments or complete threads are analysed. Email access and refresh credentials are encrypted and remain on the backend.
You can open, edit, select or ignore suggestions. Only your explicit final approval creates applications in your tracker; email content cannot change existing applications. Full email bodies are not retained by GradPlan. Temporary suggestions, small source excerpts and scan records expire after 30 days; message fingerprints and approval receipts expire after 180 days. Expired data is inaccessible through the importer and is removed by automated database expiry. You can disconnect at any time in Settings → Password & security → Connected email accounts. Previously approved applications remain until you remove them or delete your account.
Gmail handles the mailbox and connection permissions; Google Cloud/Firebase handle processing and storage; Gemini handles limited structured extraction while the existing AI release controls pass. You can also remove provider consent through your Google account. GradPlan does not opt email requests into optional Gemini data sharing or model training. Provider processing remains subject to the AI and international-transfer details in this notice. Provider availability is subject to setup and verification.
6. Files, recordings and local device storage
Supported documents are stored in private Google Cloud Storage. The backend checks your identity, access and the exact approved object before issuing a short-lived, generation-bound download. Parsed text and document metadata may be stored in Firestore to provide the workspace. Uploads remain quarantined until file validation and the configured malware scanner approve their exact bytes.
Interview audio upload, transcription and processing are disabled. Historical recordings, transcripts and feedback remain subject to account export, erasure and retention controls; document availability does not enable new audio processing. Cloud Storage soft delete can keep a recoverable deleted file for about seven further days.
GradPlan uses necessary browser/device storage for Firebase authentication, security, preferences, in-progress forms, rate/idempotency state, PWA caching and service operation. We found no advertising or general behavioural-analytics tracker in the paid Early Access source. See the Cookies and Device Storage Notice.
7. Recipients and processors
- Google Cloud/Firebase – hosting, authentication, Firestore, Cloud Functions/Run, Storage, logging, security and Speech-to-Text.
- Google Cloud Vertex AI (Gemini models) – only for the user-requested AI flows described above while release controls pass.
- NewsData.io – recent public company-reporting search for Role & Company Intelligence. It receives a bounded company-name query and server request metadata, not candidate or workspace content.
- Stripe – checkout, payment, refunds/disputes, receipts and billing portal. Stripe acts as processor for some activities and as an independent controller for certain payment/compliance purposes.
- Resend or another approved email delivery provider – only where enabled for essential account/transactional messages. Durable post-contract confirmation is a release requirement, not a claim that every email flow is already active.
- Professional advisers, authorities or courts – when reasonably necessary to comply with law, protect rights or handle a claim.
We do not sell personal data and do not share your workspace with employers. We require providers to use appropriate contractual, security and confidentiality protections.
Optional newsletter
New newsletter signup and confirmation are paused during the current Early Access release. Historical newsletter records remain covered by account export and deletion, and we retain only the minimal suppression evidence needed to honour an earlier unsubscribe or erasure choice. If newsletter signup is reintroduced, its consent will remain separate from requesting or purchasing Early Access.
8. International transfers
GradPlan’s core Google Cloud resources identified in the audit are in UK/EU multi-regions and europe-west2, and source uses the EU Speech-to-Text endpoint. The configured Gemini 3.5 Flash London endpoint supports UK machine-learning processing. Provider support, service operations, Stripe payment operations and communications can involve processing outside the UK; this is not a promise that all AI-related data stays in the UK.
Where restricted transfers occur, we rely on the provider’s applicable UK adequacy route or contractual safeguards, such as the UK International Data Transfer Addendum/recognised standard clauses, together with technical and organisational measures. The executed provider agreements and live account configurations must be verified before payment launch. You can request information about the relevant safeguard from hello@gradplan.uk.
9. Retention and deletion
We keep personal data only as long as needed for the purpose described, legal duties and the establishment, exercise or defence of claims. Current implementation and provider limits are:
| Data | Current retention/deletion behaviour |
|---|---|
| Account, Tracker, Application Studio, Prep and Improve workspace data, including Role & Company Intelligence, private notes, private interview reflections and stored coaching | Kept while the account remains open. Deleting an application or account targets its private intelligence record as well as other related records. A reflection can also be deleted individually. Uploaded documents, including saved document versions, and their parsed text are scheduled for removal 30 days after the related BetaPass ends; a valid extension before terminal deletion can move that deadline. Other workspace data is not automatically deleted solely because the pass expires. Account deletion targets active operational records after recent sign-in, with only the restricted retention categories below kept. |
| User-deleted documents and operational data | A terminal deletion state blocks document reuse and clears private extracted content immediately. Exact-generation byte deletion is retried if the provider refuses it. The remaining terminal document metadata is kept for seven days after confirmed byte cleanup, then purged when no related object version, deletion job or pending account-erasure barrier remains. While cleanup is pending, that metadata can include file names, labels and source/template details alongside the identity, path, generation, digest and status binding. Private extracted and parsed content is cleared immediately; retries do not restart the confirmed-cleanup retention period. Cloud Storage soft delete can retain a recoverable version for about seven further days; other provider recovery systems expire on their own cycles. |
| Offline interview audio | New interview audio uploads and processing are disabled. Historical temporary objects remain subject to cleanup; Storage soft delete may retain a recoverable deleted file for about seven further days. |
| Speech-to-Text batch result | Google documents approximately five days for asynchronous/batch transcript-result availability. Input audio is not retained by Speech-to-Text under the non-logging configuration described above. |
| Gemini prompts, context and responses | Google documents up to 90 days for flagged-prompt abuse monitoring, including possible authorised review. Optional provider request/response logging and in-memory caching are disabled. GradPlan may hold limited replay/cache content for shorter technical periods where implemented; workspace results remain under the account lifecycle. |
| Restricted records kept after account erasure | Our internal category policy keeps minimal verified payment/accounting evidence until six years after the last related financial year ends on 31 July; the first accounting period ends 31 July 2027. Legal-acceptance metadata is kept for 24 months after retention begins, resolved privacy-complaint metadata for 24 months after resolution, administrative security audit metadata for 90 days, nonfinancial access-reconciliation metadata for 30 days, and account-erasure completion receipts for 90 days. Reusable provider references, document content and unverified foreign billing payloads are excluded. These finite records have expiry deadlines; database deletion can follow the deadline after the provider delay. A missing reliable financial timestamp, unverified ownership or an unresolved complaint instead produces a minimal review record with a 30-day review deadline. Such case-specific holds do not have an automatic expiry until reviewed and resolved. |
| Service and security logs | Ordinary service logs in our configured Google Cloud default log bucket are retained for 30 days. Google-required audit logs are retained for 400 days. These periods were verified on 19 September 2026. Logs are intended for operational and security metadata, not full CVs or prompts. |
You can download a JSON account export in Settings even without an active paid entitlement. Account deletion is available after recent authentication while the approved category policy is configured. Erasure removes active operational content and records the outcome separately from restricted legal/accounting retention. If provider cleanup fails, the request can remain pending for retry; local deletion does not promise immediate erasure from provider recovery systems. Contact us if the control is unavailable or you need information about a review hold.
10. Security
Controls evidenced in source include Firebase authentication, server-side entitlement checks, UK access controls, least-privilege database/storage rules, private file paths, short-lived access authorisation, reauthentication for deletion, App Check/reCAPTCHA and rate/cost limits. Cloud metadata previously evidenced UK/EU resource regions, uniform bucket access, seven-day soft delete and Firestore point-in-time recovery. No internet service is risk-free; tell us promptly if you suspect unauthorised access.
11. Your UK data-protection rights
Depending on the circumstances, you may ask us to:
- give you access to personal data and information about its use;
- correct inaccurate or incomplete data;
- erase data;
- restrict processing;
- provide data you supplied in a portable format;
- object to legitimate-interests processing or direct marketing;
- withdraw consent at any time where consent is the basis, without affecting earlier processing; and
- obtain human review and challenge a qualifying automated decision. GradPlan does not currently make such decisions.
Rights are not absolute. We will explain a lawful refusal or restriction. We normally respond within one month, subject to the UK GDPR rules for complex requests. There is no charge unless a request is manifestly unfounded or excessive.
12. Privacy complaints
Email hello@gradplan.uk with the issue and outcome you want. We will acknowledge a data-protection complaint within 30 days, investigate it, keep you informed where resolution takes longer, and provide the outcome without undue delay.
You may complain at any time to the UK Information Commissioner’s Office (ICO), including through the ICO data-protection complaint service. We would appreciate the chance to address the issue first, but you do not have to contact us before the ICO.
13. Changes to this notice
We may update this notice when features, providers, law or processing changes. We will publish the new version and effective date and give an appropriate in-product or email notice for a material change. New optional processing will not be justified by a historic acceptance where a new choice or consent is required.
GradPlan Autofill — controlled Chrome Early Access release (10 September 2026)
GradPlan Autofill uses information you explicitly approve in Settings to suggest and populate job-application fields. Existing account and career-profile details are offered as unverified drafts. Each value records its source, approval status and review time. You control permitted categories, can disable Autofill, disconnect extensions and delete the separate Autofill Profile.
The extension scans visible form metadata on the active page only when you choose to scan it. Labels, input types, field identifiers, descriptions and select options are classified locally. Page contents and candidate answers are not sent to AI services or GradPlan for classification. Only selected values are sent to the page when you choose to fill. The receiving website and its scripts can read values once inserted. You should review the website and every answer before continuing.
Equality and special-category fields, highly sensitive identifiers, declarations, signatures and CAPTCHA are excluded. Do not put sensitive information into free-text Autofill fields. Obvious sensitive terms are rejected, but this filter cannot determine every meaning of free text. The extension never submits an application, clicks application navigation or uploads a file. Selected document names and references can be displayed; files are uploaded manually through the existing document workflow.
Connection approval happens in the signed-in GradPlan website using Firebase authentication and App Check. The website keeps the public connection challenge in session storage for up to ten minutes to preserve the request through sign-in; the secret verifier stays in the extension. A one-use connection grant expires after two minutes. The extension keeps a short-lived session credential and account email in Chrome session memory, cleared on browser restart or disconnect. Credentials rotate during active use, expire after 15 minutes without renewal and have an eight-hour absolute lifetime. Complete profiles are not written to Chrome persistent storage. Previous field values for Undo remain in the content script's memory until navigation or browser closure.
Profiles stay in your GradPlan account until deleted or removed under the account-retention process. Session records, pairing grants, rate-limit buckets and optional daily aggregate counts have expiry fields and are scheduled for Firestore TTL deletion; expiry is enforced before physical deletion. Aggregate counts are retained for up to 90 days plus the provider's deletion delay. Profile and linked session records are included in account export and deletion; security credentials are not exported as usable secrets.
Optional anonymous daily counts are off by default. If enabled, they record totals such as scans, detected fields, insertions and undo actions, without names, answers, page domains or form text. An Early Access diagnostic report is created locally only when requested and contains the domain, detected platform and classification counts. You decide whether to share it with support. The API and hosting providers also process network and operational request metadata under the existing service-security arrangements.
Successful online GradPlan sign-out revokes paired extension access. If a network failure prevents revocation, disconnect the extension locally; server access remains bounded by credential expiry and the eight-hour absolute limit. Disabling Autofill, deleting its profile and account/token revocation also block future access. Already inserted data on an employer website must be edited there.