Privacy Policy

1. What we collect

We collect information you provide directly (name, email, password), information generated by your use of the Service (XP, progress, quiz answers, AI queries), and standard technical data (IP address, browser type, cookies).

2. How we use your data

We use your data to: provide and improve the Service; personalise your learning experience; process payments; send transactional emails (account confirmation, streak reminders); and analyse platform usage to improve content.

3. Data storage and international transfers

Your account data is stored in a Supabase (PostgreSQL) database hosted in the United States (AWS us-east-2, Ohio). Our application is served from Vercel's infrastructure, which also processes requests in the United States.

If you are in the United Kingdom, the European Economic Area or Switzerland, this means your personal data is transferred outside your home jurisdiction. Our providers offer this transfer under the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can ask us for details of the safeguards that apply by emailing hello@automateandgraduate.com.

Product analytics are processed separately by PostHog on EU infrastructure. Payments are processed by Stripe; we never store full payment card details. Advertising measurement data is processed by Google, including in the United States.

4. Third-party services

We use the following third-party processors: Supabase (database & auth), Stripe (payments), Resend (email), Anthropic (AI responses), PostHog (product analytics and session recording), Google Ads (advertising and conversion measurement) and Vercel (hosting). Each operates under their own privacy policy.

5. Cookies

We use strictly necessary cookies for authentication (your Supabase session). These are always set and cannot be disabled without breaking sign-in.

We use analytics cookies and similar local storage (PostHog) to understand how users navigate the platform, and advertising cookies (Google Ads) to measure whether an advert led to a signup. Google Consent Mode is in use: until you accept, advertising signals are sent without cookies and Google records only a modelled, non-identifying conversion.

If you accept cookies, we also enable session recording — PostHog captures a replay of your interactions with the site (clicks, navigation and page content) so we can see where the product is confusing. Password fields are masked. Session recording is off unless you accept.

You can change your choice at any time by clearing this site's cookies and local storage in your browser, which will bring the consent banner back.

6. Your rights

Under GDPR, you have the right to access, correct, export, or delete your personal data. To exercise these rights, email hello@automateandgraduate.com. We will respond within 30 days.

7. Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.

8. AI queries

Queries you send to the AI Assistant are processed by Anthropic's API. We also store the text of your queries, together with the AI response, in our own database — linked to your account — so that we can enforce usage limits, investigate faults and improve the quality of answers. Do not submit sensitive personal information, employer data, or anything confidential in AI queries.

You can ask us to delete your stored AI queries at any time by emailing hello@automateandgraduate.com; they are also deleted with your account.

9. Contact

Data controller: Automate & Graduate. For privacy questions: hello@automateandgraduate.com.