Privacy policy
The data GradMe keeps, why, for how long, and how to see or delete it.
In short
GradMe keeps as little data as possible. You can browse the site without an account. If you create one, we only keep what is needed to show you the right opportunities and remind you of deadlines.
We do not sell your data, rent it or use it for advertising. The site shows no ads. It counts its visits with Google Analytics only if you accept it in the cookie banner.
Who is responsible for your data
The data controller is the publisher of the site, presented in the Legal notice. For any question about your data, write to hello@grad-me.com.
The data we keep
When you create an account and use your space, we keep:
- your account: your e-mail address, the name you give (optional), the site language and your password in encrypted form (a fingerprint computed with the scrypt algorithm; nobody, not even us, can read it back);
- your profile, as you declare it: country of residence, nationalities, year of birth (only if you want age limits taken into account), level and field of study, grades, languages and certificates, skills, years of experience, target studies, destinations, wished departure date and budget;
- your tracking: the opportunities you save, their state (saved, preparing, applied), the steps you tick and your personal notes;
- your reminder preferences and the reminder e-mails prepared for you;
- your sign-in sessions: only a fingerprint of the sign-in token, with its expiry date.
You never upload any document to GradMe: no ID, no diploma, no transcript. We will never ask for them.
Why we use it
Your data is used only to run the service you ask for:
- signing you in to your account and protecting it;
- comparing your profile with the conditions of opportunities and explaining each match;
- keeping your tracking and notes from one visit to the next;
- sending you the deadline reminders you chose.
This processing is based on providing the service you request by creating an account. Protection against abuse (limiting repeated sign-in attempts) is based on our legitimate interest in securing the site: for this, the IP address and the e-mail address typed are kept briefly in memory, never in the database.
Your profile is never used to refuse you anything: it only sorts and explains opportunities.
Audience measurement
If you accept it in the cookie banner, Google Analytics 4 records how the site is used: pages viewed, length of the visit, type of device and browser, the site you came from, approximate country or city. These figures help us know which pages are useful. Without your consent, nothing is loaded from Google.
This measurement is based on your consent. You can withdraw it at any time with the “Manage cookies” button at the bottom of every page. Your IP address is not used for advertising.
Who can see your data
Your data is shared with no one other than:
- GradMe’s administration team, who sees the list of accounts (e-mail address, name, language, creation date) to run the site;
- our host (Vercel Inc., Supabase Inc.), which stores the site’s PostgreSQL database;
- Resend, the e-mail sending service, only when reminder sending is switched on: it receives your e-mail address and the content of the reminder;
- Google Ireland Limited, only if you accept audience measurement: it receives the visit information described above and processes it on our behalf, as a processor, without using it for advertising.
The organisations offering opportunities receive nothing from GradMe. When you apply, you do so directly on their website.
How long we keep it
Your data is kept as long as your account exists. A sign-in session expires after 30 days. When you delete your account, your profile, tracking, notes, sessions and reminder e-mails are erased at the same time, immediately.
Your rights
Under the General Data Protection Regulation (GDPR), you have the right:
- to access your data and receive a copy of it;
- to correct it: your profile can be edited at any time from My space;
- to delete it: the account deletion button is in My space;
- to get it in a readable format to use elsewhere (portability);
- to object to processing or ask for it to be restricted;
- to lodge a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.
To exercise a right that cannot be done directly from your space, write to hello@grad-me.com from your account’s address.
Security
Passwords are never kept in plain text. The sign-in token can only be read by the server and only its fingerprint is stored. Repeated sign-in attempts are slowed down to block attempts to guess a password.