Privacy Policy

Your research is yours. Each account’s notes, sources and documents are separated at the database level so no other user can read them. We do not sell your data, we do not run advertising trackers, and we do not use your content to train third-party AI models.

GradDesk is the data controller for GradDesk. Contact: support@graddesk.com.

• Account data, email address, and name or profile photo if you sign in with Google.
• Your content, sources, notes, takeaways, tasks, calendar entries, books, dissertation notes and any documents or slides you upload.
• Usage and technical data, basic logs such as IP address, browser type and error reports, used to keep the Service running and secure.
• Billing data, handled by our payment provider. We receive subscription status, not your full card number.

• To provide the Service you signed up for, performance of a contract.
• To secure accounts, prevent abuse and fix faults, legitimate interests.
• To take payment and meet tax and accounting duties, contract and legal obligation.
• To send optional product emails, consent, withdrawable at any time.

When you use the assistant, summaries, transcription or the writing check, the text you submit and the relevant excerpts from your own library are sent to our AI provider to generate a response. That provider processes it on our behalf to return the answer and does not use it to train models. If you would rather not send a particular passage to an AI provider, do not use the AI features on it.

Other users cannot see your data. Access rules are enforced by the database itself, per account. Our processors (hosting and database, AI provider, payment provider and email provider) may process data strictly to deliver the Service under contract.

Staff access is restricted to what is necessary to operate the Service. Where support requires looking at account data to fix a fault or meet a legal obligation, access is limited to that purpose. Where practical we will ask for your permission first, and you can always ask what was accessed.

Data is stored on managed cloud infrastructure, encrypted in transit and at rest, and may be processed in the EU or the United States under appropriate safeguards such as Standard Contractual Clauses. Uploaded files are kept in private storage that requires a signed, expiring link.

We keep your content while your account is active. If you delete an item it is removed from the live database and drops out of backups within 30 days. If you close your account we delete your content within 30 days, except records we must keep for tax or legal reasons.

Depending on where you live, you may access, correct, export, delete or restrict processing of your data, object to processing, and withdraw consent. You can export everything yourself from the Export page at any time. To exercise any other right, email support@graddesk.com; we respond within 30 days. You may also complain to your local data protection authority.

The Service is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.

We will post updates here and, for material changes, notify you in the app or by email before they take effect.