Skip to content
Grade Booster Academy

Privacy Policy

Last updated 21 October 2026

This policy explains how Grade Booster Academy ("we", "us") handles your personal data when you use our website, app and services. Grade Booster Academy is operated by [company legal name], [company registration number], [registered address] (the data controller). We serve university students worldwide.

Our approach is simple: everyone gets the same high level of protection, modelled on the EU General Data Protection Regulation (GDPR), wherever they live. Section 12 explains extra rights that apply under the law of your country or state.

1. Data we collect

  • Account and contact data: name, email address, phone number, time zone, country and preferred language.
  • Booking data: services, subjects, session times, tutors, notes you add, session summaries and, with your explicit consent, session recordings.
  • Files you upload: drafts and documents you share with your tutor, and the feedback on them.
  • Payment data: transaction references, amounts and status. Card and wallet details are handled by our payment providers; we never see or store full card numbers or PINs.
  • Messages: chat with tutors and our support assistant.
  • Technical data: device and browser type, and privacy-friendly, aggregated usage analytics only if you consent.

We do not ask for sensitive data (such as health, religion or ethnicity). If you choose to share it, for example to request study adjustments, we use it only for that purpose.

2. Why we use it, and our lawful basis

  • To provide the services you book, including scheduling, reminders and tutor matching (performance of a contract).
  • To take payments, issue receipts and process refunds (contract; legal obligation for tax records).
  • To keep the platform safe, prevent fraud and enforce our Academic Integrity Policy (legitimate interests).
  • To send study tips and offers, only if you opt in; you can unsubscribe at any time (consent).
  • To improve the site with aggregated analytics, only with your consent (consent).

3. Who can see your data

Your files and messages are visible only to you, your assigned tutor and a small number of authorised staff who need access to resolve a support request. We never sell personal data. We use trusted processors (and their sub-processors) under written data processing agreements:

  • Hosting, database, authentication and file storage providers.
  • Payment providers: Stripe and PayPal as our main methods, plus optional regional methods (such as M-Pesa, FPX, UPI or Pix) where available. We never store card details.
  • Email and SMS delivery providers.
  • Video call providers for live sessions.
  • Analytics providers, used only with your consent.
  • Our AI assistant provider, which powers the support chat.

A current list of sub-processors is available on request from gradeboosteracademyy@gmail.com.

4. International transfers

Our tutors and processors are located in several countries, so your data may be processed outside your own. Whenever it is, we use the safeguards your law requires: adequacy decisions, the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA) or UK Addendum, your consent where a law requires it, and equivalent contractual protections elsewhere.

5. How long we keep it

  • Uploaded files: deleted automatically after 90 days unless you choose to keep them.
  • Session recordings: 30 days, unless you choose to keep them.
  • Account data: while your account is active, then deleted or anonymised within 30 days of account closure.
  • Payment and invoice records: kept for as long as tax and accounting law requires (typically 5 to 10 years).

6. Security

  • Encryption in transit (TLS) and at rest.
  • Files are stored privately and accessed only through short-lived signed links.
  • Role-based access controls with access logging, so staff see only what they need.
  • Two-factor authentication (2FA) is required for all staff accounts.

7. Data breaches

If a personal data breach occurs that is likely to affect you, we will notify the relevant regulators within the time limits set by law (for example within 72 hours under the GDPR) and tell affected users without undue delay, explaining what happened and what we are doing about it.

8. Automated decision-making

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our AI assistant only answers questions; it does not decide bookings, refunds, grades or account actions.

9. Children

Our services are intended for university and college students aged 16 and over. Where the law in your country requires it, users under 18 need the consent of a parent or guardian. We do not knowingly collect data from children under 16; if we learn that we have, we delete it.

10. Cookies

We keep storage on your device to a minimum and load analytics only with your consent. See our Cookie Policy for details.

11. Your rights (everyone)

Wherever you live, you can: be informed about how we use your data; access it; correct it; delete it; restrict or object to processing; receive a portable copy; withdraw consent at any time; and opt out of marketing. You can export or delete your data from your account settings, or email us.

  • How to ask: email gradeboosteracademyy@gmail.com or use your account settings. We may need to verify your identity first.
  • Response time: within 30 days (45 days for California requests under the CCPA/CPRA), or sooner where your law requires. If we need more time, we will tell you why.
  • We will never treat you differently for exercising your rights.

12. Your rights where you live

The baseline above applies to everyone. These laws give you additional or specific rights.

European Union and EEA (GDPR)

  • Lawful bases are listed in section 2; you can object to processing based on legitimate interests.
  • EU representative (Article 27): [EU representative name and address].
  • Transfers outside the EEA use adequacy decisions or Standard Contractual Clauses.
  • You can complain to your local supervisory authority (edpb.europa.eu lists them).

United Kingdom (UK GDPR and Data Protection Act 2018)

  • You have the same rights as under the EU GDPR.
  • UK representative: [UK representative name and address].
  • Transfers outside the UK use UK adequacy regulations, the IDTA or the UK Addendum to the SCCs.
  • You can complain to the Information Commissioner's Office (ico.org.uk).

United States: California (CCPA/CPRA)

  • You have the right to know what personal information we collect and why, and to delete and correct it.
  • We do not sell personal information or share it for cross-context behavioural advertising. You can still send a "Do Not Sell or Share" request, and we honour Global Privacy Control (GPC) browser signals.
  • We use sensitive personal information only as needed to provide the services, so no "limit the use" request is required.
  • Exercise your rights at gradeboosteracademyy@gmail.com, personally or through an authorised agent. We respond within 45 days.

Other US states

  • Residents of states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah and Texas) have similar rights to access, correct, delete and port data and to opt out of targeted advertising, sale and profiling. If we decline a request, you can appeal by replying to our decision.

Canada (PIPEDA and Quebec Law 25)

  • You can access and correct your information and withdraw consent.
  • Quebec residents have additional rights under Law 25, including data portability and information about automated decisions. Our privacy officer is [name].
  • You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information.

Australia (Privacy Act 1988)

  • We handle your information in line with the Australian Privacy Principles (APPs), including access and correction.
  • Complain to us first; if you are not satisfied, contact the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand (Privacy Act 2020)

  • You can access and ask us to correct your information.
  • You can complain to the Office of the Privacy Commissioner (privacy.org.nz).

China (PIPL)

  • You can access, copy, correct, delete and port your data, and withdraw consent.
  • Because our providers are outside mainland China, we ask for your separate consent before transferring your data abroad.
  • You can complain to the Cyberspace Administration of China.

Japan (APPI)

  • You can request disclosure, correction, suspension of use and deletion.
  • You can complain to the Personal Information Protection Commission (ppc.go.jp).

South Korea (PIPA)

  • You can access, correct, delete and suspend processing of your data, and withdraw consent.
  • You can complain to the Personal Information Protection Commission (pipc.go.kr).

India (Digital Personal Data Protection Act 2023)

  • You can access a summary of your data, correct, complete or erase it, withdraw consent and nominate someone to act for you.
  • Raise grievances with us first; you can then complain to the Data Protection Board of India.

Singapore (PDPA)

  • You can access and correct your data and withdraw consent.
  • You can complain to the Personal Data Protection Commission (pdpc.gov.sg).

Hong Kong (PDPO)

  • You can make a data access request and a data correction request.
  • You can complain to the Privacy Commissioner for Personal Data (pcpd.org.hk).

Malaysia (PDPA 2010)

  • You can access and correct your data, withdraw consent and stop direct marketing. We respond to access requests within 21 days.
  • You can complain to the Personal Data Protection Commissioner (pdp.gov.my).

Thailand (PDPA)

  • You can access, port, correct and delete your data, and object to or restrict processing.
  • You can complain to the Personal Data Protection Committee (pdpc.or.th).

Indonesia (PDP Law)

  • You can access, correct, delete and port your data, and withdraw consent.
  • You can complain to the Indonesian data protection authority once established, or to the Ministry of Communication and Digital Affairs.

Philippines (Data Privacy Act 2012)

  • You can be informed, access, object, correct, erase and port your data.
  • You can complain to the National Privacy Commission (privacy.gov.ph).

United Arab Emirates (PDPL)

  • You can access, correct, delete and port your data, and object to or restrict processing.
  • You can complain to the UAE Data Office.

Saudi Arabia (PDPL)

  • You can be informed, access, obtain a copy, correct and delete your data.
  • You can complain to the Saudi Data and AI Authority (SDAIA).

South Africa (POPIA)

  • You can access, correct and delete your information and object to processing, including direct marketing.
  • You can complain to the Information Regulator (inforegulator.org.za).

Nigeria (NDPA 2023)

  • You can access, correct, delete and port your data, and withdraw consent.
  • You can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Kenya (Data Protection Act 2019)

  • You can be informed, access, correct and delete your data, and object to processing.
  • You can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Users elsewhere in Africa have similar rights under their national data protection laws and can contact their local regulator.

Brazil (LGPD)

  • You can confirm processing, access, correct, anonymise, port and delete your data, and withdraw consent.
  • You can complain to the National Data Protection Authority (ANPD, gov.br/anpd).

Users elsewhere in Latin America and in other countries have rights under their local laws; we will honour them. Contact us and we will help.

13. Changes to this policy

We may update this policy. We will show the new date at the top and, for significant changes, tell you by email or in the app before they take effect.

14. Contact

Data controller: [company legal name], [registered address]. Data Protection Officer: [DPO name]. Email: gradeboosteracademyy@gmail.com.

Book a session