Privacy Policy

Last updated: 19 May 2026

GradeSphere ("we", "us", "our") is a school analytics platform operated by Lokesh, based in Dubai, United Arab Emirates. This policy explains what data we collect, how we process it, and your rights under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL").

1. What data we collect

School account data: School name, contact email, administrator name, curriculum type. Collected at account creation.

Student data: Student ID, name, year group, class, and demographic attributes (gender, nationality category, SEN status, EAL status, gifted & talented status). Uploaded by the school via CSV import.

Assessment data: Student results, grades, and scores per subject, term, and assessment. Uploaded by the school via CSV import.

Inspection documents: KHDA and ADEK inspection report PDFs, uploaded by the school. These are public documents published by the relevant inspection authority.

Usage data: Server access logs (IP address, timestamp, URL requested). No tracking cookies, no third-party analytics, no advertising pixels.

2. How we process data

Analytics: Student data is processed to generate attainment, progress, and demographic reports. All processing happens on our servers. No student data is shared with third parties.

AI processing: Inspection PDF documents are sent to the Anthropic API (Claude) for structured data extraction. Only the inspection document content is sent — no student names, IDs, or personal data are included in AI requests. Aggregated, anonymised statistics (e.g. "pass rate: 85%") may be sent to generate AI narratives. Anthropic does not use this data for training.

School comparison tool: The free comparison tool processes publicly available KHDA inspection reports. No school account is required.

3. Where data is stored

All school and student data is stored on a dedicated server hosted by Hetzner Online GmbH in Helsinki, Finland (EU). Data is encrypted in transit (TLS 1.3). Database backups are stored in Backblaze B2 cloud storage (EU region). No data is stored in the UAE or transferred to jurisdictions outside the EU, except for AI processing requests to Anthropic (US-based), which contain no student personal data.

4. Data retention

School data is retained for the duration of the subscription. Upon account termination, all school data (students, results, assessments, uploaded documents) is deleted within 30 days. Backup copies are purged within 90 days.

5. Your rights

Under UAE PDPL, schools and data subjects have the right to: access their data, request correction of inaccurate data, request deletion of data, request data portability (export), and withdraw consent for processing. To exercise any of these rights, contact us at hello@gradesphere.com.

6. Data sharing

We do not sell, rent, or share student data with any third party. We do not display advertising. The only external service that receives any school-related content is Anthropic (for AI features), and that content is limited to publicly available inspection documents and anonymised aggregate statistics.

7. Security

Access to school data requires authentication. All data is scoped to the school account — one school cannot access another school's data. Server access is restricted to SSH key authentication. The database is not publicly accessible.

8. Cookies

GradeSphere uses a single session cookie for authentication. No tracking cookies, analytics cookies, or third-party cookies are used.

9. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Material changes will be communicated to active school accounts via email.

10. Contact

For questions about this privacy policy or data protection, contact: hello@gradesphere.com