Privacy Policy

1. Who is responsible and how to contact us

The controller responsible for personal information handled by GradAbroad is GradAbroad, based in New Delhi, India. Contact gradabroad.online@gmail.com for privacy questions, access requests, correction, deletion, account closure or a suspected security issue. This Policy covers GradAbroad, not independently operated websites or sign-in providers.

This notice describes the current product. It does not ask you to give blanket consent to all data use. Acknowledging that you have read it is separate from agreeing to the Terms, and does not waive your privacy rights.

2. Information we receive

Account and sign-in information: authentication identifiers, email address, verification status and the basic profile information made available by the sign-in provider, such as your name or avatar. Google or GitHub handles your provider password; GradAbroad does not ask you to give us that password. Email-link authentication uses your email and session credentials.

Information you choose to enter: profile details such as date of birth, contact details, address, education, marks, language scores, experience and study preferences; saved programmes, application statuses, custom documents and checklists, journey progress, expenses and budget settings. Most profile fields and all document uploads are optional; provide only what you need for your own planning.

Uploaded files: supported PDFs and images, their filenames, categories, file types, sizes, upload times, storage identifiers and upload-validation results. Files can contain identity and education information depending on what you upload. Do not provide unnecessary sensitive information or other people's private documents.

Operational information: hosting and authentication services may process IP addresses, device/browser details, request times, errors and security events to deliver and secure the website. We also store the version of the Terms and Privacy Policy acknowledged, a server-recorded acceptance time and the acceptance method. The acceptance record itself does not collect an IP address or a device fingerprint.

Feedback and support: information you put into a feedback message or send by email, plus the contact information needed to reply. General feedback can be delivered through EmailJS and its configured email provider. Avoid putting private documents, credentials or sensitive personal details in general feedback.

3. Why we use information and our legal grounds

We use account information and requested planning data to authenticate you, save and reload your information, operate your private workspace, and deliver features you choose to use. Where applicable, this is necessary to perform our agreement with you or take steps at your request before entering it.

We use limited operational information to prevent abuse, diagnose failures, secure accounts and documents, keep the service functioning, and handle support or disputes. Where applicable, we rely on legitimate interests in running a secure service, balanced against your rights, and on legal obligations where a law requires processing or retention.

Where a particular optional use legally requires consent, we must seek specific consent for that use separately and allow withdrawal. The login checkbox is not consent to advertising, sale of information, unrelated marketing, or all possible processing of sensitive information. Do not upload health, biometric, religious or other specially protected information that the service does not need.

4. Service providers, disclosures and international processing

We use Supabase for authentication, database services and private file storage, and Vercel for hosting and delivery. Google or GitHub processes sign-in under its own notice when you choose that provider. EmailJS and the configured email service process submitted feedback. These services receive the information necessary for their role and may maintain their own operational records.

Your profile and document library are not intentionally public, and the application owner dashboard does not provide access to other users' private documents. Authorised infrastructure administrators and providers may nevertheless have access where necessary to operate, secure or support the systems; this is not end-to-end encrypted storage that only you can decrypt.

We do not sell your uploaded documents or provide them to universities automatically. We may disclose information when legally required, to investigate a security incident or protect lawful rights, or to a successor operating the service with appropriate safeguards and notice where required. We do not use this login acknowledgement as permission for advertising or marketing.

Providers may process information outside your country, depending on the configured service region and their subprocessors. Where applicable law requires international-transfer safeguards, those transfers must use an appropriate legal mechanism, such as an adequacy decision or standard contractual clauses. Contact us for information about the arrangements relevant to your data. No promise is made that all data stays exclusively in Germany or the EU.

5. Cookies and browser storage

Authentication cookies and related browser storage keep you signed in and support secure sign-in redirects. A short-lived first-login acknowledgement cookie carries your chosen policy version through sign-in so we can attach it to the verified account. A browser preference helps avoid repeating the introductory notice on the same browser, but it is not the authoritative account acceptance record.

The site also stores preferences such as appearance where needed by the interface. Browser settings can remove or block this storage; doing so may sign you out or make the introductory notice reappear. This implementation does not add advertising cookies, tracking pixels, behavioural profiling or analytics consent. Any future optional tracking that requires consent must be handled separately.

6. File privacy and security limitations

Private document access is checked against the signed-in account. The document bucket is private, database and storage access rules separate accounts, and server endpoints validate files and impose usage limits. We restrict supported file types and reject some unsafe file content. These controls do not guarantee that every harmful file or attack can be detected or prevented.

We do not promise absolute security, uninterrupted availability or zero risk of theft. Protect your sign-in account and device, avoid shared-device sessions, and keep secure copies of important documents. Contact us promptly if you suspect unauthorised access. Where applicable law requires notification of a personal-data breach, we will notify the relevant authority and affected people as required.

7. How long information is kept and deletion

Account information, saved planning records and documents are generally kept while your account remains active or until you delete the relevant content or request account closure. You can remove documents from Your Documents. For account deletion or information you cannot remove yourself, contact us from your sign-in email. We may need proportionate identity verification before carrying out a request.

Operational logs, provider backups and records needed for security, legal obligations or the establishment, exercise or defence of legal claims may remain for the limited period required for those purposes. Acceptance records are kept with the account to document the agreed version. We do not promise instant removal from every provider backup or an exact log/backup retention period that has not been confirmed. Ask us about a specific record or deletion request; applicable legal response deadlines still apply.

Deleted files are not a substitute for your own backup, and we cannot promise recovery after deletion. When processing a deletion request, we will explain any lawful exception that prevents complete or immediate deletion.

8. Your choices and rights

You can browse public programme information without an account, leave optional fields blank, avoid uploads, edit supported profile/planning data, remove uploaded files and stop using the service. Account creation necessarily involves authentication and basic operational processing; refusing optional data is not a reason to require unrelated disclosures.

Depending on the law that applies, you may request access to your data, correction, deletion, restriction, portability, or object to processing, including processing based on legitimate interests. If a specific processing activity relies on consent, you may withdraw that consent without affecting processing already lawfully performed. Rights can have lawful limits; we will explain an applicable limit rather than automatically reject your request.

Send a request to gradabroad.online@gmail.com. We aim to answer within the applicable legal timeframe and may ask for information needed to verify identity. You may complain to the data-protection authority competent for your situation, including an EU authority where GDPR applies. Contacting us first does not remove that right.

9. Children, automated decisions and changes

GradAbroad is not directed to children under 16. If you believe such a child's information was provided without appropriate authority, contact us so we can investigate and take appropriate action. Older students must have any legal capacity or parental authorisation required in their situation.

The current planning groups, checklist progress and calculator results do not make automated decisions about your admission, visa or eligibility. Universities and authorities make those decisions independently. We will update this notice when the product or our handling of data materially changes, identify the new version and provide additional notice where required. A privacy-notice update does not override your statutory rights or silently create consent to a new optional purpose.