Privacy Policy

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is all data with which you can be personally identified.

Data Collection on this Website

• Who is responsible? The data processing on this website is carried out by the website operator details in the Imprint.
• How do we collect your data? Some data is collected when you provide it to us (e.g., contact forms). Other data is collected automatically by our IT systems (e.g., technical data like browser version).
• What do we use your data for? Part of the data is used to ensure the error-free provision of the website. Other data may be used to analyze user behavior or facilitate communication with partners.

We host the content of our website with the following provider:

Vercel

The provider is Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel is a cloud platform for hosting web applications. When you visit our website, your data is processed on Vercel's servers. This may also result in data transfer to the USA.

Data Transfer to the USA: We have concluded a standard contractual clause (SCC) agreement with Vercel to ensure compliance with European data protection standards. For more details, please refer to Vercel's Privacy Policy: https://vercel.com/legal/privacy-policy.

Approximate Location Detection: Vercel automatically derives your approximate location (country, city, and continent) from your IP address using MaxMind's GeoIP database. We use this information solely to personalise the content shown to you — for example, displaying programs in your region first. This processing occurs entirely on Vercel's infrastructure; we receive only the derived location data, not your raw IP address. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing relevant content).

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Note on the Responsible Body

Revocation of your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

Right to Object (Art. 21 GDPR)

If the data processing is based on Art. 6 Para. 1 lit. e or f GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation.

Contact Form & Inquiries

If you send us inquiries via the contact form or course inquiry modal, your details from the inquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on this data without your consent, except to the specific educational institution you are inquiring about.

Location Preferences & Content Personalisation

When you first visit Gradia, your approximate location (country, city, and continent) is automatically detected via Vercel's infrastructure (see Section 2) and stored in your browser's local storage under the key gradia_locale. This data never leaves your device — it is not transmitted to our servers or database.

We use this location to personalise homepage content and search suggestions, for example by showing executive education programs in your region first. You can view or override your detected region at any time via the Preferences panel in the page footer. Selecting "Reset to auto" re-runs the detection.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing a relevant, personalised experience. No precise location (GPS or street-level address) is ever collected; detection is country and city level only, derived from your IP address.

Supabase (Database & Auth)

We use Supabase for data storage and user authentication. The provider is Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992. However, our database instance is located in Frankfurt, Germany (EU).

Despite the EU server location, remote access by the US/Singapore parent company cannot be completely ruled out for support purposes. We have therefore concluded standard contractual clauses (SCC) to secure such potential transfers.

Gradia offers an AI Course Advisor: a chat assistant that answers questions about programs and suggests courses that fit your situation. It is powered by a large language model operated by a third party, which means the text of your conversation is sent outside Gradia to be processed.

What we send

• Everything you type into the advisor, for the current conversation. Please treat it as you would an email to a stranger — see the note on sensitive information below.
• Which course or school page you had open when you asked, so the answer is about the program in front of you.
• Your saved career profile, if you are signed in and have one: your first name, your stated goal, your current role and seniority, your topics of interest, preferred format, preferred locations, timing, budget, who is funding the course, your desired skills, and the free text you wrote about your background. This is what lets the advisor pick up where you left off instead of interviewing you again.

We do not send your email address, your account identifier, your password, or your message history with schools.

Who processes it

Requests are routed through the Vercel AI Gateway (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA), which acts as our processor and passes the request to the model provider. Those providers act as sub-processors engaged by Vercel. At present they are:

• Google — generates the advisor's replies from the conversation.
• OpenAI — converts your stated career goal into a numeric vector (an "embedding") that we use to rank which courses match it. Only the goal text is sent, not the conversation.

We may change model providers as the technology moves. We will keep this list current, and the safeguards described below apply to any provider we route to.

Data Transfer to the USA: this processing takes place in the USA. Transfers are covered by standard contractual clauses (SCC) and, where the provider is certified, the EU-U.S. Data Privacy Framework.

Your conversations are not used to train AI models

Every request we send carries a no-prompt-training instruction. This is not a preference we ask providers to honour: the gateway will only route to providers that are contractually bound not to train on the content we send, and will fail the request rather than fall back to one that would.

To be precise about what this does not mean: providers may still retain content briefly for security, abuse prevention, and operating the service, in line with their own terms. It is not used to improve their models.

Where the conversation is kept

The transcript is stored in your browser's local storage, under the keys gradia:advisor:panel:v2 and gradia:advisor:shortlist:v1, so that closing the advisor or reloading the page does not lose your place. We do not store the transcript in our database. You can erase it at any time with Clear chat in the advisor, or by clearing your browser's site data.

If you explicitly save a shortlist or a career profile to your account, that data is stored in our database (Supabase, Frankfurt — see Section 4) and you can delete it from your account settings.

Please do not share sensitive information

The advisor is a free-text chat, so it is technically possible to type anything into it. Please do not enter special categories of personal data as defined in Art. 9 GDPR — for example information about your health, religious or philosophical beliefs, trade union membership, ethnic origin, political opinions, or sex life — and please do not enter other people's personal data. We do not ask for any of this, and the advisor has no reason to need it.

No automated decisions about you

The advisor ranks and suggests courses. It does not make any decision that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. It does not decide admissions, eligibility, pricing, or anything a school will do — those decisions rest with the schools, and any application you make is your own. Its output is a suggestion you are free to ignore.

Legal basis

Art. 6(1)(b) GDPR for running the advisor itself: you started the conversation in order to be advised, and processing what you write is how we deliver that. Art. 6(1)(f) GDPR — our legitimate interest in giving relevant, personalised recommendations — for sending your saved career profile along with it. You can object to the latter at any time (see Section 3), and using the advisor without a saved profile, or without an account at all, remains possible.

PostHog

This website uses PostHog, an open-source product analytics suite. We use the PostHog Cloud EU version, meaning data is stored within the European Union.

PostHog captures data such as your IP address (anonymized), browser type, and interactions with our application to help us improve the user experience. You can opt-out of this tracking via our cookie settings.

OpenStreetMap

This site uses map services from OpenStreetMap (OSM). The provider is the OpenStreetMap Foundation. To use the functions of OSM, it is necessary to store your IP address. This information is usually transferred to an OSM server and stored there. The provider of this site has no influence on this data transfer.