Privacy Policy

Effective Date: 16 October 2026

Last Updated: 16 October 2026

1. Introduction

Gradwate ("Gradwate", "we", "us", or "our") provides a business-to-business digital training-management platform. Businesses, training providers, educational institutions, and other organisations use Gradwate to create courses, enrol learners, deliver training through WhatsApp and web-based experiences, administer assessments, monitor progress, and issue verifiable certificates.

Gradwate is operated by IDARA MEDIA LLC, with its business headquarters in Sarasota, Florida, United States.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when individuals or organisations use our websites, applications, WhatsApp learning service, and related services (collectively, the "Services").

For privacy enquiries or requests, contact admin@gradwate.com.

2. Scope

This Policy applies to:

• visitors to the Gradwate website;
• organisations that create or manage Gradwate workspaces;
• organisation administrators and authorised personnel;
• learners, employees, students, and trainees enrolled in programmes;
• candidates taking assessments or proctored examinations;
• authorised progress-reporting contacts linked to a learner, such as a manager, supervisor, programme sponsor, or, where relevant, parent or guardian;
• course creators and other persons receiving platform payouts;
• certificate holders and persons using public certificate verification; and
• individuals contacting us for support, demonstrations, or business enquiries.

This Policy does not govern a third-party service that you use independently, even if the Services link to it.

3. Our Role in Processing Personal Information

Depending on the activity, Gradwate may act as a controller (or equivalent term under applicable law) or as a processor/service provider acting for an organisation.

3.1 Gradwate as controller

Gradwate generally determines the purposes and means of processing associated with its own operations, including website administration, account registration, subscriptions and billing, support, platform security, service communications, creator administration, and authorised marketing.

3.2 Gradwate as processor or service provider

When an organisation uses Gradwate to manage its learners, employees, courses, assessments, or certificates, that organisation generally determines why learner information is processed. Gradwate processes that information on the organisation's behalf under its instructions and the applicable agreement.

The organisation is responsible for providing required notices and establishing an appropriate legal basis for the information it submits. If an organisation controls your training information, you may need to contact it first to exercise certain privacy rights. We will assist it as required by law and our agreement.

4. Personal Information We Collect

The information collected depends on how the Services are configured and used.

4.1 Account and organisation information

• organisation name, settings, and authorised users;
• name, email address, telephone number, and preferred language;
• employee or learner identifier, department, group, or cohort;
• authentication information, one-time-code records, and session information; and
• subscription, entitlement, trial, and account-status information.

4.2 Learning, assessment, and certificate information

• programme, course, module, and lesson enrolments;
• lesson activity, completion status, pacing, and training progress;
• quiz and assessment attempts, individual answers (including free-text answers), scores, feedback, and completion dates;
• learning activity such as study streaks, badges, and reminders;
• certificates and credentials, including holder name, programme, issuer, issue date, verification status, and, where applicable, examination or integrity information; and
• course reviews, feedback, feature requests, and votes.

4.3 Proctoring and identity-verification information

When an organisation enables a proctored examination, Gradwate collects the information described to the candidate on the examination consent screen. This currently may include:

• an image of an identity document and a selfie;
• periodic camera snapshots during the examination;
• examination-session events, including leaving or returning to the examination tab, full-screen exits, and paste events;
• device-based face-presence signals, such as no face or multiple faces detected; and
• an identity-review status, integrity score, review notes, and examination outcome.

The device-based face detector counts faces in a captured frame; it is not used to identify a person. Identity images may also be reviewed with AI assistance and by authorised human reviewers. Gradwate does not use proctoring images for advertising or to build a facial-recognition database.

Proctoring begins only after the candidate provides the specific consents shown before the examination and permits camera access. A person who does not consent cannot take that proctored examination, but may continue using other available parts of the Services.

4.4 WhatsApp and communications information

When WhatsApp delivery, support, or notifications are enabled, we may process:

• telephone number and WhatsApp business-scoped user identifier;
• messages, answers, commands, and attachments sent to the Gradwate service;
• message identifiers, delivery status, and timestamps; and
• opt-in, opt-out, and communication-preference records.

We do not collect your WhatsApp contact list or messages you exchange with people other than the Gradwate service.

4.5 Authorised progress-reporting contact information

An organisation may nominate an appropriate person to receive progress reports about a linked learner. Depending on the training context, this contact may be a manager, supervisor, programme coordinator, sponsor, client representative, or, where the learner is a minor, a parent or guardian. We may process the contact's name, telephone number, email address, role or relationship to the learner, link status, verification information, communication preferences, and delivery history. Authorised reports may include the linked learner's participation, progress, completion, or assessment information.

4.6 Payment, billing, and creator information

We may process plan and purchase information, billing contact details, amounts, currency, invoices, payment references and status, refund information, creator revenue allocations, and payout references. Payment-card and bank-payment processing is performed by the payment provider. Gradwate does not receive or store full payment-card numbers.

4.7 Protected-content and access information

For protected learning content, the Services may create an account-linked watermark and record the content accessed, a viewer or watermark identifier, access time, IP address, and browser/device user agent. We use this information to control access and investigate unauthorised copying or distribution.

4.8 Technical, security, and diagnostic information

• IP address, browser and device information, operating system, and timestamps;
• application, security, and administrative audit logs;
• errors, performance data, and diagnostic information; and
• where error monitoring is enabled, limited session-replay data used to reproduce and correct faults.

We do not collect precise geolocation through the Services unless a feature clearly asks for it and provides an appropriate notice first.

4.9 Support and other information provided voluntarily

We process information submitted through support requests, contact forms, demonstrations, business enquiries, and other communications, including any attachments you choose to provide.

5. How We Collect Information

We collect information:

1. directly from individuals who register, communicate with us, make a purchase, or use the Services;
2. from organisations, schools, employers, administrators, or course creators that enrol or manage users;
3. from learning, assessment, proctoring, certificate, and content-access activities;
4. through WhatsApp and other enabled communication channels;
5. from payment and other authorised service providers; and
6. automatically through necessary cookies, local storage, logs, security controls, and diagnostics.

6. How We Use Personal Information

We use personal information to:

• create accounts, authenticate users, and manage access;
• create, administer, and deliver training through WhatsApp and the web;
• enrol learners and record participation and progress;
• administer, grade, and review assessments and examinations;
• verify examination identity and integrity where proctoring is enabled;
• generate, issue, and verify certificates;
• deliver authorised progress reports to organisations and their nominated reporting contacts;
• protect paid or restricted learning content;
• process subscriptions, purchases, refunds, invoices, revenue allocations, and payouts;
• provide support and respond to requests;
• send transactional, training, reminder, and other authorised communications;
• detect abuse, fraud, security incidents, and unauthorised activity;
• maintain, troubleshoot, analyse, and improve the Services; and
• comply with law and enforce our agreements.

We do not sell personal information to advertisers or data brokers. We do not use learner answers or proctoring images to train third-party AI models.

7. Lawful Bases

Where applicable law requires a lawful basis, we rely on one or more of the following:

• contract: processing needed to provide requested Services or perform an agreement;
• legal obligation: processing needed to comply with applicable law, tax, accounting, regulatory, or lawful-request requirements;
• legitimate interests: operating, securing, supporting, and improving the Services; preventing fraud; protecting content; and maintaining reliable records, where those interests are not overridden by individual rights;
• consent: where consent is required or selected, including the specific consent collected for proctoring information and consent for direct marketing where applicable; and
• other lawful grounds: any other basis available under applicable law.

Organisations using Gradwate are responsible for determining the lawful bases for their own processing. Consent may be withdrawn at any time, but withdrawal does not affect processing already lawfully performed.

8. Automated Processing and Artificial Intelligence

The Services use automated processing and may send limited information to Anthropic's Claude service to:

• grade free-text or short-answer responses against a rubric;
• generate answer explanations and draft practice questions;
• provide learning or performance feedback; and
• assist with preliminary review of identity-document and selfie images for proctored examinations.

Automated rules also calculate scores, detect examination-integrity events, and may disqualify an examination session after repeated rule violations. AI-assisted identity review is not biometric face matching or liveness detection. Cases requiring identity judgement may be routed to an authorised human reviewer, and a candidate may contact us to contest an AI-graded answer or request review of an identity or examination decision.

Only information reasonably necessary for the relevant task should be sent to the AI provider. Availability and use of AI features may depend on the organisation's settings.

9. WhatsApp and Meta

When an organisation or learner enables WhatsApp communication, relevant personal information is transmitted through Meta's WhatsApp Business Platform. Depending on the communication, this may include a telephone number or business-scoped identifier, message content, media, message identifiers, timestamps, and delivery information.

Meta processes information under its own terms and privacy practices for purposes it independently determines. Organisations are responsible for having the permissions and lawful basis required to contact their learners through WhatsApp.

10. Cookies and Similar Technologies

Gradwate uses cookies, browser storage, and similar technologies for authentication, session management, security, necessary preferences, and application functionality. If error monitoring is enabled, it may use browser storage to associate diagnostic events or session replays.

We do not use third-party advertising or cross-site behavioural-advertising cookies in the current product. If non-essential analytics or tracking is introduced, we will update our notice and obtain consent where required by law.

11. How We Disclose Personal Information

We may disclose information as follows:

11.1 Organisations and authorised users

Workspace administrators, instructors, employers, schools, and other authorised personnel may access information relevant to the programmes they manage. An employer or organisation may receive enrolment, participation, progress, scores, completion, and certificate information for learners it has enrolled.

11.2 Service providers

Subject to configuration, our service providers include:

• Meta Platforms, for WhatsApp messaging;
• Paystack, for payment processing and payouts;
• Anthropic, for the AI-assisted activities described in Section 8;
• Sentry, for error monitoring and, when enabled, limited session replay;
• Amazon Web Services or another configured S3-compatible storage provider, for private content, certificate files, rendered content, and proctoring media;
• Resend or a configured SMTP email provider, for transactional and report emails; and
• infrastructure, database, security, backup, and technical-support providers used to operate the Services.

These providers may process information only for the services they supply to us and subject to applicable contractual and legal restrictions. The exact provider set may vary with the deployment and features enabled.

11.3 Legal and safety disclosures

We may disclose information where reasonably necessary to comply with applicable law or valid legal process, respond to an authorised public authority, protect a person's safety, investigate fraud or security incidents, or establish and defend legal claims.

11.4 Business transactions

Information may be transferred as part of a merger, financing, acquisition, restructuring, sale of assets, or similar transaction, subject to applicable law and appropriate safeguards.

We do not share personal information with third-party advertisers or data brokers.

12. Public Certificate Verification

Certificates may be verified using a QR code or public verification link. A person with the link or code may see limited credential information, such as the certificate holder's name, issuing organisation, programme title, issue date, verification status, and whether a relevant examination was proctored. The precise fields depend on the certificate configuration.

Public verification does not display private contact details, identity documents, camera snapshots, or examination answers. Organisations are responsible for ensuring that certificate information is accurate and lawfully submitted. Contact us or the issuing organisation if you believe a public certificate record is inaccurate.

13. International Data Transfers

Gradwate and its providers may process personal information in the United States, Nigeria, the European Economic Area, or other countries where they operate. Those countries may have privacy laws different from those where the information was collected.

Where applicable law restricts an international transfer, we use an available lawful mechanism, which may include an adequacy decision, contractual data-protection terms, consent where appropriate, or another legally recognised safeguard. Information about safeguards relevant to a particular transfer is available by contacting us.

14. Data Security

We use reasonable technical and organisational measures designed to protect personal information. Depending on the system and information involved, these measures include encrypted communications, authentication and access controls, organisation-level access restrictions, private storage for protected and proctoring files, time-limited access links, webhook verification, audit logging, restricted administrative access, monitoring, backups, and security updates.

No online service can guarantee absolute security. Users are responsible for protecting their credentials and promptly reporting suspected unauthorised access.

15. Data Retention

We keep personal information only for as long as reasonably necessary for the relevant purpose, the organisation's lawful instructions, legal or accounting requirements, dispute resolution, security, and enforcement of agreements.

In particular:

• proctoring images, identity-document images, selfies, and camera snapshots are configured to be deleted 90 days after the examination;
• account information is generally kept while the account is active and during any applicable deletion-grace period;
• learning, assessment, and certificate records may be retained to provide the learner and issuing organisation with a durable record of achievement;
• payment, invoice, and payout records are retained for applicable tax, accounting, chargeback, and legal periods;
• security, audit, protected-content-access, support, and diagnostic records are retained for an appropriate operational or legal period; and
• an organisation may require different retention periods for information Gradwate processes on its behalf, subject to applicable law and its agreement with us.

When information is no longer required, we delete or anonymise it in accordance with applicable law and our verified deletion procedures. Backups may retain a protected copy for a limited period before routine expiry.

16. Children and Minors

Some organisations may use Gradwate for secondary-school or other programmes involving minors. Gradwate is not intended for a child under 13 to create an independent account without the involvement and authorisation of a parent, guardian, school, or other organisation legally permitted to act for the child.

An organisation enrolling minors must provide required notices, obtain any required parental or guardian authorisation, and comply with applicable children's privacy and education laws. Camera-based proctoring of a minor must not be enabled unless all legally required parent or guardian notices and consents have been obtained.

A parent or guardian may contact us or the enrolling organisation to request access to, correction of, or deletion of a child's information, subject to verification and applicable law. If we learn that a child's information was collected without required authorisation, we will take appropriate steps to delete it.

17. Your Privacy Rights

Depending on where you live and subject to legal exceptions, you may have the right to:

• receive information about how your personal information is processed;
• request access to or a portable copy of your information;
• request correction of inaccurate or incomplete information;
• request deletion in applicable circumstances;
• object to or request restriction of certain processing;
• withdraw consent where processing relies on consent;
• opt out of direct marketing;
• request human review of certain automated decisions; and
• lodge a complaint with the privacy or data-protection authority where you live.

To exercise a right, contact admin@gradwate.com. If Gradwate processes the relevant information for an organisation, we may direct the request to that organisation or assist it in responding. We may verify your identity and authority before acting on a request. We will respond within the period required by applicable law.

You will not be discriminated against for exercising an applicable privacy right.

18. Communication Choices

You may opt out of non-essential or marketing communications using the instructions in the communication or by contacting us. Service, account, security, transaction, and active-training messages may still be sent when necessary to provide the Services.

WhatsApp learners and authorised progress-reporting contacts may use the supported opt-out controls to stop eligible reminders or reports. Opting out of a communication does not necessarily delete the underlying account or training record.

19. Personal Data Breaches

If a personal-data breach occurs, we will investigate, contain, and remediate it. We will notify affected organisations, individuals, and regulatory authorities when and within the time required by applicable law.

20. Third-Party Services

The Services may link to external websites, payment services, or applications. Their privacy practices are governed by their own notices. Gradwate is not responsible for independent third-party processing outside our control.

21. Changes to This Policy

We may update this Policy to reflect changes in the Services, providers, law, or processing practices. We will publish the revised version with a new "Last Updated" date. Where required by law, we will provide additional notice or obtain consent before a material change takes effect.

22. Contact Information

For privacy questions, requests, or complaints, contact:

• Gradwate
• Legal entity: IDARA MEDIA LLC
• Business headquarters: Sarasota, Florida, United States
• Email: admin@gradwate.com
• Website: https://www.gradwate.com