← Gradsey

Privacy

Last updated 14 October 2026

This page says what Gradsey keeps, why, who else handles it, and how to have it deleted. Questions and requests go to [email protected].

What Gradsey keeps

  • Your account. Your name and email from Google sign-in, held by Clerk, which runs sign-in. In Gradsey’s own database: your email (encrypted), the Stripe keys you add (encrypted, never shown back in full) with their labels, your time zone, the hour you chose so the morning email arrives then and the reports it covers (or that you stopped it), the customers you marked as contacted (their names and emails encrypted), and the times of failed key checks and scans, which cap how often they can be retried. It also notes when you last opened the dashboard, when you added your first key, and, when a key is turned away, the reason it was given and how many times that happened.
  • Your customers, as Stripe has them. A scan reads subscriptions, customers, invoices, products, events, payment intents and charges with your read-only key. The latest scan of each Stripe account is stored, encrypted, so the dashboard opens without reading Stripe again; a morning email that covers every report stores its read as that scan too. It includes your customers’ names, email addresses, plans, amounts, and anything they wrote when cancelling. Gradsey handles this data on your behalf, as a processor, under the data processing terms in the Terms; toward your customers, you stay responsible for it.
  • Feedback you send. What you write with the dashboard’s feedback button: its subject and message (encrypted), what it is about, and when you sent it. At most one a day and five in all. Gradsey’s operator reads it, with your email, to answer you.
  • Counts. How many times a day the front page is viewed, how many keys are added and how often each report is opened. Numbers only: no cookies, no IP addresses, nothing tied to a person.
  • A server log. A line for each thing you do on Gradsey, with your email: opening the dashboard, scans, keys added, removed or turned away, switching profiles, daily email settings, opening a report, marking someone as contacted, sending feedback (what it is about, never what it says), and each morning email sent. It never names your customers: a contacted mark logs the report, not the person. A front-page visit logs only the site it came from, and a visit to the demo only that it happened.
  • In your browser only. Email templates you edit and your customer-portal link are kept in your browser’s local storage and never sent to Gradsey.

What Gradsey doesn’t do

  • It never writes to Stripe, and turns a secret key (sk_) away before using it.
  • It never emails your customers. Drafts open in your own Gmail; Gradsey sees only that you clicked, never the email itself.
  • It doesn’t sell data, show ads, or use tracking cookies.

Why

Your account and your Stripe data are used only to provide the service you signed up for. The counts, the server log, and the notes on your account about when you last visited and how adding a key went, are kept in Gradsey’s legitimate interest in knowing whether the site works and where people get stuck. Gradsey’s operator can see those notes with your email, to write to you if adding a key keeps failing; never your customers’ data or your scans. Feedback is kept so it can be read and answered.

Who else handles it

  • Clerk runs sign-in and sets the cookies that keep you signed in. Apart from Cloudflare’s below, they are the only cookies on gradsey.com.
  • Google confirms who you are when you sign in.
  • MongoDB Atlas hosts Gradsey’s database.
  • Resend delivers the morning email to you. It carries the names and email addresses of the customers in the reports you chose for it.
  • Cloudflare sits in front of gradsey.com and may set a cookie of its own to keep abusive traffic out.
  • A virtual server runs the app itself and keeps the nightly backup of the database.
  • Stripe is where the data comes from. Gradsey reads it with the key you give it.

Some of these, Clerk and Resend among them, are in the US, so your data can be handled outside the EU. Those transfers are covered by the EU–US Data Privacy Framework or the EU’s Standard Contractual Clauses, under each service’s data processing terms.

How long it’s kept

  • A stored scan is replaced by the next scan of the same Stripe account.
  • Removing a key under Profiles deletes the key, its stored scan and your contacted marks for it at once, and stops its morning email.
  • One backup of the database is kept on the server that runs Gradsey and replaced each night, so whatever is deleted leaves the backup at the next one.
  • The server log stays on the server that runs Gradsey, and goes as new versions of the app replace old ones.
  • Your account stays until you ask for it to be closed; then everything is deleted.
  • Resend keeps a log of sent emails for a limited time, under its own policy.

Your rights

You can ask for a copy of your data, for it to be corrected or deleted, or object to how it is used: write to [email protected] and it is handled within 30 days. To stop the morning email without removing a key, press Stop daily emails on your dashboard. If you think your data is mishandled, you can also complain to your local data protection authority.

If you are the customer of a business that uses Gradsey, that business decides what happens to your data — contact them first. Write to [email protected] if they can’t help.