Legal
Privacy Policy
Last updated: 26 August 2026
01Who we are
GradWorx is operated by GRADWORX UK LIMITED, a company registered in England and Wales under company number 15345966, with its registered office at 41 Baltimore House, Juniper Drive, London, England, SW18 1TS.
In this policy, “GradWorx”, “we”, “us” and “our” mean that company. We are the data controller for the personal information described below, which means we decide why and how it is used, and we are responsible to you for it.
For anything about this policy or your information, write to connect@gradworx.io.
02What this policy covers
This policy covers the GradWorx mobile app and the service behind it at www.gradworx.ai, including the Grace assistant, job matching, and messaging with employers.
Our marketing website and the employer web portal at www.gradworx.io are covered by the separate policy at gradworx.io/privacy-policy. Where something involves both, such as an employer reading your profile, the two policies describe the same processing from each side.
The sections below are grouped to match the privacy labels shown on our App Store listing, so what Apple displays and what we tell you here line up item for item.
03The information we hold
Some of this you give us directly, some Grace reads out of your CV with your permission, and some the app produces as you use it. Nothing in this table is bought from a data broker.
| App Store label | What it is in GradWorx | Why we have it |
|---|---|---|
| Name | Your name and the name you prefer to be called. Typed during onboarding, or read from your CV. | To identify your profile to you and to employers you allow. |
| Email address | The address you sign in with. | Authentication, password reset and essential service messages. |
| Phone number | The app has no phone number field. We only hold one if you include it in a message to us, in your CV, or as an employer contact. | So we can reply to you. |
| Physical address | Where you are based and where you would work. Normally a city or region, not a postal address. A full address only if your CV or a message to us contains one. | To match you to roles in places that suit you. |
| Other contact information | Your LinkedIn URL, and anything else you add so employers can reach you. | To let an interested employer follow up. |
| Photos | Your profile picture and cover image, taken with the camera or chosen from your library. | To render your profile card. |
| Other user content | Your CV file, your conversation with Grace, your messages with employers, and the free-text parts of your profile. | This is the profile itself, and the conversations it leads to. |
| Customer support | Anything you send us when you contact us or report content. | To deal with the request and keep the platform safe. |
| User ID | An account identifier we generate, carried in the sign-in token your device stores. | To tie your data to your account and keep you signed in. |
| Device ID | The app does not read your device advertising identifier. Where a device or installation identifier is handled at all, it is only by the systems that deliver and secure the app. | Security and delivery. Never advertising. |
| Product interaction | Roles you save or dismiss, posts you like, guide steps you tick off, and roughly when you last opened the app. | To keep your lists, and to know when to prepare new recommendations. |
| Other usage data | The state of your matching and recommendation runs, and how long each Grace turn took. | To spot failed runs and keep the service responsive. |
| Diagnostics | Crash and performance reports you choose to share with developers through your iOS settings, plus our own server error logs. | To find and fix crashes and slow paths. |
What we deliberately do not collect
- We do not collect your precise location. The app never asks for location permission.
- We do not use your microphone. The app records no audio.
- We do not use advertising identifiers, ad networks, or third-party tracking or analytics SDKs inside the app.
- We do not take payment details from graduates. The app is free to use and asks for no card.
Sensitive information
We do not ask for special category data, meaning things like health, religion, ethnicity or political views. Please leave them out of your CV and your chat with Grace. If your CV happens to contain something of that kind, it is processed only as an incidental part of the document you uploaded, in order to build the profile you asked for, and you can remove it at any time by editing your profile or uploading a different CV.
04Why we use it, and our legal basis
Under UK data protection law we need a lawful basis for everything we do with your information. Ours are these.
| What we do | Information used | Legal basis |
|---|---|---|
| Create and run your account | Email address, password (stored only as a one-way hash), user ID | Performance of our contract with you |
| Build your profile with Grace | Your chat, your CV, the profile fields Grace fills in | Performance of our contract with you |
| Recommend roles to you | Your profile, and a mathematical representation of it used to compare against live vacancies | Performance of our contract with you |
| Let employers find you and start a conversation | Your profile as described in section 07, and the messages in that conversation | Performance of our contract with you, and your choice to be discoverable |
| Send you service messages | Email address | Performance of our contract with you. Anything promotional is sent only with your consent, and you can withdraw it at any time |
| Keep the platform safe and prevent misuse | Account identifiers, server logs, and message content where we investigate a report | Our legitimate interests in a safe, working service |
| Fix faults and improve the app | Usage and diagnostic information, in aggregate wherever possible | Our legitimate interests in a reliable product |
| Meet legal and regulatory obligations | Whatever the obligation requires | Compliance with a legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you can object at any time; see section 11.
05Grace, our AI assistant
Grace is the assistant you talk to when you build your profile, and the system that scores how well a vacancy fits you. It is powered by Google’s Gemini models.
What is sent to the model
- The messages you write to Grace, and the profile she has built so far.
- The contents of a CV you attach, so skills, experience and certificates can be pulled out of it.
- Your profile and the text of live vacancies, so each one can be scored against you.
This happens on our servers, not on your phone: your device sends the text or file to GradWorx, and GradWorx calls the model. We do not give the model provider your email address or your account credentials.
What we keep
We store your conversations with Grace on our servers, along with the profile details each turn produced. That is what lets you close the app mid-conversation and pick it up later, and what lets us investigate when Grace gets something wrong.
Scores are recommendations, not decisions
Grace produces a fit score out of 100 and a ranked list of roles. That ranking decides what you are shown and which profiles surface to an employer searching for candidates. It does not decide whether you are hired, interviewed or rejected. Employers make those decisions themselves, and they read your profile and speak to you first. It is not automated decision-making producing legal or similarly significant effects under Article 22 of the UK GDPR.
You are not stuck with a result: you can edit any part of your profile, upload a different CV, ask for a fresh set of matches, turn off discoverability entirely, or write to us at connect@gradworx.io and ask a human to look at it.
07Being discoverable by employers
GradWorx works by letting employers come to you, so when you finish building your profile the “Ready to be discovered?” setting starts switched on. While it is on, employers using GradWorx can find your profile, it can be recommended to them for roles it strongly matches, and they can message you about live or upcoming vacancies.
What an employer can see
Your name and photos, your degree, university, study stage, year of study and graduation year, any additional education, where you are based and where you would work, the kind of role and company you want, your dream job, work style, languages, skills, certificates, experience, interests, your LinkedIn link, and your CV.
What an employer never sees
Your email address, your password, your conversations with Grace, the industries and role types you keep in your private preferences, and any role you saved or dismissed.
Turning it off
Open Profile → Edit profileand switch off “Make my profile public”. From then on you stop appearing in employer searches and recommendations. Conversations you have already started stay where they are, so nobody is left mid-sentence; leave a conversation or delete your account to end those too.
Switching it off does not reach backwards: an employer who already read your profile, downloaded your CV, or saved a direct link to a file of yours still holds that copy. It stops being available from GradWorx when you replace the file or delete your account, but what they already have is theirs to delete. Section 11 covers how to ask them.
08Sending data outside the UK
Your profile, CV, photos, conversations and messages are stored in Nuremberg, Germany, inside the European Economic Area. The UK recognises the EEA as providing an adequate level of data protection, so that storage needs no further safeguard.
Some of the other providers in section 06 process information outside the UK and the EEA, including in the United States: the Gemini models behind Grace, and our email delivery. Where that happens we rely on the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, or an adequacy decision covering the country concerned, so that your information keeps essentially the same protection it has here.
09How long we keep it
- Your account, profile, CV, photos, Grace conversations and messages: for as long as your account exists.
- After you delete your account in the app: removed from our live systems immediately (within 30 days if you ask us by email instead), and aged out of encrypted backups within a further 30 days.
- Server and security logs: about 12 months.
- Records we must keep by law: for as long as the law requires, and no longer.
- Anonymised, aggregated statistics that cannot identify you: indefinitely.
10Deleting your account
You can delete your GradWorx account from inside the app: open Profile → Delete account and confirm twice. The deletion happens straight away. There is no waiting period and no way to undo it.
You can also write to connect@gradworx.io from the address on your account and ask us to delete it. We will confirm and complete the deletion within 30 days.
Deleting your account removes your profile, your CV and uploaded images, your conversations with Grace, your saved and dismissed roles, your recommendations, and your side of any conversation with an employer. An employer may still hold a copy of information you sent them directly, or that they exported while your profile was public. They are responsible for that copy, and you can ask them to delete it.
11Your rights
Under UK data protection law you have the right to:
- Access: get a copy of the personal information we hold about you.
- Rectification: have anything inaccurate or incomplete corrected. Most of it you can edit yourself in the app.
- Erasure: have your information deleted; see section 10.
- Restriction: ask us to pause what we do with it while a question about it is resolved.
- Portability: receive the information you gave us in a structured, machine-readable format.
- Objection: object to processing we base on our legitimate interests.
- Withdraw consent: at any time, where we relied on your consent. Withdrawing it does not undo what was lawful beforehand.
Write to connect@gradworx.io to use any of these. We will respond within one month. There is nothing to pay unless a request is clearly unfounded or excessive.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.
12How we protect your information
- Everything the app sends travels over an encrypted HTTPS connection.
- Passwords are stored only as a one-way hash. We cannot read yours, and neither can anyone who obtains the database.
- Your sign-in token is held in the iOS Keychain, protected by the operating system rather than by ordinary app storage.
- Your CV and profile images are served from long, randomly generated links that are not listed or searchable. Treat such a link like the file itself: anyone you forward it to can open it.
- Sessions expire after 30 days. The app renews them quietly while you are using it, and signs you out if the session is no longer valid.
- Access to production systems and the database is limited to the people who need it.
No service can promise perfect security. If a breach ever affects your rights, we will tell you and the Information Commissioner’s Office as the law requires.
14Children
GradWorx is for students and graduates and is not directed at children under 16. We do not knowingly collect information from anyone under 16. If you believe a child has given us their information, write to connect@gradworx.io and we will delete it promptly.
15Changes and contact
We update this policy when the app changes. The date at the top always shows the current version, and if a change materially affects you we will tell you in the app or by email before it takes effect.
GRADWORX UK LIMITED
41 Baltimore House, Juniper Drive, London, England, SW18 1TS
connect@gradworx.io