Privacy Policy

What we collect

• Account data handled by our authentication provider (Clerk): your name, email, and sign-in identifiers.
• Learning data: your progress, assessment scores, scenario responses, reactions, and tutor conversations, so we can show progress and adapt content.
• Payment data: processed by our payment provider (Square). We do not store full card numbers.
• Your submitted work: scenario answers, exam answers, and capstone submissions, kept so they can be graded, reviewed on appeal, and shown as the evidence behind your credential.
• Checkout records: what you bought, the amount, the payment reference from Square, any discount code, and the IP address and device recorded at the moment of purchase. The IP and device are kept specifically so we can defend a payment dispute; we do not use them to profile you.
• Support and safety records: waiting-list requests, problem reports you send us, newsletter signups, and records of misuse of the AI features.
• Basic technical data: standard server logs (e.g. request times) used to operate and secure the service.

Why we are allowed to process it

Where the EU or UK GDPR applies, our legal bases are: performance of our contract with you (delivering the program, grading your work, issuing your credential, taking payment); our legitimate interests (keeping the service secure, preventing abuse, defending payment disputes, and improving the product); your consent (marketing emails and the newsletter, which you can withdraw at any time); and compliance with legal obligations (tax and accounting records).

Automated grading, and your right to a human

Written work is scored by an AI evaluator against a published rubric, and the score contributes to whether a credential is issued. The decision to issue a credential itself follows a fixed rule rather than discretion: pass every core topic and pass the mastery exam. Because that outcome can matter professionally, you have the right to ask a person to review any AI-assigned score by writing to support@gage.academy, and you may reattempt any assessment without limit. Our AI transparency policy explains exactly what AI decides and what it never decides.

How we use it

To provide and personalize the courses, grade assessments, issue completion records, process payments, secure the platform, and improve the product. We do not sell your personal data.

Processors we rely on

Clerk (authentication), Supabase (database hosting), Vercel (hosting and server logs), Square (payments), and Resend (email delivery). For the AI features, your input is sent to the provider that powers them: DeepSeek (the professor, the scenario and exam graders, the credential Q&A, and translation), Anthropic (the capstone assistant), and OpenAI (converting your tutor question into a search vector to find the relevant part of the lesson). Your name, email, and payment details are never sent to an AI provider. Each processor handles data on our behalf under its own terms.

Where your data goes

GAGE is based in the United States, so data you give us is processed there. Some of the processors above operate outside the European Economic Area and the United Kingdom, which means your data may be transferred outside your country. Where that happens for EU or UK personal data, we rely on the transfer safeguards offered by those providers, and we keep what is sent to them to the minimum the feature needs. If you would rather not have your writing processed by an AI provider, you can use the programs without the professor and without submitting scenario work, though assessments and the credential require graded submissions.

Your rights

You can access or update your account information in Settings. Where the EU or UK GDPR applies, you also have the right to obtain a copy of your data, correct it, have it erased, restrict or object to its processing, receive it in a portable format, and withdraw any consent you have given. To exercise any of these, write to support@gage.academy from the address on your account and we will respond within one month. You also have the right to complain to your data protection authority: in the United Kingdom that is the Information Commissioner’s Office, and in the European Union it is the supervisory authority in your country.

How long we keep it

Account, progress, and submitted work are kept for as long as your account exists, because they are the evidence behind your credential; delete your account and they go with it, except where we must keep a record. Payment and checkout records, including the dispute-defense fields, are kept for seven years to meet tax and accounting obligations and to answer chargebacks, which card networks allow to be raised long after a sale. Problem reports and abuse records are kept for two years. Newsletter signups are kept until you unsubscribe.

Contact

Questions about privacy? Reach us via the support page.