Last updated 17 April 2026
This policy explains what personal data Graden collects, why, what we do with it, and the rights you have. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Graden Ltd is the data controller for personal data about company users (your team) and the data processor for personal data about candidates that your company uploads or invites into the platform. You can reach us at hello@gradenhq.com.
From company users: name, email address, password (hashed), organisation name, role, login activity, IP address, and acceptance of these terms.
From candidates: name and email address as supplied by the hiring company; whatever the candidate submits as their take-home deliverable (text, files, link, GitHub repository); answers to any questionnaire the company attaches; and basic technical data needed to deliver the portal.
Billing: we don't store full card details. Payments are handled by Stripe, who hold the card number; we hold a customer reference and invoice metadata.
Technical: server logs, error reports, and usage events used to keep the service running and secure.
We rely on the following lawful bases under UK GDPR Article 6:
Submissions are sent to Anthropic (the maker of Claude) for the AI review step. We have a data processing agreement in place. Anthropic does not use Graden traffic to train its models. The submission, the rubric, and the resulting review are stored in Graden's database; the prompt and response are not stored permanently by Anthropic beyond their retention window.
We use the following sub-processors to deliver the service:
Customer Data is kept for as long as your account is active. If you cancel, we'll delete it within 30 days unless we're required to keep it by law (for example, billing records for tax purposes). You can request earlier deletion at any time.
Some sub-processors are based outside the UK. Where data leaves the UK, we use UK-approved Standard Contractual Clauses (or equivalent safeguards) so that your data remains protected to UK GDPR standards.
Under UK GDPR you have the right to:
To exercise any of these rights, email hello@gradenhq.com from the address on your Graden account. We respond within 30 days and, for export or deletion requests, confirm in writing once the work is done. Deletion covers your account, organisation, team members, challenges, assignments, submissions, and reviews; billing records we're required to retain for tax purposes are kept for the statutory period and deleted after. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
We protect data in transit with TLS, encrypt sensitive data at rest, run on hardened infrastructure, restrict employee access on a need-to-know basis, and review our security posture regularly. No system is perfectly secure, but we take this seriously.
See our Cookie Policy for details on the cookies we set.
We'll update this policy as the service evolves. If a change materially affects you we'll let you know by email.
Questions, requests or complaints: hello@gradenhq.com.