Privacy policy

The data controller is the team that publishes Gradia (“Gradia”, “we”). Its identification details are provided on request through the Contact page.

The processing described here is carried out in compliance with Moroccan law no. 09-08 on the protection of individuals with regard to the processing of personal data and its implementing decree no. 2-09-165.

This English text is a translation provided for convenience; in the event of any difference, the French version prevails.

We only collect the data the service needs:

• identification and contact: last name, first name, username, e-mail address, phone number if you provide it;
• if you choose to sign in with Google: your Google account identifier, e-mail address and name, sent by Google; we never receive your Google password;
• academic path: university, programme, semester or competitive exam prepared;
• learning activity: attempts, answers (including code submitted to programming exercises), scores, mistakes, study sheets, notes, bookmarks, revision plans, messages posted in the community;
• subscription and payment: plans, dates, orders, proofs of payment you send, and the record of any complimentary access; we collect no bank card data;
• technical data: sign-in logs, sessions, IP address, for security purposes;
• exchanges with support and academic requests: messages and attachments.

• providing the service (account, access to content, progress tracking, educational AI, running submitted code): performance of the contract;
• granting the free trial only once per person, using a normalised form of the e-mail address and phone number: legitimate interest;
• managing orders, payment verification, complimentary access and refunds: performance of the contract and legal obligations;
• ensuring security (fraud prevention, session management, detection of abnormal access): legitimate interest;
• sending you service e-mails (activation, password reset, follow-up of a request, reminders): performance of the contract;
• sending you marketing communications: your consent, which you can withdraw at any time from your settings;
• improving the platform using aggregate statistics computed on our servers: legitimate interest.

When you use an AI feature (explanation of a mistake, revision plan, study sheets, indicative assessment of an answer), the content needed for the answer - the question, your answer or your code, your description - is sent to a third-party artificial intelligence provider. We do not attach your identification data.

This provider may be located outside Morocco. Any transfer of data abroad is carried out under the conditions laid down by law 09-08.

Code submitted to programming exercises is run in an isolated environment, on Gradia's infrastructure; it is not sent to a third party for this.

Your data is accessible to authorised Gradia staff, within the limits of their duties (for example, verifying a payment), and to our technical subcontractors, who act on our instructions and are bound by confidentiality:

• hosting of the platform, the database and files (proofs of payment, documents, images);
• sending e-mails;
• artificial intelligence (see the previous section);
• sign-in with Google, if you choose it: Google receives the sign-in request and sends us the information described above;
• anti-bot check at sign-up, when it is enabled: Cloudflare (Turnstile), which receives your IP address and technical information about your browser.

Your public profile (username, avatar, level) may appear in the community and the leaderboards; you can opt out of the leaderboards in your settings.

We do not sell your data.

• account and learning data: for as long as the account exists, then deleted or anonymised when it is deleted;
• billing, payment and complimentary-access data, including proofs of payment: for the period required by accounting and tax obligations;
• technical and security logs, and exchanges with support: for as long as needed to keep the service secure and handle requests, then deleted or anonymised.

Under law 09-08, you have the right to access and rectify your data and to object, on legitimate grounds, to its processing, as well as the right to object to marketing.

You can change most of your information from your profile and settings, and delete your account from the “Security” area.

For any other request, write to us through the Contact page. We reply within the time limits set by law. You may also contact the CNDP (www.cndp.ma).

Gradia uses no advertising cookies and no third-party audience measurement or tracking tools. This is everything the Platform stores in your browser:

Strictly necessary — Required to sign in and keep the account secure. They cannot be switched off.

• gradia_session (cookie, Gradia): Session token of the signed-in user (httpOnly, secure). Duration: 24 hours at most.
• gradia_refresh (cookie, Gradia): Renews the session without asking for the password again (httpOnly, secure). Duration: 30 days at most.
• gradia_setup (cookie, Gradia): Marks an academic set-up still pending, to show the right page. Duration: 30 days at most.
• gradia_reset_email (cookie, Gradia): Remembers the e-mail address during a password reset. Duration: 24 hours at most.
• gradia_google (cookie, Gradia): Protects a sign-in with Google in progress (one-time token), then clears itself. Duration: 10 minutes at most.
• gradia:active-account (local storage, Gradia): Detects a change of account in another tab, so two sessions are never mixed. Duration: Until the user clears it.
• gradia-consent (cookie, Gradia): Remembers your cookie choices (no personal data). Duration: 12 months.

Preferences — Remember interface settings you choose yourself. No tracking.

• gradia-locale (cookie, Gradia): Interface language. Duration: 12 months.
• gradia-theme (cookie, Gradia): Display theme (light or dark). Duration: 12 months.
• gradia-sidebar-collapsed (local storage, Gradia): Sidebar collapsed or expanded. Duration: Until the user clears it.
• gradia-welcome-tour-seen:* (local storage, Gradia): Welcome tour already seen. Duration: Until the user clears it.
• gradia-level-seen:* (local storage, Gradia): The last level already celebrated on this device, so each new level is celebrated once. Duration: Until the user clears it.
• gradia.codeEditor.dark (local storage, Gradia): Code editor theme. Duration: Until the user clears it.
• gradia.study-room.sound (local storage, Gradia): Study room sound on or off. Duration: Until the user clears it.
• gradia:exam-flags:* (session storage, Gradia): Questions you flagged to review during an exam, kept across a reload. Duration: Until the tab is closed.

These are needed for the service or remember settings you chose: they do not require your consent. If an optional tool were added, it would only run after your agreement, asked for by a banner, and this section would be updated.

You can view this list at any time through the “Cookie settings” link at the bottom of the page, and erase this data from your browser settings (you will then be signed out).

Exchanges are encrypted (HTTPS), passwords are stored hashed, session cookies cannot be read by scripts, and access to data is limited by role. In the event of a data breach likely to concern you, we will inform you under the conditions laid down by the regulations.

A minor must obtain the consent of their legal representative before creating an account. The legal representative may exercise the rights described above on their behalf.

This policy may change. The date of the last update and the version appear at the top of the page; you will be informed of any significant change.