Effective from 10 October 2026 · Grace Certified · Agora Intelligence
1. Data controller
The data controller is Kaimakiweb, VAT IT03945530123, Varese (IT), operating under the "Agora Intelligence" and "Grace Certified" brands. For any data-related request: hello@gracecert.com.
2. What data we process
Account data: name, email, password (stored as an irreversible hash).
Usage data: prompts submitted for evaluation, scores, XP, badges, certifications, progress, duels and tournaments.
Personal prompt history: submitted prompts stay linked to the account together with what Grace answered, so the user finds them again in the sections that keep an attempt history. The same applies to "Improve your prompt": the starting text, the analyses, the draft written by Grace, the refinement requests and every later version stay in the "Your prompts" history, visible only to the account holder and included in the export of their own data. They follow the retention of usage data (section 8): they last as long as the account and the texts are erased when it is deleted.
Anonymous prompt archive: evaluated prompts may be stored in a statistical archive dissociated from the account (free of name, email or other identifiers). Prompts found to contain personal data are automatically excluded from this archive.
Moderation logs: prompts violating community rules are recorded with date, time, content and account (or a technical identifier for anonymous users) for safety and moderation purposes.
Technical data: IP address and user-agent. Usage limits and statistics rely on aggregated or hashed forms; in security logs (logins, verifications and exports of the training register) the IP is kept in clear for 90 days for abuse prevention. Technical and analytics cookies (see section 11).
Registered devices: to keep the account personal (legal basis: legitimate interest in security and abuse prevention), we store up to 2 devices per account, identified by a random code generated by the browser and a label chosen by the user. The code carries zero information about the device (never brand, model or technical data) and is deleted immediately when the user removes the device from their profile or deletes the account.
Physical product orders (Prompt Battle decks): buyer name, shipping address and email, processed to perform the contract (order fulfilment, delivery, warranty) and retained for tax obligations. Payments are handled by Stripe: card data never reaches our servers.
Gifts and credit codes: if the buyer provides a recipient email, we use it solely to deliver the gift code and any message (legal basis: performance of the gift contract). The recipient receives that single communication and their email stays excluded from any further use: no newsletter, no profiling. That address stays written on the payment record as the reference for the sale, and follows the payment data retention set out below.
Credit ledger: the account balance, the batches that make it up with the date they were granted and their validity, and one line for every movement (purchase, redeemed gift, bonus, spending, refund, withdrawal) with date, amount, reason, resulting balance and the reference of the action behind it. It is there to perform the contract (art. 6.1.b GDPR), to answer a dispute over a charge and to document what was spent. The ledger is part of the data export from your profile, batches included.
Payment data: handled entirely by the payment processor (Stripe); the platform receives the transaction outcome, never card details.
Company teams: whoever joins a team through the invite link makes their level, XP, average score, attempts and certifications visible to the team owner in the dashboard; the training register, which the owner can export in CSV, lists name, email, modules completed with their titles, final quiz, measured minutes, average scenario score, attempts, active certifications, path certificate with verification URL, last activity and status (active or left, with the date). Whoever leaves the team stays in the register with the leaving date, for as long as the team exists, and may ask at any time to be removed from the register: the request is made from their own account or by writing to hello@gracecert.com, and the row disappears with name, email and scores. The export of their own data also lists the teams they have left, so they always know which register still holds their row. Inside an AI literacy assessment window a seat already spent stays spent after the removal: the name goes, the count of seats used remains. Every export leaves a line in the security log with the IP of the person exporting, kept for 90 days. Path data stays for the life of the account and is anonymised when the account is deleted. The team owner is responsible for informing their members about this processing.
3. Purposes and legal bases
Service delivery (evaluations, progress, certifications), contract performance (art. 6.1.b GDPR).
Security, content moderation and abuse prevention, legitimate interest (art. 6.1.f).
Statistics and Service improvement, anonymous or aggregated data, outside GDPR scope.
Service communications (transactional email: account verification, notifications), contract performance. Promotional communications: if and when active, with revocable consent (art. 6.1.a).
4. AI processing
Submitted prompts are analysed by a proprietary evaluation engine relying on third-party AI model providers, selected with adequate contractual safeguards: data sent for evaluation is used to generate feedback and scores, and providers commit to excluding it from training their models. Operational advice, also built into the product: describe situations generically and avoid real personal data in prompts, the system warns you when it detects any.
Pro course: the questions asked to Grace with its answers, the lesson progress, the purchase (amount, date, payment reference) and the certificate issued are kept to perform the contract (art. 6.1.b GDPR). They're part of the data export from the profile and are erased or anonymised with the account. The text of the scored practices goes into the anonymous evaluation archive, with no link to the account.
5. Certification exam
Whoever sits the paid certification exam also entrusts us with this data, processed to perform the contract (art. 6.1.b GDPR):
Exam prompts: the five answers, the per-dimension scores and the feedback, kept with the result to document the certification. When the account is deleted they are erased or anonymised.
Session event log: tab switches, focus losses, paste attempts, start and submission times. Kept for 90 days.
Webcam pictures, at Prompt Master level only: one a minute, saved on a private server disk. Only the administration sees them, to review the result. Deleted after 90 days.
Public certification: once the exam is passed, the verification page shows full name, level, score, issue date, expiry and status, for the 18 months of validity and, marked "expired", afterwards too. On request to hello@gracecert.com the name is replaced by initials or the certification is revoked: the link then answers Certification not found, with no personal data.
Identity: the exam requires two-step verification. The code app secret stays encrypted on our servers and the recovery codes are stored as hashes.
6. AI literacy assessment
Whoever orders the AI literacy assessment for their company leaves us this data, processed to perform the contract (art. 6.1.b GDPR):
Who decides and who carries it out. The buying company chooses who to assess, with which scenarios and what to do with the outcomes: towards the people it assesses, it is the data controller. Kaimakiweb processes that data as a processor, on the company's behalf and on its instructions (art. 28 GDPR). Kaimakiweb stays controller for platform security, abuse prevention and the relationship with the buying company. For the order data below, the controller is Kaimakiweb.
Order data: company name, contact email, number of people to assess, the buyer's declaration of being of age, payment outcome and the Stripe session reference. They serve to activate the seats, to write to you to schedule the week and to document the sale.
Invoicing data: VAT number, company name and address are collected in the order form or by Stripe on the payment page, and are written on the order and on the receipt. The platform issues no electronic invoice through the national interchange system: whoever needs one asks at hello@gracecert.com. Card data stays with Stripe, always outside our servers.
Data of the people assessed: it is the company team data described in section 2. Each person sees the detail of their own evaluations; the team owner sees each member's average score, attempts, measured minutes, level, certifications and last activity in the dashboard, and exports the training register in CSV. The buying company is responsible for informing the people it assesses before the assessment starts.
Legal basis towards the assessed person. It is not consent: an invite code arriving inside an employment relationship does not found free consent, because whoever receives it cannot refuse without consequences. The controlling company relies on the performance of the employment relationship and the duties flowing from it (arts. 6.1.b and 6.1.c GDPR) and on its own legitimate interest in documented training on AI use (art. 6.1.f), and has to hand those people its own notice before starting.
Dashboard and Article 4 of the Italian Workers' Statute. The dashboard shows the employer each employee's scores, attempts, measured minutes and last activity: data from which remote monitoring of work derives. Article 4 of law 300/1970 allows the tools such monitoring derives from only after an agreement with union representatives or an authorisation from the labour inspectorate, and in any case on condition that workers are given adequate information on how the tools are used and on how checks are carried out. Checking and meeting those conditions falls to the buying company.
Automatic score and human review. Every prompt receives a 0-100 score from an artificial intelligence model, with no person reading it first. In our Terms the company undertakes not to take decisions about staff or the employment relationship on the automatic score alone. The assessed person can ask for a human review of their evaluation, express their point of view and contest the outcome, by writing to hello@gracecert.com or to their own company.
Retention: the order record with company name, contact email and amount stays for 10 years to meet tax obligations, like every other payment. The summary prepared for the debrief stays in our correspondence with the company and is deleted on request.
Purchase without an account: whoever orders as a guest has no data export from a profile. To access their data or ask for its erasure they write to hello@gracecert.com from the address used on the order, and we reply within 30 days.
7. Candidates in a selection
Whoever sits a selection test with an offer code does so for a company that is hiring, with no Grace account to create. This section describes that processing.
Who decides and who carries it out. The company that opens the selection chooses the role, the scenarios, who to invite and what to do with the outcome: for that data it is the controller. Kaimakiweb processes it as a processor, on the company's behalf and on its instructions (art. 28 GDPR). Kaimakiweb stays controller for platform security and abuse prevention. The company name appears on the entry screen of the test, before consent is given.
Classification under the AI Act. The module that runs the test is a high-risk artificial intelligence system: it falls under Annex III, point 4(a) of Regulation (EU) 2024/1689, which covers systems used to evaluate candidates in the course of selection procedures. Kaimakiweb is its provider and the company that opens the selection is the deployer. The entry screen of the test tells the candidate so before consent is given. The duties that follow for the company, information to the workers' representatives included, sit in the Terms, paragraph 8.
What we collect. First name, surname, email and chosen language; the text of every answer; the score of each scenario with the per-dimension scores and the written feedback; the time spent on each scenario; the five integrity signals listed below; the offer code and a random identifier for the attempt, which is also the key the candidate uses to find their data again. Alongside the answers we store no IP address and no user-agent: what stays are the two processings that apply site-wide, that is the route rate limiter, which counts requests per network address, and Google Analytics 4, which receives address and browser as on any other page (sections 9 and 11).
The five integrity signals. Time per scenario, measured by the server; paste events; window exits during the test; typographic characters typical of AI-generated text (long dashes, curly quotes, special spaces); typing speed, derived by dividing the words of the answer by the seconds taken. All five reach the card the company reads. The typography signal is a weak clue: the automatic punctuation on iOS produces curly quotes and apostrophes by itself, so a high count proves nothing on its own.
Address confirmation. After sign-up we send a confirmation link to the address given and the test starts from there. While that link stays unopened the application does not exist for the company and the data collected stops at first name, surname and address, deleted with the selection. The message exists to prevent anyone applying on someone else's behalf without their knowledge (legitimate interest, art. 6.1.f GDPR).
Legal bases. The candidate's consent to sharing their data and their result with the company (art. 6.1.a GDPR), collected through a box that starts unticked before the test begins; the performance of pre-contractual steps taken at the data subject's request for the test itself (art. 6.1.b); the company's legitimate interest in a genuine test for the integrity signals (art. 6.1.f).
Recipients. The company that opened the selection receives first name, surname, result, signals and the text of the answers; the email stays hidden until the company unlocks it from its own panel. The answers are evaluated by an AI model provider outside the platform, chosen with the contractual safeguards described in section 4, which commits to excluding them from training its models. Then come the technical providers of section 9: European Union hosting, CDN and email provider.
Automatic score and ranking. Every answer receives a 0-100 score from an artificial intelligence model, with no person reading it first. The average of those scores places the candidate in a ranking that the company sees already sorted. The decision on who to meet and who to hire stays with the company, which undertakes in our Terms not to reject anyone on the score alone. The candidate can ask for a human review of their evaluation, express their point of view and contest the outcome, by writing to hello@gracecert.com or from their own data page.
Explanation of the individual decision. Anyone subject to a decision based on the outcome of the test, where that decision produces legal effects or significantly affects them, has the right to a clear explanation of the role the system played in that decision and of the main elements the decision was built on. The explanation is asked of the company that opened the selection, which answers directly; on the technical detail of the evaluation we answer ourselves at hello@gracecert.com.
Event log of the test. For every test the log that documents it stays: start and submission times, time per scenario, the text of the answers, per-dimension scores, written feedback and the five signals. It is there to document the company's decision and to defend a candidate who contests it. The log lives as long as the candidate data does, so for as long as the selection is open and for the 90 days that follow its closure; a company that has to keep it longer exports it before deletion and answers for it from that moment on.
Retention. Candidate data stays for as long as the selection is open and is deleted automatically 90 days after the company closes it. Whoever wants out sooner asks for erasure and we carry it out without waiting for the closure.
Seeing your data, withdrawing consent, asking for erasure. The data page opens from every screen of the test, a test left halfway included, in the browser the candidate came in from and for as long as the attempt code stays there: it is a shortcut, not the only way to exercise these rights. Inside sits the summary of what was collected and three links that open their mail app with the request already written and the attempt code inside it: human review of the evaluation, withdrawal of consent, erasure of the data. The request reaches hello@gracecert.com, we record it by hand and we reply within 30 days. Whoever changed device writes to the same address from the mailbox used in the test, quoting the offer code. Withdrawing consent works from that moment on and leaves untouched what the company has already seen.
8. Retention
Account and usage data: for the life of the account. Upon deletion, personal data is erased or anonymised through a periodic automated process.
Moderation logs: for as long as needed to document violations and suspensions.
Anonymous prompt archive: indefinitely, as it contains no identifiers.
Credit ledger: balance, batches and movements stay for the life of the account and are erased or anonymised when it is deleted, along with the other account data. The lines documenting a purchase or its refund stay attached to the payment record and follow the 10 years of tax obligations, in accounting form and without the data of the deleted account.
Payments: receipts and purchase amounts are kept for 10 years to meet tax obligations. Stripe keeps the customer record (email, payment method and history) under its own privacy policy.
9. Recipients and transfers
Data is processed on European Union infrastructure (DigitalOcean hosting, Frankfurt) with Cloudflare CDN and protection. External providers: AI model providers (see section 4), Google Analytics 4 for navigation statistics, Stripe for payments, email providers for communications. Transfer outside the Union is no hypothesis: every answer sent for evaluation travels to Anthropic PBC, in the United States, the provider of the model that scores it. Navigation data collected by Google and payment data handled by Stripe travel to the United States too. These transfers rely on the safeguards of GDPR chapter V, that is the Commission's standard contractual clauses together with the supplementary measures agreed with each provider.
Corporate transactions: in the event of a merger, acquisition, contribution or transfer of the business (or a business unit), data may be transferred to the resulting or acquiring entity, which will take over as data controller with the same purposes and safeguards. Registered users will be notified.
10. Your rights
You can exercise your rights under arts. 15-22 GDPR at any time: access, rectification, erasure, restriction, portability and objection. Write to hello@gracecert.com and we reply within 30 days. You also have the right to lodge a complaint with the Italian supervisory authority (gpdp.it) or your local one.
11. Cookie
The platform uses technical cookies and storage (session, preferences, local progress) required for operation, plus Google Analytics 4 for aggregated navigation statistics. On the first visit a panel asks you to choose between Accept and Reject before going on: analytics cookies are switched on only if you accept, and the choice can be changed at any time from "Cookie preferences" at the bottom of the page. Zero advertising profiling cookies.
12. Minors
Registration requires a minimum age of 14; younger children need the consent of a parent/guardian, who can write to us at hello@gracecert.com. Public educational content, such as the AI School, is designed for younger readers too and is freely accessible: reading requires zero registration and zero data.
13. Changes
Substantial changes to this policy are announced on the platform and, for registered users, by email. The current version is always available on this page.