This policy explains what personal data SafeGrade collects, why, where it goes, how long we keep it, and your rights. It covers safegrade.co.uk and app.safegrade.co.uk.
SafeGrade is a trading name of Liam Broad, a sole trader, of 4th Floor, 14 Museum Place, Cardiff, CF10 3BH. For UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office, registration number C1894749.
Contact: help@safegrade.co.uk
When you publish a share card, you decide what goes in it and who you share it with, and you are responsible for that content. We host the page and delete it on the schedule you choose.
Account information
When you create an account, we collect your institutional email address, your university, course, subject group and year of study, and the modules you add. If you sign in with your university's Microsoft account, Microsoft also tells us your name. We use this to run your account and to tailor analysis and feedback to your course.
SafeGrade's workspace also lets you record details about your tutors or markers — for example their name and how they prefer work to be structured, referenced or argued. This is personal data about someone else, so please record only what is relevant to your studies. Marker names are never sent to Anthropic; only the preferences are, and only to tailor feedback to how your work will be marked. You can edit or delete these records at any time.
Your work
When you upload or paste text into SafeGrade — essays, assignment briefs, and your messages to Sage — we store it on our server so we can analyse it and keep your results, version history and workspace. Your work is yours; we don't claim any rights to it.
Share Cards
Share Cards let you publish a short-lived page — a link, a note, a document, a set of slides or a small sheet — and share it with a QR code or a link.
A share card is public. Anyone with the link, or with the printed code, can read it without signing in. You can add a view code so that only people who have it can open the page, and we add one by default when you publish a sheet.
If you put other people's information in a share card — names, marks, groups, anything about someone who isn't you — that is personal data about someone else, and you are responsible for it. Publish only what those people would expect to be public, and use a view code if you're unsure. You can take a share card down at any time.
Usage data
We record which features you use and how often (for example, how many scans or Sage messages you've used) so we can apply the limits of your plan and keep the service running well. We don't use tracking cookies, advertising pixels or third-party analytics services.
Payment information
If you buy a paid plan or a Usage Boost, Stripe processes your payment. We never see or store your full card details. We receive only confirmation of payment, your Stripe customer ID and your subscription details.
| What we do | Lawful basis |
|---|---|
| Analyse your writing and give you feedback, scores and suggestions | Contract: it's the service you signed up for |
| Keep your workspace, assignments and version history | Contract |
| Publish and serve the share cards you create, for as long as you choose to keep them open | Contract |
| Tailor analysis to your university, course and discipline | Contract |
| Take payments and manage your plan | Contract |
| Send essential service emails: verification, password resets, payment confirmations, and notices about changes to our terms | Contract |
| Apply usage limits, prevent abuse and keep the service secure | Legitimate interests: keeping SafeGrade secure and fair for everyone |
| Record how you found SafeGrade, to see which pages and partners bring people to us | Legitimate interests: understanding what works, without advertising trackers |
| Keep payment records | Legal obligation: UK tax law |
We don't use your data for advertising or profiling, and we never sell it. We don't use your work to train AI models.
Your account and your work are stored on our server in a UK data centre, provided by Fasthosts. Some of your data leaves the UK, as follows.
AI analysis: Anthropic PBC (United States). Writing Analysis, the grade band estimate you see, and referencing checks are calculated entirely on our own server and send nothing to Anthropic. Every other feature that analyses your writing — currently Deep Scan, Improve, grammar checking, Priorities, the Research Planner, assignment brief summaries and Sage — sends the text you submit to Anthropic, which provides the AI models, together with your university, course, year of study and module details so the feedback fits your course.
What we remove first: before sending, we remove your email address; your name and student number where they appear in your essay's heading; your university's name if you typed it in yourself; and any email addresses or UK phone numbers in the text. We don't attach your name, email address or file names to what we send. Names written elsewhere in your essay are not removed, so please leave out anything you don't want shared.
Your work is never sent to any AI detection service such as GPTZero or Turnitin.
Anthropic processes this data only on our instructions, under a data processing agreement, and does not use it to train its models. The United States does not have a UK adequacy decision covering Anthropic, so we rely on the EU Standard Contractual Clauses (Module Two, controller to processor) together with the International Data Transfer Addendum (version B1.0) issued by the Information Commissioner, both part of Anthropic's data processing agreement. We have carried out a transfer risk assessment. Anthropic deletes what we send within 30 days, or keeps it for up to two years if its automated safety systems flag it.
Share Cards are not sent to our AI provider. Nothing you publish in a share card is analysed by AI, sent to Anthropic, or used for anything other than showing the page to whoever opens it.
Website delivery, security and backups: Cloudflare, Inc. (United States). All traffic to SafeGrade passes through Cloudflare's network, which may process it in data centres outside the UK. Copies of our database are kept in Cloudflare's storage service, set to a Western Europe location and encrypted at rest by Cloudflare. Cloudflare is certified under the UK Extension to the EU–US Data Privacy Framework, and its data processing agreement also includes the Standard Contractual Clauses and the UK Addendum.
Standby server: DigitalOcean, LLC. The server is in London. DigitalOcean is a US company; any access from outside the UK is covered by the Data Privacy Framework (UK Extension) and the Standard Contractual Clauses with the UK Addendum.
Payments: Stripe. Stripe processes your payment details; we never see your card number. Stripe transfers data under the Data Privacy Framework (UK Extension) and its Data Transfers Addendum, which includes the UK Addendum. For some purposes, such as fraud prevention and its legal obligations, Stripe acts as a separate controller under its own privacy policy.
Email and Microsoft sign-in: Microsoft. Our email runs on Microsoft 365, with UK data location. If you sign in with your university's Microsoft account, Microsoft tells us your name and email address.
You can ask for a copy of the safeguards for any of these transfers by emailing help@safegrade.co.uk.
Passwords are stored hashed, never in plain text, and two-factor authentication is available on every account. Backups are taken automatically, and the copies held in our cloud storage are encrypted at rest by the provider. Access to our servers requires cryptographic keys, and all connections use HTTPS with TLS 1.2 or above.
See section 4 for where your data is stored and processed.
We do not delete your essays on a timer. Your essays, results and Sage conversations stay in your account until you delete them or close your account. You can delete individual essays from your Library, or your whole account from Settings, at any time. When you delete your account, we delete your data from our live systems straight away; copies in our backups are deleted within about three months. Our AI provider, Anthropic, deletes what we send it within 30 days (up to two years if its safety systems flag it).
Share Cards are different, because you choose how long they last. When a share card expires, or you take it down, the page stops showing its contents immediately. If you take it down, we delete its contents at once; if it expires, we delete them within 24 hours. We keep its title and basic details (when it was published and when it closed) for 30 days after its expiry date, so that anyone scanning the code is told it has closed, and then delete those too.
The exception is payment records. We keep records of payments and invoices for as long as UK tax law requires (for a sole trader, at least five years after the relevant tax return deadline). Stripe holds these on our behalf, and they do not include your essays or Sage conversations.
Under the UK GDPR, you have the right to:
To use any of these rights, email help@safegrade.co.uk. We'll respond within one month, as the law requires.
You can also complain to the Information Commissioner's Office at ico.org.uk if you think we've got something wrong. We'd appreciate the chance to put it right first.
If someone else's share card mentions you
If you are named or described in a SafeGrade share card and you are not a SafeGrade user, email help@safegrade.co.uk with the link. We'll look at it and respond within one month, and we can take the page down. You don't need an account, and you don't need to know who published it.
We don't use advertising or third-party analytics cookies, and no advertising or analytics scripts run on SafeGrade. Everything below is set by SafeGrade itself and is there to make the service work.
Cookies
Cloudflare, which protects our network, may set a short-lived security cookie if it needs to check that traffic isn't automated. Stripe sets its own cookies on its checkout pages, under its own privacy policy.
Browser storage
We keep a few things in your own browser: your light or dark theme, how you've arranged your home page and sidebar, which notices you've dismissed, and any share card you're still drafting. None of it leaves your device.
How you found us. When you first arrive, we note how you found SafeGrade — the page you landed on, the site you came from, and any campaign tags in the link — for the length of your visit (and in a cookie that lasts 10 minutes if you sign in with Microsoft). If you create an account, we save it with your account. We use it only to understand which of our pages and partners bring people to SafeGrade, and we never share it.
SafeGrade is for university students aged 18 and over. You must confirm that you are 18 or over when you create an account. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account, email help@safegrade.co.uk and we will close the account and delete its data.
We may update this policy from time to time. If we make significant changes, we'll tell you by email or with a notice in the app before they take effect. The date at the top shows the current version.
For any question about this policy or your personal data: help@safegrade.co.uk, or write to Liam Broad trading as SafeGrade, 4th Floor, 14 Museum Place, Cardiff, CF10 3BH.