Privacy policy
How OneGrade collects and uses your personal data, and what rights you have.
Last updated: 8 October 2026 · Versão em português
1. Who we are
The controller of your personal data is OneGrade, a company being registered in Portugal (its name, tax number (NIPC) and registered office will be published here as soon as registration is complete, and in any case before any sale) ("OneGrade", "we").
For anything about your data, write to [email protected]. We have not appointed a data protection officer, as the law does not require one for our activity.
2. What data we collect and why
| When | What data | Why | Legal basis (GDPR, art. 6(1)) |
|---|---|---|---|
| You send a form on the site (question, waitlist, free lessons, call) | Name, email, phone or WhatsApp (optional), chosen plan, your message, level test result, the page you came from and the ad or link that brought you (UTM tags, referrer) | To answer you, send what you asked for and help you choose a plan; to know which of our ads and pages bring requests | (b) steps at your request before a contract; (f) our legitimate interest in measuring our marketing — for the source of your request |
| You take the level test | Your answers and result (kept in your browser; sent to us only together with a form) | To show your level and suggest a plan | (b) steps at your request |
| You write to us in the chat | Your messages and any contact details you give | To answer you | (b) steps at your request |
| You buy a course | Name, email, billing details, what you bought, payment status. Card details are handled by Stripe; we never see or store them | To take the payment, issue the invoice and give you access | (b) contract; (c) legal obligation (tax and accounting records) |
| You study with us | Progress, tests, homework and feedback, messages with teachers, lesson attendance | To teach you and give you feedback | (b) contract |
| You take part in live lessons | Your image (if your camera is on), voice and chat messages in the lesson recording | So that you and your group can watch the lesson again during your access | (b) contract — recordings are part of the course you buy |
| You agree that a group lesson recording in which you appear may be used in our self-study course | The same recording, shown to other students of the course | To add real lesson recordings to the course | (a) your consent — separate, optional, and you can withdraw it at any time |
| You visit the site | Visit statistics (pages, clicks, device, approximate location), ad measurement, chat session | To see which pages and ads work and to keep the chat working (section 3) | (f) our legitimate interest in running and improving the site and our marketing |
Our courses are for adults aged 18 and over; we do not knowingly collect data from children.
We do not sell your data and do not make decisions about you based only on automated processing.
3. Cookies and similar technologies
The site uses the tools below when you visit it. You can block or delete cookies and site data at any time in your browser settings; the site keeps working, but the chat may not remember your conversation.
| Name / tool | What it does |
|---|---|
og_attribution (session storage) |
Remembers which page or link brought you, so it is sent with your form even after you move between pages. Deleted when you close the browser |
| Live chat (Chatwoot, on our own server) | Loads after your first interaction with the page and keeps your chat conversation between pages |
| Google Analytics 4 | Visit statistics. Google does not store IP addresses in GA4 |
| Meta Pixel (when we use it) | Measures our ads on Facebook and Instagram |
4. Who processes data for us
These providers process data only on our instructions, under a data processing agreement.
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Our server: website, chat, forms and automations (Chatwoot and n8n run on it) | Germany (EU) |
| Cloudflare, Inc. | Delivering the website quickly and securely | Global network |
| Google Ireland Ltd / Google LLC | Email (Google Workspace), live lessons (Google Meet), visit statistics (Google Analytics, with consent) | EU and USA |
| Stripe Payments Europe Ltd | Payments | EU and USA |
| Our online learning platform | Course access, progress and homework | We will name the platform here before the first student joins |
| Meta Platforms Ireland Ltd | Ad measurement (with consent, when we use it) | EU and USA |
| Our certified accountant (contabilista certificado) | Accounting and tax | Portugal |
When data is transferred outside the European Economic Area, it is protected by the EU–US Data Privacy Framework (for certified companies, such as Google, Stripe, Cloudflare and Meta) or by the European Commission's standard contractual clauses.
5. How long we keep data
| Data | How long |
|---|---|
| Form and chat requests that did not lead to a purchase | 12 months after our last contact |
| Student account, progress and homework | Until 12 months after your access ends |
| Lesson recordings for your group | Until 12 months after the access of the group ends |
| Recordings used in the course with your consent | While the course uses them, or until you withdraw your consent (then we remove or blur your part in the next update, at the latest within 30 days) |
| Invoices and accounting records | 10 years, as required by Portuguese tax law (Código do IRC, art. 123.º) |
| Record of your consents | As long as we rely on them, and then as long as needed to prove them |
| Google Analytics data | 14 months |
6. Your rights
You can ask us to:
- give you a copy of your data (access);
- correct it (rectification);
- delete it (erasure);
- limit how we use it (restriction);
- send it to you or another company in a common format (portability);
- stop using it where we rely on our legitimate interest (objection).
Where we use your data based on consent, you can withdraw it at any time, as easily as you gave it; this does not affect what we did before.
Write to [email protected]. We reply within one month (this can be extended by two more months for complex requests; we will tell you if so).
You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt.
7. Security
The website and our internal tools run on our own server in Germany behind Cloudflare. Internal admin tools are behind an additional access control, connections are encrypted (HTTPS), and only the people who need the data can see it.
8. Changes
If we change this policy, we update the date at the top. If the change matters to you, we will also tell you by email.