GRIDD · Legal
Privacy Policy
This page explains how GRIDD handles information when you visit, create an account, join an academy or use a course. GRIDD is operated by Beaten Track Music LTD, 2 Bure Valley, Broughton, Milton Keynes, Bucks, MK10 7DR, United Kingdom.
Who we are
Beaten Track Music LTD operates GRIDD and processes personal data to run the platform. Academies may separately decide how they use student data for their education, coaching, communications, sales, payments and programmes, and may have their own data-protection responsibilities. The precise legal roles depend on the activity and the arrangements with the academy; we do not assume one controller/processor relationship applies to every academy. For questions about academy course records, we may need to work with that academy to respond.
Information you provide and generate
Depending on how you use GRIDD, we process your name, email address and account details; your academy relationship, invitations and course access; and information you enter in onboarding questionnaires or profile fields.
Learning activity may include your course progress, lesson completions, submissions, check-ins, community posts, replies, reactions, and messages to course assistants. If you upload files or video for a course, the content and related metadata are also processed to provide that feature. Academy staff can access course-related information according to their assigned roles.
Accounts and Google sign-in
We use an authentication provider to create accounts, verify identity and maintain sign-in sessions. If you choose Google sign-in, GRIDD may receive the basic Google account information needed for authentication: your name, email address, profile image and Google account identifier. We use this for account creation, authentication and account security.
Google sign-in requests only basic account identity permissions (openid, email and profile). GRIDD does not request access to your Gmail, Google Drive, Google Calendar or contacts through Google sign-in. We do not sell Google user data or use it for targeted advertising. Information received through Google sign-in is used only for providing and securing your account, and is shared only as needed to provide that service or meet legal obligations.
AI-assisted learning
If you use an AI course assistant, GRIDD processes your messages and relevant course context to generate a response. Conversations and limited grounding references may be stored so the feature can work and be reviewed. Do not include information you do not want processed by the assistant. AI responses may be inaccurate; see our Terms of Service.
Payments and service messages
Where payment features are used, GRIDD processes payment-related records such as purchase status, provider references, subscription or entitlement status and transaction events needed to manage access. Payments are handled by payment providers; the relevant academy may be the merchant of record for a student’s course purchase. GRIDD does not collect or store student card details for those academy payments. We also process email addresses and delivery status to send invitations and essential service messages.
Technical data, cookies and logs
When you use the site, device or browser details, request data and security or application logs may be processed to operate and protect the service. GRIDD and its authentication provider Clerk use necessary cookies or similar browser storage for sign-in sessions, account security and essential application state. These are needed for the signed-in service. Internal course progress, activity and reliability events are not advertising cookies.
GRIDD does not currently use optional advertising or behavioural marketing cookies. Site-level usage analytics may be provided through our hosting service where enabled; this is distinct from advertising tracking. If optional analytics or marketing technologies requiring consent are introduced, we will give appropriate notice and consent controls before using them where required by law.
How we use your information and our lawful bases
Depending on the activity, we rely on performance of a contract, legitimate interests, legal obligations or, for optional promotional activity where required, consent. We rely on legitimate interests only where we consider those interests are not overridden by the rights and freedoms of the people concerned. The bases below describe GRIDD’s platform processing; an academy may have its own basis for its separate activities.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Accounts and identity | Name, email, profile and authentication identifiers | Contract; legitimate interests in secure accounts |
| Sign-in and security | Sessions, login records, identifiers and security events | Contract; legitimate interests in protecting users and the service |
| Course access and learning | Enrolment, entitlements, progress, submissions, check-ins and history | Contract; legitimate interests in delivering and improving learning services |
| Onboarding and recommendations | Questionnaire answers, diagnostic profiles and learning paths | Contract; legitimate interests in personalising learning |
| AI course support | Questions, conversation history and relevant course context | Contract; legitimate interests in providing course support |
| Academy administration | Student records, programme dates, staff notes and memberships | Contract; legitimate interests in programme administration |
| Payments and commercial records | Payer identity, provider references, status, invoices and agreements | Contract; legal obligations; legitimate interests in accounting and fraud prevention |
| Essential messages | Email address, invitations, delivery and service notices | Contract; legitimate interests in operating the service |
| Promotional messages, if sent | Contact details and communication preferences | Consent where required by electronic-marketing law, or another documented lawful basis where available; opt-outs are respected |
| Operation and troubleshooting | Device details, logs, errors and security activity | Legitimate interests in reliability, security and abuse prevention |
| Service improvement | Aggregated or minimised usage and activity | Legitimate interests; consent where required for future optional tracking |
| Legal compliance and claims | Relevant account, payment, audit and support records | Legal obligation; legitimate interests in defending legal claims |
Service providers and sharing
GRIDD uses Clerk for authentication, Replit for hosting, Supabase for data storage, Resend for transactional email, Mux for video and Stripe for payments where applicable. AI-assisted features use a configured AI service provider, which may include Replit’s AI service, Anthropic or OpenAI depending on configuration. These providers process information relevant to the service they deliver. We share course and participation information with the academy and authorised staff responsible for your programme. We may disclose information where required by law or to protect the service. We do not sell Google sign-in data.
Retention and security
We keep personal data only as long as reasonably necessary to provide and secure GRIDD, maintain account and programme history, support academy and student operations, resolve disputes and support issues, and meet legal, accounting or regulatory duties. When a valid erasure request is actioned, operational data is deleted or anonymised according to our erasure process. Some payment, contractual, security or audit records may need to be retained for legitimate legal or audit reasons, with identifiers removed or minimised where supported.
Deleted information may remain for a limited period in encrypted or restricted backup systems until those backups are overwritten or expire under our providers’ normal backup-retention schedules. Backups are for security and disaster recovery, not ordinary business use. We do not promise that every database row is immediately or physically deleted.
We use role-based access controls and measures such as protected sessions and signed video playback where applicable. No online service can guarantee absolute security.
International transfers
GRIDD is operated in the UK, but some service providers may process personal data outside the UK or European Economic Area. Where this happens, we take appropriate steps intended to protect it under applicable data-protection law. Depending on the destination and provider, these may include UK or EU adequacy decisions, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, EU Standard Contractual Clauses, or other applicable contractual or lawful transfer arrangements. Not every safeguard applies to every provider.
Your rights and deletion requests
Where UK GDPR or GDPR applies, you may have rights to access, correct or delete personal data; restrict or object to some processing; request portability; and lodge a complaint with a relevant data protection authority. These rights depend on the circumstances and may be subject to legal exceptions. To ask about your data, request correction or account deletion, object or restrict processing where applicable, or raise a privacy concern, contact privacy@thegridd.io. For academy-managed course information, we may coordinate with your academy. Deletion is not necessarily immediate across all systems or records.
Children
GRIDD is intended for users aged 18 and over. You must be at least 18 years old to create an account or use the service. GRIDD is not designed for children’s accounts. If you believe someone under 18 has provided personal data, please contact privacy@thegridd.io.
Normal course and onboarding activities are not designed to require sensitive information such as health, political or religious beliefs, ethnicity or sexual orientation. Please do not submit sensitive information unless it is genuinely needed for an agreed purpose.
Changes and contact
We may update this policy as the service changes. The current version will remain available at this address; we will communicate material changes where appropriate. For privacy questions contact privacy@thegridd.io. The operator’s business address is Beaten Track Music LTD, 2 Bure Valley, Broughton, Milton Keynes, Bucks, MK10 7DR, United Kingdom.