Privacy Policy

1. Information We Collect

When you use Acelro, we collect the following types of information:

• Account information: your email address and authentication credentials.
• Career data: CV uploads, career goals, current and target job titles, and skills you provide.
• Learning activity: quiz responses, lesson progress, project submissions, and coach chat messages.
• Usage analytics: pages visited, features used, and interaction patterns to improve the product.

Paid-plan waitlist without an account: on our pricing page you can ask to be told when paid plans open without signing up. If you do, we store the email address you give us, the plan you picked and the time you ticked the consent box. We use it to send you one email when paid plans open, and for nothing else. We rely on your consent, and you can withdraw it at any time. We delete the address once we have sent that email, and in any case within 12 months. To have it removed sooner, email privacy@acelro.com.

An organisation you name in our survey: our product survey asks whether your university, college or employer might pay for Acelro, and who we should speak to there. If you answer, we store the organisation and contact you give us with your survey answers. We contact them only if you tick the box that allows it, and only to ask about paying for Acelro. We do not share your answers with them without asking you first. If you name a person, we tell them where we got their details when we first get in touch. These details are deleted with your account, or sooner if you or they ask at privacy@acelro.com.

Survey answers without an account: anyone with the link can answer our product survey without signing up. If you do, we store your answers, including how you heard about the survey and any organisation or contact you name, with nothing that links them to an account. We use them to decide what Acelro should cost and what to build next, which is our legitimate interest, and we quote them, without your name, only if you tick the box that allows it. Your email address is optional. We keep it only if you tick the box allowing us to email you follow-up questions about your answers, or the box to join the paid-plan waitlist, and we use it only for what you ticked. For the email we rely on your consent, and you can withdraw it at any time. We delete your answers, and any email address you gave with them, within 12 months. To have them removed sooner, email privacy@acelro.com. If you ticked the box for follow-up questions, tell us the email address you gave so we can find your answers. Without it, we have no way to tell which answers are yours.

2. How We Use Your Data

We use your data to:

• Generate personalized skill gap analyses and career roadmaps.
• Provide tailored learning recommendations and content.
• Power coaching conversations and project reviews.
• Improve the accuracy and relevance of our analysis over time.

Your career data is processed using AI analysis to deliver personalized insights. We do not sell your data to third parties or use it for advertising.

3. Third-Party Services

We use trusted third-party services to operate Acelro:

• Database and file storage (Amazon Web Services): your data is stored in a managed PostgreSQL database on Amazon Web Services in London, UK, with encryption at rest. Files you upload, such as your CV, are stored in Amazon S3 in London. Sign-in is handled by an identity service (Logto) that we host ourselves.
• AI analysis: your career data is sent to AI providers for personalized analysis. Data is transmitted securely via encrypted connections and is not used to train third-party models. See section 8 below for the providers we use and how AI shapes the product.
• Analytics (PostHog): we use an EU-hosted analytics service to understand how users interact with the product. Before you make a cookie choice it runs in a cookieless statistical mode, described in section 4. Analytics cookies are set only if you accept them.
• Payment processing (Stripe): subscription billing is handled by Stripe. We do not store your payment card details.
• Infrastructure: we use industry-standard cloud providers for hosting, email delivery, error monitoring, and speech processing. All data is transmitted over encrypted connections.

The full list of subprocessors, including each provider's region and the legal mechanism we use for any transfer outside the UK or EEA, is maintained as a formal record under change control. Email privacy@acelro.com for a copy. We notify all account holders by email at least 14 days before adding or replacing a subprocessor.

4. Cookies & Analytics

Acelro uses cookies to keep you signed in. For analytics, what we store depends on the choice you make in the cookie banner.

Before you choose, and if you decline: we count visits without setting any analytics cookie and without storing any identifier on your device. Our EU-hosted analytics provider counts each visit on its servers using a hash built from your IP address, browser type, and our site name, mixed with a random value that changes and is deleted every day. The hash cannot be linked back to you and stops matching you after 24 hours. We use these counts only as aggregate statistics about our own site, such as daily visitors and which pages people arrive on. We do not use them for advertising and we do not share them. UK law permits this kind of statistical measurement (PECR, as amended by the Data (Use and Access) Act 2025). In the EU we rely on legitimate interest for aggregate audience measurement, in line with the audience measurement exemption published by the French regulator (CNIL).

If you accept cookies: our analytics provider sets first-party cookies so we can understand usage across days, such as whether a change helped returning users. These cookies do not track you across other websites. Advertising and marketing tags load only after you accept.

Session replay: if you accept cookies, we also record a masked playback of your visit.

Masked means every piece of text and every form field is replaced with a blank block, in your browser, before anything is sent. We can see where you clicked, scrolled or got stuck. We cannot see what any of it said.

This is about playbacks only. It does not change what you give us directly: we still hold your CV, your coach messages and your project work, and sections 1 and 2 set out what we collect and why.

Playbacks are held by our EU-hosted analytics provider and deleted after 30 days. Choose Decline in the cookie banner and no playback is recorded.

AI features in analytics: our analytics provider offers features that use external AI services to summarise and investigate product data, and we have them switched on. This can involve information about how you use Acelro, and in some cases information that identifies you, being sent to those providers. They act under our provider's data processing terms, and your data is not used to train their models or anyone else's. To ask which providers are involved, write to privacy@acelro.com.

Your opt-out: choose Decline in the cookie banner and no analytics cookie is ever set; only the anonymous daily count described above remains, and it stores nothing on your device. If you object to any measurement at all, contact us at privacy@acelro.com.

5. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law.

Anonymized, aggregated data (such as overall usage statistics) may be retained indefinitely to improve the product.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Correction: update or correct inaccurate data.
• Deletion: request that we delete your data.
• Export: receive your data in a portable format.
• Objection: object to certain types of processing.

To exercise any of these rights, contact us at privacy@acelro.com. We will respond within 30 days.

7. How to Make a Complaint

If you believe we've handled your personal data incorrectly, you can make a formal complaint. Use our complaint form at acelro.com/privacy/complaint. We'll acknowledge receipt immediately and respond substantively within 30 days. If the case is complex and we need longer, we'll write to you with the reason and a new timeline, up to a further two months as permitted by UK GDPR.

You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. The ICO usually expects you to contact us first.

8. AI Systems and Automated Decisions

Acelro is an AI-first product. The value proposition, marketing pages, onboarding flow, and global product chrome all surface that you're using AI. Per EU AI Act Art. 50(1), this means the "AI involvement is obvious" exemption applies to most surfaces. We still anchor compliance on persistent disclosures: the onboarding education step, the global "AI: how we use it" chip, the coach chat badge, and a visible mark on AI-generated images. We'll re-evaluate this position when the EU's final Code of Practice publishes (June 2026).

What AI does and doesn't decide. AI generates suggestions: a roadmap, a gap list, lesson content, a coach reply, a project review. It doesn't make any decision that legally affects you. We don't share Acelro's outputs with employers, recruiters, or institutions. You can edit, ignore, or reject any AI output.

The providers we use. Acelro doesn't train its own AI models. We use models from Google, Anthropic, OpenAI, and Perplexity. For voice lessons we use transcription and text-to-speech services. The set of providers stays the same unless we say otherwise here.

Voice processing in voice-interactive features. Acelro has voice-interactive features (live lessons today; we may add others such as mock interview practice or Professor voice chat in future). The first time you use any of them, we ask for your consent. Your microphone audio is sent to a transcription service to convert it into text, and that text is sent to an AI model to generate the next part of the session. We don't retain the audio. We keep the transcript so you can resume the session later. One agreement covers every voice-interactive feature; you can withdraw consent at any time by contacting us at privacy@acelro.com, and we'll stop voice processing across all of them. If we materially change what voice processing involves, we'll re-prompt every existing user before the next voice session.

Your data and AI training. We don't fine-tune or train any model on your data. We send your inputs to model APIs to generate a response, and the providers' terms, together with the settings we use with them, exclude using API inputs to train their models. If a provider changes that policy, we'll notify users and reconsider the integration.

AI Act and your rights. Under the EU AI Act, you have rights that go beyond GDPR: be told an AI system is involved (this notice plus the in-product disclosures), get a plain-English explanation of how a specific output was generated (contact us), report a problem with any AI output and ask us to re-check it (every output has a report link or you can email us), and request human review of any AI output that you believe is wrong. Email founder@acelro.com. We treat all users the same regardless of jurisdiction.

UK automated decision-making (Data (Use and Access) Act 2025). From 5 February 2026, UK rules on automated decision-making are set out in Articles 22A to 22D of the UK GDPR, as amended by the Data (Use and Access) Act 2025. Those rules apply to decisions based solely on automated processing that have a legal or similarly significant effect on you. Acelro's AI outputs (roadmaps, gap analyses, lessons, coach replies, project reviews) are advisory suggestions that you can edit, ignore, or reject, and we don't share them with employers, recruiters, or institutions, so we don't make solely automated decisions with legal or similarly significant effects. If we ever introduce a feature that does, we'll provide the Article 22B safeguards before it launches: telling you a decision was automated, and letting you make representations, obtain human review, and contest the decision.

Limitations. AI gets things wrong. It can be confidently wrong. Roadmaps may miss certifications specific to your country. Coach replies may misremember details. Generated images and quizzes may include errors. Verify anything you'll act on professionally.

Subprocessors. The full list of providers that process personal data on our behalf, including each provider's region and the legal mechanism used for any transfer outside the UK or EEA, is maintained as a formal record under change control. Email privacy@acelro.com for a copy.

How we record processing. We keep Records of Processing Activities (RoPA) and a Data Protection Impact Assessment (DPIA) for the AI parts of the product. Both are reviewed at least annually and on every material change. Email privacy@acelro.com for a copy.

9. Data Security

We protect your data with industry-standard measures including encryption in transit (TLS), encryption at rest, and secure access controls. While no system is 100% secure, we take reasonable steps to safeguard your information.

10. Children's Privacy

Acelro is not directed at children under the age of 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. If we make significant changes, we will notify you by email or through a notice on the platform. Your continued use of Acelro after changes are posted constitutes acceptance of the updated policy.

12. Contact

If you have questions about this privacy policy or your data, contact us at privacy@acelro.com.

If we contacted you about Acelro for your organisation, see how we handle your details when we contact you.