1. Privacy Policy
Effective date: [EFFECTIVE DATE]
Last updated: [EFFECTIVE DATE]
Robles Consulting LLC d/b/a GradeVu ("GradeVu," "we," "us," or "our") operates the GradeVu mobile application and the website at rarvo.com (together, the "Service"). This Privacy Policy explains what we collect, how we use it, who receives it, how long we keep it, and the choices you have.
Contact:
Robles Consulting LLC — GradeVu
100 Plaza Pl, Ste 300, PMB 58
Northlake, TX 76226, USA
Privacy: privacy@gradevu.com
Support: support@gradevu.com
1. Scope and eligibility
The Service is offered only to individuals who are 18 years of age or older and located in the United States. We do not knowingly collect information from anyone under 18, and we do not offer the Service outside the United States. If we learn that we have collected information from a person under 18, we will delete the account and associated data.
This Policy does not apply to third-party sites or apps we link to, including Apple's services.
2. Information we collect
(a) Account and sign-in information. When you sign in with Apple, we receive an Apple-generated user identifier, your name and email address only if you choose to share them, and — if you use Apple's Hide My Email — an Apple private relay email address rather than your real address. We store your account identifier, display name, and the email or relay address on file. If you delete the app but not your account, your account remains.
(b) Card photos and capture details. When you scan a card, we collect the photographs you take or select, including front, back, corners, edges, and surface images; any images you import from your photo library; and capture details such as the scan session identifier, the order of images in a session, the device model you used, the app version, and technical image characteristics used to check photo quality. We may store a downscaled working copy alongside the original. We do not request or use precise location. If your images contain embedded metadata such as GPS coordinates, we strip it on upload.
(c) Corrections and annotations. If you correct an estimate, label a defect, mark a centering measurement, or leave notes, we store those corrections, labels, and annotations and link them to the underlying images and to your account.
(d) Usage data. We collect in-app events such as screens viewed, features used, scans started and completed, estimates viewed, and session times. We use this to operate, secure, and improve the Service.
(e) Diagnostics. We collect crash logs, error reports, performance timings, device model, operating system version, app version, language, and IP address. IP addresses are used for security, rate limiting, and coarse region checks (United States only).
(f) Support communications. If you email us, we keep your message, attachments, and our reply.
(g) Purchases. Subscriptions and purchases are processed by Apple. We receive transaction status and a subscription receipt — not your payment card number.
(h) Public content. If you publish a certificate page, create a profile, or post in community features, we store and display that content as described in Section 8.
What we do not collect: precise geolocation, contacts, calendars, health data, biometric templates (Face ID and Touch ID stay on your device), advertising identifiers, or browsing activity in other apps. We do not track you across other companies' apps or websites, we do not run third-party advertising SDKs, and we do not sell personal information.
3. How we use information
Purpose Data used
Create and secure your account; sign you in Account and sign-in data
Generate estimates, sub-scores, and defect reports Card photos, capture details
Show your scan history and certificates Photos, capture details, corrections
Improve accuracy for your account (e.g., re-run estimates as models improve) Photos, corrections
Operate, debug, and secure the Service; prevent abuse and fraud Usage data, diagnostics, IP
Provide support Support communications
Process subscriptions and comply with Apple's rules Purchase data
Publish certificate pages you choose to publish Public content
Moderate community content and enforce our Terms Public content, usage data, reports
Optional research — only if you turn it on Photos, capture details, corrections
Optional commercial model training — only if you turn it on Photos, capture details, corrections
Aggregate analytics on de-identified derived data (always on) See Section 5
Legal compliance, tax, and enforcing our rights As required
4. Our consent model — three separate choices
We separate three things that most apps bundle together. You control the last two.
Core processing (required). Generating estimates, storing your scans, running your account, securing the Service. This is necessary to provide the Service. Without it, we cannot operate your account.
Research use (optional, OFF by default). Allows GradeVu and our affiliate rarvo.com to use your photos, capture details, and corrections for internal research and evaluation — for example, measuring how our models perform across card types, print runs, and lighting conditions. Turning this on does not permit commercial model training.
Commercial model use (optional, OFF by default). Allows us to use your photos, capture details, and corrections to train, fine-tune, evaluate, and improve machine-learning models that we use in GradeVu and that we may license or otherwise commercialize, including models offered to third parties. This is the broadest option and it is off unless you turn it on.
Both optional choices start OFF. We do not pre-select them, we do not bundle them with the core terms, and we do not condition access to the Service on either one. You can change either choice at any time in Settings → Privacy & Data. A change applies going forward; see Section 6.
5. De-identified derived data (always on)
We generate De-Identified Data: numeric and statistical outputs derived from scans — for example, measured centering ratios, edge-wear scores, defect counts by card type, model confidence values, and aggregate accuracy statistics. We use De-Identified Data to monitor model performance, produce internal reports, and improve our models.
De-Identified Data does not include your card images, your corrections text, your account identifier, your name, or your email. We commit not to attempt to re-identify it, to require our service providers to do the same by contract, and to publish only aggregate results. We treat card images as identifiable and linked to your account, which is why image-based training requires your opt-in under Section 4.
6. Withdrawal, and what it does not undo
You can turn off Research use or Commercial model use at any time in the app, or by emailing privacy@gradevu.com. Withdrawal is prospective: it stops new use, and we will remove your data from research and training datasets assembled after your withdrawal, subject to the retention limits in Section 7.
Withdrawal does not require us to retrain, recall, or delete models that were already trained before your withdrawal, and does not require us to remove your data from a model that has already been trained. Those models do not store retrievable copies of your photos. This is a material term of the Service and is stated again in the Terms of Use.
If you want your photos deleted entirely, use the in-app deletion controls or delete your account (Section 8).
7. Retention
Data Retention
Card photos and capture details Until you delete them or delete your account
Corrections and annotations Same as the linked photos
Account and sign-in data While your account is open, then 30 days after deletion
Research or training datasets you opted into Until you withdraw, then removed in the next scheduled dataset refresh (within 90 days), except as to already-trained models
Usage data 24 months
Diagnostics and crash logs 12 months
Support emails 24 months
Purchase and tax records As required by law (up to 7 years)
De-Identified Data Retained indefinitely (not personal information)
Backups Purged on a rolling 90-day cycle
8. Account deletion, and what survives it
You can delete your account in-app at Settings → Account → Delete Account, or by emailing privacy@gradevu.com from your registered address. We will verify and process the request within 30 days (45 days where a state law allows an extension, with notice).
On deletion we delete or de-identify: your account record and sign-in identifiers, your photos, your corrections and annotations, your scan history, and your profile.
What may survive deletion, and why:
De-Identified Data (Section 5) — it is not linked to you and cannot be used to identify you.
Already-trained models — a trained model does not contain a retrievable copy of your photos.
Published certificate pages you made public — these are public records by design. Deleting your account unpublishes them and removes your display name, but we may retain a minimal, non-identifying record of the certificate identifier and outcome for integrity and anti-fraud purposes. See the Public Certificate Page Notice.
Records we must keep — tax, accounting, and legal-hold records.
Residual backups — purged within 90 days.
9. Who receives information
We share personal information only with:
Apple — Sign in with Apple, App Store distribution, subscriptions, and push delivery.
Hosting, storage, and database providers — cloud infrastructure that stores images and account records on our behalf.
Diagnostics and analytics providers — crash reporting and product analytics, configured without advertising identifiers and without cross-app tracking.
Email and support providers — to send transactional email and answer your requests.
Our affiliate, rarvo.com — an affiliated entity operated within the GradeVu group, for the research purposes described in Section 4 and for shared engineering and model development.
Moderation and trust-and-safety providers — to screen public content and detect abuse.
Professional advisers, auditors, and insurers — under confidentiality.
Authorities and counterparties in a corporate transaction — where legally required, or in connection with a merger, financing, acquisition, or sale of assets (with notice and continued protection).
Other users — only the public content you choose to publish.
We do not sell personal information, do not share it for cross-context behavioral advertising, and do not disclose it for targeted advertising.
10. Your privacy rights
Depending on your state of residence (for example California, Texas, Colorado, Virginia, Connecticut, Utah, Oregon, Montana, and others), you may have the right to:
Know and access the personal information we hold about you and how we use and share it;
Correct inaccurate personal information;
Delete personal information, subject to exceptions;
Port a copy of certain information in a machine-readable format;
Opt out of sale, sharing for targeted advertising, and certain profiling — we do none of these, so there is nothing to opt out of;
Limit use of sensitive personal information — we do not collect sensitive personal information as defined by these laws;
Non-discrimination for exercising your rights;
Appeal a refusal — reply to our decision with "Appeal" and we will respond within the period required by your state's law;
Use an authorized agent, with proof of authorization.
To exercise any right, use the in-app controls or email privacy@gradevu.com. We will verify your identity using your account and sign-in method and respond within 45 days. California residents: we have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months, and we do not knowingly collect information from consumers under 18.
11. Security
We use encryption in transit, encryption at rest for stored images, access controls, and least-privilege internal access. No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.
12. Children
The Service is for adults 18 and over in the United States only. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. We do not target advertising to children and do not use the Service to advertise to minors.
13. International transfers
We provide the Service in the United States only. We store and process data in the United States. If you access the Service from outside the United States, you do so on your own initiative and the Service is not intended for you.
14. Cookies and tracking
Our website uses only strictly necessary cookies and basic first-party analytics. We do not use advertising cookies, we do not use pixels that build cross-site profiles, and we honor Global Privacy Control signals where technically applicable. The app does not track you across other companies' apps or websites.
15. Changes
We will post changes here and update the date above. For material changes — in particular any change to the optional choices in Section 4 — we will notify you in-app and, where required by law, ask for your consent again.
16. Complaints
Contact privacy@gradevu.com first. You may also complain to your state attorney general, or in California to the California Privacy Protection Agency.