Legal
Privacy Policy
Last updated 27 August 2026
This policy explains what personal data My Acolyte collects, why we process it, who we share it with and the rights you have over it. We are the data controller for the personal data described here, and we handle it in line with the UK GDPR and the Data Protection Act 2018.
1. What we collect
Account data: your name, email address and account role, provided when you register.
Academic profile data: the information you choose to enter about your education, research interests, publications, experience, skills, awards, language tests, funding and visa situation, referees, and the personal statements and stories you write for use in your documents.
Application data: the opportunities you save, your application progress and checklists, your notes, your document drafts and saved versions, your conversations with the AI coaches, and any files you upload.
Review data: documents you submit for human review, the notes you write for the reviewer, and the feedback and annotations returned to you.
Billing data: your plan, subscription status, allowance usage, purchase history and the customer and subscription identifiers held by Stripe. We never see or store your full card details.
Technical data: essential cookies and similar storage needed to keep you signed in and remember your preferences, and — only if you consent — limited product analytics about how the app is used.
2. Why we process it, and our lawful basis
To provide the service you signed up for — running your workspace, generating drafts from your profile, tracking your applications and delivering reviews you purchase. Lawful basis: performance of a contract with you.
To take payment, manage subscriptions and allowances, and keep financial records. Lawful basis: performance of a contract, and legal obligation for accounting records.
To send service messages you need, such as deadline reminders, review status updates, billing notices and account security messages. Lawful basis: performance of a contract and our legitimate interest in keeping you informed.
To keep the service secure, prevent abuse and enforce fair use, including our rate limits. Lawful basis: our legitimate interest in protecting the platform and its users.
To understand how the app is used and improve it. Lawful basis: your consent, given through the cookie banner. You can withdraw it at any time from your Settings page.
3. AI processing of your material
When you ask a coach for a draft, feedback or a strength check, the relevant parts of your profile, your current draft and your conversation are sent to our AI processing providers so the response can be generated. This happens only in response to an action you take.
We do not sell your material and we do not use it to train public AI models. Our providers process it on our instructions under contract, for the sole purpose of returning the output you asked for.
Please avoid putting special-category information — such as health, ethnicity, religion or sexual orientation — into your drafts or coach conversations unless it is genuinely needed for your application, since it will be processed in the same way as the rest of your text.
5. International transfers
Some of our providers process data outside the United Kingdom. Where they do, the transfer is covered by UK adequacy regulations or by the International Data Transfer Agreement or Addendum, together with appropriate technical and organisational safeguards.
6. How long we keep it
We keep your account, profile, application and document data for as long as your account is open, because it is what the service runs on.
When you ask us to delete your account we begin a 14-day grace period, so that an accidental or regretted request can be reversed. During that time your account remains as it was and you can cancel the deletion from your Settings page. After 14 days your profile, applications, documents, drafts, coach conversations, notifications, review requests and membership record are permanently erased.
A minimal record of the deletion itself, and the financial records we are legally required to keep for accounting and tax purposes, are retained after erasure. Those records do not include your application material.
7. Your rights
You have the right to be informed, to access your data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on it.
Two of these are built into the app. "Export my data" on your Settings page gives you a complete machine-readable copy of everything we hold about you, and "Delete my account" starts the erasure process described above. For anything else, contact us and we will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put it right first.
9. Security
Access to your records is enforced at the database level, so one member’s data cannot be read by another. Payments run through Stripe and never touch our servers as card data. Payment webhooks are signature-verified and sensitive endpoints are rate limited. No system is perfectly secure, so please use a strong, unique password and tell us promptly if you suspect a problem with your account.
10. Contact
For any privacy question, or to exercise a right that is not automated in the app, contact us through your Settings page or by replying to any email you receive from My Acolyte.