Privacy Policy

This Policy applies to kennara.ai, app.kennara.ai, the Kennara test-preparation application, school and family features, support, emails, and other services that link to it (the “Service”). “Kennara,” “we,” and “our” mean Yetsye International LLC, doing business as Kennara, the U.S.-based operator of the Service. A linked or integrated third party is governed by its own policy.

Privacy contact: [email protected]. Mailing address: Yetsye International LLC d/b/a Kennara, 470 Dacula Rd #713, Dacula, GA 30019, United States.

• Student accounts are for people age 13 or older; Kennara currently bars anyone under 13.
• We collect birth month and year and derive a conservative date only to apply the age gate.
• Ordinary Nara tutor chats are not written to Kennara's application database. A redacted excerpt is stored only if a student flags a response for review.
• Linked parents and authorized teachers see bounded progress and effort—not raw answers, tutor chat, private notes, or emotional inferences.
• You may request access, correction, export, or deletion.

The information depends on your role and features used:

• Account and identity: email, a username for an email-less teen account, role, authentication identifier, account status, birth month and year, derived age classification, and legal acceptances.
• Family and school relationships: parent email, consent and link status, teacher or organization membership, class codes, invitations, seat assignments, and school or district details.
• Learning activity: exams, diagnostic and practice answers, response text, scores, mastery estimates, misconceptions, plans, goals, test dates, schedules, progress, bookmarks, notes, flashcard reviews, rewards, and media feedback.
• Content you submit: essays, explanations, tutor prompts, feedback reports, support messages, and onboarding answers. If separately enabled and authorized, speaking features retain a transcript and feedback, not raw audio.
• Billing: payer email, plan and interval, subscription and trial status, renewal dates, Stripe references, invoices, taxes, and billing contact/address. Stripe—not Kennara—receives the full card or bank-account number.
• Communications: delivery status, reminder settings, time zone, marketing consent, newsletter confirmation, unsubscribe records, and support history.
• Device, usage, and security: IP address in server/security logs, browser/device details, timestamps, feature events, pseudonymous analytics, session data, fraud signals, and scrubbed error/performance telemetry.
• Adult school inquiries: name, role, organization, work email, state, phone, estimated students, interests, and message.

We do not ask for government identifiers, precise geolocation, health records, or a student photo for core use. Avatars are fixed characters. Do not place unnecessary sensitive information in free-text fields.

We receive information directly from you; from an authorized parent, teacher, school, or district; automatically from use of the Service; and from providers such as Google or Apple sign-in, Stripe, and our email provider.

We use it to provide and personalize learning; authenticate and secure accounts; apply age, permission, entitlement, and usage rules; process payments and school purchases; communicate about the Service; support users; prevent fraud and abuse; measure reliability and educational effectiveness; improve content and features using aggregated or de-identified data where practical; comply with law; and carry out a purpose disclosed when collected. Adult marketing requires opt-in.

Where a legal basis is required, we rely as appropriate on contract, requested pre-contract steps, legitimate interests in operating and securing an educational service, consent, and legal obligations.

Kennara uses automated systems for tutoring, explanations, plan review, formative writing feedback, insights, and content-quality work. A student-facing request may include submitted text plus relevant question, lesson, exam, and limited learning context. Kennara redacts common personal-information patterns first, but no filter is perfect.

Current student-facing AI is processed through Anthropic's commercial API. Kennara does not persist ordinary Nara chat text; it retains usage metadata and, only when a student selects “this seems wrong,” the redacted message and AI response for review. Anthropic generally retains commercial API inputs/outputs for up to 30 days unless a different contract setting, safety exception, or law applies.

OpenAI may support limited educational-content generation or independent review designed to use authored material rather than student account data. AI output can be wrong and is not used to make admissions, employment, credit, health, or other legally significant decisions about a student.

We do not sell personal information or disclose it for cross-context behavioral advertising. We disclose it only as follows:

• Providers: Supabase (database/authentication), Cloudflare (network/object storage), Stripe (payments/billing/fraud), Anthropic (student-facing AI), OpenAI (limited content operations), Emailit (email), PostHog (server-side pseudonymous analytics), and Sentry (scrubbed error monitoring).
• Chosen third parties: Google or Apple sign-in and privacy-enhanced YouTube media, under their own policies.
• Authorized people: a linked parent or the teacher/school whose class a student joins, limited by role.
• Professional, legal, and safety recipients: advisers, auditors, insurers, banks, authorities, or others when necessary for contracts, law, valid process, fraud/security, safety, or legal claims.
• Business changes: a financing, merger, acquisition, reorganization, bankruptcy, or asset sale, subject to confidentiality and continued notice obligations.
• At your direction, or in aggregated/de-identified form that cannot reasonably identify you.

Schools may buy seats, invite staff, create classes, issue join codes, and authorize progress access. The school is responsible for authority, notices, permissions, and appropriate account roles. When a written school agreement and the FERPA school-official criteria apply, Kennara processes education-record information under the school's direct control and only for the authorized educational purpose. We do not use school-provided student data for targeted ads, unrelated commercial profiles, or unauthorized redisclosure.

A school-specific agreement controls if it provides stronger terms. Parents, eligible students, and school users should usually direct education-record requests to the school; Kennara will assist it. Standard teacher reporting excludes raw tutor chat, private notes, raw answers, and emotional inferences.

Kennara is for learners age 13 or older. Anyone under 13 may not create or use an account, including with a class code; Kennara currently offers no under-13 parent-profile or school-consent path. Users 13–17 must have parent or guardian permission. A verified parent link is separate and required before parent reporting or parent-funded coverage.

Teens receive the no-sale, no-targeted-advertising, minimization, access, correction, export, and deletion protections in this Policy. Marketing is limited to consenting adults. If you believe we collected data directly from a child under 13, stop use and email [email protected]. See the Children's Privacy Notice.

First-party cookies support authentication, security, checkout continuity, age/onboarding routing, and preferences. Browser local storage remembers dismissal of the cookie notice. These are not used for advertising profiles.

PostHog receives server-side events with an HMAC-pseudonymized identifier and controlled properties—not email, name, birth date, or free text. Sentry receives scrubbed error telemetry after Kennara removes user objects, cookies, headers, query strings, request bodies, and detected email addresses. Privacy-enhanced YouTube may store information after you play it.

Because we do not use cross-site advertising, Do Not Track does not change the Service. We treat recognized Global Privacy Control as an opt-out of sale/sharing, although we do neither. See the Cookie & Tracking Notice.

• Account and learning records remain while needed for an active account. Inactive student accounts are anonymized after 24 months without learning activity: login details and direct identifiers are removed while de-identified measurements may remain.
• Under-13 accounts are deleted when detected. Unused parent-consent requests expire after 72 hours and are purged; used consent evidence may remain.
• Ordinary tutor chat is not stored by Kennara. Flagged excerpts remain with review records. Anthropic's temporary retention is described above.
• Optional speaking audio is deleted immediately after transcription/grading; the transcript and feedback remain with the learning record.
• Billing, tax, school-purchase, audit, security, suppression, and legal records remain as reasonably required for accounting, fraud prevention, contracts, law, or disputes.

A verified deletion request removes the account and user-keyed data from active systems unless retention is required or permitted. Disaster-recovery copies age out under their backup cycle. De-identified data may remain for research, security, and improvement.

Safeguards include encrypted transport, role- and row-scoped access, restricted credentials, authentication controls, audit/security logging, minimization, vendor review, monitoring, and tested export/deletion paths. Staff access is limited and logged. No system is perfectly secure; protect credentials and report suspected access to [email protected]. We provide breach notice when law requires it.

Depending on location, you may have rights to know/access, correct, export, delete, restrict or object, withdraw consent, opt out of sale/sharing/targeted advertising or certain profiling, and appeal a denial. We do not discriminate for exercising a right and extend access, correction, export, and deletion channels to all users when practical.

Use account, notification, and billing settings where available; unsubscribe from adult marketing; or email [email protected] / use Support. Include account email, role, request, and jurisdiction—never a password or card number. We may verify identity and an agent, parent, or school's authority. If denied, we explain available appeal rights. You may complain to your privacy regulator.

Categories collected in the prior 12 months are identifiers/account data; customer and transaction records; age classification; commercial/subscription data; internet/device/security activity; education and learning information; submitted content; and inferences such as mastery/readiness. Account credentials and voluntarily submitted content may be sensitive information. Sources, purposes, and recipients are above. We do not use sensitive information to infer characteristics for ads.

In the prior 12 months, Kennara has not sold personal information or shared it for cross-context behavioral advertising, including for users known to be under 16. We therefore do not show a “Do Not Sell or Share” link. If that changes, we will provide notice and required controls first. We also do not disclose personal information for third parties' own direct marketing.

Kennara operates from the United States, and providers may process information in the United States or other countries with different laws. We use recognized transfer safeguards where required. For EEA, UK, and Swiss users, Kennara is generally controller for direct accounts and processor for school-directed data. In addition to the rights above, you may object/restrict and complain to a supervisory authority.

The version/effective date identify this Policy. For a material change, we provide notice appropriate to the change and request renewed consent when required. We will not apply a materially different use to previously collected school student data without school authorization or another lawful basis.

Privacy: [email protected]
General/billing: [email protected]
Mail: Yetsye International LLC d/b/a Kennara, 470 Dacula Rd #713, Dacula, GA 30019, United States