Legal

Privacy Policy

Version: v3-2026-06-25 · Last updated: 2026-06-25

Who this is for: the parents, carers and Educators who create a Kvasi account, and the children who learn with Kvasi.

1. Who we are

Kvasi is a children's learning platform operated by Kvasi Ltd, a company registered in England and Wales (company number 17126186), with its registered office in London, United Kingdom.

Controller: Kvasi Ltd
Contact (including data-protection queries): contact@kvasi.app
ICO registration: ZC189882

We are the data controller for the personal data described here. UK GDPR and the Data Protection Act 2018 apply, and because Kvasi is designed for and likely to be accessed by children, we follow the ICO's Age Appropriate Design Code (the "Children's Code").

Our guiding principle: if we can avoid collecting data we don't strictly need, we don't.

2. The data we hold

About the adult account holder (parent/carer or Educator)

Email address - to sign in, verify the account, and contact you about the service.
Password - stored only as a scrambled, one-way "hash"; we never see or store your actual password.
Account type (parent or Educator) and, for Educators, optional school name and year groups taught.
Subscription status (trialing / active / paused / cancelled) for parent accounts.
Email-verification and last-login timestamps.

We do not ask for or store the account holder's name. We do not store your home/postal address. We do not store an IP address against your account or against consent records.

About the child

Display name - this can be a nickname or alias; it does not have to be a real name.
Learning data - what the child has practised and how they are progressing (see §4).

We do not collect the child's date of birth or age, gender, country, or home address.

Voice and audio

Kvasi reads words and sentences aloud using a synthetic, AI-generated narrator voice. We do not record, collect or process your child's voice: there is no microphone capture and no speech is sent to us. "Pronunciation progress" is inferred from in-game interactions, not from any recording of your child speaking. See §10 for how we mark AI-generated audio.

Payment data

Card/payment details are handled entirely by our payment provider, Stripe (Stripe Payments Europe, Ltd.), using Stripe-hosted checkout. Card numbers never touch Kvasi's systems. We hold only your subscription status and, optionally, a billing email, plus the Stripe customer and subscription identifiers needed to manage your subscription.

What we deliberately do NOT collect

No account-holder name, no home address, no IP address stored against identity or consent, no child's date of birth, age or gender, no card numbers, no behavioural tracking for advertising, and no third-party ad/analytics SDKs that profile children.

3. Why we process it, and our lawful basis

Purpose	Data	Lawful basis (UK GDPR)
Create and secure the account; sign-in; email verification	Adult email, password hash	Contract - Art 6(1)(b)
Run the learning game - give each child the right next lesson	Child display name and learning progress	Contract / provision of the service - Art 6(1)(b)
Take payment and manage the subscription	Subscription status, billing email	Contract - Art 6(1)(b)
Improve Kvasi and how we teach, using the child's pseudonymised play data	Pseudonymous learning data	Consent - Art 6(1)(a), opt-in, off by default
Send newsletters / product-update emails	Adult email	Consent - Art 6(1)(a), opt-in, off by default
Keep an audit trail of consents and data-rights requests; security	Account ID, consent/erasure records	Legal obligation / legitimate interests - Art 6(1)(c)/(f)

Note on the lawful basis for running the game. Processing a child's progress in order to deliver the adaptive lessons you signed up for is necessary to provide the service, so its lawful basis is contract, not consent - it cannot be declined while continuing to use the product. At registration we record an acknowledgement that we have explained this; we do not present it as "consent," because consent must be freely refusable and this is not. The two genuine consents - use of pseudonymised data to improve the product and marketing - are strictly opt-in and off by default, and either may be withdrawn at any time without losing access to the game. See the separate Children's Data Notice.

We do not use the child's data for advertising, profiling for commercial purposes, or any automated decision-making with legal/significant effects.

4. How the child's learning data is kept separate (pseudonymisation)

This is a core design choice, not a bolt-on:

All behavioural/learning data is stored under a pseudonymous identifier, in a separate part of the database that holds no link back to the child's identity.
A single small mapping record is the only connection between the child and their learning data.
Deleting that mapping permanently severs the link - the learning data remains but becomes unattributable to any person. This is exactly how we satisfy erasure (§7) while keeping anonymous aggregate value for improving the game.

5. Who we share data with

We do not sell personal data. We share only with the processors needed to run the service:

Payment provider - Stripe (Stripe Payments Europe, Ltd.). Stripe processes card payments and hosts the checkout and billing portal; card numbers never reach us.
Network / DNS / security - Cloudflare, which routes and protects traffic to the service.
Hosting / infrastructure - Cloudflare (Cloudflare, Inc.), whose Pages and Workers platform hosts the site and runs its serverless functions.
Email delivery - Resend (Resend, Inc.), which delivers verification and (if you opt in) newsletter emails.
Analytics - Cloudflare Web Analytics, a privacy-preserving, cookieless service that counts page views in aggregate. It sets no cookies, does no cross-site tracking, and never profiles children.

Each processor is bound by a data-processing agreement and may only act on our instructions. We do not use any third-party advertising or child-profiling SDKs.

Cookies and local storage. Kvasi sets no advertising or tracking cookies. We use only strictly-necessary browser storage - your language and light/dark preference, and, when you are signed in, a session token - so no cookie-consent banner is required.

Educators and classrooms. Only a parent/carer creates and owns a child's profile. Educators never create or own children's profiles. An Educator runs a classroom and invites parents to join; if a parent accepts, that parent chooses per child what (if anything) an Educator may see - typically progress and session statistics - and can change or withdraw this at any time. The child's profile and data stay owned by the parent's account. Educators may also run name-only group activities, where a child just enters a name to play: that is a temporary session, not an account, and no learning record is kept against a child's identity.

International transfers: we keep personal data in the UK/EEA wherever possible. Where a processor (e.g. Stripe or Resend) processes limited data outside the UK/EEA, the transfer is covered by an adequacy decision or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, with appropriate safeguards.

6. How long we keep it

Account + child profile: for the life of the account. On erasure (or after 6 months of account closure or continuous inactivity) the children's records are hard-deleted and the account is anonymised.
Pseudonymised learning data: retained for aggregate research value, but unattributable once the identity mapping is severed.
Consent and erasure audit records: kept as proof we honoured the law, in PII-free form, for 6 years (the UK statutory limitation period), then deleted.
Billing records: retained for 6 years to meet UK tax/accounting obligations (held by us and by Stripe).

We auto-pause inactive subscriptions rather than silently charging - see the Terms.

7. Your rights (and the child's)

You can exercise these for yourself and on behalf of your child:

Access / portability (Art 15 & 20) - from your account settings you can download everything we hold: the account and profiles, each child's progress, settings and learning stats, and your consent and deletion history. (We leave out the scrambled password and the raw activity logs - the latter are already summarised into the stats you get.)
Erasure (Art 17) - you can delete your account and your children's data. This permanently breaks the link between a child and their learning data, removes the children's records, and scrubs the personal details from the account; we keep only an anonymous note that the deletion happened, as proof.
Rectification (Art 16) - edit account and child details in-app at any time.
Withdraw consent - turn off product-improvement use and/or marketing at any time, without losing access to the game.
Object / restrict, and complain to the ICO (ico.org.uk) - though we'd welcome the chance to help first at contact@kvasi.app.

8. Children's Code commitments

Best interests of the child first - we design for wellbeing and learning, not for time-on-app.
Data minimisation by default - a display name that never has to be a real name, no date of birth, no gender, no IP, no ad tracking.
High-privacy defaults - optional uses are off until explicitly turned on.
No nudge techniques that push children to share more data or play longer.
No profiling of children for commercial purposes.
A child-friendly explanation lives in the Children's Data Notice.

Age assurance (who holds the account)

Kvasi accounts are held and managed by adults - a parent/carer or an Educator - not by children directly. We apply an age-assurance approach proportionate to the low-risk, data-minimised nature of the service (ICO Children's Code, Standard 3):

the account holder confirms at sign-up that they are 18 or over, and a parent/carer creating a child's profile confirms they are that child's parent/carer (or have their authority);
email verification provides an adult-presence signal;
where a subscription is taken, the payment card is a further adult signal.

9. Security

We protect personal data with:

Scrambled passwords - stored only as a one-way "hash", so we never see or hold your actual password.
Protected sign-in - access uses secure signed login tokens, and we limit repeated attempts at signing in, registering and resetting passwords to resist guessing and abuse.
Encryption in transit and at rest - all traffic uses HTTPS/TLS, and our database and backups are encrypted.
Identity kept apart from learning data (see §4), so no single store ever holds both who a child is and everything they have done.
Least-privilege access for the small number of people who operate the service.

No system is perfectly secure, but we keep these measures under review. If a personal-data breach is likely to result in a risk to people's rights, we will report it to the ICO within 72 hours and notify affected account holders without undue delay where the law requires.

10. AI-generated audio

Kvasi teaches reading partly through spoken audio. Some of that audio - including the narrator voice - is generated by an AI text-to-speech system, not recorded by a person for every line. In line with transparency expectations (including the EU AI Act's marking requirements for AI-generated audio), this AI-generated audio carries an inaudible, machine-readable watermark identifying it as synthetic. As noted in §2, we do not capture, record or clone your child's voice.

11. Changes to this policy

We version this policy (v3-2026-06-25). Material changes will be notified by email and/or in-app, and re-acknowledgement requested where required. The version you accepted is recorded in your consent history.

Last updated: 2026-06-25 · Contact: contact@kvasi.app