Privacy Policy

This policy explains what KindiX can collect, why, and how long it is kept. It describes what the product does today, feature by feature; several features are off unless an institution turns them on and you agree. Template only — counsel review is pending before public launch.

What we collect

What any account carries, whatever is switched on:

• Your account. Your name, email address, role and a hashed password, and the month and year you were born and the country you live in — never the day. They decide which protections for young people apply.
• Your learning. Courses you join, lesson progress, attempts and answers, what you have shown you understand, and your conversations with the tutor (older parts of a long conversation are also kept as a summary).
• Assessment conditions. Where a course's assessment uses integrity settings: its timing, and whether you left the page. An unusual signal can lead to a short follow-up conversation and never fails you on its own; only a missed deadline or text copied from a source can.
• Family links. If a parent links to your account: the link, and the protections and consents they set.
• Records of actions. An append-only log of important actions (a grade overridden, a role changed, a consent given). For some actions it includes the IP address and browser of the person who acted, and an invitation keeps the email address it was sent to. Nothing can change an entry; each one is deleted seven years after it was written, the longest period record-keeping duties such as anti-money-laundering rules commonly require.
• Messages to us. What you send through the Contact page, with the name and email address you give. They are deleted a year after you send them.
• Security. Your IP address is used briefly to limit repeated sign-in and sign-up attempts, and is not stored on your account. When you choose a password, the first five characters of its hash are checked against a public list of breached passwords; the password itself never leaves us.
• Product analytics and error reports. Only where this install has turned them on: how pages are used (including session recordings, with everything typed masked) and technical error reports.

We do not sell personal information.

Voice

Voice features are optional. What happens to the sound depends on the feature:

• Dictation (speaking instead of typing, for learners and teachers). The recording is sent to the speech-to-text provider, turned into text and dropped. Nothing is kept unless you send or save the text.
• Voice mode (talking with the tutor). Your audio is transcribed as you speak and is not stored. The transcript is kept as part of your tutor conversation, with when the session ran and how long it lasted.
• The course assistant (for teachers building a course). No audio is stored. Transcripts are kept for up to 90 days — less if the organisation chooses — and then deleted automatically. Changes it proposes that nobody acts on expire after 14 days.
• Spoken answers (questions that ask you to explain out loud). The recording is stored with your attempt and transcribed so it can be graded. Your course's staff can play it back; nobody else can. It is deleted 180 days after you record it; the transcript and the grade stay with your attempt.
• Follow-up conversations about an answer, typed or spoken. Spoken replies are transcribed and the audio is not stored; the text is kept with the assessment.

Features that read your face or typing

Two features process biometric data. Each is off on every install until its operator has acknowledged a data-protection agreement covering it; even then it is off until an institution turns it on for its own courses, and it runs only after you agree. For an account marked under 18, typing rhythm is refused, and camera stills run only after a linked parent agrees. None of them is available on a personal account.

• Camera stills during an assessment: still images, about one every 20 seconds, never video. Only the course's staff can open one, and every time a reviewer does, who and why is recorded. Each one is deleted 30 days after it is taken, every stored copy of it. You can withdraw consent at any time.
• Typing rhythm, to recognise how you type. We keep four summary numbers about how long keys are held and the gaps between them — never which keys you pressed. They are wiped a year after you agree, or as soon as you withdraw. It is refused for an account marked under 18, and one already kept is wiped when the account is marked. It can only ask for a short follow-up conversation; it never fails you on its own.
• No voiceprint. KindiX does not record or keep a voiceprint, and nothing checks who is speaking. Voice identity is not offered until a speaker check has been measured to work on real voices; any voiceprint kept before 10 October 2026 has been deleted.

The usage meter

Every AI request is metered so an organisation can see and cap its costs: which account, course and organisation it was for, the feature, the model and how much it used — not what was said. The one exception is web search, where the search words are kept with email addresses and phone numbers removed. Search results are cached for up to a day under a fingerprint of the search words, never the words themselves. Usage records are deleted after 13 months. Billing counts (seats, units) are kept per organisation and name no one.

Sign-ins

Each sign-in, wrong password, password reset and sign-out from every device is recorded with its time, the kind of device (for example “Chrome on Windows”) and the network it came from, shortened so that it does not point to one address. You see your own on the Account page. An organisation you belong to sees only when you last signed in and how many wrong passwords there were in the past week. These records are deleted after 400 days.

AI and other providers

The tutor, grading, dictation and voice features send the text or audio they work on to an AI provider. Which one depends on how this install is set up: a hosted provider (for example Google Gemini or OpenAI) or models the operator runs on its own servers. Materials teachers upload are indexed and stored with us so the tutor can cite them. Where web search is on, search words go to the search provider this install uses (Google Search through Gemini, Brave, or a search engine the operator runs itself); it is off for a child unless a parent allows it. Where this install sells plans, payment is handled by Stripe: you enter your card on Stripe's own page, and we keep only a reference to your Stripe customer and subscription, never your card details.

How long we keep it

Your data is kept while your account is active, apart from the shorter periods above. Recordings, camera stills and pictures are stored privately and shown only to the people allowed to see them; a link to one expires within minutes. Read-aloud audio and pictures the tutor draws are deleted after 7 days. When you delete your account, your account and the records tied to it are deleted, and so are the files stored for you: spoken answers, camera stills, the pictures the tutor drew for you and, for a teacher, the files you uploaded, except those a course that outlives you still uses, which are deleted when that course is. A teacher's own course that nobody else studies is deleted with the account, with its lessons and materials. A course other learners study is archived instead, so they keep their progress and certificates: it keeps its lessons and materials, names its author only as a former teacher, takes nobody new, and is deleted with its files once no learner has used it for 730 days. Its learners are told. A certificate is its learner's and stays even when the course, or the organisation that issued it, is deleted: it still verifies, and only the learner deleting their own account removes it. A course an organisation owns stays with the organisation. If our file storage is unavailable at that moment, the account is deleted all the same and the remaining files are removed automatically once storage is back. Usage and voice-session records are kept with your name removed, and the log of actions keeps an account number that no longer leads to anyone until the entry is deleted seven years after it was written, because an organisation's costs and audit trail depend on them. A check you overrode on a course you do not own keeps the name you gave with it. When a file is deleted, our file storage keeps its previous copy for about a day; backups are kept for up to about 120 days, so a deleted record can remain in a backup for a time. When a member of staff opens a learner's record or work, or downloads a course's results, we note who and when; the learner, a linked parent and the organisation's admins can see these notes, which are deleted after two years.

Your rights

On the Account page you can download your data (your account, courses, progress, attempts and answers, what you have shown, certificates, tutor conversations and what the tutor remembers about you, messages, consents and family links, with recordings listed rather than included, and never your password or any other credential), correct your name, and delete your account. For anything the download does not include, or any other request about your data, contact us.

Children

Sign-up asks for a month and year of birth and a country. Under the age of digital consent where the person lives (13 to 16 in the EU and EEA depending on the country, 13 in the UK and the US, 16 anywhere else or when no country is given), an account someone opens for themselves cannot be used until a parent agrees through a link we email them; the parent is told in plain words what is processed. If the parent says no, or nobody answers within 7 days, the account and everything in it is deleted. A school or university that creates or invites a child's account relies on its own consent from the child's parents. Everyone under 18 is treated as a minor: camera stills and voice mode need a parent's consent, a typing profile is refused (any already kept is wiped), web search is off unless a parent allows it, image generation is off, and a certificate goes on a public page only if a linked parent allows certificate sharing and the child then chooses to share it. No voiceprint is taken from anyone, child or adult. A child under the age of digital consent whose account rests on a parent's agreement cannot remove that parent themselves; the parent can, and doing so withdraws the consent: the account is paused at once and deleted after 7 days unless another parent agrees. These protections end by themselves at 18. An account from before we asked is asked once, at its next sign-in; until then a linked parent can mark it as under 18.

Contact

Questions about privacy? Write to us through the Contact page.