Last updated 8 September 2026. This notice describes how Kiplrn handles personal data. It is written to match what the product actually does today, which is deliberately very little. If we change how the product works, we will change this notice before the change ships, not after.
Who we are
Kiplrn is operated by MindCore AI, based in Malta. For the purposes of the UK and EU General Data Protection Regulation, MindCore AI is the data controller.
Contact for any privacy question or request: support@kiplrn.com.
The important thing first
We do not have user accounts and we do not keep a database of children. Your child’s profile — first name, age, avatar, language, parent PIN, and their progress — is stored in your own browser on your own device. We never receive a copy.
This means most of what a privacy notice usually describes does not apply to us. There is no account to close, no stored profile to export, and nothing to delete on our side, because there was never anything there.
What data is involved, and where it goes
1. Data stored on your device
The app writes to your browser’s local storage: your child’s first name, age, avatar choice, teaching language, the parent PIN, daily time settings, and a record of sessions, XP and streaks. This stays on the device. Clearing your browser data deletes it permanently and irreversibly.
2. Data sent to AI providers to generate a reply
When your child sends a message, we transmit to an AI provider: their first name, age, chosen language, the subject and topic, and the messages in that conversation. Nothing else. We do not ask for and therefore cannot send a surname, address, school, email address, telephone number or photograph.
Our providers are Anthropic PBC (Claude models) and Google LLC (Gemini models). Both are located in the United States, so this involves a transfer of personal data outside the EEA. Each processes the data under its own published API terms and retains it for its own limited periods; we do not permit either to use it to train models under those terms.
3. Operational logs
Our hosting provider, Vercel Inc., records standard server logs for requests to our API: timestamp, IP address, and any technical error. Conversation content is not written to these logs. Vercel retains them for a limited period under its own policy.
4. This website
kiplrn.com uses Google Analytics to count visits and understand which pages are useful. This is the marketing site only — it is separate from the app and involves no child data. The app carries no analytics, advertising or third-party tracking.
Why we are allowed to process it (legal basis)
- Providing the tutoring service — performance of a contract with the parent or guardian who set up the profile, and our legitimate interest in operating the service they asked for.
- Keeping the service running and secure — legitimate interest (server logs, error diagnostics).
- Website analytics — consent, given through the cookie banner on kiplrn.com. You can decline and the site works normally.
Children
Kiplrn is designed for children aged 4 to 15 and is intended to be set up and supervised by a parent or guardian. A child should not create a profile on their own. By setting one up, you confirm you are the parent or guardian of that child and consent to the processing described here.
We minimise children’s data by design: we ask for a first name because a tutor that uses a child’s name teaches better, and an age because the tutor must pitch its language correctly. We ask for nothing else, and the tutor is instructed never to request identifying details and never to repeat them back if a child volunteers them.
How long we keep things
| Your child’s profile and progress | On your device, until you clear it. We hold no copy. |
| Conversation content | Not retained by us at all. Held briefly by the AI provider under its own terms. |
| Server logs | Retained by our host for a limited period, then discarded. |
| Website analytics | Per Google Analytics retention settings, currently 14 months. |
Your rights
Under the GDPR you have the right to access, correct, erase, restrict and object to the processing of personal data, and the right to data portability. Because we hold no personal data about your child on a server, there is normally nothing for us to produce or erase — those controls sit in your own browser, and clearing your site data exercises them completely.
If you believe we hold something about your child, write to support@kiplrn.com and we will investigate and respond within one month.
You also have the right to complain to a supervisory authority. In Malta that is the Office of the Information and Data Protection Commissioner (IDPC).
What we do not do
- We do not sell personal data, and we never will.
- We show no advertising in the app and run no advertising trackers in it.
- We do not build advertising profiles of children.
- We do not make automated decisions producing legal or similarly significant effects. Adjusting a lesson’s difficulty is not such a decision.
Changes to this notice
Accounts and a database are on our roadmap so that progress survives a new device. That is a substantial change to everything above, and we will publish the revised notice — describing exactly what will be stored, why, and for how long — before that feature ships.
This notice describes our actual practices accurately to the best of our knowledge. It has not yet been reviewed by a lawyer. If you spot something that looks wrong or unclear, please tell us at support@kiplrn.com.