Privacy policy

1. Who we are

Kito and Kito Parent are operated by KobasLabs LLC, a Delaware limited liability company in the United States. The parent experience manages the family account, purchases, uploads, review and reports. The child experience opens only on a device authorised by the parent.

Privacy and parental requests: privacy@kito.education, +1 617 602 8027, or KobasLabs LLC, 2093 Philadelphia Pike, Claymont, Delaware 19703, United States.

2. Information we collect

Parent account information

We collect an email address, authentication records, subscription status, privacy choices and customer-support correspondence.

Child profile information

A parent may add a child's first name or nickname, birth year, selected learning buddy and progress. A child does not need an email address and cannot create an account independently.

Uploaded school material

Parents may upload PDFs and images. We process the files to extract text, create grounded questions and provide source references for review. Parents should remove names, addresses, health information and other details that are not needed for learning.

Teacher pilot information

A verified adult teacher may provide their name, school or organisation, rights attestation and private learning material. Teachers must not upload student records. Material is processed once into a reviewed private question bank and may be assigned to a term-bounded class. The parent authorises that class for one child and can preview games, pause future delivery or disconnect it at any time. A teacher cannot see accepting families, child identities or individual histories. Anonymous Class Pulse totals are optional and remain hidden until at least five learners participate.

Learning and technical data

We record answers, first-attempt results, corrections, concepts to revisit, mastered concepts, streaks and rewards. We also process device authorisation, security, diagnostics and usage records needed to operate and protect the service. A push token is collected only after parent opt-in and device permission.

3. Why we use information

• Provide, secure and personalise Kito for the family.
• Transform parent-provided material into questions and practice rounds.
• Prepare rights-attested private Teacher packs and deliver them under a bounded parent class authorisation.
• Show learning progress to the authorised parent.
• Manage subscriptions, page allowances, support and fraud prevention.
• Meet legal, safety and record-keeping obligations.

4. Children's privacy and parental control

The adult creates the family account, provides any child information, authorises processing and pairs the child device. We do not knowingly allow a child to register independently. See our Child privacy notice and direct notice to parents.

5. Service providers

We use specialised providers to host data, process documents, generate questions, deliver app services and manage purchases. They may process only the data required for their role under contractual and security safeguards. Current providers and purposes are listed on the Subprocessors page.

6. Retention

• Original uploaded files: deleted after 30 days, or earlier when the parent deletes the material.
• Teacher pilot source files: deleted after 30 days; intermediate extracted text is deleted within 7 days after generation.
• Intermediate extracted text and processing maps: deleted within 7 days after generation completes.
• Approved questions, source excerpts and learning history: kept while the family account is active so Kito can provide practice and progress, then deleted with the account.
• Operational analytics: first-party events are kept for no more than 13 months.
• Security logs: normally kept for up to 90 days unless an incident requires longer investigation.
• Consent, deletion and transaction evidence: limited records may be kept after deletion where necessary to prove compliance, resolve disputes or satisfy tax and accounting law. They do not include uploaded school material.

Deletion from protected backups follows the provider's backup lifecycle. We do not restore deleted data into active use except during disaster recovery.

7. Security

We use encrypted connections, row-level access rules, separate parent and child-device roles, expiring one-use pairing codes and restricted service credentials. Parents can revoke a child device. No system can guarantee absolute security.

The Teacher workspace is a separate identity and data scope. Private invitation links and backup codes are stored only as hashes, expire, can be revoked and have a family cap. QR is used only for parent-controlled child-device pairing. A copyright report that identifies a pack freezes its distribution pending review.

8. Your choices and rights

Depending on location, you may have rights to access, correct, export, restrict, object to processing, withdraw consent or delete personal data. A parent may review or delete a child's information, inspect teacher-assigned games, pause or revoke a teacher class connection, and disable anonymous Class Pulse sharing at any time. Kito Parent includes a readable family report, a raw data export and account-deletion controls. See our account deletion page.

9. International processing

Our providers may process data in the United States and other countries. Where required, we rely on data processing agreements, Standard Contractual Clauses or other recognised safeguards.

10. Advertising, sale and tracking

Kito has no advertising, cross-app tracking or child advertising profiles. We do not sell personal information. The website currently uses only technology required to serve and protect it. See Cookies & tracking.

11. Changes and contact

We will notify the parent before a material change that requires a new choice or consent. Contact privacy@kito.education with privacy questions or requests.