Privacy Policy

1. Controller

The controller responsible for data processing at Kavelu is:

Milad Heidari / Kavelu
c/o IP-Management #10534
Ludwig-Erhard-Strasse 18
20459 Hamburg
Germany

Email: support@kavelu.de

2. General Information

Kavelu is a learning app for primary school children. Parents or legal guardians create the account and set up child profiles. Children should not enter full names, addresses, or other sensitive information in Kavelu. Kavelu does not use ads in the child app, does not sell learning currencies, and does not build advertising profiles for children.

3. Data We Process

• Parent account: email address, authentication data, technical account IDs, consent timestamps, parent PIN hash, support information, and security information. If you sign in with Google or Apple, we also receive the account identifier and email address from that provider; with Google, Supabase Auth also stores the name and profile picture link that Google sends.
• Child profiles: nickname or display name, grade, avatar and skin settings, learning preferences, XP, Gold, streaks, and achievements.
• Learning data: completed tasks, answers, correct/incorrect signals, time spent, error types, learning level, topic progress, recommendations, review logic, screen-time settings, and tests entered by parents.
• Pre-account check: before registration, Kavelu processes the selected grade and subject plus the answers needed to evaluate a short check. No child profile is created on the server at this stage. The result is stored only locally (iOS: the device keychain, web: this browser's storage) and is deleted as expired after 30 days. On iOS the entry can survive reinstalling the app. Only when a parent signs in or creates an account is the result linked to a child profile and then removed locally.
• Sign-up source: if the registration link contains campaign parameters (for example utm_source or a school or partner code), we store them with the account.
• Technical data: IP address, request timestamp, browser and device information, visited pages, server logs, security signals, and rate-limit signals.
• Usage statistics: page views and individual product steps, see Section 7.
• Support and admin data: support requests, bug reports and the notes needed to handle them.
• Payment and subscription data: Stripe processes website payments. Apple processes purchases made in the iOS app. For App Store subscriptions, Kavelu receives and stores the product, transaction and original transaction identifiers, signed transaction and renewal information, subscription status, expiration or revocation dates, renewal status, environment, and an account token linked to the Kavelu account. Kavelu does not receive or store full card, bank, PayPal, or Apple payment details.

4. Purposes and Legal Bases

• Account, login, learning progress, child profiles, parent features including the AI functions in the parent area, subscription management, and support: performance of a contract or pre-contractual steps, Art. 6(1)(b) GDPR.
• Consents and optional notifications: consent, Art. 6(1)(a) GDPR.
• Security, abuse prevention, rate limits, error analysis, usage statistics, and product improvement: legitimate interests, Art. 6(1)(f) GDPR.
• Retention of tax or commercial-law relevant data: legal obligation, Art. 6(1)(c) GDPR.

5. Child and Family Protection

In the current product phase, Kavelu is intended for children in grades 1 to 4 and is set up by parents or legal guardians. Parents are responsible for ensuring that children use Kavelu only with their permission. We ask parents to use nicknames only and not to enter sensitive child data in free text fields or support requests.

6. AI Functions

The learning area for children does not use AI: children's answers and everything a child enters while learning are checked by Kavelu itself and are not sent to an AI provider. Explanations after a mistake are prepared in advance. Kavelu uses Anthropic only for these functions for parents, and not on the Free plan:

• the tip in the weekly report (grade, topics, error types and numbers; „the child“ is sent instead of the name, no individual answers),
• matching topics to a test entered by a parent,
• the worksheet-photo helper (Family), see Section 8.

Children's names, email addresses, and account IDs are not sent to Anthropic. AI outputs can be incorrect and do not replace a teacher, school, or individual educational advice.

7. Cookies, Local Storage, and Statistics

Kavelu uses technically necessary cookies and local storage for login, security, language settings, and app functionality. These are required for operation (Section 25(2) TDDDG) and do not require consent. Kavelu does not set advertising or marketing cookies and does not use the Meta Pixel or any other advertising tracker.

For usage statistics, we use two services that set no cookies and store nothing on your device:

• PostHog (PostHog Inc., EU cloud in Frankfurt): page views and individual steps such as registration, the first learning round, or starting a subscription, always without URL parameters. After login, a parent is linked by the random account ID, never by email or name. Events from the learning area contain at most random IDs, grade, subject, and result numbers (for example correct or not), never names or answer texts. Automatic click capture and session recordings are switched off. For technical reasons, PostHog receives the IP address.
• Vercel Web Analytics (Vercel Inc.): counts page views without cookies, only on the website.

Statistics run on the website and in the Android app, not in the iOS app. Legal basis: our legitimate interest in understanding and improving Kavelu (Art. 6(1)(f) GDPR). You can object at any time, for example by email.

Own product statistics (no third party): To see where families get stuck, Kavelu additionally records a few product steps on its own servers, on the website and in the iOS and Android apps: steps of the get-to-know check before an account exists (linked only to a random installation ID that the app keeps on the device; on the website a random ID that exists only in the open tab), on which explanation slide a child leaves an explanation, whether a parent saw the subscription offer, whether a learning round runs on the website, iOS or Android, and anonymous daily counts of flyer QR scans. These records contain at most random IDs (account, child profile, round), a topic ID and slide numbers, never names, free text, answers, IP addresses or device fingerprints. They are evaluated only in aggregate and are deleted together with the account or child profile. Legal basis: legitimate interest (Art. 6(1)(f) GDPR); you can object at any time.

8. Service Providers and Recipients

Kavelu uses technical service providers that process personal data only for providing the product, security, communication, payments, or support.

• Supabase (Supabase Inc.; database in the EU, Frankfurt): database, authentication, file storage (including the pre-generated read-aloud audio), realtime features, account management, and sending sign-in emails (confirmation code, password reset).
• Vercel (Vercel Inc., USA): hosting, server functions in Frankfurt, worldwide CDN, technical logs, website delivery, and Vercel Web Analytics (Section 7).
• PostHog (PostHog Inc.; EU cloud in Frankfurt): usage statistics (Section 7).
• Anthropic (Anthropic PBC, USA): AI functions for parents (Section 6), never for children's answers. This includes the worksheet-photo helper („Foto-Helfer“): when a parent takes a photo of a worksheet, the image is sent to Anthropic for analysis and is not stored by Kavelu. Such photos may contain personal data (e.g. a child’s handwritten name); please avoid photographing names where possible. Processing takes place on US servers (Art. 44 GDPR) under a data processing agreement; Anthropic does not use API data to train models and applies limited trust-&-safety retention.
• Resend (Resend Inc., USA): sending reminder and service emails. This sending is currently switched off.
• Sentry (Functional Software Inc.): error reports from the website and the iOS app, with emails, IDs, IP addresses, URL parameters and form contents removed before sending. Error reporting is currently switched off.
• Upstash (Upstash Inc.): rate limiting and abuse prevention using request keys such as the IP address, where active.
• Stripe (Stripe Payments Europe Ltd., Ireland): payment processing, subscriptions, invoices, payment status, fraud prevention, and refunds for purchases made on the Kavelu website.
• Apple Distribution International Ltd. / Apple: optional “Sign in with Apple” in the iOS app (Apple account identifier and the verified email address or Apple relay address provided by you), plus App Store and StoreKit payment processing, subscription management, purchase verification, refunds, fraud prevention, and server notifications for purchases made in the iOS app. Apple processes this data under its own privacy terms.
• Google Ireland Ltd.: optional “Continue with Google” on the website. Google sends the account identifier, email address, name, and profile picture link. Google processes this data under its own privacy terms.
• Postal service provider: receiving and forwarding letters sent to our business address.

The read-aloud audio is generated in advance from task texts with ElevenLabs. No user data is sent to ElevenLabs.

Where service providers process data outside the EU or EEA, or use subprocessors outside the EU or EEA, this is, to our current knowledge, based on appropriate safeguards such as the EU-US Data Privacy Framework, Standard Contractual Clauses, data processing agreements, or adequacy decisions.

9. Social Media

If Kavelu operates official profiles on social networks such as Instagram, TikTok, YouTube, LinkedIn, Facebook, or X and you visit those profiles, the privacy notices of the respective platform also apply. We usually receive aggregated statistics there and process messages or comments where this is necessary to communicate with you.

10. Communication and Support

If you contact us by email, social media, or support features, we process your information to handle the request. We may send product and security information to account holders where this is necessary for operation, security, or contract performance. We send advertising or newsletters only where there is a legal basis.

11. Retention and Deletion

Account and learning data are stored while the account is active or while the data is needed to provide Kavelu. Parents can delete their account or individual child profiles in the parent area. Deleting the account also cancels a running website subscription and deletes the customer record at Stripe. After deletion, personal data is generally deleted or anonymized within reasonable timeframes unless statutory retention duties apply. Payment and booking data may be subject to statutory retention periods. Technical security logs are stored only as long as necessary for operation, security, and error analysis.

12. Data Security

We use technical and organizational measures to protect personal data against unauthorized access, loss, misuse, and alteration. These include access controls, encrypted transmission and regular security checks.

13. Data Subject Rights

Data subjects have rights under the GDPR, including access, rectification, deletion, restriction of processing, data portability, objection, and withdrawal of consent. There is also a right to lodge a complaint with a competent data protection supervisory authority. Parents can download all stored data at any time in the parent area under Subscription (“Export data”).

14. Privacy Contact

Privacy requests can be sent by email to: support@kavelu.de

Language

This English version is a translation of Kavelu's German privacy policy.