Privacy Policy

Who we are

Kanotion is operated by Norvande Ltd, a company based in the United Kingdom. For questions about this policy or your personal data, contact us at [email protected].

What we do

Kanotion helps people turn learning materials into a more structured study system. We process the information you provide so the service can create study plans, practice questions, flashcards, summaries, review schedules, progress insights, and related learning experiences.

What data we collect

We collect the information needed to create, secure, and manage your account, such as your contact details, profile details, account preferences, and sign-in credentials in protected form.

We process the learning materials and instructions you choose to provide, together with the study materials and outputs created for you through the service.

When you use the study assistant, your questions and its answers are saved to your account so conversations can continue across sessions and devices. You can clear a conversation at any time from the study's Q&A panel; cleared conversations are deleted, not archived.

We collect information about your learning activity so we can personalise your experience, track progress, support reminders, and improve the way Kanotion helps you study.

We collect information about how the service is used and performs so we can operate, protect, improve, and develop Kanotion.

We also process technical information that is commonly collected by online services, including information needed for security, reliability, diagnostics, and fraud prevention.

If you subscribe, we process billing information such as your plan, subscription status, billing dates, Stripe customer and subscription identifiers, and payment events. Your full card details are collected and handled by Stripe, not stored by Kanotion.

Why we use your data

Under UK data protection law, we rely on the following bases:

• Contract, where processing is needed to create and manage your account, provide the service, process your content, generate learning materials, and support requested features.
• Legitimate interests, where processing is needed to protect the service, prevent abuse, understand and improve product performance, support users, develop new features, and maintain the long-term quality of Kanotion.
• Consent, where we ask for permission, such as optional marketing or certain optional communications. You can withdraw consent at any time where consent is the basis for processing.
• Legal obligation, where we must keep or use information to meet tax, accounting, consumer-protection, regulatory, or law-enforcement requirements.

Our legitimate interests are keeping the service secure and reliable, preventing fraud and abuse, understanding whether core features work, supporting users, and improving the service in a proportionate way. We balance those interests against your rights and expectations.

Information needed to provide the service

An email address and account credentials are needed to create and protect an account. Learning material or instructions are needed when you ask us to create a study from them. Billing information is needed if you choose a paid plan. You do not have to provide optional profile, preference, feedback, or marketing information, but some features may not work without the information they need.

How we use your content

We use the content you provide to deliver, secure, and maintain your learning experience, including extracting study structure, identifying concepts, answering questions, creating practice materials, and tailoring review recommendations.

We do not sell your content or use private learning content for advertising. We do not use private learning content to train a general-purpose AI model unless we first clearly disclose that use and obtain any permission required by law. Where we use AI or infrastructure providers, they process data on our behalf to provide the service.

AI and automated processing

Kanotion uses automated systems, including AI services, to generate learning materials and personalise study workflows. These systems support learning and productivity. They do not make legal, financial, medical, employment, or similarly significant decisions about you.

Third party services

We use service providers including:

• Google, when you provide a YouTube source, to access the video and available transcript or related source information;
• OpenAI, to process relevant instructions and learning content for AI-assisted study features and embeddings;
• Cloudflare, for network security, delivery, and storage of uploaded files;
• Stripe, for checkout, subscription management, payments, fraud prevention, and billing records;
• Resend, for account, service, reminder, waitlist, and permitted marketing emails;
• Sentry, for error monitoring, diagnostics, and service reliability; and
• PostHog, for product analytics, session replay, and error monitoring, so we can understand how the app is used and fix problems.

These providers receive only the information reasonably needed for their role and process it under applicable contractual, confidentiality, security, and data-protection obligations. A provider may also act as an independent controller for limited purposes required by law or described in its own notice, such as Stripe's payment-compliance and fraud-prevention activities.

International transfers

Some providers may process data outside the United Kingdom. Where this happens, we use appropriate safeguards or rely on lawful transfer mechanisms recognised under UK data protection law, such as an adequacy regulation or approved contractual safeguards. You can contact us for more information about safeguards relevant to your information.

Emails and communications

We may send service emails such as verification messages, password resets, security notices, account updates, reminders, and learning digests. We may also send product or marketing emails where you have joined a waitlist, opted in, or where the law allows. You can unsubscribe from marketing emails at any time.

Cookies and local storage

We use strictly necessary cookies and similar browser storage to keep you signed in, protect the service, remember basic preferences, and provide requested features. These always run. We also use product analytics and session replay, provided by PostHog, to understand how the app is used and to diagnose problems. Inputs such as text fields are masked in session recordings. This only runs if you choose Accept in the cookie banner. Choosing Necessary only keeps it off. We do not use advertising cookies and do not sell your data. If we add further tracking technologies in the future, we will update this notice.

Data retention

Account information, learning content, and progress are normally kept while your account remains open. Product-usage events are normally removed after 180 days. Security, support, email, and diagnostic records are kept only for periods proportionate to their purpose. Billing and transaction records may be kept for longer where tax, accounting, fraud-prevention, or legal rules require it.

If you delete your account, we delete the account and associated learner content from active systems, subject to a deletion request completing successfully. Limited records may remain where the law requires them, where needed to establish or defend legal claims, or temporarily in protected backups until they are overwritten in the ordinary backup cycle. We determine periods by the sensitivity of the information, operational and security need, limitation periods, and applicable legal requirements.

Your rights

Under UK data protection law, you may have the right to:

• access personal data we hold about you;
• correct inaccurate or incomplete personal data;
• delete personal data in certain circumstances;
• export certain data in a portable format; and
• object to or restrict certain processing, including processing based on legitimate interests.
• withdraw consent at any time where we rely on consent; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where that right applies.

Contact us if you have questions about your data or want to exercise a right. We may need to verify your identity and normally respond within one month, subject to lawful extensions or exceptions.

You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concern first.

Security

We use reasonable technical and organisational measures to protect personal data, including secure connections, protected account credentials, access controls, monitoring, and security-focused development practices. No online service can be guaranteed to be completely secure.

Young people

Kanotion is available to users aged 13 and over. If you are under 18, you should use the service only with the permission of a parent or guardian.

We do not knowingly collect personal data from anyone under 13. If you believe someone under 13 has created an account, contact us at [email protected] and we will take appropriate action.

We provide the same learning experience regardless of age. Protective data practices and high-privacy defaults apply across the service, including private studies by default, data minimisation, and no sale of personal data. Learning recommendations are intended to support your choices, not make decisions about education, employment, or qualifications for you. A parent or guardian may contact us with a privacy concern relating to a young person.

Changes to this policy

We may update this policy as Kanotion develops. If changes are significant, we will take reasonable steps to notify you, such as by email or an in-product notice.

Contact

For questions about this privacy policy or to exercise data rights, email [email protected].