KIARI Legal
Privacy Notice
What personal data KIARI collects, why, who it is shared with, how long it is kept, and what rights you have over it.
Last updated: 22 September 2026
1. Who we are
KIARI is a voice-led AI Maths tutoring service for GCSE students. For the purposes of UK data protection law, the data controller is Bailey Turan trading as KIARI, a sole trader — there is no company registration number, as KIARI is not operated through an incorporated company. Contact baileyturan05@gmail.com, 07841612909.
Our registered or trading address is 345 Shenley Road, WD6 1TN. We are registered with the Information Commissioner's Office (ICO), registration reference C2039441.
Almost every KIARI account is opened by a parent or guardian on behalf of a child. Throughout this policy, "you" means the account holder, and "your child" means the student the account is for.
2. The data we collect
We have listed this at the level of the actual records we hold, rather than in broad categories, so you can see exactly what exists.
Account and contact data
| What | Why we hold it |
|---|---|
| Parent or guardian email address, and a securely hashed password | To create and secure the account, and to contact you about the service. |
| Payment records | To take payment for lessons and to handle refunds. Card details are handled entirely by Stripe and never reach our servers. |
Data about your child
| What | Why we hold it |
|---|---|
| The name or nickname you give your child in the app, their age, their year group, and their predicted grade | To pitch lessons at the right level from the first question. |
| Our own estimate of their working grade, and the topics they find easy or hard | To choose what to teach next and to show you progress. |
| A record of every question attempted, whether it was answered correctly, and how many hints were used | To track progress, avoid repeating questions, and show your progress dashboard. |
| The state of an in-progress lesson, including the conversation so far | So a lesson that is paused, interrupted or disconnected can be resumed where it left off rather than restarted. |
| Lesson recordings: the audio of your child speaking, the audio of the tutor speaking, and a record of what appeared on the lesson board | So you and your child can listen back to a lesson and see the working in sync. |
| Safety flags: if a lesson triggers a safety concern, we record the category of concern and a short snippet of the transcript that caused it | To tell you, and so there is a record of what happened. See section 5. |
| Lesson summaries: which topics and questions were covered, how your child did on each, how long the lesson ran, and any safety flags from it | So you get a written summary by email after each lesson, at the address on your account. |
Technical data
Standard server logs, which may include IP address, browser type and timestamps, generated automatically when the service is used. We use these to keep the service running, diagnose faults and detect abuse.
3. Why we are allowed to use it
UK GDPR requires a lawful basis for each use of personal data. Ours are:
| What we do | Lawful basis |
|---|---|
| Provide tutoring lessons, track progress, save and resume sessions, take payment | Performance of a contract with you. |
| Send you a summary of each lesson by email | Performance of a contract with you: a report on the lesson you bought is part of what you are buying. |
| Monitor lessons for safety concerns and tell you about them | Legitimate interests: protecting the welfare of a child using the service. Where a flag concerns a child's health, we also rely on the substantial public interest basis for safeguarding children under Article 9 and Schedule 1 of the Data Protection Act 2018. |
| Keep records of payments and tax | Legal obligation. |
| Diagnose faults, keep the service secure and improve teaching quality | Legitimate interests: running and improving the service. |
| Any non-essential cookies or marketing email, if we introduce them | Consent, which you can withdraw at any time. |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by the rights of the person concerned, which matters more than usual here because that person is often a child. You can object to any of this processing. See section 8.
4. Children's data
KIARI is built for children, most of them of secondary school age, and the app accepts an age as low as 4. We treat that as the central fact of this policy rather than a footnote.
- The account, the contract and the payment relationship are all with an adult. A child does not open an account, agree to terms, or enter card details.
- We do not use a child's data to build advertising profiles, we do not sell it, and we do not share it with anyone for their own marketing.
- We do not use techniques designed to keep a child using the service longer than they intended. Lessons are time-boxed.
- We aim to follow the ICO's Age Appropriate Design Code, which sets out fifteen standards for online services likely to be accessed by children, including data minimisation, high-privacy defaults and age-appropriate explanations.
5. Safety monitoring
Lessons are automatically checked for a small number of serious safety signals, including indications of self-harm, hate speech, extremist content and explicit language. If one is detected, the tutor responds to it seriously in the moment — for a self-harm signal, by asking the child to speak to a trusted adult and giving them the Childline number — and a record is made. The lesson is not stopped; it carries on from the same question. The parent or guardian on the account is told in the summary emailed at the end of that lesson, which includes what was said and what the tutor did about it.
We consider this necessary to run a service used by children safely. It does mean that what a child says during a lesson is assessed automatically. A record that a child said something suggesting self-harm is sensitive information about that child, and we treat it accordingly: it is visible only to the parent or guardian on the account, and to the small number of people who operate the service.
This monitoring is automated. It is not a substitute for professional help, and KIARI is not a safeguarding, counselling or emergency service. If a child is at immediate risk, contact the emergency services.
6. Who we share it with
We do not sell personal data. We share it with the following service providers, who process it on our instructions so that KIARI can work:
| Provider | What they process | Where |
|---|---|---|
| Supabase | Account, profile, progress and lesson recording storage, plus authentication. | Ireland (eu-west-1) |
| Anthropic | Lesson conversation text, so the AI tutor can teach and assess answers. | United States |
| OpenAI | Short text fragments for topic matching and formatting clean-up. | United States |
| Deepgram | Audio of your child speaking, converted to text so the tutor can respond. | United States |
| ElevenLabs | Tutor script text, converted to the spoken voice you hear. | United States |
| Stripe | Payment and card details, which go to Stripe directly. | United States and Ireland |
| Google (Gmail) | Support messages you send us through the in-app help widget, and your name and email address if you give them, so we can reply. | United States |
We may also disclose data where the law requires it, or to protect the vital interests of a child.
Transfers outside the UK
Several of the providers above are based in the United States. Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with an assessment of the risks of the transfer. We have checked this provider by provider rather than assuming it: Anthropic and Stripe incorporate the UK Addendum into their standard terms automatically, as does ElevenLabs through its published Data Processing Addendum. Data Processing Agreements incorporating the same safeguards are in place with OpenAI and Deepgram on our accounts.
We send email — support replies, and the summary a parent receives after each lesson — through a personal Gmail account rather than a business email provider. That account carries no data processing agreement: Google only attaches those terms to paid Workspace accounts, not to a free consumer one. This matters more than it did when that mailbox only carried support messages, because a lesson summary can contain a safety flag and a short quotation of what a child said. We are moving email to a provider with a proper agreement in place, and until we have, this is the honest position rather than one we would defend.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and profile data | For as long as the account is open, then deleted within 30 days of closure. |
| Progress and question history | For as long as the account is open, then deleted with the account. |
| Lesson recordings | 12 months from the date of the lesson, then deleted automatically. |
| Saved in-progress lesson state | Until the lesson is resumed or finished, and in any case no longer than 30 days. |
| Safety flag records | 24 months, because these may need to be revisited. |
| Lesson summary emails sent to you | Held in your own inbox, not by us. We generate each summary from the lesson at the moment it is sent and do not keep a separate copy, so deleting the email deletes it. |
| Payment and tax records | Six years, as required by UK tax law. |
| Support emails | 24 months. |
These are the retention periods we work to. Automated deletion that enforces them on a schedule is in development and not yet live; until it is, expired records are removed by manual review rather than automatically. If you believe we are holding data past the periods above, email baileyturan05@gmail.com and we will remove it.
8. Your rights
Under UK GDPR you can ask us to give you a copy of the personal data we hold, correct it if it is wrong, delete it, restrict how we use it, or provide it in a portable format. You can object to processing we carry out on the basis of legitimate interests, and withdraw consent where we rely on it. A child has these rights over their own data too, and a parent can normally exercise them on their behalf.
To exercise any of these, email baileyturan05@gmail.com. We will respond within one month. There is no charge.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or call their helpline on 0303 123 1113.
9. Security
Data is held in access-controlled cloud infrastructure, encrypted in transit. Database access rules mean an account can only ever read its own records. Passwords are stored hashed and are never visible to us. Card details never reach our systems. Lesson recording files are kept in a private storage bucket with no public or guessable path to them; each audio segment is served only via a short-lived signed URL, generated fresh for that request, currently valid for one hour.
10. Cookies
See our Cookie Notice.
11. Changes
If we change this policy we will update the date at the top, and tell you by email if the change materially affects you.