🔒 Privacy Policy

1. Introduction

Welcome to KIRIKAT ("Company," "we," "us," "our"). KIRIKAT is committed to protecting your privacy and ensuring you have a positive experience on our platform.

This Privacy Policy explains:

• What information we collect from you
• How we use that information
• Your rights regarding your personal data
• How we protect your information

By accessing or using KIRIKAT, you agree to this Privacy Policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 Information You Provide Directly

• Account Registration: Name, email address, phone number, profile picture, country of residence
• Payment Information: Card details (processed by Stripe; we do not store full card numbers)
• Avatar Creation: Voice samples, documents, videos, personal knowledge base content
• Communication: Messages, feedback, customer support inquiries
• Profile Data: Biography, expertise areas, teaching style, preferences

2.2 Information Collected Automatically

• Usage Data: Pages visited, time spent, features used, interaction patterns
• Device Information: Device type, OS, browser, IP address, language preferences
• Cookies & Tracking: Session data, authentication tokens, analytics tracking
• Conversation Logs: Chat history between students and avatars (for quality improvement)
• Technical Data: Error logs, performance metrics, server response times

2.3 Information from Third Parties

• Payment processors (Stripe, etc.)
• Cloud services (Supabase, AWS)
• Analytics providers (Google Analytics)
• Communication platforms (SendGrid for email)
• AI service providers (OpenAI, DeepL, Alibaba for LLM services)

3. How We Use Your Information

3.1 Service Delivery

• Providing avatar creation and training functionality
• Processing subscriptions and payments
• Delivering chat responses and learning experiences
• Managing user accounts and profiles
• Handling refunds and subscription changes

3.2 Product Improvement

• Analyzing user behavior to improve features
• Identifying bugs and technical issues
• Optimizing response quality and latency
• Personalizing user experience
• Conducting A/B testing

3.3 Communication

• Sending account updates and service notifications
• Responding to customer support requests
• Marketing communications (with your consent)
• Important security alerts

3.4 Safety & Compliance

• Detecting and preventing fraud
• Complying with legal obligations
• Protecting against security threats
• Enforcing Terms of Service
• Content moderation and safety

3.5 AI Model Training (Optional)

• We may use anonymized conversation data to improve our AI models
• You can opt-out of this in your account settings
• Personal identifiable information is removed before training

4. Data Sharing & Disclosure

4.1 We Share Data With:

4.2 We DO NOT Sell Your Data

✅ We do NOT sell, trade, or rent your personal information to third parties for marketing purposes.

4.3 Legal Obligations

We may disclose data if required by law, court order, or government request (with notice where legally permitted).

4.4 Business Transfers

In case of merger, acquisition, or bankruptcy, user data may be transferred as part of that transaction. You will be notified of any such change.

5. Data Security

• 🔐 Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256)
• 🔑 Authentication: Multi-factor authentication (MFA) support for accounts
• 🛡️ Row-Level Security: Database-level access controls
• 🔍 Regular Audits: Security testing and penetration testing
• 📋 Compliance: GDPR, CCPA, and SOC 2 standards
• ⚠️ Access Control: Minimal necessary access for employees
• 🚨 Incident Response: 24/7 monitoring and incident response team

Note: While we implement strong security, no system is 100% secure. You are responsible for keeping your password confidential.

6. Your Privacy Rights

6.1 GDPR Rights (EU Residents)

If you are in the European Union, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Delete your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Download your data in portable format
• Right to Object: Opt-out of marketing communications
• Right to Appeal: Lodge a complaint with your data protection authority

6.2 CCPA Rights (California Residents)

If you are in California, you have the right to:

• Know what personal information is collected
• Know whether personal information is sold or disclosed
• Say no to the sale of personal information
• Access personal information
• Request deletion of personal information
• Non-discrimination for exercising your rights

6.3 How to Exercise Your Rights

To exercise any of these rights, contact us at: privacy@kirikat.com

We will respond to your request within 30 days (or as required by law).

7. International Data Transfers

KIRIKAT operates globally. Your data may be transferred to and processed in countries other than your country of residence, including:

• 🇺🇸 United States (AWS infrastructure)
• 🇸🇬 Singapore (Supabase servers)
• 🇦🇪 United Arab Emirates (Hub71/Abu Dhabi)
• 🇪🇺 European Union (GDPR-compliant processing)

Important: These countries may have different data protection laws. By using KIRIKAT, you consent to such transfers. We ensure appropriate safeguards are in place (Standard Contractual Clauses, Privacy Shield certifications).

8. Data Retention

You can request data deletion at any time by contacting privacy@kirikat.com.

9. Children's Privacy

KIRIKAT is not intended for children under 13 years old. We do not knowingly collect personal information from children under 13.

If we discover we have collected data from a child under 13, we will delete it immediately. Parents/guardians concerned about their child's information can contact: privacy@kirikat.com

For users 13-18: Parents have the right to request access or deletion of their child's data.

10. Cookies & Tracking

10.1 What Are Cookies?

Cookies are small files stored on your device to remember information about your visit.

10.2 How We Use Cookies

• Essential: Authentication, security, session management
• Performance: Analytics, page load optimization
• Functional: Remembering preferences, language settings
• Marketing: Tracking ad performance (optional, consent-based)

10.3 Cookie Management

You can control cookies through your browser settings. Disabling cookies may limit KIRIKAT functionality.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Major changes will be announced via email or notification on our platform.

Continued use of KIRIKAT after updates constitutes acceptance of the new policy.

12. Contact Us

If you have questions about this Privacy Policy, please contact: