Privacy Policy

KONEssance Math is designed for learners from Kindergarten to Grade 12, including young children. In line with the U.S. Children's Online Privacy Protection Act (COPPA), accounts for children under 13 are created and controlled by a parent, guardian, or teacher — never by the child directly.

For learners in the EU, EEA, and UK, GDPR Article 8 sets a "digital consent age" of between 13 and 16 depending on the country. Our sign-up age gate detects the applicable age for the visitor's country and, below that age, requires the account to be created and managed by a parent or guardian who provides verifiable consent.

We collect only the information needed to run lessons and track learning progress. We do not require children to provide personal contact details, and we never ask children for information beyond what is necessary for the educational service.

When schools and teachers use KONEssance Math, student progress data constitutes an education record. Consistent with the U.S. Family Educational Rights and Privacy Act (FERPA), we act as a school official with a legitimate educational interest and process this data only under the direction of the school.

Schools and parents may request access to, correction of, or deletion of a student's records. Teachers and districts control who can view student progress data within their classroom or organization.

Where GDPR or UK GDPR applies, our lawful bases for processing are: performance of a contract (to provide the learning service you or your school signed up for); consent (for accounts of children below the applicable digital-consent age, given by a parent or guardian); legitimate interests (keeping the service secure and reliable, and improving our exercises, balanced against your rights); and legal obligation (where we must retain or disclose data by law). For school and district deployments, the school is the data controller and KONEssance Math acts as a data processor under a Data Processing Agreement.

You have the right to access your data, to receive a portable copy, to rectify inaccurate data, to erase your data, to restrict or object to processing, and to withdraw consent at any time. Signed-in students and account holders can download a full machine-readable copy of their data and delete their account directly from Account Settings. Other requests can be made using the contact details in the final section.

You also have the right to lodge a complaint with your local data protection supervisory authority. Our data controller for direct (non-school) accounts, and our EU representative and Data Protection Officer where required, can be reached at the contact address in the final section.

For families and schools in Canada, we handle personal information in line with the federal PIPEDA and provincial laws including Québec's Law 25. We collect only what is necessary, identify our purposes at collection, and never sell personal information or use student data for advertising.

Consistent with Québec Law 25, where a student is under 14 we require consent from a parent or guardian before creating and running the account; at 14 and over a young person may consent on their own for the educational service. For schools, this consent is coordinated through the educational relationship.

Canadian users can export or delete their data from Account Settings, and may contact our Privacy Officer using the details in the final section. You may also complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d'accès à l'information. Schools can request our PIPEDA/Law 25 Privacy Addendum and Canadian School Data Privacy Agreement.

Account information provided by the parent, teacher, or adult account holder (such as name and email for the account owner), a learner's first name or display name, chosen grade level and language, and learning activity such as exercises attempted, answers, mastery scores, streaks, and badges.

We also collect limited technical data (such as basic device and usage information) needed to keep the service secure and working reliably.

We use data to deliver adaptive lessons, track mastery, show progress to parents and teachers, and improve the quality of our exercises. We never sell or rent student data, and we do not show third-party advertising to students.

We keep our analytics deliberately minimal. To understand how many people visit our public pages and how many go on to create an account, we use privacy-friendly, cookieless web analytics (Vercel Web Analytics). It does not set advertising or tracking cookies, does not build a profile of you, and does not follow you across other websites.

We do not use any third-party advertising networks, ad pixels, social-media tracking pixels, or cross-site trackers anywhere in the product. We never track individual children for advertising, and we never sell or share usage data for marketing.

As a conservative privacy posture, we turn web analytics off entirely for visitors we detect in the EU, EEA, and UK — no analytics script is sent to those visitors at all. What we do measure elsewhere is aggregate and about the site, not the child: counts of page visits and of the pre-signup steps (for example, how many visitors reach the signup screen), so we can see where people get stuck. Inside a student's account, we record learning activity (exercises, scores, streaks) to run the lessons and show progress — that is described in the sections above, not here.

Data is encrypted in transit, access is restricted to authorized personnel, and payment information is handled by our payment processor (Stripe) — we do not store full card numbers. We retain learning records only as long as an account is active or as required to provide the service, and we delete records on verified request.

Our retention schedule: active accounts are retained while in use. Student accounts with no activity for 24 consecutive months are automatically deleted, along with all associated learning records. Support-chat transcripts are automatically deleted 90 days after the last message. Data managed on behalf of a school or district is retained and deleted according to that organization's Data Processing Agreement.

We use a small number of trusted service providers (subprocessors) to run KONEssance Math, such as hosting, database, email, and payment providers. Our current subprocessors are listed at /subprocessors.

Some of these providers may process data outside your country, including outside the EU/EEA. Where personal data of EU/EEA or UK individuals is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) to protect that data.

For email specifically: when we send messages to people in the EU/EEA or UK, we dispatch them through our email provider's EU (Ireland) region. Please note that our email provider still stores some email metadata and delivery logs in the United States regardless of the sending region; that transfer is covered by the Standard Contractual Clauses above. We keep the personal data inside emails to a minimum (for example, we use your chosen display name rather than a legal name). This is not a guarantee that email data never leaves the EU/EEA.

Parents, teachers, and schools can review, update, or delete account and student data at any time. Signed-in account holders can also download a copy of their data and delete their account from Account Settings.

For privacy requests or questions about COPPA, FERPA, or GDPR — including access, portability, rectification, or erasure requests, or to reach our EU representative or Data Protection Officer — contact us at privacy@konessancemath.com. EU/EEA and UK users may also lodge a complaint with their local data protection supervisory authority.