Privacy Policy

1. Who We Are

Keyoqi is operated by a sole trader based in the United Kingdom.

For any privacy-related questions, contact: privacy@keyoqi.com

2. What We Collect

We collect only what is necessary to operate the service.

Account Information

• Name (optional)
• Email address
• Login credentials (via authentication provider)

Usage Data

• Quiz results and answers
• Learning progress and mastery data
• Interaction with features (quizzes, lessons, conversations)

AI Interaction Data

• Text you input into quizzes, lessons, or conversations
• AI-generated responses

This data is used to provide and improve the service.

Technical Data

• IP address
• Browser type and device information
• Log data for security and debugging

Rate-Limit Data

• Timestamps of quiz and lesson generation requests (without content) — used to enforce fair use quotas and prevent abuse

Billing Information

• Payments are processed securely via Stripe
• We do not store full card details
• We may store billing-related metadata (e.g. subscription status)

3. How We Use Your Data

We use your data to:

• Provide and operate the service
• Personalise your learning experience
• Generate quizzes and AI responses
• Improve product quality
• Prevent fraud and abuse
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

We process your personal data under the following lawful bases (Article 6 UK GDPR):

• Contract performance — to create and manage your account and provide the service you signed up for
• Legitimate interests — to prevent fraud, maintain security, improve the product, and debug issues
• Legal obligation — to comply with applicable laws and regulations
• Consent — where you have explicitly agreed (e.g. receiving updates)

5. AI and Third-Party Processing

We use third-party providers to operate Keyoqi, including:

• Supabase (database & authentication)
• Vercel (hosting)
• Stripe (payments)
• Cloudflare (Turnstile bot protection — processes IP address and browser signals to verify human users)
• Google (Gemini API — quiz, lesson generation, and text processing)
• OpenAI (text generation for conversations and follow-ups, text-to-speech, and speech transcription)
• Resend (transactional email)

Your data may be processed by these providers strictly to deliver the service.

Text you input into quizzes, lessons, or conversations may be sent to Google's Gemini API or OpenAI APIs to generate responses. These providers have their own privacy policies and data processing terms.

6. Data Retention

We retain your data while your account is active.

When you delete your account, we perform a “fresh start” wipe: your quiz results, lessons, conversations, and learning progress are deleted. However, we retain a minimal set of records after deletion for the following reasons:

• Authentication identity (your email and login record) — retained to allow you to sign back in and to prevent account cycling abuse
• Billing records (Stripe customer ID, subscription status) — retained to comply with financial and tax obligations
• Rate-limit records (timestamps of quiz and lesson generations, without content) — retained under our legitimate interests in preventing abuse and circumvention of usage limits

These residual records do not include your learning content, quiz answers, or conversation history.

If you would like your authentication identity and all associated data fully and permanently deleted (rather than a fresh start), contact us at privacy@keyoqi.com and we will process the request manually within 30 days.

7. Your Rights (GDPR)

If you are in the UK, EU, or similar jurisdictions, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Request data portability
• Lodge a complaint with a data protection authority

Right to erasure: When you delete your account via the app, your learning content and progress are erased immediately. A minimal residual record (auth identity, billing records, and rate-limit timestamps) is retained under our legitimate interests and legal obligations as described in Section 6. To request complete permanent deletion of all records, contact us at privacy@keyoqi.com.

UK users: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.

To exercise your rights, contact: privacy@keyoqi.com

8. Cookies and Analytics

We may use cookies and similar technologies to:

• Keep you logged in
• Understand how users interact with the product
• Improve performance and usability

You can control cookies through your browser settings.

9. Data Security

We take reasonable measures to protect your data, including encrypted connections (HTTPS), secure infrastructure providers, and access controls. However, no system is completely secure.

10. International Transfers

Your data may be processed outside your country, including in the United States, by the third-party providers listed in Section 5 (Supabase, Vercel, Stripe, Cloudflare, Google, OpenAI, Resend).

For transfers from the UK or EU to the US, we rely on:

• Standard Contractual Clauses (SCCs) incorporated into our data processing agreements with each provider
• For providers covered by the UK–US Data Bridge or EU–US Data Privacy Framework, those adequacy mechanisms where applicable

A list of our sub-processors and their data processing terms is available on request at privacy@keyoqi.com.

11. Children's Privacy

Keyoqi is not intended for children under 13. If we become aware that we have collected data from a child without consent, we will delete it.

12. Changes to This Policy

We may update this policy from time to time. We will update the “Last updated” date when changes are made.

For significant changes, we will make reasonable efforts to notify you (for example, by email or an in-app notice).

13. Contact

For any privacy questions: privacy@keyoqi.com