This Privacy Policy explains how Kluger Ventures LLC (“we,” “us,” or “our”) collects, uses, shares, and protects information when you use Knovato — our website, web app, APIs, and related mobile apps (the “Service”) at knovato.app.
By using the Service, you acknowledge this Policy. If you disagree, do not use the Service. Our Terms of Service also apply.
1. Controller and contact
The data controller is:
- Kluger Ventures LLC
- 30 N Gould St Ste N
- Sheridan, WY 82801
- United States
- Email: contact@knovato.app
We are a U.S. company. If you are in the EEA, UK, or Switzerland, GDPR / UK GDPR / Swiss FADP rights still apply where the law reaches our processing of your personal data. We do not currently appoint a separate EU/UK representative or Data Protection Officer; contact us at the email above for all privacy requests.
2. What this Policy covers
- Accounts and authentication
- Study materials (notes, PDFs, images, URLs, YouTube links) and derived data (extractions, chunks, embeddings)
- AI tools (quiz, flashcards, write, presentation, plan, chat) and companion features (including “Bibo”)
- Progress systems (sessions, review/spaced repetition, XP, streaks, levels, leagues)
- Billing and trials
- Support email and transactional messages
- Essential cookies and first-party product analytics
It does not cover third-party sites we do not control (Stripe Checkout, Apple/Google account pages, or websites you ask us to fetch).
3. Information we collect
3.1 Account and profile
- Email address; Google and/or Apple Sign-In identifiers when you use them
- Display name, avatar, language (English or German), timezone, school level, goals, onboarding answers (study habits / pain points)
- Billing metadata: subscription status, plan/price IDs, trial flags, payment-processor customer IDs. We do not store full payment card numbers.
3.2 User Content (study materials and AI artifacts)
- Folders and items: notes (rich text + images), PDFs, crawled URL content, YouTube titles/transcripts, extracted markdown
- Derived data: chunks, embeddings, generated quizzes/flashcards/ writing/presentations/plans, chat messages, conversation summaries
- Companion memory (goals, subjects, weak/strong topics, pins, tone)
- Learning progress: sessions, review state, XP, levels, streaks, league tier and cohort stats
Do not upload secrets, health records, government IDs, or confidential third-party documents unless you accept that cloud AI providers will process them (see §7). Knovato is a study tool, not a vault for regulated health or financial data.
3.3 Technical and usage data
- IP address, browser/user-agent, device type/OS, app version; approximate location from IP (city/region at most — no GPS required)
- First-party product events (e.g. signup, onboarding complete, knowledge added, trial started, tool generated, session completed, subscription active)
- AI usage metering: action, model name, token estimates, estimated cost (for budgets and abuse prevention)
- Security, rate-limit, and error logs
3.4 Payments
- Web: Stripe processes cards and tax details; we receive status and limited billing metadata via webhooks.
- Mobile (when offered): Apple / Google and RevenueCat process in-app purchases; we receive entitlement signals, not your full payment instrument.
3.5 Communications
- Auth emails (magic links), billing notices, and emails you send us
- Occasional product updates where allowed by law; you can opt out of non-essential marketing
3.6 Cookies
- Essential: authentication/session cookies (so you stay signed in); locale preference cookie
- First-party analytics: product events described above (stored in our systems — not a third-party ad network)
We do not currently use third-party advertising cookies or major third-party analytics SDKs (e.g. Google Analytics, PostHog). If that changes, we will update this Policy and obtain consent where required (especially in the EEA/UK).
3.7 Mobile
- Local offline cache on device (Preferences / SQLite-backed storage)
- Permissions you grant (e.g. camera, share, local notifications)
- Push tokens — only if/when we enable push; we will update this Policy then
4. How we collect information
- From you: signup, onboarding, settings, uploads, chat, email
- Automatically: logs, cookies, metering, product events
- Identity providers: Google / Apple (email, name, avatar as they provide)
- Sources you connect: content from URLs or YouTube when you add those items
- Payment processors: subscription / entitlement status
5. How we use information
- Provide, secure, and improve the Service
- Generate study tools and chat grounded in your materials (including sending necessary content to AI providers — §7)
- Personalize companion memory, language (EN/DE), and study flow
- Enforce AI budgets, rate limits, and abuse prevention
- Process trials, subscriptions, invoices, and applicable taxes
- Send transactional email; limited product updates where allowed
- Analyze aggregated or de-identified trends to improve reliability and learning outcomes
- Comply with law and protect rights and safety
We do not sell your personal information for money. We do not use your study materials to train our own models that we then offer to other Knovato users. Independent AI providers may process prompts under their policies — see §7 (this is important).
6. Legal bases (EEA / UK / Switzerland)
- Contract — account, library, AI features you request, billing
- Legitimate interests — security, fraud/abuse prevention, essential product analytics, service improvement (balanced against your rights; you may object)
- Consent — where required (e.g. non-essential cookies/marketing). Withdraw anytime without affecting prior lawful processing
- Legal obligation — tax, accounting, lawful requests
7. Artificial intelligence — please read carefully
When you use AI features, we send relevant portions of your materials, prompts, chat history (or summaries), and companion memory to third-party model providers so they can return a result for you.
7.1 Providers we use today
| Provider | What we send | What you should know |
|---|---|---|
| DeepSeek (generation / chat) | Study excerpts, prompts, chat context, companion memory needed for the feature | DeepSeek states that it may process and store personal data in the People’s Republic of China. Its public policies indicate inputs/outputs may be used to improve or train its technology, with an opt-out described in DeepSeek’s own settings/policies. DeepSeek does not publicly document a zero-data-retention API tier. Treat anything you send to AI chat/generation as potentially leaving our systems under DeepSeek’s terms. |
| OpenAI (embeddings only) | Text chunks / queries for vector search | OpenAI’s published API default (as of our last review): API data is not used to train OpenAI models unless an organization explicitly opts in. OpenAI may retain API data for a limited abuse-monitoring period (commonly up to ~30 days) unless a stricter retention product is enabled. |
7.2 Our commitments
- We send only what is reasonably needed for the feature you invoked.
- We do not sell your content or use it to train a Knovato-owned model shared with other customers.
- Folders and study materials stay private to your account among Knovato users (except limited league profile visibility — §8).
- Provider policies can change. We will update this section when our stack or those policies change materially. Prefer not to paste highly sensitive personal data into notes or chat.
AI outputs can be wrong or incomplete. They are not professional academic, legal, medical, or financial advice.
8. Who we share information with
We share personal data only to run the Service or as required by law:
| Recipient | Role |
|---|---|
| Supabase | Auth, database, file storage (PDFs/images) |
| Vercel (or successor host) | Web app / API hosting |
| Stripe | Web payments and subscription management |
| Resend (or successor) | Transactional email |
| DeepSeek / OpenAI | AI inference (see §7) |
| Google / Apple | OAuth sign-in; App Store / Play billing when used |
| RevenueCat | Mobile in-app purchase entitlements (when offered) |
- Leagues: your display name and avatar may be visible to other users in your cohort. Study folders are not shared with other users in v1.
- Legal / advisors / authorities: when required or reasonably necessary to protect rights and safety.
- Business transfers: merger, acquisition, or asset sale under appropriate safeguards; we will notify if required.
We require processors to use data only for instructed purposes under their terms / DPAs where available. Optional live-chat tools (e.g. Crisp) are not enabled by default.
9. International transfers
We are based in the United States. Your data may be processed in the U.S. and in other countries where our processors operate — including, for DeepSeek generation features, processing that may occur in China (§7). Where we transfer personal data from the EEA/UK/Switzerland to countries without an adequacy decision, we rely on appropriate safeguards offered by processors (such as Standard Contractual Clauses) and supplementary measures where available. By using AI generation features, you understand that relevant content may be transferred to those providers for processing.
10. Retention
- Account & library: while your account is active.
- After account deletion: we delete or anonymize account and cascaded application data from active systems, typically within 30 days. Encrypted backups/logs may retain residual copies for up to about 90 days until rotated. Payment processors keep billing records as required by their policies and law (often multi-year for tax). Clear local app caches by signing out / uninstalling.
- Product analytics & metering: generally up to 24 months, then aggregated or deleted, unless needed longer for security or disputes.
- Support email: generally up to 24 months after the last message, unless a longer period is needed for an ongoing issue.
- Legal holds: longer when required for disputes, fraud prevention, or legal obligations.
11. Your rights and choices
Depending on where you live, you may have rights to:
- Access / know what personal data we hold
- Correct inaccurate data
- Delete data / erase your account
- Portability of data you provided
- Restrict or object to certain processing
- Withdraw consent where processing is consent-based
- Opt out of “sale” or “sharing” for cross-context behavioral ads (we do not sell personal data; if that changes we will provide required opt-outs)
- Lodge a complaint with a supervisory authority (EEA/UK) or other regulator
In-product: update profile/locale in Settings; manage billing via Stripe Customer Portal (web) or the app store (mobile); delete your account in Settings.
Email requests: contact@knovato.app with the subject “Privacy request.” We may verify identity. We aim to respond within 30 days (sooner if law requires). We will not discriminate against you for exercising privacy rights.
California / similar U.S. state laws: categories, purposes, and recipients are disclosed in §§3–8. We do not sell personal information as commonly understood. Shine the Light / CPRA requests: same contact email.
12. Security
We use commercially reasonable measures: TLS in transit, access-controlled cloud infrastructure, established auth providers, database access controls, and least-privilege service roles. No method of transmission or storage is 100% secure. Protect your devices and the inbox used for magic links / OAuth.
If we become aware of a breach affecting your personal data, we will notify you and/or regulators as required by applicable law.
13. Children and students
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have, email contact@knovato.app and we will delete it.
If you are under 18, use the Service only with a parent/guardian’s consent — especially for paid subscriptions. In the EEA/UK, where the digital consent age is higher than 13 (up to 16), you must meet that age or have verifiable parental consent as required locally.
Knovato is a consumer study tool. It is not a school-managed FERPA education-record platform unless we sign a separate school agreement.
14. Third-party links and fetched content
If you add a URL or YouTube link, we retrieve content you asked us to process. We are not responsible for those sites’ privacy practices. Only submit links you have the right to use for personal study.
15. Changes
We may update this Policy by posting a revised version here and changing the “Last updated” date. For material changes, we will also try to notify you by email or in-product notice. Continued use after the effective date means you accept the updated Policy where permitted by law; where affirmative consent is required, we will ask for it.
16. Contact
Kluger Ventures LLC
30 N Gould St Ste N, Sheridan, WY 82801, United States
contact@knovato.app