Privacy policy

Kuraplan is operated by Kodeword Ltd, a New Zealand company. This policy explains how we handle personal information when you use kuraplan.com, app.kuraplan.com and related services. It applies to teachers, school staff, parents using Kuraplan at home, and anyone who contacts us.

We comply with the New Zealand Privacy Act 2020 and, for users in Australia, the Australian Privacy Act 1988 and the Australian Privacy Principles. Users in the United Kingdom and European Union have the rights described under UK GDPR and EU GDPR.

Kinds of personal information we hold

Account information. Name, email address, password (hashed, never stored in plain text), country, school name, year levels and subjects taught, and the curriculum you choose.

Content you create. Lesson plans, unit plans, weekly programmes, worksheets, slides, quizzes, activities, chat conversations with the assistant, and files you upload. These may contain personal information if you include it. We ask you not to include student names or other personal details in prompts or uploads.

Student activity responses. When a teacher shares an activity link, a student enters a first name (or nickname) and their answers. We store the name as typed, the answers, a score, timestamps, and any messages the student sends to the activity helper, linked to the teacher's account. Students never create accounts and are never asked for anything else. The activity helper and hints are AI features: the student's messages, the question and their answer are sent to the AI model to generate guidance; the student's name is not sent. The AI also marks answers for the teacher. Schools can ask us to delete activity responses and helper messages at any time.

Learner details entered at home. Parents using Kuraplan for home learning may enter a learner's first name, age or year level. We do not collect surnames, dates of birth, health, disability, ethnicity, religion, government identifiers or any other sensitive information about learners, and there are no fields for them.

Billing information. Name, email, billing address, and subscription status. Card details are entered directly into Stripe and never reach Kuraplan.

Usage information. Pages and features used, resources created, device and browser type, IP address, and approximate location derived from IP address for currency and curriculum defaults. We do not store precise location.

Support correspondence. Emails, contact form submissions and feedback you send us.

We do not collect national student numbers, teacher registration numbers, biometric data, or any information about health, disability, behaviour, attendance, custody, ethnicity, religion or finances.

How we collect and hold personal information

We collect information directly from you when you sign up, use the product, upgrade, or contact us. If you sign in with Google, we receive your name, email address and profile picture from Google.

We may receive your name and school email address from a colleague who invites you, or from your school when it sets up school-wide access. We may also identify publicly listed staff email addresses on a school's own website so a colleague can invite them. We do not use that information for anything else.

Information is held in our database and file storage, provided by Supabase on Amazon Web Services in the United States, and processed by our application servers on Vercel. All data is encrypted in transit and at rest. See Security overview for detail and Subprocessors for every provider.

Purposes of collection, use and disclosure

We use personal information to:

• provide the service, including generating and storing your plans and resources;
• personalise defaults such as curriculum, year level and subject;
• manage your subscription and send receipts;
• send transactional email such as sign-in links, invitations, and notices about your account;
• send product news, only if you have opted in, with unsubscribe in every email;
• provide support and respond to your requests;
• understand how the product is used so we can improve it;
• detect abuse and keep the service secure;
• meet legal obligations.

We do not sell personal information. We do not share it with third parties for market research. Advertising measurement is limited to the hashed conversion events described under Cookies and analytics. We do not use your content, prompts or learner details to train AI models, and our model providers are contractually prevented from doing so.

How AI features use your information

The assistant generates plans and resources by sending your request, your curriculum settings and relevant context to third-party AI models through Vercel AI Gateway. Providers currently in use are Anthropic, OpenAI and Google, all processing in the United States under business terms with no training on your data and, where available, zero retention.

AI features are built for teachers and adults. Students without accounts can use two limited AI features inside a teacher-shared activity: a helper chat that gives guidance without revealing answers, and hints. Student messages are limited in length and rate, and the student's name is not sent to the model. Real-time detection of harmful content in student messages and a crisis-response protocol are being built; until they are live, schools should treat the helper as a beta feature.

AI features are not designed to receive personal information about students or others. Please do not include names or personal details in prompts or uploads. We keep a log of AI requests and outputs for 90 days to investigate faults and abuse, then delete it.

You can delete your conversation history at any time from within the product. Personalisation based on your past activity is controlled in settings.

We will tell you before we change the country in which AI models process your requests, with at least 30 days' notice. See the AI statement for how the assistant works, its limits, and how to report a problem with an output.

Overseas disclosure

Kodeword Ltd is based in New Zealand and its founder works from the United Kingdom. Your information is stored and processed in the United States by the providers listed on our Subprocessors page. Each provider is bound by a data processing agreement or business terms that require security and privacy safeguards comparable to New Zealand and Australian law.

We will give at least 30 days' notice before moving stored data or processing to a different country.

Who we share information with

• Subprocessors that host and operate the service, listed with purpose, data types and country on the Subprocessors page.
• Your school, if your account is part of a school plan: school administrators can see which staff have accounts and usage totals. They cannot read your chat conversations.
• Colleagues, only when you choose to share a resource with them.
• Authorities, where required by law or to protect someone's safety.

Users in one school cannot find, search or access users or content from another school. Resources shared to the public library show the author's first name and school only and must not contain personal information about students.

Data retention and deletion

• Account data and content are kept while your account is active.
• Chat conversations can be deleted by you at any time.
• AI request logs are deleted after 90 days.
• Backups are kept for up to 90 days.
• When you delete your account or ask us to, we delete your personal information within 30 days and confirm in writing. It is removed from backups within 90 days.
• Accounts inactive for 24 months are warned by email and then deleted.
• Anonymised, aggregated usage statistics that cannot identify anyone may be kept.

Access, correction and deletion

You can update your name, email and settings in the product. You can ask us for a copy of your personal information, ask us to correct it, or ask us to delete it by emailing privacy@kuraplan.com. We respond within 30 days and there is no charge. We will verify your identity before acting on a request.

Security

Every account has its own credentials. Data is encrypted in transit with TLS and at rest with AES-256. Access to production systems is limited to the founder, protected by multi-factor authentication, and logged. Row-level security in our database enforces that users see only their own data and what has been shared with them. See the Security overview.

If we become aware of a breach that is likely to cause serious harm, we will notify affected users and schools as soon as possible, and within 72 hours of confirming it, with what happened and what was affected. We notify the New Zealand Privacy Commissioner and the Office of the Australian Information Commissioner as required.

Children

Kuraplan accounts are for adults. We do not knowingly create accounts for anyone under 18. Where a parent enters a learner's first name and year level for home learning, that information is used only to tailor resources, is never used for AI training, and is deleted with the parent's account.

Cookies and analytics

We use essential cookies to keep you signed in. We use PostHog (EU) and Mixpanel to understand how the product is used, with data tied to your account identifier, and PostHog and Microsoft Clarity session replay with typed text masked.

Our marketing website and sign-up flow currently send conversion events to Meta, TikTok and Pinterest so we can measure advertising. These include a hashed (irreversible) form of your email, plus IP address and browser identifiers. They are not used to show you ads inside Kuraplan and are being removed for school users. Details are in the cookie policy.

Changes to this policy

We will email you and show a notice in the product at least 14 days before a material change to this policy or our terms takes effect.

Complaints and contact

Privacy Officer: Emory Fierlinger Email: privacy@kuraplan.com Kodeword Ltd, New Zealand

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner (New Zealand, privacy.org.nz), the Office of the Australian Information Commissioner (oaic.gov.au), or the Information Commissioner's Office (United Kingdom, ico.org.uk).