Privacy Policy

1. Introduction

This Privacy Policy explains how we collect, use and protect personal data when you visit kiinaraos.com or use Kiinara OS.

By using the Services you acknowledge this policy. If you are a student, parent, teacher or staff member using Kiinara OS through your institution, please also read Section 2, which explains who is responsible for your data.

This policy should be read together with our Terms of Service.

2. Our role: institution and Kiinara

For student, parent, teacher and staff data inside Kiinara OS, your institution decides why and how the data is used, and Kiinara processes it on the institution's behalf. In data protection terms, the institution is the controller (a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023) and Kiinara is the processor. Requests about that data should first go to your institution.

Kiinara acts as controller only for data we collect for ourselves: visitors to our website, people who contact us or book a demo, institution representatives we deal with commercially, and usage data we use to run, secure and improve the Services.

Before a new user's data is uploaded to Kiinara OS, the institution is responsible for having a lawful basis to do so, including any notice, consent or parental consent the law requires.

3. Information we collect

The institution decides which of these categories it enters. We do not ask institutions to upload more than their module configuration needs.

4. How we use information

We use personal data only to run and improve the Services, and for no unrelated purpose.

• Provide the Services: set up accounts, run admissions, timetables, accounts, broadcasts, library and other modules, and deliver the web and mobile apps
• Support and onboarding: configure the platform, migrate institution data, train users and answer requests
• Communicate: send service notices, security alerts, and replies to demo and contact requests
• Secure the platform: prevent fraud and abuse, monitor performance, fix errors and keep audit logs
• Improve the Services: analyse aggregated or de-identified usage to improve features and reliability
• Meet legal duties: comply with applicable law, respond to lawful requests and enforce our Terms
• Marketing to institutions: send product updates to institution contacts, who can opt out at any time

We do not use student data for advertising, and we do not sell personal data.

5. Kiinara Intelligence (AI features)

Kiinara OS includes AI features: smart insights, a virtual teacher, predictions and alerts, resource generation and career guidance. These features work on the data an institution has placed in its own Kiinara OS workspace.

• Institution-specific: the system learns patterns within one institution's data to give that institution insights. One institution's data is not used to give insights to another.
• No training on customer data by third parties: we do not allow our AI providers to train their general models on institution or student data.
• Human in the loop: AI outputs are suggestions. Predictions, alerts and recommendations about students are meant to support, not replace, decisions by teachers and administrators, and no decision with legal or similarly significant effect on a student is made by AI alone.
• Accuracy: AI output can be wrong or incomplete and should be reviewed before it is relied on or shared with students or parents.
• Learning from de-identified data: we may use aggregated, de-identified data to improve the platform.

6. Children and student data

Most Kiinara OS users are students, many of them under 18. We treat their data with extra care.

• Students and their parents or guardians do not sign up to Kiinara OS directly. Accounts are created by the institution, which is responsible for obtaining verifiable consent from a parent or guardian where the law requires it.
• We do not show advertising to students, do not track them for behavioural advertising, and do not build profiles of them for any purpose other than the institution's own educational use.
• Student data is visible only to authorised users of that institution, and access is limited by role.
• A parent or guardian who wants to see, correct or delete a child's data should contact the institution first. We will help the institution respond.

If you believe a child's data has been added without proper authority, write to us at the contact details in Section 13 and we will work with the institution to resolve it.

7. How we share information

We do not sell personal data. We share it only in these cases:

• With the institution: the institution that owns the data controls who within it can see it.
• Service providers: cloud hosting, AI model, email and SMS, payment, analytics and support providers who process data for us under written confidentiality and data protection terms and only on our instructions.
• Legal and safety: where required by law, court order or a lawful government request, or to protect the rights, safety and security of users, Kiinara or others.
• Business transfers: in a merger, acquisition, financing or sale of assets, subject to the same privacy commitments. We will notify institutions before their data becomes subject to a different policy.
• With your direction: where you or your institution ask us to connect a third-party integration.

A current list of our sub-processors is available to institutions on request.

8. International transfers

Kiinara is based in India (Chandigarh) and also operates in Mozambique (Maputo). Our cloud infrastructure and service providers may store or process data in other countries. Where data moves across borders, we rely on contractual safeguards and security controls, and we follow any transfer restrictions that apply under the law of the institution's country, including India's Digital Personal Data Protection Act, 2023 and applicable Mozambican law.

We host primarily in India and Mozambique, and aim to keep an institution's data within its own country wherever possible; other regions are used only for backup, support and service continuity.

9. Data retention and deletion

Institution data stays in Kiinara OS for as long as the institution has an active subscription, or as the institution instructs. When the agreement ends, the institution can export its data for 30 days; after that we delete or irreversibly anonymise it within 90 days, except where law requires us to keep it longer. Backups are overwritten on their normal cycle.

We keep website enquiry and demo-request data for as long as needed to respond and to maintain the commercial relationship, and then delete it or stop using it when it is no longer needed. Security and audit logs are kept for 12 months.

10. Security

We protect personal data with measures suited to its sensitivity, including encryption in transit and at rest, role-based access control, authentication controls, logging and monitoring, regular backups, and access limited to staff who need it. No system is completely secure, so we cannot guarantee absolute security.

If we become aware of a personal data breach affecting an institution's data, we will notify the institution without undue delay, and in any case within the period required by law, so that it can meet its own obligations to affected individuals and authorities. Please keep your password confidential and tell us promptly if you suspect unauthorised access.

11. Your rights and choices

Depending on where you live, you may have the right to:

• Access a summary of the personal data we hold about you
• Correct inaccurate or incomplete data and update it
• Ask for data to be erased when it is no longer needed for the purpose it was collected
• Withdraw consent you have given, without affecting earlier processing
• Nominate another person to exercise your rights if you die or become incapable (under India's DPDP Act)
• Complain to the relevant data protection authority

If your data is in Kiinara OS through an institution, send your request to the institution first; we will assist it in responding. For data we hold as controller, such as website enquiries, write to us at the address in Section 13. We will respond within a reasonable time and within any period set by law. Marketing emails can be stopped at any time using the unsubscribe link.

12. Cookies and analytics

Our website uses cookies and similar technologies for three purposes: essential cookies that make the site work, analytics cookies that show us how the site is used, and, if enabled, marketing cookies that measure our campaigns. Non-essential cookies are used only with your consent where the law requires it, and you can change your choice through our cookie banner or your browser settings. Student and parent data inside Kiinara OS is never used for advertising cookies.

13. Changes, third-party links and contact

Our website may link to third-party sites, such as our social media pages. We are not responsible for their privacy practices. We may update this policy as our Services or the law change; the effective date above shows the latest version, and we will give institutions reasonable notice of material changes.