Privacy policy

Last updated: 2026-10-09

Overview

KiwiBee is operated by Lukani International Limited, Hong Kong Business Registration Number 74833011. Our correspondence address is Unit 501, 5/F, Belgian Bank Building, 721–725 Nathan Road, Mong Kok, Kowloon, Hong Kong. Contact hello@kiwibee.io, marking privacy enquiries “Privacy request”. This notice covers the public website, platform, enquiries and account services. A school or other organization may also provide its own notice for records it manages.

Data we collect

• Account and workspace information: names, email addresses, roles, organizations, sign-in identifiers, password verification information, preferences and agreement records, supplied by users, administrators or sign-in providers.
• Education and family records: student identifiers, classes, guardian relationships, attendance, work, responses, grades, feedback, portfolios, recognition and communications entered by authorized school users or learners.
• Sensitive school information: wellbeing, health, disability or safeguarding records where enabled by the customer. These require appropriate authority and additional safeguards.
• Uploaded documents, images, recordings, prompts, relevant AI task context, generated content and saved conversations where the selected feature uses them.
• Subscription and billing contacts, payment status and transaction references; payment processors handle card credentials. Support correspondence, demo requests and attachments.
• Technical information: session/access records, device/browser and connection information, errors and security/audit events. Optional website measurement includes feature interactions and campaign identifiers, subject to your choices.

How we use data

• Provide requested educational features, administer workspaces and subscriptions, authenticate users, maintain security, handle support and meet applicable legal obligations.
• A school normally determines the educational purposes of school-managed records. We handle them for the service under its lawful instructions and applicable agreements. Independently operating teachers must have authority for submitted records.
• For enquiries, business administration, security and separately permitted marketing we determine the relevant purposes. Where GDPR or similar law applies, the basis depends on the activity: an applicable contract, legal obligation, assessed legitimate interest or valid consent. A school contract does not itself establish every student’s legal basis.
• Optional analytics and advertising require the choices described below. Acknowledging this notice is not blanket consent; email marketing permission is separate.

Cookies

Essential cookies support security, sign-in, and your privacy choice. Optional Google Analytics cookies measure pages and completed sign-ups. Optional Google Ads and Meta Pixel cookies support campaign measurement and consented remarketing. KiwiBee does not send student or child profile data to these advertising tools. OpenAI’s ChatGPT Ads Pixel also measures page views and completed enquiries after advertising consent, and may use hashed contact details for matching.

AI & content processing

When an authorized user requests an AI feature, relevant prompts, files and task context may be processed by OpenAI, Mistral or ElevenLabs through the infrastructure used by that feature. Inputs may include student work or media only where the user has appropriate authority. Conversations and background jobs may save state. Provider retention and settings vary by feature; we do not promise universal zero retention or infer training restrictions merely from using an API. Do not submit unnecessary sensitive records. Educators must review accuracy, bias, suitability and third-party rights. These terms do not authorize solely automated consequential decisions about students. Contact us for the provider and settings relevant to your proposed use.

Third-party services

We use a small number of third parties to keep the platform running: Supabase (auth, database, storage and server functions, hosted in Singapore), Vercel (website hosting and the AI gateway for the website chatbot), Stripe (subscription billing — KiwiBee never sees raw card data), Google OAuth (optional "Sign in with Google"), Google Analytics and Google Ads (consented measurement), Meta Pixel (consented advertising measurement), Resend (transactional email), Apple and Google (mobile push notifications), and Pinterest (auto-publishing KiwiBee-owned worksheet pins to KiwiBee-owned Pinterest boards). The Pinterest integration does not connect to any teacher's personal Pinterest account, does not read profile or follower data, and only writes to boards we own. OpenAI’s ChatGPT Ads Pixel also measures page views and completed enquiries after advertising consent, and may use hashed contact details for matching. AI providers are listed in the AI section above.

Children, students and families

School-managed student use depends on the school’s educational authority and any legally required notices and parent or guardian permissions. Direct family use needs appropriate adult authority; a child’s account is not permission to bind a school. Our separate parental-consent flow is still in development. School authorization does not authorize unrelated commercial use. We do not sell student personal information or use school educational records for targeted advertising. Optional marketing is not a condition of classroom participation. Access to family records depends on verified roles and relationships. For school-controlled records, contact your school first; we assist it with valid requests.

Sharing and international processing

Authorized workspace users receive access according to their roles and relationships. Hosting, database, AI, email, payment and push providers receive information needed for their functions. Sign-in and payment providers may also act independently under their own notices. Customer-authorized public sharing can expose content beyond the school. We may disclose information as lawfully required or to address justified safety, legal-rights or business-transfer needs, with applicable protections. The database and storage currently use Singapore; AI providers, global hosting, communications and support can involve other countries. Singapore residency is not a promise that all processing occurs there. Applicable transfer safeguards depend on the actual provider and transfer chain; contact us to discuss safeguards and available processing terms before a deployment requiring them.

Retention, account closure and deletion

We retain information for its service, security, billing or legal purpose and applicable customer instructions. A complete category-by-category retention schedule is not yet published; contact us to establish the retention and return/deletion terms required by your school. Website consent choices expire after 365 days and consented campaign attribution stored by this website expires after 30 days. These browser periods do not define retention of school records or provider records. Deactivation, closing an account and completed erasure are different: closure does not automatically erase records the school must keep, shared records, billing/legal records or all provider and backup copies. We assess valid requests and explain applicable restrictions. We do not promise immediate universal erasure or that every record cascades on account deletion.

Your rights and choices

Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction or portability, object to processing, withdraw consent and complain to a competent regulator. Use available account controls or email hello@kiwibee.io. We may verify identity and school/guardian authority proportionately. We route requests concerning school-controlled records to the school or assist it, and do not disclose another person’s records. Lawful exceptions may apply; we explain refusals or extensions where required. Withdrawal does not undo processing already lawfully performed. You can change optional cookies through the cookie settings below without disabling necessary sign-in.

Security and policy changes

We use access controls and service safeguards proportionate to the information and risks. No system guarantees absolute security. Our Trust page distinguishes implemented measures from plans; we do not claim SOC 2 certification or completed legal compliance reviews. Material changes receive appropriate notice and new consent or agreement where required. Updated website copy does not retrospectively change a school contract or authorize new unrelated processing. Contact us for a previous notice or questions about a change.

Contact

For privacy requests or questions, contact us at hello@kiwibee.io.