Privacy Policy

Effective date: June 28, 2026. We'll email you before making any material changes.

Short version (full policy below):

• We store your vocabulary and conversations to run the service. That's what you're paying for.
• We don't sell your data. We don't train AI models on your private content.
• You can delete your account and everything in it at any time.

Who we are

Kaiwaflow is the operator of this service. Questions about this policy: privacy@kaiwaflow.com.

Data we collect

Account data: Your email address. Used for login, billing, and support.

Vocabulary data: Word lists and Anki deck files you upload. This is the core of the service, and we store it so Sensei can use it in your conversations.

Conversation history: Text of your AI conversation sessions. We store this so Sensei can track which words you've recalled and schedule future review.

SRS progress data: Recall logs and spaced-repetition scheduling data. Tied to your vocabulary.

Voice input: When you use voice features, your speech is processed by your browser or device (via the Web Speech API) and converted to text before it reaches our servers. We do not receive or store audio recordings from standard voice sessions. If we ever add a server-side voice processing path, we'll update this policy and ask for your explicit consent before enabling it.

Payment data: Stripe manages all payment processing. We store only a Stripe customer token, not your card number, not your bank details. Stripe's privacy policy covers payment data handling.

Session data: Functional cookies to keep you logged in. That's it, no tracking cookies, no advertising cookies.

Why we process your data

To deliver the service: Account data, vocabulary, conversation history, and SRS data are all necessary to run what you signed up for. Legal basis under GDPR: performance of a contract (Article 6(1)(b)).

To keep the service secure: Server and request logs used for debugging and abuse prevention. Legal basis: legitimate interests (Article 6(1)(f)).

Who we share data with

We share data with the following service providers only as needed to run the service:

We don't sell your data to anyone. We don't share it with advertisers. We don't use it to build ad profiles.

Note on AI processing: When you send a message in Kaiwa, your text and relevant conversation context are sent to Anthropic (Claude API) to generate Sensei's response. Anthropic's API terms say they don't use your conversations for model training.

How long we keep your data

Account data, vocabulary, and conversation history: retained while your account is active.

Session cookies: expire when your browser session ends or when you sign out.

Deletion: When you delete your account, all associated data is permanently deleted within 30 days. This includes your vocabulary, conversation history, and SRS progress. Stripe keeps its own billing records, which is outside our control.

Your rights

You have the right to:

• Access a copy of the data we hold about you
• Correct inaccurate data
• Delete your account and all associated data (available in Settings → Account)
• Export your vocabulary data in JSON format
• Object to certain types of processing

EU residents (GDPR): We'll respond to requests within 30 days. You also have the right to lodge a complaint with your local data protection authority.

California residents (CCPA): We'll respond to requests within 45 days. We do not sell or share your personal information. You have the right to know what we collect, request deletion, and opt out of sale, but there's nothing to opt out of.

To exercise any of these rights, email privacy@kaiwaflow.com.

Cookies

We use functional session cookies to keep you signed in. These cookies are necessary for the service to work: you can't opt out of them and stay logged in.

We do not use advertising, tracking, or analytics cookies.

Children

Kaiwa is not directed at children under 13 (or under 16 for EU residents). If you believe a child has created an account, contact us and we'll delete it.

Security

We use HTTPS, encrypted storage, and restricted server access to protect your data. If we discover a breach that affects your personal data, we'll notify you and relevant authorities within 72 hours for GDPR, and quickly under US state requirements.

Changes to this policy

We'll email you before making material changes to this policy. Minor changes (typos, clarifications) may be made without notice. The effective date at the top of this page always reflects the last update.