Privacy Policy

We collect the following categories of personal data:

Account data

Name, email address, profile picture, and authentication credentials (managed by our authentication provider, WorkOS). If you sign in via a social provider (Google, Microsoft, etc.), we receive your name, email, and profile photo from that provider.

Profile and onboarding data

Industry, job function, skill level, learning goals, and assessment results you provide during onboarding. Organisation name and role if you join via an enterprise account.

Voice

You can talk with kju with or without an account. If you choose voice instead of typing, your microphone audio is processed, only while the conversation lasts, by xAI's Grok Voice model through Cloudflare so kju can understand your answers and reply. We do not record or keep the audio. Before sign-in, the answers it fills in are kept like typed answers: in a draft on your device and, if you start a sample session in the app, with that session. When you sign in and use those answers, we save them to your account. We use the microphone only after you tap the microphone button and allow it, and you can type instead at any time.

Learning data

Quiz answers, session scores, streaks, XP, level progression, track completions, course recommendations, and feedback you submit. This data powers your personalised learning experience.

Usage data

Pages visited, features used, session duration, device type, browser, and operating system. IP addresses are anonymised for analytics. Unless you allow optional analytics, measurement is cookieless: the IP address is used only to create an irreversible daily hash and is then discarded.

Payment data

If you subscribe to a paid plan, payment is processed by RevenueCat and its payment providers for individual plans, or by Stripe for organization plans. We do not store your full card number. We receive transaction confirmations and subscription status.

We use your personal data for the following purposes:

• Providing the Service — delivering personalised learning sessions, tracking your progress, and generating recommendations.
• Account management — authenticating your identity, managing your subscription, and communicating account-related updates.
• Improvement and analytics — analysing usage patterns to improve content quality, platform performance, and user experience.
• Enterprise reporting — if you use the Service through an organisation, providing learning progress reports to your organisation's administrators. This includes individual goals, onboarding answers, answers and practice questions within their managed organisation or team scope.
• Communication — sending service updates, learning reminders, and (with your consent) marketing communications.
• Legal compliance — fulfilling legal obligations, resolving disputes, and enforcing our terms.

Under the GDPR, we process your data on the following legal bases:

• Contract performance — processing necessary to provide the Service you signed up for (Article 6(1)(b)).
• Legitimate interests — improving the Service, preventing fraud, and ensuring security (Article 6(1)(f)).
• Consent — for optional marketing communications and non-essential cookies (Article 6(1)(a)).
• Legal obligation — where required by applicable law (Article 6(1)(c)).

We do not sell your personal data. We share data only with trusted service providers who process it on our behalf for the purpose of providing and improving our Service. All sub-processors are bound by data processing agreements and comply with applicable data protection regulations.

Some of our sub-processors are based outside the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission.

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (e.g., billing records for tax purposes, typically 7 years).

Under the GDPR and applicable Dutch data protection law, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — request that we limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw consent for optional processing at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

We use essential cookies to operate the Service (authentication, session management). We use optional browser analytics storage only after you allow it. If you decline, our analytics stores nothing in your browser and only provides privacy-hashed daily audience counts. Core service events may still be measured under our legitimate interest, without creating a personal analytics profile. Session replay, surveys, personal profiles, and third-party advertising tags remain off. Vercel Web Analytics and Speed Insights provide aggregate traffic and performance statistics on public pages, independently of your optional cookie choice. Do Not Track keeps browser analytics off. If you also allow advertising measurement, we load the LinkedIn Insight Tag, Google Ads conversion tag, OpenAI's ChatGPT Ads measurement pixel, and Google Analytics on public marketing pages, so we can measure waitlist, demo-request, and download campaigns and build advertising audiences. With your advertising consent, we also share hashed demo email addresses and qualified-lead and paid-team outcomes with Google and LinkedIn. We retain matching identifiers for up to 90 days after your demo request, and outcome records for up to 90 days after qualification or payment. Withdrawal removes the matching identifiers and stops future sends; a request already in flight may complete. We do not use these advertising services to measure learning activity or organisation and admin use. You can change or withdraw your choice below or through Cookie settings in the footer. Withdrawing advertising reloads the page to stop loaded tags and removes their accessible first-party identifiers. Cookies held on third-party domains are controlled by those providers and your browser.

Every cookie and storage item we use, with its purpose and duration, is listed on our Cookies page.

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Last updated" date. We encourage you to review this page periodically.

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

A kju learner can ask us to email a friend an invitation. If you received one, this is how we handle your email address. kju B.V. is the controller.

• Where it came from: the learner named in the email typed your address into kju. We did not get it from anywhere else.
• What we use it for: sending that one invitation, and stopping more invitations if you opt out. Never for marketing, and we do not add it to any mailing list.
• Legal basis: the legitimate interest of the learner who invited you, and ours in passing on their invitation (Article 6(1)(f)). At most one invitation per learner every 7 days, and at most three from all learners in any 7 days.
• How long we keep it: our record of each invitation email, and its entry in the inviting learner's list of sent invitations, are deleted about 30 days after that invitation was sent, whatever happens to the email afterwards. If you opt out, or your address bounces or reports the email as spam, we keep only a coded form of the address, which cannot be turned back into the address without our key, so we can keep honouring that. Our email provider, Resend, keeps its own delivery logs.
• Opting out: use the unsubscribe link in the email, or write to us. No account is needed.
• Your rights: you can object, ask what we hold about your address, or ask us to delete it, at [email protected]. You can also complain to the Autoriteit Persoonsgegevens (section 12).

For privacy-related questions or requests, contact us at: [email protected]

kju bv
Amsterdam, the Netherlands