Privacy Policy
The short version: we collect an email address so we can give you what you paid for. We do not sell anything about you, we do not build a profile, and nothing about your child ever reaches us.
This policy explains what we do with personal data under the General Data Protection Regulation. Last updated 3 September 2026.
Who is responsible
The controller is Alyce Beatriz Barroso de Lima, R. Infante Dom Henrique 188, 8500-694 Portimao, Portugal. Portuguese tax number (NIF) 292539096. For anything about your data, write to privacy@kaolokids.com. We answer every message ourselves; there is no data protection officer because the scale of our processing does not require one.
What we collect, why, and on what legal basis
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address and name from checkout | To send your access link and answer you about your order | Performance of the contract | As long as your access lasts |
| Purchase record: plan, amount, date, Stripe reference | To prove the sale, handle refunds, and meet accounting law | Legal obligation and contract | 10 years, as Portuguese tax law requires |
| Billing country and tax number, if you enter one | To issue an invoice and apply the right tax | Legal obligation | 10 years |
| Card brand and last four digits, held by Stripe | Fraud prevention and to identify a payment | Legitimate interest in preventing fraud | Held by Stripe under its own policy |
| What you write in the contact form | To answer your question | Legitimate interest in replying to you | Deleted once the matter is closed, at most 24 months |
| Email you give for the free sample lesson | To send you that one email | Consent, given by submitting the form | Until you ask us to delete it |
| Server logs: IP address, page, time | Security and diagnosing faults | Legitimate interest in keeping the site working | Kept by Vercel for a short period, normally under 30 days |
What never leaves your own device
Your access token and the lessons you have ticked off are stored by your browser, in localStorage, on your own machine. They are never transmitted to us and we cannot read them. Clearing your browser data deletes your ticks, and you get back in with the link from your purchase email.
We do not collect anything about your child
Nowhere on this site do we ask for a child's name, date of birth, photograph, school or any assessment result. The contact form has an optional field for a child's age in years, which you can leave empty; it exists only so we can point you at the right plan. Nothing in the lesson area records your child's progress on our side.
Who else processes your data
We use a small number of processors, each under a data processing agreement:
- Stripe Payments Europe, Ltd. (Ireland), for payment, invoicing and fraud prevention. Stripe is a controller in its own right for parts of this. See stripe.com/privacy.
- Resend (United States), to send your access email and to deliver contact form messages to us. Covered by the EU-US Data Privacy Framework and standard contractual clauses.
- Vercel Inc. (United States), which hosts the site and keeps short-lived server logs. Same safeguards.
We do not sell personal data, we do not share it with advertisers, and we do not use it to build a profile or to make an automated decision about you.
Transfers outside the European Economic Area
Resend and Vercel are established in the United States. Those transfers rely on the European Commission's standard contractual clauses and, where applicable, on the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards at privacy@kaolokids.com.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it to you in a portable format. You can object to processing we base on a legitimate interest, and you can withdraw a consent you gave, which does not undo what was lawful before you withdrew it.
Write to privacy@kaolokids.com. We reply within 30 days and we do not charge for it. We may ask you to confirm the email address you paid with, so that we do not hand your data to someone else. Note that deleting your purchase record also closes your access to the lessons, and that we must keep invoice data for the period tax law requires even if you ask for deletion.
Complaining to a regulator
If you think we have handled your data badly, tell us first. You also have the right to complain to the Portuguese data protection authority, the Comissao Nacional de Proteccao de Dados (CNPD), at cnpd.pt, or to the authority in the EU country where you live.
Cookies
What is stored in your browser and what runs only with your permission is set out on the Cookie Policy page, where you can also change your choice.
Security
The site is served over HTTPS. Access tokens are signed so that they cannot be forged or edited. We do not store card numbers at any point. If a breach ever affected your data in a way likely to put you at risk, we would tell you and the CNPD without undue delay.
Changes
If we change this policy in a way that affects you, we will say so on this page and change the date at the top.