Privacy & Compliance

1. Who We Are

Kuliso is an AI-powered tutoring platform designed for PreK–12 students. Kuliso is operated by Polsia Inc., a technology company focused on educational tools. When we say “Kuliso,” “we,” “us,” or “our” in this policy, we mean Polsia Inc. and the Kuliso platform.

This Privacy Policy covers the Kuliso web application at kuliso.org and any related services. It applies to students, parents, guardians, teachers, and school administrators who use Kuliso.

2. Data We Collect

We follow a strict data minimization principle. We collect only what is necessary to provide the tutoring service.

Student Information (Minimal Collection)

• Student name (first name and last initial, or a teacher-assigned alias)
• Email address (if provided by teacher or parent for account access)
• Grade level and subject preferences (set by teacher or parent)
• Session transcripts — questions and answers exchanged with the AI tutor
• Assessment results and progress metrics
• Learning support preferences (e.g., text-to-speech enabled, simplified language on)

Teacher & Parent Account Information

• Name and email address
• School name and grade level(s) taught (teachers)
• Password (stored as a one-way hash — we cannot read your password)
• Subscription and billing information (processed by Stripe; we do not store card numbers)

Technical Data

• Browser type and device type (for compatibility)
• IP address — used on first visit to auto-detect jurisdiction (US state or Canadian province); not stored long-term; not linked to student profiles
• Session timestamps

Geo-Detection & Jurisdiction Preference

• IP-based detection (transient): On your first visit, we use your IP address to identify your likely state or province (e.g., Texas, Virginia, Ontario). The IP itself is not stored — it is used only for this one-time detection.
• Jurisdiction code stored: We save a short jurisdiction code (e.g., “TX”, “VA”, “ON-CA”) to your profile so that all Kuliso pages — the test bank, mastery tracker, reports, micro-lessons — reflect your local curriculum standards (TEKS in Texas, SOL in Virginia, Ontario Curriculum in Ontario, etc.).
• User control: You can view and change your jurisdiction at any time in Account Settings. We use it only for curriculum personalization. It is never used for advertising, behavioral profiling, or shared with third parties.

Adaptive Assessment & CAT Data

• Individual question responses and response times
• Difficulty progression across sessions (the CAT engine tracks how hard questions get over time)
• Depth of Knowledge (DOK) performance per standard
• Mastery levels per state standard (e.g., TEKS §110.7, SOL 4.4)
• CAT proficiency band estimates (below basic, basic, proficient, advanced)

This data is used exclusively to adapt question difficulty in real-time and to generate mastery reports. Students see their own mastery. Teachers see their classroom. Admins see school/department aggregates. District admins see district-level aggregates. No individual student data is shared outside the student’s school hierarchy.

SEL & Wellbeing Check-In Data

• Optional mood ratings (if the teacher has enabled wellbeing check-ins)
• Confidence scores and frustration signals captured during sessions

This data is treated as sensitive student data. It is visible only to the student’s own teacher and authorized school administrators. It is used for MTSS tier routing and identifying students who may benefit from additional support. It is never included in cross-teacher or district-level aggregate views.

Home Language & Bilingual Content

• Student’s home language preference (set by teacher or parent)
• AI-generated translations are cached on our servers for performance after initial generation

Language preference is used only to generate native-language tutoring content and translated test prep materials. It is not used for profiling or shared with third parties.

3. Student Access Model

Students access Kuliso exclusively through teacher join codes. There is no direct student registration. Here’s how it works:

• A teacher creates a classroom and receives a unique join code
• Students enter the join code to access the tutoring platform
• Teachers retain full control over which students can access their classroom
• Parents on Family Plans enroll their children directly — the child does not self-register

This model ensures that no student under 18 can create an account independently. All student access is mediated by a responsible adult (teacher or parent).

4. How We Use Your Data

Student data is used exclusively to provide and improve the tutoring experience:

• Personalize tutoring — adapt difficulty, pace, and content to the student’s level
• Curriculum personalization — jurisdiction code determines which state or provincial standards appear across the test bank, mastery tracker, reports, micro-lessons, achievement cards, and Wrapped
• Adaptive difficulty (CAT) — the Computer Adaptive Testing engine uses question response data to select the next question in real-time, targeting the right challenge level for each student
• Cross-classroom reporting — aggregated, anonymized mastery percentages by classroom/department/grade help teachers identify standards gaps for professional development; individual students are never visible in these views
• MTSS support routing — SEL and wellbeing data helps teachers identify students who may need Tier 2 or Tier 3 support; only visible to the student’s own teacher and authorized admins
• Track progress — generate learning reports for teachers and parents
• Maintain the service — ensure reliability, diagnose bugs, prevent abuse
• Communicate — send progress summaries to teachers and parents (opt-in)

We do NOT use student data to:

• Train AI or machine learning models
• Serve advertisements of any kind
• Build profiles for marketing or commercial purposes
• Share with or sell to any third party for non-educational purposes
• Create behavioral or psychological profiles of students

4a. Geo-Detection & Jurisdiction Personalization

When you first visit Kuliso, we use your IP address to detect your likely state or province (for example, Texas, Virginia, Ontario, or Quebec). This detection happens one time, at the start of your first session.

What we do with the detection:

• We map your IP to a jurisdiction code (e.g., “TX”, “VA”, “ON-CA”, “QC-CA”)
• That code is saved to your account profile
• The IP address itself is not stored beyond this detection step

How jurisdiction data is used: The jurisdiction code controls which curriculum standards appear across the entire platform — your test bank draws from local standards (TEKS in Texas, SOL in Virginia, Ontario Curriculum in Ontario, QEP in Quebec), and your mastery tracker, reports, micro-lessons, achievement cards, and Wrapped all reflect those local standards.

What jurisdiction data is NOT used for: It is not used for advertising, behavioral profiling, or any commercial purpose. It is not shared with third parties. It is not used to determine pricing. It is used only for curriculum standard personalization.

4b. Adaptive Assessment & CAT Data

Kuliso uses Computer Adaptive Testing (CAT) to adjust question difficulty in real-time based on student performance. To do this, the platform collects detailed assessment data.

What is collected:

• Question responses: Which answer the student selected for each item
• Response times: How long the student spent on each question
• Difficulty progression: The CAT engine tracks the difficulty level of every question served and adjusts the next question up or down based on correctness
• DOK performance: Mastery at each Depth of Knowledge level (recall, skill/concept, strategic thinking, extended thinking) per standard
• Standard-level mastery: Estimated mastery percentage for each state or provincial curriculum standard the student has encountered
• Proficiency band: The CAT engine estimates a proficiency band (below basic, basic, proficient, advanced) that is updated after each session

Who can see this data:

• Student: Their own mastery dashboard and session history
• Teacher: Their own classroom — individual student mastery and class-level summaries
• School admin: School-level aggregates by classroom, grade level, and department
• District admin: District-level aggregates across schools

Adaptive assessment data is not shared outside the student’s school or district hierarchy, not sold, and not used for AI model training.

4c. Cross-Teacher Comparison & Classroom Aggregates

To help teachers identify standards gaps and collaborate on professional development, Kuliso surfaces aggregated, anonymized mastery data across classrooms.

What teachers see: Teachers can view average mastery percentages for selected standards across their grade level or department, broken down by classroom (shown as “Classroom A”, “Classroom B”, “Classroom C” by default). No teacher names or individual student names are visible in this view.

Named view for administrators: School admins and district admins can toggle on a named view to see which classroom belongs to which teacher. This is disabled by default and is available only to users with admin-level access.

This data is used solely to support teacher collaboration and professional development. It is not shared outside the school or district, not sold, and not used for advertising.

4d. SEL & Wellbeing Data

When a teacher enables wellbeing check-ins for their classroom, Kuliso collects brief check-in data from students:

• Mood ratings: Simple emoji-based mood check-ins at the start or end of a session (e.g., “How are you feeling today?”)
• Confidence scores: Self-reported confidence ratings on specific topics (“How confident are you about fractions?”)
• Frustration signals: Automatically detected signals during sessions (e.g., repeated incorrect answers, long pauses, repeated replay of instructions) that may indicate a student is struggling

This data is treated as sensitive student data:

• It is visible only to the student’s assigned teacher and authorized school administrators
• It is never included in cross-teacher comparison views or district-level aggregates
• It is never shared with other students, other teachers, or any third party
• It is used to help teachers route students to the right level of MTSS support (Tier 1, 2, or 3), not to create behavioral profiles

SEL data is retained on the same schedule as other student data (see Section 12) and can be deleted on request via the Privacy Request Center.

5. AI Provider & Data Processing

Kuliso uses Google Gemini (Gemini 2.5 Pro and Gemini 2.0 Flash) as its AI engine for tutoring interactions.

• Data processing location: All student data sent to Google Gemini is processed on United States servers. No student data is sent to non-US servers.
• No AI training: Google Gemini API data is not used to train Google’s AI models. Per Google’s API Terms of Service, data submitted through the Gemini API is not used to improve Google’s products.
• Session-scoped context: The AI receives only the current student’s session context. No cross-student data is included in any prompt.
• No persistent storage by Google: Prompts and responses are processed in real-time and are not stored by Google beyond the immediate API transaction, subject to Google’s data retention policies for API abuse prevention (typically 30 days or less).

7. Data Storage & Security

• Encrypted at rest — all database records stored with AES-256 encryption
• Encrypted in transit — all connections use TLS 1.2+ (HTTPS only)
• Hosted in the United States — data stored on Render.com and Neon (PostgreSQL), both U.S.-based, SOC 2 Type II certified cloud providers
• Access controls — only authorized Kuliso staff can access production data, under a least-privilege policy
• Role-based isolation — teachers see only their own classrooms; students see only their own data; no cross-account data access
• No third-party analytics on student pages — we do not load third-party tracking scripts on student-facing pages

For a detailed technical security overview suitable for district IT review, contact support@kuliso.org.

8. Data Sharing & Sub-Processors

We do not sell student data. We do not share student data with advertising networks, data brokers, or any commercial third parties. Ever.

We work with a small set of service providers strictly to operate the platform:

All service providers are bound by data processing agreements that prohibit using student data for any purpose other than providing the contracted service. We will provide at least 30 days’ notice before adding or replacing sub-processors.

We may disclose data if required by law (e.g., a valid court order), but we will notify affected schools and parents to the extent permitted by law before complying.

9. FERPA Compliance

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records at schools receiving federal funding.

How Kuliso fits under FERPA:

• Kuliso acts as a “school official” as defined in 34 CFR § 99.31(a)(1)
• We have a legitimate educational interest in accessing student records — specifically to provide AI tutoring services
• We use education records only for the purposes for which the school has shared them
• We do not re-disclose education records to third parties without school authorization
• We maintain direct control over student records as directed by the school
• We maintain a FERPA audit log recording every access to student PII

School responsibilities: Schools using Kuliso should identify Kuliso as a school official in their FERPA annual notice and maintain a Data Processing Agreement with us. Our standard DPA is available at kuliso.org/student-data-privacy.

10. COPPA & Children Under 13

Kuliso serves PreK–12 students, which includes children under 13. We comply with the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501.

How we protect children under 13:

• Students do not create their own accounts — they access Kuliso through teacher join codes or parent enrollment
• We collect only the minimum information necessary for the service (name, email, grade level)
• We do not show behavioral advertising to any users
• We do not condition a child’s participation on providing more information than is reasonably necessary

Family Plan route: When a parent creates a Family Plan and enrolls their child, the parent’s account creation constitutes verifiable parental consent for data collection under COPPA.

Parents may request review, correction, or deletion of their child’s data at any time. See Section 14.

11. Data Ownership

The school district or parent owns all student data. Kuliso does not claim ownership of student records, session transcripts, assessment results, or any data generated by students using the platform.

• Schools and districts may request a full export of their student data at any time
• Parents may request export of their child’s data at any time
• Upon termination of service, all student data is returned (upon request) or deleted
• We do not use student data for any purpose beyond providing the contracted tutoring service

12. Data Retention & Deletion

Active accounts: Student data is retained for as long as the teacher or parent account remains active.

After account cancellation: Data is soft-deleted (removed from active systems) within 30 days and permanently purged from all backups within 90 days of cancellation.

School or district request: We will delete all student data for a school within 30 days of a written request from an authorized school administrator.

Parent request: Parents may request deletion of their child’s data at any time. Deletion from active systems within 30 days; backup purge within 90 days.

Anonymized data: We may retain aggregated, fully anonymized analytics (e.g., “average session length by grade level”) with no personally identifiable information, indefinitely, for service improvement.

Audit logs: FERPA audit logs (recording who accessed what data and when) are retained for 5 years, even after student account deletion. These logs contain no personal tutoring content.

To request data deletion, email support@kuliso.org with “Data Deletion Request” in the subject line, or use the Privacy Request Center.

13. Breach Notification

In the event of a data breach involving student information, we will:

• Investigate and contain the breach within 24 hours of discovery
• Notify affected schools and districts within 72 hours of confirming a breach
• Notify affected parents and guardians as required by applicable state law
• Provide a written incident report detailing: what happened, what data was involved, remediation steps taken, and recommended actions for affected users
• Cooperate fully with schools’ incident response teams and legal counsel

To report a suspected security issue or vulnerability, contact support@kuliso.org.

14. Parent & Guardian Rights

As a parent or legal guardian, you have the following rights regarding your child’s data:

• Right to access — request a copy of all data we hold about your child
• Right to correct — request corrections to inaccurate or incomplete data
• Right to delete — request permanent deletion of your child’s data
• Right to restrict — ask us to stop using your child’s data for specific purposes
• Right to export — request a machine-readable copy of your child’s data
• Right to withdraw COPPA consent — immediately suspends the student account pending deletion

To exercise any of these rights, email support@kuliso.org or visit the Privacy Request Center. We will respond within 10 business days.

We will never retaliate or degrade the service for users who exercise their privacy rights.

15. Canadian Users — PIPEDA & Quebec Law 25

Kuliso serves Canadian students, teachers, and schools — primarily through provincial curriculum support for Ontario (Ontario Curriculum), British Columbia (BC Curriculum), Alberta (Alberta Program of Studies), and Quebec (QEP). Canadian users have additional rights under federal and provincial privacy law.

PIPEDA (Personal Information Protection and Electronic Documents Act)

For Canadian users outside Quebec, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to the collection, use, and disclosure of personal information in the course of commercial activities.

• Consent: We collect information with the knowledge and consent of the individual (or the school acting on behalf of the student, as appropriate under applicable law)
• Limiting collection: We collect only the information necessary for the identified purposes
• Limiting use, disclosure, and retention: Student data is used only for educational personalization and is not disclosed for other purposes
• Accuracy: We keep data as accurate as needed for its purpose; individuals may request corrections
• Safeguards: All data is encrypted at rest (AES-256) and in transit (TLS 1.2+)
• Openness: This privacy policy describes our practices fully and is publicly accessible
• Individual access: Canadian users may request access to their personal information. See Section 14 and the Privacy Request Center.

Our Privacy Officer can be reached at support@kuliso.org. Complaints that cannot be resolved by us may be escalated to the Office of the Privacy Commissioner of Canada (priv.gc.ca ↗).

Quebec Law 25 (Law 25 / Bill 64)

Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25), as amended by Bill 64, imposes additional requirements for Quebec residents:

• Privacy by design: Kuliso incorporates privacy considerations into its system design, including data minimization, purpose limitation, and access controls
• Confidentiality incident notification: In the event of a confidentiality incident likely to cause serious injury, affected individuals and the Commission d’accès à l’information (CAI) will be notified
• Right of access and rectification: Quebec residents may request access to or correction of their personal information
• Right to be forgotten / de-indexation: Quebec residents may request deletion of information that was collected, used, or communicated contrary to law, or where the purposes for which it was collected have been fulfilled
• Privacy impact assessment: Kuliso conducts privacy impact assessments before implementing new features that involve significant collection or processing of personal information

16. Terms of Service

The full Terms of Service govern your use of Kuliso. Key points:

Who these terms apply to:

Key terms:

• Educational use only — Kuliso is a tutoring tool, not a replacement for qualified instruction or specialized learning services
• Students don’t self-register — all student access is mediated by a teacher or parent
• AI disclaimer — the AI tutor may occasionally produce inaccurate responses; teachers and parents should review when accuracy is critical
• Cancel anytime — no long-term lock-in. See our Refund Policy
• Intellectual property — student session transcripts belong to the student’s school or parent, not Kuliso

Read the full Terms of Service →

Policy Changes

We may update this Privacy Policy and Terms of Service periodically. When we make significant changes, we will notify active account holders by email at least 30 days before the new terms take effect.

For minor changes (corrections, clarifications), we will update this page and the “Last updated” date. Continued use of Kuliso after the effective date means you accept the updated policy.

Legal Disclaimer

We are committed to transparency and will work cooperatively with districts during vendor vetting, including providing signed DPAs, completing privacy questionnaires (e.g., LearnPlatform, Common Sense Media Privacy Program), and responding to legal review requests.

17. Contact & Questions

Questions about this policy? Need a signed DPA? Want to exercise your privacy rights? We respond quickly.