Privacy Policy

Last updated: June 18, 2026

1. Controller

Albatross Technologies UG (haftungsbeschränkt)
c/o IP-Management #9631
Ludwig-Erhard-Straße 18, 20459 Hamburg, Germany
Email: info@albatrossen.de
Managing Director: Dr. Jan Baumbach

2. Data We Collect

To create and use a Kanna account we collect and store on our own servers:

Account data: email address, a securely hashed password, and display name. For child accounts, a parent/guardian may additionally provide the child's age, gender, and school type. Accounts are organised into a shared family "household".
Content you provide: documents you upload as source material (e.g. PDF, DOCX, TXT, images), the exercise sets and exercises generated from them, and chat messages exchanged with the AI tutor and the exercise planner.
Learning data: the answers children submit, whether they were correct, and the resulting scores and progress statistics.
Embeddings: vector representations of your uploaded documents, stored in our ChromaDB instance on our servers, used for semantic search when generating exercises.
Usage data: AI token counts and monthly budget information used to enforce fair-use limits.

3. Purpose of Data Processing

We process your data to:

Authenticate users and manage accounts and households.
Provide the core service: AI-assisted generation of school exercises, automatic grading, an explanatory tutor chat, and progress statistics.
Track AI usage to enforce fair-use limits.
Maintain and improve the quality of the service.

4. Children's Data

Kanna is designed to be set up and supervised by a parent or legal guardian. The parent creates the household, invites and configures any child accounts, and is responsible for the child accounts and for the content provided. By creating a child account, the parent/guardian consents to the processing of that child's data as described in this policy. If you believe a child's data has been provided to us without appropriate consent, please contact us and we will delete it.

5. Third-Party Services

Your content is processed through the following third-party service:

Google Gemini API: texts and documents are sent to Google's AI models to generate exercises, grade answers, power the tutor chat, and create embeddings. Google's API Terms of Service apply.

We do not use payment processors, advertising networks, or third-party analytics. We do not sell or share your personal data with any other third parties.

6. Data Storage and Security

All your data — including accounts, uploaded documents, generated exercises, answers, embeddings, and statistics — is stored exclusively on our own secured servers located in Germany (Hetzner infrastructure). We use encryption in transit (HTTPS/TLS) for all communications. Database and filesystem access is restricted to authorized systems only. Passwords are stored only as salted hashes.

7. Data Retention and Deletion

Your data is retained as long as your account exists. A parent can remove a household member (and their data) from the Family screen at any time. To delete your entire household or request erasure, contact us at info@albatrossen.de. Upon deletion, the following is permanently removed from our systems:

The affected user accounts and profile data.
Uploaded documents and the files derived from them.
Generated exercise sets, exercises, answers, and statistics.
All embeddings and vector index data (ChromaDB collections).

8. Your Rights (GDPR)

Under the EU General Data Protection Regulation, you have the right to:

Access your personal data.
Rectify inaccurate data.
Request erasure of your data ("right to be forgotten").
Restrict or object to processing.
Data portability.
Lodge a complaint with a supervisory authority.

To exercise these rights, contact us at info@albatrossen.de.

9. Cookies

We use a single session cookie solely for authentication purposes. We do not use tracking cookies or third-party analytics.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date.