Privacy Policy

1. Data controller and contact

Service: Klyra — https://klyralearn.com.
Data controller: Operator identity.
Address: Address.
Contact for personal data matters: Contact email.
Data protection officer: Data protection officer.

2. Data we process

Depending on how you use Klyra, the following data may be processed:

• account identifiers, including your email address and profile information;
• login and session information needed for authentication, including when you choose Google;
• courses, documents, content, questions and answers that you add or generate in the service;
• subscription data and status. Payments are processed by Stripe; Klyra does not receive your full card number;
• technical data and logs needed to operate, secure and troubleshoot the service;
• audience measurement data, only if you accept it in the cookie banner: pages viewed, usage events (for example account creation, completing onboarding, viewing the subscription page, clicking an offer, starting a payment, and confirmation of a subscription or payment with the amount, currency and plan concerned) and the standard technical information collected by Google Analytics (for example browser and device type). These events contain neither your name nor your email address; a Stripe checkout session reference is attached to the confirmation of a payment or subscription;

Authentication, account data and uploaded files are managed using Supabase. When you use “Continue with Google”, Google sends the information needed to authenticate the Klyra account, according to the permissions shown at the time of sign-in.

3. Purposes and legal bases

• Creating and administering your account, providing the features you request and saving your content: performance of a contract or pre-contractual measures.
• Managing subscriptions, payments and support requests: performance of a contract and compliance with applicable legal obligations.
• Protecting the service, preventing abuse and diagnosing incidents: Klyra’s legitimate interest in ensuring the security and proper functioning of the service.
• Measuring audience and understanding how the service is used, with Google Analytics 4, only with your consent, which you can withdraw at any time: consent.

Audience measurement (Google Analytics 4). Klyra uses Google Analytics 4, a Google service, to measure the site’s audience and understand how it is used so that it can be improved. Consent is handled by the “Audience measurement cookies” banner: by default every type of storage is denied, and no measurement cookie (_ga, _ga_*) is set until you click “Accept all”. Until you accept, the Google service is loaded in “denied” mode: Google may receive technical signals that do not rely on cookies. Your choice (accept or reject) is stored in your browser for 180 days, after which the banner asks you again. You can change or withdraw it at any time through the “Manage cookies” link (in the footer of the public pages and on your Profile page); if you reject or withdraw, the measurement cookies already set are deleted. The choice is a single one (“Accept all” / “Reject all”).

Klyra’s own audience measurement. In addition to Google Analytics, and under the same single choice in the banner, Klyra measures its own audience with a system independent of Google. Only if you accept: a random identifier stored in your browser (it is not derived from any personal data and is deleted if you withdraw), the pages visited (path only, never the query string), the language, the origin of your visit (referrer site and campaign parameters such as utm_source), a signal every minute while the tab is open, and the main actions (sign-up, sign-in, onboarding, use of the AI feature, starting a revision, quiz or flashcard session, subscription). Never the content of your documents, messages or questions to the AI, your email address, your IP address or any payment data. If you reject, nothing is recorded. Raw events are kept 13 months (the one-minute signals 7 days), daily aggregates 25 months, and are only visible to Klyra’s administrators.

4. Artificial intelligence content and features

The documents and instructions you submit may be sent to the providers needed for the artificial intelligence features you use, in particular to generate, explain, correct or analyze documents and images. The reference country of this policy is France; this does not mean that data is hosted or processed in France. The rules applicable to international transfers apply where they take place. Avoid adding sensitive data or information about third parties to your documents.

5. Recipients and transfers

Access to data is limited to the people and providers who need it to operate, secure and support the service. Depending on the features used, some data may be shared with the providers responsible for hosting and storage, authentication, artificial intelligence features or payments. The countries where these providers process data depend on their infrastructure and configuration. The reference country is France, without presuming the location of the servers. International transfers, where they take place, are subject to the applicable rules. Host: Host. When you accept audience measurement, measurement data is sent to Google (Google Analytics 4); a cookie consent banner is integrated into the service.

6. Retention periods

Data is kept for as long as necessary for the purposes for which it is processed, subject to applicable legal obligations. At the end of these periods, it is deleted or archived where the law requires it. Providers may apply their own retention and backup rules.

• Account data, content, invoices, security logs and support requests follow this criterion, subject to the legal obligations specific to certain data.
• Audience measurement data is kept by Google Analytics for the retention period set in our Google Analytics property; your consent choice is kept in your browser for 180 days at most.

7. Your rights

Under the conditions provided for by applicable regulations, you may request access to your data, its rectification, erasure, restriction of its processing, its portability, or object to certain processing. Where processing is based on your consent, you may withdraw it at any time for the future (for audience measurement, directly through “Manage cookies”). To exercise your rights, contact Klyra at the address given in the contact information. You may also lodge a complaint with the CNIL (www.cnil.fr) if you believe your rights are not being respected.

8. Security and changes

Klyra implements appropriate technical and organizational measures to protect data. As no online service can guarantee absolute security, protect your credentials and report any unauthorized use using the contact information given on this page. This policy may change; its update date will then be modified.