Privacy Policy

1. Who we are

Lernoa is operated by Corvidae Limited (New Zealand) ("we", "us", "our"). This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use the Lernoa website and app (the "Service").

We are a New Zealand company and we comply with the New Zealand Privacy Act 2020 and its Information Privacy Principles. The short version of our whole approach: we collect the minimum we need to run a study app, we never sell your data or use it to train AI models, and you can export or delete everything in one tap.

2. What we collect

2.1 Information you provide

• Account details: Email address, display name, and a password (or a social sign-in via Google or Microsoft).
• Decks and cards: The decks and cards you create, import (from Anki or CSV), or generate with AI, including any images you add.
• Study activity: Your reviews, self-ratings, review schedule, streaks and progress — the data the spaced-repetition engine needs to schedule your next review.
• AI generation prompts: The topic, level and card count you enter when you generate a deck with AI — see section 4.
• Payment information: Payments are processed by Stripe. We receive limited billing details (such as which credit pack you bought and the last four digits of your card) but never your full card number. All purchases are one-off — we hold no recurring billing mandate.
• Communications: Messages you send via the contact form or support channels.

2.2 Information collected automatically

• Usage data: Features used and credit transactions (so we can show your balance and history).
• Device information: IP address, browser type, operating system.
• Cookies and similar technologies: See section 9.

2.3 We keep it minimal

Your decks and study history belong to you. We collect only what the features need, we never sell your data, we never share it with advertisers, we don't build advertising profiles from it, and we don't use your content to train AI models. Lernoa is a study tool, not a medical or professional-advice service.

3. How we use your information

We use personal information to:

• Provide the Service — store your decks and cards, run the spaced-repetition engine, sync across your devices, and show your progress and stats
• Generate decks with AI from the topics you enter
• Manage your credit balance and process one-off purchases
• Send you service messages (receipts, security notices, support replies) — not marketing, unless you opt in
• Respond to your inquiries and provide support
• Detect, prevent, and address technical issues, abuse, or fraud
• Comply with legal obligations

Where the law requires consent for particular processing (for example, non-essential cookies), we ask for it first, and you can withdraw it at any time.

4. AI features

When you generate a course or deck, chat about a course or document, or listen to a course, Lernoa uses AI services within Amazon Web Services: Amazon Bedrock (running Anthropic Claude models) for generation and chat, and Amazon Polly for audio narration. Here is exactly what happens:

• Per-request only: Your topic or the relevant text of your document/course is sent securely to the AI provider, which returns the draft course, deck, answer or audio. The provider processes the request in the moment and does not retain your content or use it to train its models.
• What we keep: The generated course or deck lives in your account, where you can edit or delete it. Narration audio is cached privately in your account's storage so it is only synthesized once, and is deleted with the course. You control it entirely.
• No training on your content: Your prompts, documents, courses, decks and study history are not used to train AI models — ours or anyone else's.
• Drafts are drafts: AI output can be wrong or incomplete. You can review and edit cards, and verify course content, before or after you study it.

5. ChatGPT and AI assistant integrations

You can choose to connect your Lernoa account to ChatGPT, Claude, or another AI assistant that supports the Model Context Protocol (MCP), through our server at api.lernoa.com/mcp. See our ChatGPT plugin help page for the full list of what it can and cannot do. In summary:

• You choose to connect it. The integration is off until you approve it, and you approve it through an OAuth consent screen that names the assistant and lists exactly what it can and cannot do.
• What it can request: only your own courses, decks, cards, subjects, chapters, course notes, materials, and study settings and progress, and only when the assistant calls a tool to fetch or change one of those categories in response to something you asked it to do.
• Task-relevant data only: each tool call returns only the data needed for that specific request, not a bulk copy of your account.
• No chat-history access: Lernoa does not receive your full conversation history with ChatGPT or any other assistant, only the specific inputs sent when a tool is called.
• Disconnecting: you can disconnect an assistant at any time from Settings, "Connected AI apps", in the Lernoa app, or from that assistant's own connected-apps settings. Disconnecting revokes its access immediately.
• Disconnecting does not delete your account. It only ends that assistant's access; your Lernoa account and content remain exactly as they were. Deleting your account is a separate action in Settings.

6. When we share information

We do not sell your personal information, and we do not share your decks or study history with advertisers. We disclose personal information only in these situations:

• Service providers: Trusted third parties that run parts of the Service under confidentiality and security obligations:
  • Amazon Web Services (AWS) — hosting, database and file storage
  • AI generation and chat (Amazon Bedrock, running Anthropic Claude models) — per-request only; no retention, no training on your content
  • Audio narration (Amazon Polly) — per-request synthesis of your course text; no retention, no training on your content
  • Amazon SES — account and notification emails
  • Stripe — one-off payment processing
  • Cloudflare Turnstile — bot and abuse protection
  • Google and Microsoft — optional social sign-in; analytics only where enabled and consented (see section 9)
• Legal requirements: When required by law, court order, or governmental authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets (you will be notified).
• Protection: To protect our rights, property, or safety, or that of our users.

Data location: The Service is hosted on AWS in the Asia-Pacific region (New Zealand and Australia). Some providers (for example, Stripe, Google, and Microsoft) operate globally. When personal information is disclosed overseas, we take reasonable steps to ensure it receives protection comparable to the NZ Privacy Act 2020, as Information Privacy Principle 12 requires.

7. Security and retention

• Data is encrypted in transit and at rest
• Access controls and authentication protect our systems
• AI generation prompts are processed per-request and not retained by the AI provider (section 4)
• Your decks and study history are kept while your account is active so your schedule and progress work

When you delete your account (one tap in Settings), your personal information is deleted. We may retain limited records where the law requires it (for example, tax records of purchases). No method of transmission over the Internet is 100% secure, but we work hard to protect your information.

8. Your rights — export and delete in one tap

Under the NZ Privacy Act 2020 you have the right to access and correct your personal information. We go further and build the controls in:

• Export: Download your complete decks and account data in a structured, machine-readable format — one tap in Settings.
• Delete: Permanently delete your account and all your data — one tap in Settings, no email ping-pong, no retention dark patterns.
• Access & correction: Your decks and cards are fully visible and editable in the app at all times.
• Complaints: Contact us first at support@lernoa.com. If you are not satisfied, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

9. Cookies and analytics

• Essential cookies: Required for the Service to function — sign-in, security, and your preferences.
• Analytics (only where enabled): We may use privacy-respecting usage analytics on the marketing site to understand how pages are used. Visitors from regions requiring prior consent (EEA/UK) are asked before any non-essential cookie is set; everyone can adjust or withdraw via the "Cookie settings" link in the footer.
• No ad tracking of your study data: Your decks and study history are never used for advertising.

10. Children's privacy and educational use

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have, please contact us immediately.

The ChatGPT and AI assistant integration described in section 5 is built to be appropriate for a general audience, including users aged 13 to 17, and is not aimed at or marketed to children under 13. This is separate from the minimum age to hold a Lernoa account: because the integration only ever operates within an existing, authenticated Lernoa account, and creating that account already requires you to be at least 16 (see our Terms and Conditions), no one under 16 can use the integration in the first place.

• Progress is not an official grade. Course completion, quiz scores, and study statistics shown in Lernoa or returned through an AI assistant are self-assessment only. They are not an accredited grade, qualification, or result from any school, university, or examination body.
• No guarantee of exam success. Lernoa is a study aid. We do not guarantee any exam, test, or assessment outcome from using it.
• Academic integrity. Lernoa and its AI assistant integration are designed to support learning, for example by explaining material, building study aids, and organising revision. They must not be used to complete graded coursework, assignments, or controlled or live assessments on a student's behalf, or otherwise to misrepresent someone else's work as the student's own.
• Copyright and takedown. If you believe content stored in a Lernoa account infringes your copyright, contact support@lernoa.com with a description of the work and its location, and we will review and act on the request; see our Support page for details.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. We will never quietly downgrade your privacy: material changes to how we handle your decks or study data will be announced in the app.

12. Contact

Questions, concerns, or requests about this Privacy Policy or our data practices: