Privacy Policy

• Name: Kissho Co., Ltd.
• Address: Kissho Bldg., 5-8-19 Mejiro, Toshima-ku, Tokyo, Japan
• Representative: Zhou FEI
• Contact: jerry@kissho.school

• Account information: email address, password (stored encrypted), family name, display language
• Learner information: name or nickname, display name, age, school year, Catherine's speaking style, avatar text
• Learning information: subjects, goals, learning plans, conversations and answers during lessons, learning records, progress, and learning profiles built from these
• Purchase information: plan, amount, date, and payment status. Card numbers are collected by our payment provider, not by us
• Device and usage information: an identifier for each signed-in device (a random value we issue), device type, IP address, browser details, access times, error logs
• Consent records: which document, version, and language you agreed to, and when, with IP address and browser details
• What you send us when you contact us

• to register accounts, verify identity, and manage sign-in
• to make learning plans for each learner, teach lessons, and adjust plans
• to show learning records and learning profiles
• to charge fees, confirm payments, grant learning time, and give refunds
• to prevent misuse and keep the Service secure
• to investigate faults and maintain and improve the Service
• to answer enquiries and send important notices
• to comply with the law

We do not use personal information beyond these purposes. We do not serve ads or analyse data for marketing.

To create lesson content and learning plans, we send learning goals, the learner's name, age, and school year, and the content of conversations and answers to the companies that provide our AI models. They are listed in section 6.

We keep information not needed for learning, such as home address, school name, or phone number, out of what we send to the AI. Please also avoid typing such details into lessons.

We do not share personal data with third parties without the consent of the person concerned (or, for a minor learner, their legal guardian), except:

• where the law requires it
• where it is necessary to protect someone's life, body, or property and consent is hard to obtain
• in other cases permitted by the APPI

When we outsource work, we choose contractors carefully and supervise them as needed.

The Service uses the following companies, and personal data is stored or processed in these countries:

• Database and sign-in: Supabase, Inc. (United States), with data stored in Japan (Tokyo)
• Website hosting: Vercel Inc. (United States), processing mainly in Japan (Tokyo)
• Background processing and some servers: Alibaba Cloud (China)
• AI models: DeepSeek (China); when it cannot respond, we switch to Zhipu AI (China)
• Payments: Stripe (United States)

About these countries' rules:

• United States: there is no comprehensive federal privacy law; there are sector-specific laws and state laws such as the California Consumer Privacy Act.
• China: there is a Personal Information Protection Law; there are also laws that let government bodies require companies to provide information, such as the National Intelligence Law.

For details, see the survey of foreign personal information protection systems published by Japan's Personal Information Protection Commission. We use these companies only after reviewing their terms, data-handling commitments, and security.

• Organisational: a named person is responsible for personal data, and handling is reviewed regularly
• Personnel: everyone who handles personal data is bound to confidentiality
• Physical: devices that handle personal data are protected against theft and loss
• Technical: encrypted connections (HTTPS), data separated by family, least-privilege access, encrypted password storage, monitoring for unauthorised access
• External environment: we take the rules of the countries in section 6 into account

• We keep personal information while your account exists, to provide the Service.
• When you pause a subject in the app, it is hidden from Home and the learner page; its records remain available under Review and it can be resumed. When you delete a learner, that learner's data is no longer shown or used to provide the Service. The data stays in our systems to help improve the Service and investigate faults. For complete erasure, contact us as described in section 10.
• How to close your account, and what happens to the data afterwards, is described in Account and Data Deletion.
• Records the law requires us to keep, such as transaction records, are kept for the period the law sets.

The Service uses cookies to keep you signed in, remember your display language, and identify signed-in devices. We do not use cookies for advertising or third-party analytics.

The person concerned (or, for a minor learner, their legal guardian) may ask us to state the purposes of use, disclose personal data we hold (including records of sharing with third parties), correct, add to, or delete it, stop using or erase it, or stop sharing it with third parties.

Email requests and questions to jerry@kissho.school. Once we have confirmed your identity (for example, by a message from the registered email address), we will respond without delay, free of charge.

We will announce changes to this policy in the Service. For significant changes, such as new purposes of use, we will ask for your agreement again in the Service.