Privacy Policy
Effective date: April 15, 2026 | Published by KIRUNIVERSE LLC, Brooklyn, New York
1. Introduction
kidHQ is a school communication and administration platform operated by KIRUNIVERSE LLC, headquartered in Brooklyn, New York, accessible at kidhq.app and as a progressive web application installable on any device.
This Privacy Policy describes how we collect, use, disclose, and protect information when schools, administrators, staff, teachers, parents, guardians, and students use the kidHQ platform, and describes your rights with respect to that information.
By using kidHQ, you agree to this Privacy Policy. If you are accessing kidHQ on behalf of a school or district, you represent that you have the authority to bind that institution to this policy.
2. Who we are and how to contact us
KIRUNIVERSE LLC | Brooklyn, New York, United States | Platform: kidhq.app | Privacy inquiries: privacy@kiruniverse.com
We will respond to all verified privacy inquiries within 30 days.
3. The information we collect
We collect information in three ways: information you provide directly, information generated through your use of the platform, and information provided to us by your school.
Information provided directly: Name, email address, and password on signup. Administrators may provide a phone number. Parents and guardians may provide contact information and information about their children including name, grade level, and school enrollment.
Information generated through use: Records of platform activity including messages, forms submitted, payments made, and announcements viewed. Device information including browser type, operating system, and IP address. Session data to maintain your login state.
Information provided by your school: Schools may upload or import student roster data including student names, grade levels, enrollment status, and parent or guardian contact information.
Payment information: Payment card data is collected and processed directly by Stripe, Inc. KIRUNIVERSE LLC does not store payment card numbers, CVV codes, or full card details. We store transaction records including amounts, dates, and status.
4. How we use information
We use information to operate and improve the platform, communicate about your account and activity, process payments, send notifications and digest emails, enforce our Terms of Service, comply with applicable law, and respond to support requests.
We do not use student data for advertising. We do not sell, rent, or trade personal information to third parties for commercial purposes. We do not use student data to build profiles for purposes unrelated to the school's educational mission. We do not use personal data to train generative AI models, and we do not permit our third-party service providers to do so.
5. Student data and FERPA
kidHQ handles education records as defined by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. The school is the data controller for student education records. KIRUNIVERSE LLC acts as a "school official" with a "legitimate educational interest" under FERPA, pursuant to the Data Processing Agreement with the school.
Under this arrangement, KIRUNIVERSE LLC uses student data only to provide services described in the agreement, does not disclose student records to third parties except as permitted by FERPA or directed by the school, maintains appropriate safeguards, and returns or destroys student data upon termination as directed by the school.
Schools retain all rights to their students' education records. Parents and eligible students retain all rights under FERPA including the right to inspect, amend, and request deletion of education records.
6. Children's privacy and COPPA
We do not knowingly collect personal information directly from children under 13 without verifiable parental consent or school authorization. When a school provides student data, the school is responsible for obtaining any required parental consent under COPPA (15 U.S.C. § 6501 et seq.) and represents that it has done so prior to providing information about children under 13 to the platform.
If you believe we have inadvertently collected personal information from a child under 13 outside the school context, contact us immediately at privacy@kiruniverse.com.
7. New York Education Law 2-d
KIRUNIVERSE LLC complies with New York Education Law Section 2-d and its implementing regulations. Under this law, we use student data only for purposes set forth in our agreement with the school, do not sell student data, do not use student data for advertising or non-educational profiling, maintain a data security program consistent with industry standards, return or destroy student data per the school's instructions upon termination, and provide annual reporting to schools upon request.
Schools operating in New York may request a copy of our Parents' Bill of Rights for Data Privacy and Security, incorporated into our Data Processing Agreement.
8. How we share information
With your school: Administrators have access to activity logs, student records, parent profiles, and audit data related to their school.
With service providers: Third-party vendors contractually bound to use your information only to provide services to us. Key providers: Supabase (database and authentication, US), Stripe (payment processing, US), Vercel (hosting, US), and Google (calendar integration and email, US). A complete subprocessor list is available upon request.
For legal compliance: When required by law, court order, or governmental authority, or to protect the rights, property, or safety of KIRUNIVERSE LLC, our users, or the public.
Business transfers: In the event of a merger, acquisition, or sale of assets. We will notify affected schools before any such transfer is completed.
We do not share information with advertisers. We do not sell personal information.
9. Data retention
We retain account information for as long as your school's account is active. Upon termination, we will return or securely delete school and student data within 60 days, unless a longer period is required by law or requested in writing by the school.
Anonymized, aggregated usage data may be retained indefinitely for product improvement. Payment transaction records are retained for seven years per applicable financial recordkeeping requirements.
10. Security
We maintain technical and organizational measures to protect information against unauthorized access, disclosure, alteration, or destruction, including TLS-encrypted data transmission, encrypted data storage, role-based access controls, row-level security at the database layer, audit logging of all administrative actions, and regular security reviews. Our infrastructure is hosted on Supabase and Vercel, both of which maintain SOC 2 compliance.
In the event of a data breach affecting student data, we will notify affected schools in accordance with applicable law and without undue delay.
11. International users and GDPR
kidHQ currently serves schools in the United States. Users in the EEA, UK, or other jurisdictions should be aware that information may be transferred to and processed in the United States. For EEA or UK users, KIRUNIVERSE LLC acts as a data processor on behalf of the school (data controller). Users in these jurisdictions have rights under GDPR including access, rectification, erasure, restriction of processing, and data portability. Contact us at privacy@kiruniverse.com or instruct your school administrator to exercise these rights.
We will add full GDPR compliance mechanisms including Standard Contractual Clauses prior to onboarding any school outside the United States.
12. Your rights
Depending on your location and role, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. Contact us at privacy@kiruniverse.com or your school administrator to exercise these rights.
13. Cookies and tracking
kidHQ uses cookies solely to maintain your login session and support platform functionality. We do not use third-party advertising cookies or cross-site tracking technologies. See our Cookie Policy for full details.
14. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email to school administrators with the effective date updated at the top of this document. Schools may terminate their agreement within 30 days of notice of a material change if they do not accept the updated terms.
15. Contact us
KIRUNIVERSE LLC | Brooklyn, New York, United States | privacy@kiruniverse.com | kidhq.app