Privacy policy

Last updated 3 October 2026.

Kablow Education Limited operates Kablow. We are a Hong Kong business, business registration number 81308318, at 2/F Lot 393B Hang Hau Road, Tseung Kwan O, Hong Kong. Contact kablow@kablow.education for privacy questions or requests.

For learners: your educator can see your answers and progress. Other people in your class may see your display name, avatar and gameplay. They can also see delivered messages when chat is turned on. Use a nickname and keep your address, contact details and passwords private. Report a worrying message and tell a trusted adult. You or your parent can contact us about your information. Kablow is not an emergency service; get help from a trusted adult or local emergency service if someone is in immediate danger.

For educators and parents, in short: - We collect what is needed to run classes, games and progress reports. We do not sell student data or use student data to train AI models. - Learners are added by their educator. Chat is off until an authorised educator turns it on. - Chat messages are deleted after 30 days. - You can ask to see, correct or delete information at any time by emailing us.

1. Who this covers

This policy covers educators, school-managed learners, learners with older independently registered accounts, and visitors to Kablow's website, learning activities and games. "Educator" and "Learner" are account names; your legal rights depend on your circumstances, not the label.

For a school's education records that we handle only on the school's documented instructions, the school decides the purposes and Kablow acts as its processor (or service provider). For adult account administration, older independent accounts, security and any other processing for our own purposes, Kablow is responsible for the data itself. A contract label alone does not decide these roles. Schools can request a data processing agreement and provider details from us.

School-managed accounts are currently available for eligible arrangements in Hong Kong, the United Kingdom and the United States. Direct family sign-up and new independent learner accounts are not offered. Existing independent accounts remain covered by this policy.

2. Information we handle

Educator accounts: name, email, sign-in details, optional organisation details, classes, assignments, settings, support messages and subscription status. We use these to run and secure accounts, provide teaching tools, communicate about the service and manage plans.

School-managed learner accounts: username or display name, sign-in details, class membership, answers, scores, progress, difficulty and review history. We also store game state such as avatars, cosmetics, virtual currency, collections and in-game position. Educator-issued username accounts do not need a learner's own email address or any payment details.

Older independent learner accounts: some learners registered themselves with a name and email address, or through Google sign-in. We no longer accept new registrations of this kind. We are reviewing each existing account to confirm parental permission or arrange deletion. An email confirmation is not proof of age or parental permission.

Chat and submitted content: class-world messages, moderation results, educator reviews, message reports and any materials you submit. Classmates see delivered messages. Educators can review their class's messages, including messages that were blocked from other learners. Please do not put contact details or sensitive information in chat or in public names.

Technical information: IP address, browser and device details, request logs, sign-in and session identifiers, and approximate country (used for security and pricing). In-game coordinates are positions inside the game, not your physical location. We do not ask for photographs, biometric data, home addresses or precise location for learner gameplay. Anything you type voluntarily may still contain personal data.

Usage measurement: on public pages (for example the home page, pricing, FAQ and public lessons), we use Vercel Web Analytics to count page views, visitors, referring sites, country, device and browser. It is aggregate and does not use cookies, and it does not identify you. It does not run for signed-in browsers or inside the app, classes or demo. Separately, for every signed-in account, including educator and learner accounts, Kablow records active time in the app. While the tab is visible and you have interacted with it within the past minute, the app sends a heartbeat about every 30 seconds. We add credited seconds to a daily total linked to the account. Administrators can see total active minutes and minutes from the past seven days for each account. We do not record the contents of your interactions through this feature. Hidden or idle tabs do not earn time. This measurement helps us understand use of the service and administer accounts; it is separate from learning answers and adaptive revision records. Schools must give required notices and obtain any permissions needed for school-managed learners. We do not run other signed-in product measurement. If we add another type of measurement, we will update this policy first and obtain consent where required.

Billing: when you buy through Paddle, Paddle handles payment details, billing information and tax records under its own privacy notice. We receive the purchaser's identifiers, subscription status and the transaction information we need for access, support and accounting. Please do not send payment-card numbers or passwords to our support email.

School-authorisation records: an educator's email-confirmation status, their adult and authority declaration (institution, country, educational purpose, and how families are told and permission is handled), the date and version of the declaration, and access status. If an administrator acts on an account, we may also keep the decision, who made it, the date and a reference. We use these records to decide access and to be accountable for those decisions. We do not collect identity documents for routine sign-up. Email confirmation proves control of an email address; it does not verify age, institutional authority or parental consent.

Children need particular protection. Where a school authorises Kablow, we collect information only for the school's educational purposes, within the limits of the law. School authorisation does not allow unrelated commercial use or unrestricted sharing, and it does not remove our duty to give notices and protect children's information.

- United States (under 13): COPPA may require verifiable parental consent unless an exception or valid school authorisation applies. Independent sign-up and activity outside school need their own assessment and cannot rely on a teacher's acceptance. - UK and EEA: the school must identify a lawful basis. Where consent is the basis for an online service offered directly to a child, local age rules and parental authorisation apply. - Everywhere: a school is not authorised to consent on behalf of every parent in every country.

How educators get access. Before issuing learner logins or turning on chat, an educator must confirm their email and save a declaration that they are an adult with authority to manage the learners, covering their institution, country, educational purpose, and how families are told and give any required permission. We record this declaration but do not independently check it and it is not parental consent. Class codes do not enrol anyone: learners must be on the educator's managed roster, so a code alone cannot admit a guest. Chat is off by default. If an educator changes their declaration, chat switches off until they turn it on again. An administrator can withdraw an educator's access for safety or authority concerns, which blocks class access and pauses chat. Student-hosted shared rooms are currently closed.

Parents can contact us directly, even where a school manages the account. If you believe a child is using Kablow without a required permission, tell us. We will look into it, limit processing where appropriate, and arrange permission or deletion as the law requires. Schools should give families this notice and explain the class features they turn on.

4. Purposes and legal grounds

We use information to run accounts, learning activities, games and reports; to adapt difficulty and schedule revision; to manage paid access; to answer support requests; to protect users and systems; to meet legal obligations; and to maintain and improve the service. Adaptive learning supports practice and educator judgement. It does not decide admission, determine an official grade or have a comparable legal effect.

Where GDPR or UK GDPR applies, we generally rely on: contract (adult accounts and subscriptions); legal obligation (necessary records); and legitimate interests (proportionate security and service improvement, weighed against children's interests and rights). School-instructed processing follows the school's lawful basis and instructions. Anything that needs consent will rely on a proper consent mechanism; this notice is not itself consent.

We do not sell student personal data. We do not use it for paid-conversion targeting or training general-purpose AI models. ## 5. Cookies and local storage {#cookies}

Kablow uses cookies and browser storage for sign-in, session security, language preference and saved interface or activity state. These are needed for features you ask for. We do not use analytics cookies; the public-page analytics described in section 2 does not set or read cookies. Where consent is required for non-essential storage, we will obtain it before that storage begins. You can clear or restrict storage in your browser, though blocking necessary storage may stop sign-in or saved settings working.

Your educator and school receive class membership and learning reports through their accounts. Other players may see display names, avatars, gameplay, supported item exchanges and messages within the features you use. Authorised Kablow staff may access information as needed for support, safeguarding, security and operation; this privileged access is restricted and is separate from educator access. Parents do not gain access to a child's school records merely by contacting support or paying for a plan; we check authority and coordinate school-controlled requests with the school.

Reporting. Reports can be made through the chat report control, to an educator or trusted adult, or to kablow@kablow.education. Educators can hide a message, temporarily restrict a sender, or escalate a message for review by Kablow. Reports and escalations do not automatically contact emergency services or send an email alert. We may share relevant information with school safeguarding staff or authorities where necessary and lawful; we cannot promise absolute confidentiality. For immediate danger, contact local emergency or child-protection services without waiting for Kablow.

Providers. We use these providers, each receiving the information its service needs: - Supabase: sign-in and database - Vercel: website hosting - Our real-time game server host: live class games and presentations - Resend: email delivery - Cloudflare Turnstile: anti-abuse checks, where enabled - Google: only if you choose Google sign-in - Paddle: purchases, as reseller and merchant of record

Their own privacy notices also apply. Ask us for the current school subprocessor and transfer details before you buy or activate.

We may disclose information when legally required, or when reasonably necessary to protect users, investigate abuse or establish legal claims. If ownership of the business changes, information may transfer subject to applicable law, notice requirements and continued protection. We will not notify someone where doing so would be unlawful or would compromise a safeguarding investigation.

7. International processing and protection

Kablow is based in Hong Kong and uses cloud providers that may process information in other countries. An account's location does not mean its information stays there. Our primary database is hosted in South Korea (Seoul region). Other providers may process data elsewhere, including the United States. Where UK or EEA transfer restrictions apply, we rely on an applicable lawful transfer mechanism and any needed additional safeguards. Contact us for current provider locations and transfer arrangements before activating a school.

We protect information with access controls, authentication and encrypted connections. No online service is perfectly secure. We investigate suspected incidents and notify affected schools, individuals and authorities where required, within the deadlines that apply to our role and the circumstances. The 72-hour GDPR rule for notifying a regulator is not a promise that every individual is told within 72 hours.

8. Retention and deletion

We keep account and learning information while it is needed to provide the account or school service, then delete or de-identify it, subject to records we must keep for legal, safety or dispute reasons. We do not keep children's information indefinitely just because it might be useful. If a school stops using Kablow, or a learner leaves, ask us to review and delete what is no longer needed.

- Class chat (including report and escalation markers on messages) is deleted after 30 days. If a safeguarding case needs longer preservation, the necessary evidence is moved to a restricted, documented case record before the 30 days end. The chat feature has no indefinite legal hold. - Active-time totals are linked to an account and removed from the live database when that account is deleted. We do not currently apply a separate automatic expiry to these daily totals. - Inactive educator accounts are reviewed after 24 months of inactivity, with 30 days' email notice before deletion. - Safeguarding and authority-review records are kept only for their documented purpose and legal obligations, and reviewed. - Billing records are held separately by Paddle under its own legal obligations.

Removing a learner from a class does not necessarily delete their account, and deleting an educator account does not delete learners' independent accounts. Contact us for account-wide deletion where roster controls cannot do it. Deleting an account does not by itself cancel a subscription; use the management link in your receipt, or ask us to do both.

Deletion removes information from our live systems, apart from permitted retention. Copies in provider backups expire on the providers' schedules; we do not currently promise a fixed backup-erasure deadline. We will explain any exception when we handle your request. If a scheduled deletion hasn't happened, or you haven't had a reply to a request, contact us rather than assuming it has been done.

9. Your rights and requests

Depending on the law that applies to you, you may have rights to access, correct, delete, receive a portable copy of, restrict, or object to the use of your information, and to withdraw consent without affecting earlier lawful processing. In Hong Kong this includes access and correction rights under the Personal Data (Privacy) Ordinance. We will explain any limits or records we have to keep. You do not need to buy a plan to use a privacy right.

Email us with the account name and what you are asking for. Please do not include a password, card number or unnecessary identity documents. We may check your identity or authority in proportion to the request. For school-controlled records we may coordinate with the school, but parents can contact us directly and we remain responsible for our own obligations. We aim to reply within one month, or the legal deadline that applies, and will explain any lawful extension.

You can complain to the relevant authority, such as the Hong Kong Privacy Commissioner for Personal Data, the UK Information Commissioner's Office, an EEA supervisory authority, or Australia's OAIC where it has jurisdiction. This policy does not claim certification under COPPA, FERPA, GDPR or any other regime.

10. Updates and contact

We will publish changes with their effective date and give appropriate notice of material ones. If a new purpose needs consent or school agreement, updating a webpage does not replace that.

Privacy contact: kablow@kablow.education. Kablow Education Limited, business registration number 81308318, 2/F Lot 393B Hang Hau Road, Tseung Kwan O, Hong Kong. Read our Terms of service and Refund policy for account and payment conditions.

Your privacy on Kablow