Privacy Policy
Operator: Flemming Consulting Group, LLC, doing business as Klyra · Effective date: July 22, 2026 · Last updated: July 22, 2026
1. Scope and Parent-Mediated Service
This Privacy Policy explains how Flemming Consulting Group, LLC, doing business as Klyra (“Klyra,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects information through the Klyra website, applications, and related services.
Klyra is designed for parents and legal guardians. A parent creates and controls the account, creates a learner profile, photographs and uploads the learner’s mathematics worksheet, and receives the resulting explanations, practice materials, and progress information. Children do not create accounts, do not log in, and should not use Klyra directly. Klyra does not currently provide child-facing chat, voice input, live tutoring, or a tutor marketplace.
2. Operator and Contact Information
- Operator: Flemming Consulting Group, LLC, doing business as Klyra
- Mailing address: 17023 Upper Ridge Lane, Humble, TX 77346
- Privacy telephone: (516) 668-2267
- Privacy and COPPA email: privacy@klyratutor.com
- Security email: security@klyratutor.com
- Designated privacy officer: Dawayne Flemming
3. Information We Collect
3.1 Parent and Account Information
- Parent or legal guardian name, email address, telephone number, and account preferences
- Account authentication and security information managed through Clerk
- Subscription, transaction, and payment-status information; payment-card details are handled by the applicable payment provider and are not stored in full by Klyra
- Direct Notice and parental-consent records, including notice version, consent method, timestamp, and account or profile reference
- Support requests, emails, and other communications sent to Klyra
3.2 Learner Profile Information
- The learner's first name, initial, alias, or other parent-selected profile name
- Grade level
- Profile and account identifiers used internally to keep records associated with the correct parent-managed profile
Klyra does not require a learner’s last name, date of birth, home address, school name, student identification number, telephone number, email address, social-media identifier, or child login credentials.
3.3 Worksheet and Learning Information
- Worksheet photographs uploaded by the parent
- Text extracted from the worksheet using optical character recognition
- Parent-confirmed worksheet region or problem selection, when used
- Identified mathematical concepts, errors, and misconceptions
- Generated explanations, answer guidance, practice materials, and parent teaching scripts
- Learning outcomes, completion status, and progress records associated with the learner profile
Parents should obscure names, school names, teacher names, addresses, student numbers, and other unnecessary identifiers before uploading a worksheet.
3.4 Technical and Usage Information
- Internet Protocol address, browser, device type, operating system, app version, and timestamps
- Authentication, security, rate-limit, fraud-prevention, and audit logs
- Error and performance information configured to exclude worksheet content and child personal information
- Pseudonymous product-usage events on parent-facing surfaces; Klyra does not use advertising trackers or behavioral-advertising profiles
4. How We Use Information
- Create and manage the parent's account and learner profiles
- Receive, store temporarily, and process worksheet photographs
- Extract worksheet text and identify the mathematical content
- Generate parent-facing explanations, practice, answer guidance, and progress information
- Manage subscriptions and payments
- Provide customer support and transactional communications
- Protect accounts, detect abuse or fraud, enforce usage limits, and maintain service reliability
- Comply with law, respond to valid legal process, and establish or defend legal claims
- Evaluate service performance using aggregated or pseudonymous operational information
Klyra does not sell personal information, use child-related information for behavioral advertising, permit service providers to use child-related content for their own advertising, or authorize Google or Anthropic to train general-purpose models on Klyra’s paid commercial API content.
5. Children’s Information and Parental Consent
Klyra follows a parent-mediated model. Before Klyra creates or processes a worksheet upload for a learner profile, the parent must receive the current Direct Notice and complete Klyra’s verifiable parental-consent process. The server blocks worksheet creation and processing when the required notice version has not been acknowledged.
When Klyra materially changes how it collects, uses, or discloses child-related personal information, Klyra issues a new notice version and requires renewed consent before processing resumes for existing profiles.
5.1 Information Collected About Learners
The child-related information Klyra collects is limited to the learner profile information, worksheet image and extracted text, derived learning information, and technical identifiers needed to provide, secure, and maintain the parent-managed service.
5.2 Parent Rights
- Review the categories and specific information maintained about the learner
- Correct inaccurate profile information
- Refuse further collection or use
- Withdraw consent
- Delete the learner profile and associated information, subject to limited legal, security, billing, and consent-evidence records described below
- Receive a copy of the learner information in a reasonably accessible form
Parents may exercise these rights through available account controls or by emailing privacy@klyratutor.com with the subject line “COPPA Request.” Klyra will use reasonable steps to verify that the requestor is the parent or legal guardian associated with the profile.
6. Service Providers and Disclosures
Klyra uses service providers to perform functions necessary to operate the parent-mediated service. Klyra reviews provider capabilities and obtains written contractual assurances appropriate to the information processed.
| Provider | Function | Information Processed | Important Limits |
|---|---|---|---|
| Google LLC | Gemini optical character recognition | Worksheet photograph and extracted text | Paid Gemini API. Google does not use paid-service prompts or responses to improve its products. Google may retain limited logs for safety, security, policy enforcement, and legal obligations. |
| Anthropic PBC | Mathematical classification, explanation, and practice generation | Name-redacted worksheet text and grade level; never the worksheet photograph | Commercial API content is not used to train general-purpose models. Standard API inputs and outputs are generally deleted within 30 days, subject to usage-policy and legal exceptions. |
| Supabase | Database and file storage | Parent account data, learner profiles, uploads, extracted text, learning results, and internal records | Access is restricted by account, role, and signed storage controls. |
| Clerk | Authentication and account management | Parent identity, email, authentication factors, and account identifiers | Children do not receive Clerk accounts. |
| Stripe | Web subscription billing | Parent billing, payment, subscription, and transaction information | Klyra does not store full payment-card numbers. |
| RevenueCat | Mobile subscription status | Parent account identifier, subscription tier, platform, and entitlement status | Used only to synchronize subscription access. |
| Twilio | Transactional SMS | Parent telephone number and transactional message content | No child-directed marketing messages. |
| Resend | Transactional email | Parent email address and transactional message content | Transactional messages only. |
| Sentry | Error and performance monitoring | Pseudonymous technical and diagnostic data | Configured to exclude worksheet content and child personal information. |
| PostHog | Product analytics on parent-facing surfaces | Pseudonymous parent-surface usage events | No behavioral advertising; no worksheet text or child-profile content. |
| Vercel | Web hosting and request delivery | Network, request, deployment, and application data required to host the service | Hosting infrastructure only. |
Apple and Google may independently process parent account, device, and purchase information when a parent downloads an app or purchases a subscription through their stores. Their processing is governed by their own terms and privacy notices.
Klyra may disclose information when required by law, valid legal process, or a government request; to protect the rights, safety, or security of a person or the Service; to investigate fraud or misuse; or in connection with a merger, acquisition, financing, or sale, subject to continued protection of the information.
7. Data Retention and Deletion
Klyra retains child-related personal information only for as long as reasonably necessary for the stated purpose and applies the following written schedule.
| Data Category | Purpose | Business Need | Deletion Timeframe |
|---|---|---|---|
| Failed or abandoned worksheet uploads | Complete or troubleshoot an attempted upload | Short operational recovery window | Deleted within 72 hours of upload |
| Successfully processed worksheet photograph and OCR text | Read the worksheet, confirm the problems, and generate learning results | Temporary processing, correction, and support window | Deleted no later than 30 days after processing |
| Derived learning results | Track misconceptions, generated practice, outcomes, and progress | Ongoing parent-requested learning history | Retained while the profile is active; deleted within 30 days after profile deletion; inactive profiles are deleted after 24 months without activity |
| Learner profile | Associate learning records with the correct parent-managed learner | Provide ongoing parent-managed service | Deleted within 30 days after profile deletion or after 24 months of inactivity |
| Minimized consent evidence | Demonstrate notice and parental consent | Legal compliance and audit evidence | Five years after the later of consent withdrawal, profile deletion, or replacement by a superseding consent record, unless a legal hold applies |
| Parent billing and tax records | Payment, accounting, tax, and dispute handling | Legal and financial compliance | Retained for the period required by applicable tax, accounting, and payment laws |
| Security and audit records | Protect accounts, investigate misuse, and demonstrate controls | Security and legal compliance | Retained under Klyra's documented security-log schedule and deleted when no longer reasonably necessary |
When Klyra deletes information, it uses reasonable measures designed to prevent unauthorized access to or use of the information during deletion. A deletion request removes active data first and propagates through Klyra systems and service-provider workflows within the applicable period. Limited records may be retained when required by law, subject to a legal hold, or necessary to establish consent, prevent fraud, secure the Service, or resolve a dispute.
8. Security
- Written information-security program and a designated security coordinator
- Risk assessments at least annually and when material system changes occur
- Encryption in transit and at rest where supported
- Role-based access controls and least-privilege administration
- Audit logging of administrative access to child-related information
- Restricted storage paths and signed access controls for uploaded files
- Service-provider diligence and written security assurances
- Monitoring, incident response, deletion-job logs, and security testing
No system is completely secure. Klyra will provide notices required by applicable law if it determines that a security incident requires notification.
9. Cookies and Analytics
Klyra uses essential cookies and similar technologies for authentication, security, session management, and service operation. Klyra does not use third-party advertising cookies, cross-site behavioral advertising, or advertising profiles. Product analytics are limited to pseudonymous events on parent-facing surfaces.
10. U.S. State Privacy Rights
Depending on where a parent resides and whether a law applies to Klyra, the parent may have additional rights to access, correct, delete, or obtain a copy of personal information, and to appeal certain decisions. Klyra does not sell personal information or process it for targeted advertising. Requests may be sent to privacy@klyratutor.com. Klyra will respond within the period required by applicable law.
11. United States Service
Klyra is operated in the United States and is intended for parents and legal guardians located in the United States. Information is processed in the United States and in other locations where Klyra’s contracted service providers operate.
12. Changes to This Policy
Klyra may update this Privacy Policy. Klyra will provide notice of material changes through the Service or by email. When a change materially affects the collection, use, or disclosure of child-related personal information, Klyra will issue a new Direct Notice version and obtain renewed verifiable parental consent before applying the change to an existing learner profile.
13. Contact
- Email: privacy@klyratutor.com
- Mail: 17023 Upper Ridge Lane, Humble, TX 77346
- Telephone: (516) 668-2267
- COPPA requests: Use the subject line "COPPA Request."