akono

Privacy Policy

Last updated: September 11, 2026

1. Introduction

Akono B.V. ("Akono," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered adaptive learning platform (the "Service"). It covers our website at akono.ai and our mobile applications for iOS and Android, which share one account and one set of data. Where something applies to only one of them, this policy says so.

Controller:
Akono B.V.
De Nieuwe Erven 3 - unit 14742, 5431 NV Cuijk, Netherlands
KvK (Chamber of Commerce): 98954377
Contact: [email protected]

By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Email address
  • First name (optional)
  • Authentication data (password hash or OAuth tokens)
  • How you heard about us (referral source)

If you sign up using Google, we receive your name and profile picture from Google. If you sign up using Apple, we receive your name and an email address — which is a private relay address that forwards to you, if you chose to hide your real one. We never receive your password from either.

2.2 Study Materials You Upload

When you create a course, you upload study documents (PDFs, Word documents, presentations, images, etc.). These documents are:

  • Uploaded to our storage on Google Cloud Storage, where they are kept private to your account
  • Processed by our AI to extract educational content (lessons, concepts, questions)
  • Retained for the lifetime of the associated course so we can support features that reference the original material (e.g. re-generation, source citations)
  • Permanently deleted within 30 days when you delete the course, or within 30 days of account deletion

Your uploaded documents are never shared with other users and are never used to train AI models.

2.3 Learning Activity Data

As you use Akono, we collect:

  • Courses you create and their content
  • Questions you answer and your responses
  • Tutor session data (time spent, concepts reviewed)
  • Learning progress and mastery levels
  • Chat conversations with the AI tutor
  • Feedback you provide on questions

2.4 Payment Information

If you subscribe to a paid plan, Stripe (our payment processor) collects your payment details. We store only:

  • Your Stripe customer ID
  • Subscription status and plan type
  • Billing period dates

We never store your credit card number, CVV, or full billing address.

2.5 Technical and Usage Data

On the website, we automatically collect:

  • Device information (browser type, operating system)
  • IP address
  • Pages visited and features used
  • Session recordings (see Section 4.2)
  • Advertising click identifiers, if you arrive from an ad on Meta or Google. These are only collected if you accept analytics and advertising cookies (see Sections 4.3 and 6)

In the mobile apps, we automatically collect:

  • Device model, operating system version, locale and time zone
  • The app version you are running
  • A randomly generated installation identifier, created by our analytics library and reset when you sign out or reinstall
  • IP address
  • Which screens and features you use, and when the app is installed, opened, updated or backgrounded
  • Crash and error diagnostics when something goes wrong: the error message, the code location it came from, and the app state at that moment. These do not include your study materials or your conversations with the tutor

The apps contain no advertising SDK. We do not collect Apple's advertising identifier (IDFA) or Google's advertising ID, we do not track you across other companies' apps or websites, and no data from the apps is sent to any advertising platform. The advertising measurement described in Section 4.3 happens on the website only. The apps do not record session replays.

2.6 Voice Data

Akono includes voice features. Voice dictation (speech-to-text) is powered by Deepgram, and spoken tutor responses (text-to-speech) are powered by Cartesia. When you use these features:

  • Audio is streamed directly to Deepgram for transcription, and we do not store audio recordings
  • Text is sent to Cartesia to generate spoken audio, and may include tutor and session content
  • Transcribed text is processed like any other text input

2.7 Connected Accounts (Notion, Google Drive)

You can import study materials directly from Notion or Google Drive instead of uploading files from your device. If you choose to, you are sent to that provider to sign in and approve the connection, and we never see your password there. We then receive:

  • An access token, stored so the import can run and so you do not have to reconnect every time
  • The list of pages or files you are choosing from, and the contents of the ones you select

We request read-only access, we only read what you pick, and we never write to or delete anything in your Notion or Drive. Imported documents are then treated exactly like uploaded ones (Section 2.2). You can disconnect at any time from your Notion or Google account settings, or by contacting us.

3. How We Use Your Information

We use your information to:

  • Provide the Service: Create courses from your materials, generate questions, track your learning progress, and personalize your study experience
  • Process payments: Manage subscriptions and billing through Stripe
  • Improve the Service: Analyze usage patterns, fix bugs, and develop new features
  • Measure our advertising: Understand which ads bring students to Akono, by sharing conversion data with Meta and Google as described in Section 4.3. Only with your consent
  • Communicate with you: Send transactional emails (account confirmation, password reset) and respond to support requests
  • Ensure security: Detect and prevent fraud, abuse, and unauthorized access

Legal Basis for Processing (GDPR)

We process your data based on:

  • Contract performance: Processing necessary to provide the Service you signed up for (Article 6(1)(b))
  • Consent: Advertising measurement and the non-essential cookies described in Section 6 (Article 6(1)(a)). We ask for this in the cookie banner on our website, and you can withdraw it at any time
  • Legitimate interests (Article 6(1)(f)): Keeping the Service secure and preventing fraud and abuse, and understanding how our own product is used so we can improve it — see "Product analytics" immediately below
  • Legal obligation: Retaining billing records where tax or accounting law requires it (Article 6(1)(c))

Product analytics, and why we rely on legitimate interest

We measure how our own product is used — which screens people reach, where a flow is abandoned, whether a feature is working — and we rely on legitimate interest for it rather than consent. We think that is fair to you, and we want to be specific about why rather than assert it:

  • It is first-party and it stays with us. This data is used to run and improve Akono. It is never sold, never shared with advertising platforms, and never used to build a profile of you across other companies' apps or websites
  • It is limited to what the question needs. Which screens, which actions, which version of the app, on which kind of device — not the contents of your study materials, your tutor conversations or your answers
  • You are not surprised by it. A student using a study app reasonably expects the people who built it to be able to tell whether it is working
  • You can object, easily and at any time. Because we rely on legitimate interest rather than consent, you have the right to object under Article 21 — and objecting has to be as easy as the processing was invisible. In the mobile apps there is a Share usage data switch in Profile that turns this off on the spot. On the website it is governed by the cookie banner instead, which asks first

Advertising measurement is a different matter and we do not rely on legitimate interest for it. It happens on the website only, it is asked for in the cookie banner, and nothing is sent if you decline (Section 4.3).

4. Third-Party Services

We use the following third-party services that process your data:

4.1 Infrastructure & Database

Supabase (United States - California)

Render (United States - Oregon)

Google Cloud Storage (United States)

4.2 Analytics

PostHog (European Union)

  • Our primary analytics service, used on both the website and the mobile apps; tracks feature usage and user flows
  • Our PostHog data is held on their EU infrastructure, so this data does not leave the European Union
  • On the website, records session replays (screen recordings of your interactions). Form inputs are captured in these recordings, and passwords are masked
  • The mobile apps do not record session replays
  • Also receives crash and error reports from the mobile apps (see Section 2.5), so we can find and fix a crash without waiting for someone to report it
  • Privacy: https://posthog.com/privacy

Mixpanel (United States) — website only

4.3 Advertising Measurement

We advertise Akono on Meta and Google. To understand which ads actually bring students to us, we share a limited set of conversion data with these platforms. This only happens if you accept analytics and advertising cookies. If you decline, nothing in this section is sent, from your browser or from our servers.

This section applies to our website only. Our mobile apps contain no advertising SDK and send nothing to Meta or Google Ads, and we do not collect the advertising identifiers those platforms use (Apple's IDFA, Google's advertising ID).

Meta Platforms (United States and Ireland)

  • We use both the Meta Pixel (in your browser) and the Meta Conversions API (from our servers)
  • We send events marking sign-up, starting a trial, and purchasing a subscription, including the value and currency of the purchase
  • With those events we send, where available: your email address in hashed (SHA-256) form, a hashed identifier for your account, your IP address, your browser user agent, and the Meta cookie identifiers described in Section 6. Hashing means Meta does not receive your email in readable form, but it can still be matched against an existing Meta account
  • Privacy: https://www.facebook.com/privacy/policy

Google Ads (United States)

  • We use the Google tag with Consent Mode to measure when an ad click leads to a trial
  • We store the Google click identifier (gclid) from the URL you arrived on, so a later conversion can be attributed to that ad
  • Privacy: https://policies.google.com/privacy

4.4 AI Processing

Google Gemini API (United States)

  • Processes your uploaded documents to generate courses
  • Generates questions, explanations, and study content
  • Your content is sent to Google's servers for AI processing
  • Privacy: https://policies.google.com/privacy

Anthropic (Claude) (United States)

OpenAI (United States)

LangSmith (LangChain) (European Union)

  • Records our AI calls so we can find and fix failures and improve our prompts
  • Receives prompts and AI responses, which may include course content and tutor conversation
  • We use their EU instance, so this data does not leave the European Union
  • Privacy: https://www.langchain.com/privacy-policy

4.5 Payments

Stripe (United States) — subscriptions bought on our website

Apple and Google — subscriptions bought inside our mobile apps

  • A subscription bought in the app is processed by the App Store or Google Play under your own store account. We never see your payment details, and we do not receive your Apple ID or Google account — only a confirmation that a subscription exists and what it covers
  • Privacy: Apple · Google

RevenueCat (United States)

  • Verifies app-store subscription receipts and tells our servers whether your subscription is active
  • Receives your Akono account identifier, the product you bought, and the status and dates of that subscription. It does not receive your payment details or your study content
  • Privacy: https://www.revenuecat.com/privacy

4.6 Email

Resend (United States)

4.7 Voice (Speech and Audio)

Deepgram (United States)

Cartesia (United States)

  • Converts tutor text responses into spoken audio (text-to-speech)
  • Receives text, which may include session and course content
  • Privacy: https://cartesia.ai/legal/privacy

4.8 Document Imports

Notion (United States) and Google Drive (United States)

  • Only if you choose to import study materials from them (Section 2.7)
  • We hold a read-only access token and read only the pages or files you select
  • Privacy: Notion · Google

5. International Data Transfers

Most of our third-party providers are located in the United States, so when you use Akono your data is transferred to and processed there. This includes the advertising platforms in Section 4.3 (Meta and Google), where you have consented to that processing.

Two exceptions, both deliberate: our analytics (PostHog) and our AI call records (LangSmith) are held on those providers' European infrastructure, so that data stays in the European Union.

For transfers from the European Economic Area (EEA) to the US, we rely on:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • The EU-US Data Privacy Framework, where applicable

These mechanisms ensure your data receives adequate protection as required by GDPR.

6. Cookies, Local Storage and App Storage

This section is about our website unless it says otherwise. Our mobile apps use no cookies at all and show no cookie banner — what they store on your device is covered at the end.

Essential cookies

These are required for the service to work and are set regardless of your cookie choice:

  • Authentication cookies: Managed by Supabase to keep you logged in
  • Temporary cookies: For specific features (e.g., course cloning)
  • Cookie preference: Stores the choice you made in the cookie banner

Analytics and advertising cookies

These are only set if you accept them in the cookie banner, and are not set at all if you decline. They let us measure which of our ads bring students to Akono.

  • _fbp, _fbc: Set by the Meta (Facebook) Pixel to identify your browser and attribute an ad click. We also write _fbc ourselves from the click identifier in the URL when the Meta script is blocked
  • Google Ads identifiers: Including the click identifier (gclid) captured from the URL when you arrive from a Google ad
  • PostHog and Mixpanel cookies: Used to recognise return visits and group your activity into sessions

You can withdraw your consent at any time using the link at the end of this section, which is as easy as giving it.

Local Storage

We store preferences locally in your browser:

  • Theme preference (light/dark mode)
  • UI state (selected views, temporary answer selections)
  • Analytics deduplication flags

This data stays on your device and is not transmitted to our servers.

Mobile app storage

The apps store the following on your device, and none of it is a cookie or an advertising identifier:

  • Your login session, so you are not signed out between uses
  • Your preferences (tutor, voice, language, sounds) and cached course content so screens open instantly and work offline for a moment
  • A randomly generated analytics installation identifier, reset when you sign out or reinstall

Deleting the app removes all of it. Signing out clears the session and resets the analytics identifier.

To change your cookie preferences, to reset your choice.

7. Data Retention

Data TypeRetention Period
Account dataUntil you delete your account
Uploaded documentsUntil you delete the course or your account (deleted within 30 days)
Course content & progressUntil you delete the course or your account
Payment recordsAs required by law (typically 7 years for financial records)
Analytics dataSubject to our analytics providers' retention policies

When you delete your account, all your personal data, courses, and learning progress are permanently deleted from our systems.

8. Your Rights (GDPR)

As a user in the European Economic Area, you have the right to:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Correct inaccurate or incomplete data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Restriction: Limit how we process your data
  • Portability: Receive your data in a portable format
  • Object: Object to processing based on legitimate interests, including our product analytics — in the mobile apps, the Share usage data switch in Profile does this immediately, and on the website the cookie banner asks first
  • Withdraw consent: Where processing is based on consent

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl).

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

  • All data is encrypted in transit (HTTPS/TLS)
  • Database access is protected by Row Level Security policies
  • Authentication tokens are securely managed
  • Payment processing is handled by PCI-compliant Stripe
  • Access to production systems is restricted

While we strive to protect your data, no method of transmission or storage is 100% secure.

10. Age Requirement

Akono is intended for users who are at least 16 years old. We do not knowingly collect personal data from anyone under 16. If you are under 16, please do not use our Service or provide any personal information.

If we learn that we have collected data from a user under 16, we will delete that information promptly. If you believe we may have data from someone under 16, please contact us at [email protected].

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

  • Posting the new policy on our website
  • Updating the "Last updated" date
  • Sending an email notification for material changes

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Akono B.V.
De Nieuwe Erven 3 - unit 14742
5431 NV Cuijk
Netherlands

Email: [email protected]

This Privacy Policy is governed by Dutch law and the General Data Protection Regulation (GDPR).