Privacy policy: Kematra
Last updated: 2026-10-14
Kematra is a study planner for students. We collect as little as we can, we never sell your data or show ads, and we never use your data to train AI. This page explains exactly what we keep, why, where, and for how long.
Who's responsible for your data
James Paas, trading as Kematra, a sole trader in New South Wales, Australia, is the "controller" of your personal data. Privacy contact: support@kematra.com · 47 Coulton Road, Wallaroo, NSW, 2618, Australia
What we collect, why, and for how long
| What | Why | How long |
|---|---|---|
| Your email address | To send login links and important messages about your account | While your account exists. If you don't finish signing up, deleted within 24 hours |
| Your country (and province in Canada) | Age rules and sensible defaults | While your account exists |
| Your birth month and year | The age check only | Not kept: used once, then forgotten |
| Whether you're at school or uni (if you say) | To check Kematra works well for everyone; it doesn't change your plan | While your account exists |
| Your tests, topics, plan, sessions and check results | The study planner itself | Until 30 days after each test's date, or until you delete them |
| What a notice or other material says that you confirm (for example "no calculator") | Planning for your real test | With that test |
| Material you choose to have read (only the text you approved, with names, emails and phone numbers hidden) | Reading it for you | Deleted when you confirm or cancel, and within 7 days at the latest. The original file never leaves your device |
| Your resource library (books, worksheets, links you add) | Your study kit | While the subject's tests exist, then 12 months after its last test |
| Safety reports you send | Looking into the concern | 90 days, unless the law requires longer |
| Payment records | Billing | Held by Paddle (see below), as tax law requires |
| Security records (sign-in attempt counts, error reports with content removed) | Keeping Kematra safe and working | From minutes (sign-in limits) up to 30 days (error reports) |
Your study content is encrypted with a key that belongs only to your account. When something is deleted, its key is destroyed, so it can't be read again, even from backups.
Our legal reasons
- To provide Kematra to you (our agreement with you): your account, plan, sessions and materials.
- Our legitimate interests, balanced against yours: security, preventing abuse, and checking Kematra works well.
- Legal obligations: tax records (held by Paddle), and responding to lawful requests.
- Your consent, where we ask for it (for example before any photo is ever sent to be read).
Who we share it with
We use a small number of trusted service providers. They process your data only on our instructions and under data-protection agreements:
- Supabase (United States): stores your account and study data, and runs sign-in.
- Cloudflare (global): stores the keys that lock your data, and hosts this website.
- Resend (United States): sends login emails.
- Anthropic (United States, US-only processing): reads material you choose to have read, only after you've hidden private details. It never uses what it reads to train its AI, and deletes it within 30 days (up to 2 years if its safety systems flag it). Only when this feature is switched on; the app tells you when it is.
- Paddle (our reseller and Merchant of Record): handles payments, taxes and invoices. Paddle receives your payment details directly; we never see your card. Paddle is responsible for that data under its own privacy notice.
- Professional advisers and authorities, only where the law requires it.
We never sell your data, use it for advertising, or share it with schools, other students or anyone else.
International transfers
Your data is stored in the United States. Where the law of your country requires it (for example in the UK and Ireland), transfers are protected by our providers' standard contractual clauses (or the UK addendum to them).
Your rights
You can, at any time:
- see the data we hold about you, and get a copy;
- correct it;
- delete it, or your whole account (in the app, or by asking us);
- limit or object to how we use it, or move it to another service;
- withdraw consent where we relied on it.
Email support@kematra.com. We'll reply within one month (sooner where the law requires). If you're not happy with our answer, you can complain to your privacy regulator:
- Australia: OAIC;
- the UK: ICO;
- Ireland: DPC;
- Canada: OPC (or your province's commissioner);
- New Zealand: the Privacy Commissioner;
- the US: your state's attorney general.
Children
Kematra is for students 13 and over (16 in Ireland, 14 in Quebec). We ask your country and birth month and year before anything else, don't create an account for anyone younger, and don't knowingly collect data from children under 13. If you think a child under the minimum age has signed up, email us and we'll delete the account. Your age is self-declared; we don't verify it.
Keeping it safe
Encryption in transit and at rest, a separate key for each account, strict access rules so no one can see another student's data, and limits on what our providers can access. No system is perfectly secure; if a breach affecting you happens, we'll tell you and the regulator as the law requires.
Cookies
We use only the cookies needed to keep you signed in and keep Kematra secure. No advertising or tracking cookies.
Changes
If we change this policy in a significant way, we'll tell you in the app or by email before it takes effect.
Contact
James Paas, trading as Kematra · support@kematra.com · 47 Coulton Road, Wallaroo, NSW, 2618, Australia