Privacy Policy

This Privacy Policy explains how Karson AI, Inc. collects, uses, discloses, retains, and protects information when you use Make Questions, our educational question generation, study, assessment, sharing, and export service.

This policy is intended to describe our current practices. It is not a promise that any feature, provider, integration, or data practice will remain unchanged.

Account and Contact Information

• Name, email address, user ID, and profile details provided through account authentication
• Communications, support requests, feedback, and other messages you send to us

Content and Activity Information

• Prompts, source text, URLs, uploaded files, selected content, settings, and preferences used to generate questions
• Generated questions, answers, explanations, titles, saved sessions, public shares, exported files, and question interactions
• Feedback, ratings, answer attempts, grading requests, and similar product activity

Billing Information

• Subscription status, plan, billing interval, Stripe customer and subscription identifiers, checkout status, invoice-related events, and cancellation status
• Payment card numbers and sensitive payment credentials are processed by Stripe and are not stored by us directly

Technical, Device, and Usage Information

• IP address, browser type, operating system, device information, locale, referrer, timestamps, pages viewed, feature usage, performance data, logs, and error reports
• Cookies, local storage, session storage, anonymous identifiers, analytics identifiers, and similar technologies described in our Cookie Policy

Google Integration Information

• Google OAuth tokens and scopes when you choose to connect your Google account for Google Docs or Google Forms export
• Export metadata needed to create documents and forms that you request

We collect information from:

• You, when you enter prompts, upload content, save sessions, publish links, export materials, submit feedback, or contact us
• Your account and authentication provider when you sign in or manage your profile
• Your device, browser, cookies, local storage, session storage, server logs, and analytics tools when you use the Service
• Service providers such as Stripe for billing events and Google APIs when you authorize a Google export connection

We use information to:

• Provide, secure, maintain, troubleshoot, and improve the Service
• Generate, save, display, grade, share, and export questions and related educational materials
• Authenticate users, manage accounts, enforce feature access, and prevent unauthorized access
• Process subscriptions, billing, invoices, cancellations, and plan entitlements through Stripe
• Create Google Docs and Google Forms when you choose to use Google export
• Analyze product usage, reliability, performance, errors, and abuse patterns
• Respond to support requests, privacy requests, security reports, and feedback
• Comply with legal obligations, enforce our Terms, and protect rights, safety, and the Service

We do not sell personal information for money. We share information only as described in this policy or as otherwise disclosed to you. If privacy laws where you live define certain analytics or service-provider disclosures as a “sale,” “sharing,” or similar activity, you may contact us to exercise any rights available under those laws.

Service Providers

We use providers to operate the Service, including:

• Clerk: authentication, user sessions, and account management
• Stripe: checkout, subscriptions, payment processing, billing portal, invoices, and related billing events
• MongoDB: application database storage for sessions, billing state, Google token records, referrals, feedback, and related service data
• Vercel: hosting, serverless functions, analytics, speed insights, and Vercel Blob storage for attachments and generated/exported assets where used
• PostHog: product analytics, event tracking, user identification, and error reporting
• OpenAI and our Python API-backed generation service: AI-powered generation, follow-up, explanations, titles, and grading for user-submitted content
• Google APIs: optional Google Docs and Google Forms export when you connect your Google account

Legal, Safety, and Business Transfers

• We may disclose information to comply with law, legal process, or government requests
• We may disclose information to enforce our Terms, detect abuse, protect security, or protect the rights and safety of users, us, or others
• We may transfer information as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction, subject to applicable law

Public Sharing and User Direction

If you publish a public session link, export materials, send files to a third-party service, or otherwise direct us to share content, that content may be available to the people or services you choose. Public sessions that meet our indexing criteria may also be included in public sitemaps or become discoverable by search engines and other crawlers.

User-submitted text, files, generation settings, and related context may be processed by AI providers or our backend generation services to provide question generation, title generation, answer generation, explanation, follow-up, and grading features.

Uploaded attachments are stored in Vercel Blob using public but unguessable URLs tied to your account namespace. When you use attachments for generation, the attachment URLs and related metadata may be sent to our Python API-backed generation service and AI providers to provide the requested feature.

AI services only receive content needed to provide the feature you request. Google User Data obtained from Google APIs is never sent to AI services.

We do not use Google User Data to train, retrain, or fine-tune AI or machine-learning models.

We retain information for as long as reasonably needed for the purposes described in this policy, including:

• Account information while your account remains active or as needed to provide the Service
• Saved sessions, generated questions, public shares, and exports until deleted, unpublished, overwritten, or no longer needed to provide the Service
• Uploaded attachments referenced by saved sessions or public shares while those records are retained; unreferenced attachment uploads may be deleted after a cleanup period
• Billing and transaction records as required for accounting, tax, fraud-prevention, dispute, and legal purposes
• Google OAuth tokens until you disconnect Google export, revoke access, or we delete them for security or operational reasons
• Logs, analytics, performance, and security records for periods appropriate to operate, secure, debug, and improve the Service
• Backup, archival, and residual copies for a limited period after deletion from active systems

We may retain de-identified, aggregated, or non-Google-API-derived analytics information for service improvement. Google User Data obtained via Google APIs is not included in anonymized or aggregated datasets.

Depending on where you live, you may have rights to access, correct, delete, receive a copy of, restrict, object to, or withdraw consent for certain processing of your personal information.

To make a privacy request, contact us at hello@karson.ai. We may need to verify your identity before completing a request. We will respond within a reasonable time and as required by applicable law.

You can manage billing through the Stripe billing portal where available, manage authentication profile details through the account controls made available in the Service, disconnect Google export from the Export dialog, and revoke Google access at myaccount.google.com/permissions.

We use cookies, local storage, session storage, and similar technologies for authentication, security, preferences, referrals, analytics, performance, error reporting, and product functionality.

You can control cookies through your browser settings. Disabling cookies or storage may limit or break parts of the Service. See our Cookie Policy for more detail.

We use technical and organizational safeguards designed to protect information, including access controls, encrypted transport, provider security controls, and operational monitoring.

No method of transmission, processing, or storage is completely secure. We cannot guarantee absolute security.

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact us at hello@karson.ai.

If you use the Service in an educational setting or on behalf of students, you are responsible for ensuring that you have the necessary authority, notices, and consents required by your institution and applicable law.

We and our service providers may process information in the United States and other countries where privacy laws may differ from those in your location. Where required, we rely on appropriate safeguards for international transfers.

“Google User Data” means data obtained from Google APIs through your Google account connection.

When you connect your Google account to Make Questions, we request access to the following Google services:

Google Services We Access

• Google Docs: To create new documents containing exported questions as printable worksheets with optional answer keys, and to update those newly created documents with your selected content
• Google Forms: To create new forms containing exported questions as quizzes, and to update those newly created forms with your selected content. The Google Forms scope may technically permit broader Forms access than our export workflow uses.
• Google Drive file access: To create and access only files created by or opened with the Service, as permitted by the Google Drive file scope

How We Use Your Google Data

• Create new Google Docs and Forms in your Google Drive when you choose to export, and update those newly created files with the questions and settings you select
• Refresh access tokens as needed so export features continue to work while connected
• Show connection status and allow you to disconnect Google export

What We Do Not Do

• We do not intentionally read, modify, or delete unrelated existing Google documents or forms
• We do not access Google services beyond the scopes you authorize for export
• We do not share Google User Data with third parties except as needed to provide the Google export feature, comply with law, or protect security
• We do not use Google User Data for advertising, retargeting, or personalized ads
• We do not use Google User Data to train, retrain, or fine-tune AI or machine-learning models

Token Storage and Revocation

When you connect Google, we store OAuth tokens associated with your Make Questions account so we can create requested documents and forms. You can disconnect Google export in the Export dialog or revoke access from your Google Account permissions page.

When you disconnect, we delete stored Google OAuth tokens from our systems.

Google API Services User Data Policy

Make Questions’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We may update this Privacy Policy from time to time. If changes are material, we will provide notice by posting the updated policy, updating the date above, or using another reasonable method.

If you have questions about this Privacy Policy or our data practices, contact us at: