Kerra Privacy Policy

Last Updated: August 25, 2026 · Effective across the Kerra web app, iOS app, Android app, and the Kerra Connect Chrome extension

1. Introduction and Our Role

PlanItUni LLC, d/b/a Kerra ("Kerra," "we," "us," or "our"), operates an AI-powered study companion available through kerra.app, our iOS and Android applications, and the Kerra Connect Chrome extension (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use and share it, and the choices you have, across every platform on which Kerra operates. It should be read together with our Terms of Service.

For privacy and data protection laws that apply to us, PlanItUni LLC is generally the controller or responsible party for the personal information described in this Policy.

Kerra is an independent, third-party platform. We are not affiliated with, sponsored by, or endorsed by any college, university, or learning management system ("LMS") provider, including Canvas, Moodle, Blackboard, or Brightspace. References to your school or LMS in this policy describe features you personally connect — not any institutional relationship.

1.1 FERPA notice

Kerra is not your school, and we do not act as your institution's "school official" under the Family Educational Rights and Privacy Act unless your institution has separately agreed to that in a direct written agreement with us. We access LMS information only through the personal authorization you grant as an individual student. If you have questions about your rights in your education records, contact your institution.

1.2 Your acknowledgment

By creating a Kerra account or using the Service on any platform, you acknowledge this Privacy Policy and confirm that you meet the age requirement described in Section 13.

2. Information We Collect

2.1 Information you provide directly

Account and profile information (name, email address, school, expected graduation year, major); your phone number, if you provide one for text messages; payment and billing information, processed by our payment processor and not stored in full on our servers; support and correspondence you send us; and any content you choose to share, such as feedback or referral information.

We also keep records of the choices you make: when you accepted our Terms of Service and this Privacy Policy, your consent to text messages and any later opt-out, your Kerra Genius enrollment status and the date you enabled or disabled it, your cookie choices, and your other feature settings. We keep these records because we need them to honor your choices and to show that we honored them.

2.2 Course and learning management system (LMS) information

If you connect Kerra to Canvas, Moodle, Blackboard, Brightspace, or another supported LMS — through our web app, mobile apps, or the Kerra Connect extension — we access a limited set of data from your LMS account through the personal access authorization you grant as a student. This is limited to your course names, assignment names and due dates, lecture files, and calendar items.

You control which courses are included: you may exclude any individual course from LMS sync at any time in account settings, and Kerra will not access or store data from excluded courses. We do not request, access, or store your grades, GPA, transcripts, gradebook entries, disciplinary records, or any other administrative or instructor-facing data — our LMS access is limited to schedule- and content-related information needed to power reminders and study features.

Your synced course names, assignment names and due dates, lecture files, and calendar items sit encrypted at rest, and Kerra has no standing server-side access to this data. When you actively prompt Kerra — for example, to summarize a lecture file or ask about an upcoming assignment — the relevant content is decrypted and sent to third-party AI providers to generate that response, as described in Section 4. See Section 8 for how we treat this data.

2.3 User content

Materials you upload or connect for study purposes — lecture recordings, notes, slides, syllabi, and documents — and the prompts, chat messages, and queries you submit to Kerra ("User Content"). This is the category that our AI processes, as described in Section 4.

2.4 Information collected automatically

Device and browser information, operating system, app version, usage and interaction data, and crash and diagnostic logs, collected through cookies, SDKs, and similar technologies across web, iOS, Android, and the Chrome extension. Usage and interaction data means how you use Kerra's features — for example, which tools you open (chat, flashcards, scheduling), how often, and for how long — not the content of your synced LMS data, which sits encrypted at rest and to which we have no standing server-side access, as described in Section 8. Our mobile apps may also collect device identifiers and push-notification tokens where you have enabled notifications.

Like virtually all web and mobile applications, our hosting and infrastructure providers automatically log IP addresses as part of standard server request logs, for security, rate-limiting, and abuse-prevention purposes. We do not separately collect, store, or use IP addresses for profiling, advertising, or Kerra Genius matching.

The Kerra Connect extension also stores connection and session state locally in your browser so that it can maintain your authorized LMS connection. That local data remains on your device until it expires, you disconnect the LMS, you remove the extension, or you clear its storage.

2.5 Information from third parties

We may receive information from authentication providers (such as single sign-on through your school or Google/Apple sign-in), payment processors, your LMS provider (per your authorization), referral programs, and, where you opt in, from Employer Partners participating in Kerra Genius (Section 5).

3. How We Use Your Information

We use information to: provide and operate the Service across all platforms; process User Content through AI systems to generate study aids such as summaries, flashcards, practice questions, and chat responses; sync assignments and deadlines; authenticate accounts and manage subscriptions and billing; send service, trial, and billing-related communications; send text messages if you have opted in; provide customer support; maintain and improve the product; detect fraud, abuse, and academic-integrity risk; enforce our Terms of Service; and comply with legal obligations.

We do not sell your academic content or grades to advertisers and we do not build advertising profiles from your coursework. Where contractually available, we prohibit our AI providers from using your academic content to train their general-purpose models, as described in Section 4.

4. AI Features and Your Data

When you upload materials or ask Kerra a question, our AI systems and select third-party AI model providers and routing vendors process that content to generate outputs such as transcripts, summaries, flashcards, practice tests, and chat responses. The categories of provider we use include cloud AI model providers and model-routing or inference vendors. Where contractually available, we prohibit these providers from using your academic content to train their general-purpose models, and we seek configurations designed to limit their retention. We cannot guarantee any provider's independent data practices after transmission, so if you do not want particular material processed by a third-party AI provider, do not submit that material to AI features.

This AI processing applies to materials you actively upload or type into Kerra, and also applies to your synced LMS content (course names, assignment names and due dates, lecture files, calendar items) when you actively prompt Kerra using that content — for example, asking Kerra to summarize a lecture file or explain an upcoming assignment. Outside of when you actively prompt Kerra, your synced LMS content sits encrypted at rest, and Kerra has no standing server-side access to it, as described in Section 8.

AI-generated study aids may contain errors or inaccuracies and should not be treated as a substitute for your course materials, instructor guidance, or your own judgment. See our Terms of Service for related disclaimers.

Kerra Genius is opt-in. Nothing in this section applies to you unless you affirmatively enable Kerra Genius in your account settings. You must be at least 18 years old, or the age of majority in your jurisdiction, to enable it.

Kerra Genius is a feature that gives participating employers, recruiting firms, corporate talent-acquisition teams, and staffing organizations ("Employer Partners") search tools to find students on Kerra. Employer Partners can search and filter only using a student's name, school, major, and class year. Kerra Genius does not use AI-generated evaluations, ratings, scores, or fit signals of any kind — Employer Partners see only the profile fields described below. If you opt in, your Kerra Genius profile — which includes your name, school, major, class year, and any additional information you choose to add, such as skills, interests, or a resume — becomes searchable and visible to Employer Partners.

5.1 Terms used in this section

These definitions match the ones used in Section 9.3 of our Terms of Service.

"Genius Data" means the information we make available to Employer Partners through Kerra Genius: your Kerra Genius profile information (your name, school, major, class year, and any additional information you choose to add) and related engagement metadata.

"Excluded Data" means information that is never part of Genius Data and is never disclosed to Employer Partners through Kerra Genius. Excluded Data is identified in Section 5.2.

Unless you separately and explicitly choose to attach or share them, the following are Excluded Data and are never included in your Kerra Genius profile and never disclosed to Employer Partners:

your grades, GPA, transcripts, or other academic performance data;
your synced LMS content, including course names, assignment names and due dates, lecture files, and calendar items;
your uploaded course materials, lecture recordings, notes, slides, and documents;
your verbatim chat messages, prompts, and AI outputs;
payment, billing, and card data;
your support correspondence, consent records, audit logs, and fraud-prevention signals; and
anything we identify in-product as excluded from Kerra Genius.

Employer Partners never receive direct access to your LMS data or your actual chat conversations — only the profile fields you provide (name, school, major, and class year, plus anything additional you choose to add).

5.3 What we require of Employer Partners

Every Employer Partner must sign an agreement with us before it can access Kerra Genius. Those agreements require the Employer Partner to use Genius Data only for legitimate recruiting, hiring, and internship purposes; not to use Genius Data for advertising, resale, or data brokerage; to maintain reasonable security safeguards; to comply with applicable data protection, employment, and anti-discrimination law; and to honor deletion and suppression requests we pass along. We use commercially reasonable efforts to enforce these agreements, but once Genius Data has been disclosed to an Employer Partner we cannot guarantee that every partner will comply with its obligations at all times.

5.4 How Employer Partners may contact you

If you opt in, we and Employer Partners may email you about relevant internship or job opportunities, recruiting events, or related updates. You may unsubscribe from Kerra Genius opportunity emails at any time through the link in those emails or through your account settings, and you may disable Kerra Genius entirely at any time.

5.5 Turning Kerra Genius off, and what that does

You may turn Kerra Genius off at any time by disabling the toggle in your account settings, or by emailing privacy@kerra.app with the subject line "Genius Opt-Out" and your full name and account email address. You may also edit or remove the information in your Kerra Genius profile at any time.

After we process your request, we will stop generating new Genius Data from your account, and we will remove your profile from active Employer Partner search results within thirty (30) days. Turning Kerra Genius off works going forward. It does not require us or an Employer Partner to recall or delete Genius Data that was already disclosed before we processed your request, and that data may remain subject to the Employer Partner's own retention obligations. We may also keep limited records of your enrollment and opt-out, and of what was disclosed, in order to honor your opt-out, enforce our Employer Partner agreements, and comply with law. De-identified or aggregated information that can no longer reasonably identify you may be retained.

Disabling Kerra Genius also does not affect an Employer Partner's separate use of information you gave it directly — for example, if you applied to a job posting on its own site. You may opt back in at any time.

Making your profile searchable and available to Employer Partners in connection with recruiting access may be considered a "sale" or "sharing" of personal information under laws such as the CCPA/CPRA and comparable state statutes. If you are a resident of a state with those rights, you may opt out at any time — see Section 12. Disabling Kerra Genius is how you exercise that opt-out.

Apart from Kerra Genius (Section 5) and the sharing you direct us to do (Section 7), we share information only in the following circumstances:

With service providers who help us operate the Service — for example, cloud hosting and database providers, payment processors, email and SMS providers, analytics providers such as PostHog, and AI model and routing providers — bound by contract to use data only to provide services to us.
When required by law, legal process, or to protect the rights, property, or safety of Kerra, our users, or others. Where we are legally permitted and it is reasonably practicable, we will try to notify you before disclosing your information in response to legal process. We do not comply with informal requests for user data that lack valid legal process.
In connection with a merger, acquisition, financing, restructuring, bankruptcy, or sale of assets, subject to continued protection under a privacy policy at least as protective as this one.
As aggregated or de-identified data that cannot reasonably be used to identify you.
With your explicit consent for any other purpose.

We do not sell personal information to data brokers, and we do not share personal information for third-party advertising or cross-context behavioral advertising. Kerra Genius is the one context in which we disclose information to third parties for their own use, and it is opt-in and disclosed in Section 5.

If you create a share link, share a workspace, or send content to another person through Kerra, you are directing us to disclose that content to the people you designate. Share links may be copied, forwarded, or accessed by people you did not intend to reach, and recipients may retain or further share what you disclose to them.

Shared content and links remain available until you disable them, we remove them, or the underlying content is deleted. Recipients may keep copies of anything they accessed before you removed it, and we cannot retrieve those copies. Your Kerra Genius settings do not affect content you share this way, and content you share this way is not disclosed to Employer Partners through Kerra Genius.

8. How We Handle Your LMS Data

Kerra is a third-party platform and is not affiliated with, endorsed by, or formally partnered with any college, university, or LMS provider, and we do not have data-sharing agreements with any of them. Our LMS integrations (Canvas, Moodle, Blackboard, Brightspace, and others we may add) work solely through the personal access authorization you grant as an individual student — the same kind of authorization you would grant any personal productivity tool that connects to your account.

Within that access, we never request or receive administrator or instructor-level permissions, and we never access grades, GPA, gradebook entries, transcripts, or disciplinary records — only course names, assignment names and due dates, lecture files, and calendar items for the courses you choose to sync. You can exclude any individual course from sync at any time, and you can disconnect your LMS integration or delete your Kerra account entirely at any time through account settings; doing so removes our ongoing access immediately.

This LMS data sits encrypted at rest on our servers, and Kerra has no standing server-side access to it — not for customer support or any other purpose absent your action. When you actively prompt Kerra using this content — for example, to summarize a lecture file or ask about an upcoming assignment — the relevant content is decrypted and sent to the third-party AI providers described in Section 4 to generate that response. It is never disclosed to your school, instructors, or administrators, and it is never included in Genius Data or disclosed to Employer Partners. If a school or institution has questions about how Kerra's integration works, they are welcome to contact us at privacy@kerra.app.

9. Data Retention and Deletion

We retain personal information and User Content while your account is active, or as reasonably necessary to provide the Service. You may request deletion of your account and associated personal data at any time by emailing privacy@kerra.app or through in-app account settings, available on web, iOS, and Android.

After a verified deletion request, we delete or irreversibly anonymize personal information within thirty (30) days, unless longer retention is required by law or for legitimate business purposes such as fraud prevention or billing records. Backups may retain deleted data for up to ninety (90) days as they age out. Disconnecting an LMS integration removes our ongoing access; previously synced data is deleted per the schedule above unless you request earlier deletion. Session data stored locally by the Kerra Connect extension remains on your device until it expires or you clear it.

Some records survive account deletion because we need them to honor your own choices or to meet legal obligations: consent and opt-out records, Kerra Genius enrollment and opt-out history, unsubscribe and suppression records, audit and fraud-prevention logs, billing records, and anything subject to a legal hold. We keep these for no longer than necessary for those purposes.

10. Data Security

We use commercially reasonable technical, administrative, and organizational safeguards — including encryption in transit and at rest, access controls, and monitoring — across our web, iOS, Android, and extension infrastructure. No method of transmission or storage is completely secure. You are responsible for keeping your account credentials, devices, and browser sessions confidential, and should contact support@kerra.app if you believe your account has been compromised.

11. Cookies and Mobile Tracking Technologies

On the web app and Chrome extension, we use essential cookies for authentication and security, analytics cookies (through our analytics provider, PostHog) to understand product usage, and preference cookies to remember settings. On iOS and Android, we use comparable device identifiers and SDK-based analytics, including PostHog, for the same purposes, consistent with each platform's tracking-permission requirements (for example, Apple's App Tracking Transparency framework, where applicable).

We do not use advertising cookies or SDKs, and we do not allow third-party advertising networks to track you across other apps or websites through the Service.

12. Your Rights and Choices

12.1 All users

You may access, correct, update, export, or delete your personal information; opt out of promotional emails, Kerra Genius opportunity emails, and text messages; enable or disable Kerra Genius; and manage or disconnect your LMS connection — all through account settings on any platform, or by emailing privacy@kerra.app. We may need to verify your identity before processing a request.

12.2 California residents

You may have rights under the CCPA/CPRA to know what personal information we collect, to delete it, to correct it, to limit certain uses of sensitive personal information, to opt out of the sale or sharing of personal information (including Kerra Genius sharing, Section 5), and not to be discriminated against for exercising these rights. To opt out of Kerra Genius sharing, disable Kerra Genius in account settings or email privacy@kerra.app with the subject line "CCPA Opt-Out." You may also designate an authorized agent to submit a request on your behalf.

12.3 Other U.S. states

If you live in a state with a comprehensive privacy law — including Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and others — you may have rights to access, correct, delete, and obtain a portable copy of your personal information, to appeal a decision we make on a rights request, and to opt out of targeted advertising and the sale of personal information. Making your Kerra Genius profile searchable and available to Employer Partners may be considered a sale or sharing of personal information under some of these laws, so if you have that right you may exercise it by disabling Kerra Genius in account settings or emailing privacy@kerra.app. To appeal a decision on a rights request, reply to our response or email privacy@kerra.app with the subject line "Rights Appeal."

12.4 EEA, UK, and other jurisdictions

If the GDPR or UK GDPR applies to you, you may have rights of access, rectification, erasure, restriction, portability, and objection, the right to withdraw consent, and the right to lodge a complaint with your local supervisory authority. Our legal bases for processing are generally: performance of our contract with you, for the processing needed to provide the Service you asked for; your consent, for optional features and communications, including Kerra Genius and text messages; our legitimate interests, for security, fraud prevention, service integrity, and product improvement; and compliance with legal obligations. Users in other jurisdictions with comprehensive privacy laws may have similar rights. Contact privacy@kerra.app to exercise any applicable rights.

13. Age Requirement and Younger Users

The Service is designed for college and university students. Kerra is intended for users who are at least sixteen (16) years old. If you are between 16 and 18, you should have a parent or guardian review this Privacy Policy and our Terms of Service before you use the Service. We do not knowingly collect personal information from anyone under 16.

Kerra Genius is available only to users who are at least 18 years old or who have otherwise reached the age of majority in their jurisdiction. We do not enroll users under 18 in Kerra Genius, and do not disclose their information to Employer Partners.

If we learn that a person under our minimum age has provided personal information, we will take steps to delete it and, where applicable, terminate the associated account. Parents and guardians may contact privacy@kerra.app.

14. International Data Transfers

Information may be transferred to, stored in, and processed in the United States and other countries where our service providers and infrastructure are located, which may have different data protection laws than your home jurisdiction. For users in the EEA, UK, or other regions requiring specific transfer mechanisms, we rely on recognized safeguards such as Standard Contractual Clauses where required.

15. Do Not Track and Opt-Out Preference Signals

Some browsers send "Do Not Track" signals. Because there is no common industry standard for responding to them, the Service does not currently respond to Do Not Track. We do treat Global Privacy Control signals as a valid request to opt out of the sale or sharing of personal information where applicable law requires us to honor them. We do not track users across unaffiliated third-party websites or apps for advertising purposes.

16. Third-Party Links and Services

The Service may link to or integrate with third-party websites, LMS platforms, app stores, payment processors, AI providers, or applications that Kerra does not operate or control, including your institution's LMS. This Privacy Policy does not apply to those third-party services, and we are not responsible for their privacy practices.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or the platforms on which Kerra operates. We will post the updated policy with a revised "Last Updated" date and, for material changes (including changes affecting Kerra Genius data sharing), provide notice by email or in-app notification across web, iOS, and Android.

Continued use of the Service after changes take effect means you accept the revised policy. If you disagree, you may stop using the Service and request account deletion. We will not apply a material change to how we disclose Genius Data retroactively to information already disclosed.

18. Contact Us

Questions, concerns, or requests regarding this Privacy Policy — including from schools or institutions — may be sent to PlanItUni LLC at privacy@kerra.app. General support requests may be sent to support@kerra.app.