What we keep, and what we do with it.

1. Who we are and how to contact us

Kai MBA Consulting is a product of Kaigen Labs, Inc., a company incorporated in Delaware, United States. Kaigen Labs Inc. is the data controller for the personal data described here, which means we decide what is collected and what happens to it.

This policy covers kaimbaconsulting.com and everything you do on it: your account, the Playbook with the tools that save your work and the connector for your own Claude or ChatGPT, and any add-on you buy.

There is no chat assistant on this site and we do not run an AI model. Anything conversational happens inside your own Claude or ChatGPT, on your subscription with Anthropic or OpenAI, under their privacy policy rather than ours. Section 5 explains where the line falls.

Write to kai@kaimbaconsulting.com about anything in this policy, including a request to see or delete your data. For everything else, kai@kaimbaconsulting.com. We have not appointed a data protection officer, because we are not required to. Your request goes to a person either way.

2. What we collect

Your account

Accounts run on Clerk. When you sign up we receive your email address, your name if you give one, and a user identifier. If you sign in with Google we receive your name, email address and profile picture from Google, and nothing more. Clerk holds your password or your sign-in method. We never see it.

Your resume and other documents

If you upload a resume or another document we store the file and the text taken out of it, so you can read it back and so the connector can serve it to your own assistant when you ask it to. A resume usually holds your name, contact details, employment history, education, test scores and whatever else you chose to put in it. Upload only what you are comfortable sharing.

What you save in the tools

The six tools that save your work keep it in your account, so it is there when you come back: your application tracker entries, your job target list, your GMAT study plan and error log, and the entries you make in the essay and practice tools. Your reading progress through the modules is stored the same way. The other six tools save nothing.

Your connector token

When you set up the connector we create a private token for your account and store it, along with the time it was created and the time it was last used. We log that a request came in and which tool it called, so we can keep the endpoint working and spot abuse. We never receive the conversation you are having with your own assistant, only the request it makes for a module, a worksheet or one of your documents.

Payment data

Stripe processes the payment. We never see or store your card number. We receive and keep payment metadata: a Stripe customer and payment identifier, the amount, the currency, the date, the last four digits and card brand, the billing country, and whether the payment succeeded. We use that to give you access and to keep our accounts.

Technical data

When you use the site we collect the technical information any web service needs: a hashed version of your IP address, which we use for rate limiting and abuse prevention and which we cannot turn back into your IP address, a browser and device description, timestamps, error reports, and the result of a Cloudflare Turnstile check that tells us whether a request came from a human. Turnstile is a privacy-preserving bot check and does not track you across sites.

What we do not collect

We do not run advertising trackers, we do not build profiles of you for marketing, we do not buy data about you, and we do not ask for special category data such as health, religion or ethnicity. Do not put that kind of information into a document you upload unless it is genuinely part of your application story.

3. Why we use it, and our lawful basis

Under the UK and EU GDPR we need a lawful basis for each purpose. Here they are, purpose by purpose.

• To give you the modules, the worksheets, the tools, the connector and the live sessions. Basis: performance of our contract with you. Data used: account data, uploaded documents, saved tool entries, connector token.
• To keep your account open before you buy the Playbook. Basis: steps you ask us to take before entering a contract with you. Data used: account data, hashed IP.
• To take payment and keep financial records. Basis: performance of our contract, and legal obligation for tax and accounting records. Data used: payment metadata, email address.
• To send transactional email: receipts, sign-in links, live session details, service notices. Basis: performance of our contract. Data used: email address.
• To keep the service up, fix bugs and investigate errors. Basis: legitimate interest in a service that works. Data used: technical data, connector request logs, and saved tool entries where they are needed to reproduce a specific fault.
• To prevent abuse and fraud, and to stop a leaked connector token being used. Basis: legitimate interest in protecting the service, and in the case of fraud a legal obligation. Data used: hashed IP, Turnstile result, connector token and its usage counts.
• To improve the Playbook and the tools by understanding what people use. Basis: legitimate interest, and we work from aggregated and de-identified patterns rather than from reading individual accounts. Data used: aggregated usage counts.
• To send you anything that is not a service email. Basis: your consent, which you can withdraw at any time.
• To defend or bring a legal claim, or to comply with a lawful request. Basis: legitimate interest, or legal obligation.

Where we rely on legitimate interests we have weighed our interest against your rights, and we have written this policy so you can see the trade we made. You can object, and section 11 says how.

4. We do not train models on your content

Your documents, your saved tool entries and anything you upload are never used to train, fine-tune or evaluate any AI model, ours or a third party’s. We do not send them to a model at all. The tools are arithmetic on researched data, with no model behind them. Your content leaves us only when your own assistant asks for it through the connector with your token, at your instruction.

We do read what you have stored when we have to: when you report a problem, when we are investigating abuse, or when we are chasing a fault that we cannot reproduce any other way. That access is limited to the people who need it.

5. Who processes data for us

We do not sell your data, and we do not share it with advertisers. We use a small number of service providers, each under a contract that limits them to acting on our instructions.

• Clerk. Accounts, sign-in and session management.
• Convex. The database and file storage. Your documents, saved tool entries and account records live here.
• Stripe. Payments. Stripe is a controller in its own right for the card data it collects.
• Resend. Transactional email.
• Cloudflare. Turnstile bot protection.
• Vercel. Hosting and delivery of the website, including the connector endpoint.

There is no AI provider on that list, because we do not run a model. If you use the connector, the model is the one inside your own Claude or ChatGPT subscription, run by Anthropic or by OpenAI as your provider, not ours. Whatever your assistant reads through the connector, and whatever you type into it, is handled under your agreement with that company and their privacy policy. We do not see that conversation.

We may also disclose data to our accountants and professional advisers, or to a public authority where the law requires it.

This list can change as the service changes. The current list is always the one on this page, and the date at the top tells you when we last revised it. If you would like to be told before a change takes effect, ask at kai@kaimbaconsulting.com and we will add you to the notice list.

6. Sending data outside the UK

Several of the providers above are based in the United States or run infrastructure outside the UK and the EEA, so your data will be transferred out of the UK.

Where that happens we rely on one of these safeguards: an adequacy decision covering the country in question, or the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, backed by an assessment of the risk in that country. Ask at kai@kaimbaconsulting.com and we will tell you which safeguard applies to which provider.

7. How long we keep things

• Your documents. Kept until you delete them, or until you close your account. You can delete a document from your account at any time.
• Saved tool entries and reading progress. Kept while your account is open, so you can come back to them, and deleted when you close it. You can clear a tool’s saved data yourself from inside the tool.
• Your connector token. Kept until you revoke it or close your account. A revoked token stops working immediately and is deleted with the account.
• Account records. Kept while your account is open, and deleted within thirty days of you closing it, apart from the financial records below.
• Financial records, including payment metadata. Kept for six years from the end of the tax year they relate to, because UK tax law requires it. A deletion request cannot override this.
• Technical logs, including connector request logs. Kept for up to ninety days.
• Records of a complaint or a legal claim. Kept for as long as the matter is live, and for six years after it ends.

8. How we protect your data

Everything moves over encrypted connections and is stored encrypted at rest by our providers. Access to production data is limited to the people who need it and protected by multi-factor authentication. Secrets and keys are held server side and never sent to the browser. Members can read only their own records, enforced in the database rather than in the interface. The connector endpoint serves nothing without a live token, the token is tied to one account, and you can revoke it and get a new one whenever you want.

No service is perfectly secure. If a breach happens that is likely to put your rights at risk, we will tell the ICO within seventy-two hours of becoming aware of it and tell you without undue delay.

9. Cookies

We use as few cookies as we can, and all of them are necessary for the service to work.

• Clerk session cookies. Keep you signed in and protect the sign-in flow.
• Cloudflare Turnstile. Sets a short-lived token to confirm a request came from a human.

There are no advertising cookies, no analytics that follow you between websites, and no third party trackers, which is why you do not see a consent banner. You can block cookies in your browser, and if you do, signing in will stop working.

10. Email we send you

We send service email through Resend: receipts, sign-in links, notices about your access, and the details of the monthly live session. You cannot opt out of those while you have access, because they are part of the service.

Anything else, such as news about new chapters, goes only to people who asked for it, and every one of those emails has an unsubscribe link.

11. Your rights

Under UK GDPR you have the right to:

• Access. Get a copy of the personal data we hold about you.
• Rectification. Have anything inaccurate corrected or completed.
• Erasure. Have your data deleted, where we do not have an overriding reason or legal duty to keep it.
• Restriction. Ask us to stop using your data while a dispute about it is sorted out.
• Portability. Receive the data you gave us in a machine-readable format, or have it sent to another provider.
• Objection. Object to any use we base on legitimate interests, including a total objection to direct marketing that we must honour.
• Withdraw consent. Where we relied on your consent, withdraw it at any time, which does not undo what we did before you withdrew it.

To use any of them, write to kai@kaimbaconsulting.com from the email address on your account. We reply within one month. If a request is complicated we may take up to two further months, and if we do we will tell you why within the first month. There is no charge, unless a request is clearly unfounded or excessive. We may ask you to confirm your identity before we release data.

You can delete your documents yourself from your account page at any time, revoke your connector token there, clear a tool’s saved data from inside the tool, and ask us to close your account and delete everything we are not required to keep.

Data held by Anthropic or OpenAI from your own use of Claude or ChatGPT is not ours to reach. Ask them, under their policy.

12. Complaining to the ICO

If you think we have handled your data badly, tell us first at kai@kaimbaconsulting.com and we will try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner’s Office, at ico.org.uk, or on 0303 123 1113. If you live in the EEA you may complain to your national data protection authority instead.

13. Children

The service is built for people applying to business school and is not intended for children. Do not use it if you are under 16, and do not create an account for anyone under 16. If we learn that we hold data about someone under 16, we delete it. To buy the Playbook you must be 18 or older.

14. Automated decision making

We do not make any decision about you by automated means that produces a legal effect or something similarly significant. Nothing in the service decides whether you get admitted, priced differently, or refused anything.

The tools calculate a result from figures you enter and from researched data, and show the rule beside it. That result is information for you to weigh. Every decision about your application is yours, and every decision about admission belongs to a school. Where an automated rule does act on your account, such as a rate limit or a bot check blocking a request, you can ask a person to look at it by writing to kai@kaimbaconsulting.com.

15. Changes to this policy

We update this policy when the service changes, when we add or remove a provider, or when the law moves. The date at the top shows the current version. If a change is material and affects people who have bought the Playbook, we will tell you by email or by a notice on the site before it takes effect.

16. How to contact us

Kaigen Labs, Inc., trading as Kai MBA Consulting.

• Privacy and data requests: kai@kaimbaconsulting.com
• Everything else: kai@kaimbaconsulting.com