Kyper Studio Privacy Policy

1. Who we are and our role

Kyper Studio accounts are provided through an organization that has an agreement with 1st90, such as your employer or a 1st90 partner (the “Customer” and the “Customer Agreement”).

For your account information and our own operation of the Studio Services, 1st90 decides how personal information is used. For content and program data that the Customer provides or that we process on its behalf, including data about learners, 1st90 acts as a service provider (or processor) and handles that data under the Customer’s instructions and the Customer Agreement.

2. Information we collect

Account information. Your name, work email address, organization, role, and the permissions assigned to your account, plus the sign-in details we need to authenticate you. If you sign in with single sign-on, we receive the identity details your organization’s identity provider shares with us.

Content you provide. Source materials you upload or link to (such as documents and webpages), instructions and prompts you enter, edits you make, and the content Kyper Studio generates for you, such as outlines, learning cycles, and voice practice personas, scenarios, and scoring rubrics. Kyper Studio is built for learning content, not personal data. It screens inputs to detect and block personal information, and we ask you not to include personal information in source materials unless the Customer Agreement permits it.

Program data. Through the Studio Services, authorized users can view data about the programs they manage, such as engagement, completion, reflection, and survey metrics. Most of this data is aggregated. Users with learner-level permissions can view individual learners’ activity records (such as when each step was started and completed) and, depending on the identity level they select, learners’ names and work email addresses.

AI connector information. When you connect the Kyper AI connector to a third-party AI assistant, we receive the authorization details needed to confirm your identity and permissions (such as OAuth tokens) and the requests the assistant sends on your behalf, including the action name and its parameters (for example, a cycle identifier or date range). We do not request, receive, or store your conversation history, memory, or other chat content from the AI assistant.

Usage and device information. Information about how you use the Studio Services, such as features used, pages viewed, actions run, timestamps, session and trace identifiers, IP address, browser type, and device information. We collect some of this through cookies and similar technologies that keep you signed in, remember your preferences, and help us understand how the Studio Services are used.

Support communications. Information you share when you contact us for help or send us feedback.

We do not ask for, and do not intend to collect, sensitive personal information through the Studio Services, such as government identification numbers, financial account or payment card information, health information, or precise location.

3. How we use information

We use personal information to:

• Provide, operate, and maintain the Studio Services, including generating learning content with AI models
• Authenticate users and enforce the access permissions the Customer has set
• Run the actions you request through the Kyper AI connector and return the results to the assistant you are using
• Screen inputs and outputs for safety, including content moderation, prompt-injection and jailbreak detection, and personal-data detection
• Provide support and send service-related communications
• Monitor, secure, and troubleshoot the Studio Services and prevent misuse
• Understand usage in aggregated or de-identified form so we can improve the Studio Services
• Comply with law and enforce our agreements

We do not use Customer content or program data to train AI models, and the AI model providers we use are not permitted to use it to train theirs.

4. Third-party AI integrations

When you connect a 1st90 or Kyper product to a third-party AI assistant, the data you request through that integration is transmitted to the provider operating that assistant, including but not limited to Anthropic (Claude) and OpenAI (ChatGPT and Codex), to deliver the feature you invoked. Only the specific data returned by the action you run is shared. The integration operates at your direction, and the provider’s handling of that data is governed by its own terms and privacy policy.

Your permissions still apply. The connector uses your existing Kyper account. It cannot return data you are not already authorized to see in the Studio Services. Learner-level data is available only to users with learner-level permissions, and learners are shown as anonymous identifiers unless you choose a more detailed identity level.

Read-only actions. The connector’s current actions retrieve information only. They do not create, change, or delete data in Kyper.

You stay in control. You can disconnect the connector at any time in your AI assistant’s settings, and the Customer or 1st90 can revoke connector access. Disconnecting stops future transfers but does not delete data the provider has already received. Contact that provider about its retention practices.

Not our service providers. AI assistants you connect are third-party services that you or the Customer choose to use, and 1st90 does not control how their providers process data. This differs from the AI model providers 1st90 uses to power Kyper Studio itself, which act on our behalf and are described in Section 5.

5. How we share information

We share personal information only as described below. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

The Customer. The Customer’s authorized administrators can access your account information, your activity in the Studio Services, and content you create for the Customer.

Service providers. We use service providers that process information on our behalf under written agreements with confidentiality and security obligations. They include cloud hosting and storage (Amazon Web Services), AI model providers that power content generation and safety screening (currently OpenAI, Google, and Anthropic), and providers of email, analytics, and support tools. We access AI models only through enterprise services whose terms do not permit the provider to use our customers’ content to train its models. A current list of subprocessors is available to Customers on request.

Third-party AI assistants you connect. At your direction, as described in Section 4.

Legal requirements and safety. Where required by law, regulation, or legal process, or where needed to protect the rights, property, or safety of 1st90, our users, or others.

Business transfers. As part of a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

With consent. For other purposes with your consent or at the Customer’s direction.

6. Where we store information and how we protect it

We store information in Amazon Web Services data centers in the United States. If you access the Studio Services from outside the United States, your information will be transferred to and processed in the United States.

We protect information with encryption at rest (AES-256, managed through AWS Key Management Service) and in transit (TLS), non-public infrastructure, role-based access based on least privilege, multi-factor authentication for administrative access, logging and monitoring, and periodic independent penetration testing. No system is completely secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us right away at hello@1st90.com.

7. Data retention

We retain your personal information for as long as your account is active or as needed to provide the Studio Services, and thereafter only as required to comply with our legal obligations, resolve disputes, and enforce our agreements. Our standard retention periods are:

• Account information: for the duration of the Customer’s relationship with 1st90 and for up to 12 months after it ends, unless you or the Customer ask us to delete it sooner
• Source materials you upload: for the duration of the Customer’s relationship with 1st90 and for up to 3 years after it ends, unless the Customer Agreement sets a different period
• Learning content you create, such as cycles and curricula: for the duration of the Customer’s relationship with 1st90 and for up to 12 months after it ends
• Prompts and AI-generated drafts: for the duration of the Customer’s relationship with 1st90
• Connector authorization tokens: until you disconnect, the token expires, or access is revoked (records of connector requests are kept as part of our logs)
• Logs: operational logs for at least 90 days, and security and audit logs for at least 12 months, then deleted on a rolling basis
• Aggregated or de-identified data: may be kept indefinitely, because it can no longer be used to identify you

The Customer can ask us to return or delete Customer data at any time, including when its relationship with 1st90 ends, and we complete those requests within 30 days. Residual copies in our encrypted backups are deleted automatically within our 30-day backup cycle. If the Customer Agreement sets different retention periods, it controls. Data that a third-party AI assistant has received is retained under that provider’s policies.

8. Your choices and rights

Access, correction, and deletion. You can ask us to access, correct, or delete your personal information by emailing hello@1st90.com. Where we process the information on behalf of the Customer, we may refer your request to the Customer or act on its instructions.

Connector access. You can disconnect the Kyper AI connector at any time from your AI assistant’s settings.

Communications. We send service-related messages while your account is active. You can opt out of non-essential emails using the unsubscribe link in those emails.

Cookies. You can control cookies through your browser settings. Blocking some cookies may stop features such as sign-in from working.

California residents. If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, and to request access to, correction of, or deletion of it. You also have the right to opt out of the sale or sharing of personal information (we do not sell or share it, as those terms are defined under California law) and the right not to be discriminated against for exercising your rights. To make a request, email hello@1st90.com. We will verify your identity before responding, and you may use an authorized agent.

Other locations. Depending on where you live, you may have similar rights under local law. Contact us and we will respond in line with applicable law.

9. Children

The Studio Services are for professional use and are not directed to anyone under 18. We do not knowingly collect personal information from children.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and notify you through the Studio Services or by email before the changes take effect.

11. Contact us

Questions, requests, or concerns about this Privacy Policy can go to our Privacy Officer: