Legal
Clenans is an academic AI platform for grading, quizzes and tutoring. This policy explains what personal data the platform handles, why, who else processes it, where it lives and how long it is kept. It is written to be read, not to be survived.
Clenans is currently operated as a sole proprietorship by Kenan Sadhu, based in Indonesia. Contact: kenan.sadhu@clenans.com. When the operating company is incorporated, this section will be updated to name it and this policy will be reissued with a new effective date.
Where Clenans is used by a school, university or tutoring organisation, that institution decides what data is entered and who may see it. In data-protection terms the institution is the controller and Clenans acts as a processor on its instructions. The institution is responsible for giving notice to its students and obtaining any consent its own law requires. If you are a student and want to know why your school uses Clenans, ask your school first — they can answer faster than we can.
Where an individual signs up directly, without an institution, Clenans is the controller for that account.
If your institution launches Clenans from Canvas, Moodle or Blackboard via LTI 1.3, we receive the identity and course information your LMS sends — typically a user identifier, name, email, role and course context — and we send grades back to your LMS gradebook when your institution has enabled that.
Ordinary server and security logs, and the cookies and local browser storage needed to keep you signed in and remember interface preferences.
What Clenans does not do. There is no advertising on the platform, no advertising network embedded in it, and no third-party analytics or tracking scripts. Personal data is never sold, rented or shared for marketing. There is no behavioural profiling for any purpose other than the educational progress reporting the platform exists to provide.
Clenans uses third-party AI models. When you use an AI feature, the relevant content is transmitted to the model provider over their API so the model can produce a response. That content can include student work, teaching materials, quiz questions and your messages to the AI.
The current providers are Google (Gemini models), OpenAI and Anthropic. Content sent to them is handled under their respective API terms. Clenans does not control those terms and they may change; if you need contractual certainty about a specific provider's handling for an institutional deployment, contact us before uploading sensitive material.
Clenans applies a standing rule that AI output is advisory: it is presented to a human for review, and a teacher decides what becomes a grade or reaches a student. That is a product design commitment, and the reason accuracy of AI output is addressed in the Terms of Service rather than treated as a guarantee here.
Teacher decisions — corrections to AI grades, accepted and rejected suggestions, and the evidence attached to learning-progress judgements — are retained and analysed to improve how the platform's AI features behave. This is a core function of the product, not an optional extra, and it is one reason those records are kept as described in section 7. Clenans does not sell these records or share them for any purpose outside operating and improving the platform.
Clenans relies on a small number of infrastructure providers, each of which processes data only to provide its service to us:
| Provider | Purpose |
|---|---|
| Supabase (hosted on Amazon Web Services) | Database, file storage, authentication |
| Vercel | Application hosting and content delivery |
| Gemini AI models; Google Sign-In where you choose it | |
| OpenAI | AI models |
| Anthropic | AI models |
We will also disclose data where we are legally required to, and to protect the rights and safety of users. This list changes as the platform changes; the effective date at the top of this page tells you how current it is.
The primary database and file storage are hosted in Singapore (AWS ap-southeast-1). Application hosting and content delivery are globally distributed, and AI providers process requests in their own regions, which are typically outside your country. Using Clenans therefore involves international transfer of the data described above.
Account and class data is retained while the account or institutional relationship is active, and for a reasonable period afterwards to allow recovery of records and to meet legal obligations.
Some records are retained deliberately and long-term, because the platform's usefulness depends on them:
These records are not routinely deleted as part of ordinary housekeeping. They can still be deleted on request as described below, subject to any obligation we have to the institution that owns the account.
Depending on where you live, you may have rights to access, correct, export, restrict or delete your personal data, and to object to certain processing.
If your account belongs to a school or institution, send your request to them first — they control the account and can act immediately. We will support them in responding, and will pass requests on where we can identify the institution.
For direct accounts, or where your institution cannot help, email kenan.sadhu@clenans.com. We will respond within 30 days. We may need to verify your identity before acting on a request, and we may be unable to delete records an institution is legally required to retain.
Clenans is designed to be used in education, and many of its users are school students who are minors. It is not offered directly to children: accounts are created by an institution, by a teacher or tutor, or by an adult.
Where students are minors, the institution is responsible for the lawful basis for their data being processed, including any parental notice or consent its jurisdiction requires. Student work and AI tutoring conversations are visible to the teaching staff responsible for that class — this is a deliberate design property, not an incident, because the platform exists to let a teacher supervise what the AI tells a student.
If you believe a child's data has been provided to Clenans without the appropriate authority, contact us and we will investigate and delete it where required.
Data is encrypted in transit. Access to data within the platform is enforced at the database level, so that users see only the classes, students and records their role and institution permit. Administrative access to production systems is limited to the operator. AI provider credentials are held as server-side secrets and are never exposed to the browser.
No system is perfectly secure. If we become aware of a breach affecting personal data, we will notify affected institutions and users, and any regulator we are required to notify, without undue delay.
We will update this page when the platform changes. The effective date at the top always reflects the current version. Where a change materially affects how personal data is handled, we will notify account holders by email or in the application.
Questions, requests or complaints: kenan.sadhu@clenans.com.