1. Introduction
Carna provides an AI English product family for individuals, schools, businesses, and assessment. This Privacy Policy describes how we handle the personal data of people who visit our websites, create accounts, and use our products. We are committed to processing your data lawfully, fairly, and transparently in accordance with the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK).
By using Carna, you agree to the practices described here. If you do not agree, please do not use the service.
2. Who we are
The data controller responsible for your personal data is Carna Labs Limited.
Registered address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, GB.
Companies House Registration Number: 17207956.
You can reach us about any privacy matter at support@carna.ai.
3. What data we collect
We collect the following categories of personal data:
- Account data — such as your name, email address, password (stored hashed), and the plan or organisation associated with your account.
- Usage data — how you interact with the product, including pages visited, features used, device and browser information, and approximate location derived from your IP address.
- Learning data — the content you generate while learning, such as lesson progress, assessment results, written essays, and audio from speaking practice, which we process to give you feedback and track your progress.
4. How we use your data
We use personal data to:
- provide, maintain, and improve the Carna products;
- personalise your learning experience and generate AI-driven feedback;
- communicate with you about your account, updates, and support requests;
- keep our service secure and prevent fraud or abuse;
- comply with our legal obligations.
5. Legal bases for processing
Under the GDPR, we rely on the following legal bases:
- Contract — to deliver the service you have signed up for.
- Legitimate interests — to improve, secure, and support our products, balanced against your rights and freedoms.
- Consent — where required, for example for certain cookies and optional marketing communications. You may withdraw consent at any time.
- Legal obligation — where we must process data to comply with the law.
6. Data sharing and sub-processors
We do not sell your personal data. We share data only with trusted service providers (sub-processors) who help us run Carna — for example cloud hosting, analytics, payment processing, and email delivery. These providers act on our instructions under written data-processing agreements and may only use your data to provide their service to us.
We may also disclose data where required by law, to protect our rights, or in connection with a corporate transaction such as a merger or acquisition.
7. International transfers
Carna operates across jurisdictions, so your data may be transferred to and processed in countries outside your own, including the United Kingdom, the European Economic Area, and Türkiye. Where data is transferred internationally, we put appropriate safeguards in place, such as Standard Contractual Clauses or equivalent mechanisms recognised under applicable law.
8. How we protect your data
We take security seriously. Personal data is encrypted in transit using TLS whenever it travels between you and Carna. We apply access controls, monitoring, and the principle of least privilege so that only authorised people can access your data for legitimate purposes. No system is perfectly secure, but we work continuously to protect your information.
9. Your rights
Depending on where you live, you have rights over your personal data under the GDPR and KVKK, including the right to:
- access the personal data we hold about you;
- rectify data that is inaccurate or incomplete;
- erase your data ("right to be forgotten");
- port your data to another service;
- restrict or object to certain processing;
- withdraw consent where processing is based on consent.
To exercise any of these rights, contact us at support@carna.ai. You also have the right to lodge a complaint with your local data protection authority.
10. Children's privacy
Some Carna products are designed for younger learners. Where a product is intended for children, we process children's data only as permitted by applicable law, including the Children's Online Privacy Protection Act (COPPA) in the United States, and we obtain verifiable parental or school consent where required. We do not knowingly collect more data from a child than is necessary to provide the service. If you believe a child has provided us data without appropriate consent, please contact us so we can address it.
11. Cookies
We use cookies and similar technologies to operate our sites, remember your preferences, and understand how our products are used. You can manage non-essential cookies through your browser settings and, where available, through our cookie preferences. Essential cookies are required for the service to function and cannot be switched off.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. We encourage you to review this page periodically.
13. How to contact us
If you have any questions about this Privacy Policy or how we handle your data, please contact Carna Labs Limited at support@carna.ai.