Legal

Privacy Policy

Effective date: August 1, 2026 · Version 1.0

1. Who we are

KR Brands, LLC, a New York limited liability company doing business as "Attriva" ("Attriva," "we," "our," or "us"), operates the Attriva mobile application and website at attriva.ai. Our registered address is: 9 Park Place, Great Neck, NY 11021. Contact us at: privacy@attriva.ai

2. Who this policy covers

This policy applies to parents and guardians who create and hold Attriva accounts, children whose information is added to an account by a parent or guardian, and visitors to attriva.ai. Accounts are held by adults only. Children do not create their own accounts and have no direct access to Attriva.

3. Information we collect

3.1 Information you give us directly

Your name and email address
A password (stored securely, never in plain text)
Your child's first name, age or date of birth, and school grade
Activities, journal entries, and photos you choose to log
Your goals and aspirations for your child — private, never shared
Any communications you send to us

3.2 Information we collect automatically

Which features you use and how often
Crash reports and error logs
Your device type and operating system version
The date and time of log entries
Implicit patterns in your own usage — roughly how often you log entries, and whether you tend to follow up on a topic you've raised — used only to decide when a notification from Attriva is likely to be welcome. This is about your usage, not your child's information, and isn't part of your child's record.

We do not collect your precise location. We do not track your movement. We do not read information from other apps on your device.

3.3 Information we do not collect

Grades, test scores, or report cards unless you choose to enter them
Data from school systems or student records
Information about children under 13 beyond what a parent directly enters
Payment card numbers — all payments processed by Stripe
Data from social media profiles

4. How we use your information

We use information only to operate your account, generate personalised roadmaps and insights for your family, create your child's annual portrait, send transactional emails, respond to support requests, improve the product using anonymised aggregate patterns, and comply with legal obligations.

4.1 AI processing policy

Attriva uses the Anthropic API to process family data for AI-powered features including signal extraction, portrait generation, weekly moves, roadmap generation, and advisor functions. Under Anthropic's commercial API terms, your data is never used to train Anthropic's AI models. Anthropic retains API inputs and outputs for up to 7 days for abuse prevention, then deletes them permanently. Attriva does not train, fine-tune, or develop AI models using your family's data. Each family's AI processing uses only that family's data — no cross-family processing occurs.

5. Children's privacy (COPPA)

Attriva applies COPPA-level protections to information about children under 13. All account holders are adults — Attriva does not collect information directly from children. A child's information is entered into Attriva by their parent or guardian, who is responsible for the accuracy of that information.

The parent-usage patterns described in 3.2 (entry frequency, follow-up behavior) are collected about the parent account holder, not the child, and are not part of any child's record.

5.1 Verifiable parental consent

By creating an account and completing payment via Stripe, the parent confirms they are 18 or older, have legal authority to provide their child's information, and consent to the collection and use of their child's information as described in this policy.

5.2 Parental rights regarding child data

At any time, parents may view, edit, delete, and export all information stored about their child. Contact privacy@attriva.ai for deletion requests. Fulfilled within 30 days.

6. Who we share your information with

We do not sell your data. We share limited information only with service providers bound by written data processing agreements:

Provider	Data received	Purpose
Anthropic	Moment text, child profile data	AI signal extraction, portrait generation, weekly moves, advisor, roadmap
Supabase	All family data and files	Primary database and file storage — encrypted at rest and in transit
Stripe	Name, email, payment data	Subscription billing — we never see your card number
Resend	Parent email address	Transactional email delivery only
PostHog	Anonymised usage events	Product analytics — no PII, no moment content
Sentry	Anonymised error logs	Error tracking — no personal data
Vercel	Web traffic logs	Web app hosting
Hetzner	Server logs	VPS hosting

7. Content vs. intelligence — what you own

What you own: Your submitted content — raw moments, photos, activity records, and child profile information. Full export available at any time in JSON format.

What Attriva built: Attriva-generated analytical outputs are Attriva's proprietary intellectual property. You receive a personal, non-commercial licence to view these outputs during an active subscription. This licence terminates on cancellation.

The portrait transfer: When a child reaches 18, Attriva offers to transfer the portrait to a personal account in the child's name. Submitted content transfers with the portrait.

8. How we protect your information

All data encrypted in transit using TLS 1.2 or higher
All data encrypted at rest in Supabase
Passwords hashed using bcrypt
Row-level security — each family can only access their own data
Production data access limited to the founding team
No admin dashboard or in-app feature displays a family's content to staff — access is limited to the founding team, for legitimate purposes only (support you request, security, or legal compliance)

If we discover a data breach affecting your personal information, we will notify you by email within 72 hours.

9. Your rights and choices

You can view, export, correct, and delete all data from within the app at any time. On account deletion: your account is limited to account settings for 30 days, during which you can download your data or reactivate, then all data is permanently deleted. To request immediate deletion, contact privacy@attriva.ai.

California (CCPA): We do not sell personal information. Contact privacy@attriva.ai for any CCPA request.

European residents (GDPR): Contact privacy@attriva.ai to exercise any GDPR right.

10. Data retention

Data kept while your account is active. On cancellation: account access is limited to Settings for 30 days (download your data or reactivate anytime during this window), then permanent deletion. Legal records retained for 7 years as required by law.

11. Cookies and tracking

The Attriva app does not use advertising cookies. attriva.ai uses essential session cookies and anonymised PostHog analytics. No advertising trackers, no social media pixels, no fingerprinting.

12. Changes to this policy

We will email you at least 14 days before material changes take effect and ask for fresh consent if any change affects how we use children's data.

13. Advisor and safety

Attriva's Advisor feature includes an automated safeguard that detects language suggesting self-harm, abuse, disordered eating, or substance use, in either Advisor conversations or logged moments. When triggered, Advisor does not attempt to provide counseling or guidance on the situation. It instead directs the user to appropriate crisis resources (such as the 988 Suicide & Crisis Lifeline) and general practitioners or school counselors. Only the category of the triggering event is logged, not the underlying content, to minimize retention of sensitive data.

Advisor is an AI-based feature and is not a licensed medical, psychological, or counseling service. It is not a substitute for professional evaluation or care. Attriva and its officers, employees, and agents are not liable for any action taken or not taken in reliance on Advisor's output.

14. Contact us

Email: privacy@attriva.ai
Response within 5 business days for general questions; 30 days for data requests.
Mailing address: 9 Park Place, Great Neck, NY 11021.