Kora

Privacy Policy

Last updated: May 30, 2026

This Privacy Policy explains how Kora ("Kora", "we", "us") collects, uses, and protects your information when you use our AI back-office platform. By using Kora you agree to the practices described here.

1. Data we collect

  • Account data: your name, email address, and business name.
  • Financial data: transactions you upload or enter, invoices, and the categories the AI assigns.
  • Contract data: the parties, terms, and documents you generate.
  • Usage data: basic, privacy-first analytics about how the product is used (no cross-site tracking cookies).

2. How we use your data

We process your data solely to provide the service: categorizing transactions, generating P&L reports and cash-flow forecasts, drafting invoices and contracts, and sending you alerts and digests. We do not sell your data, and we do not use your financial or contract content to train third-party models.

3. AI processing disclosure

Kora uses large language models to provide automated categorization, forecasting, and document generation. Relevant portions of your financial and document data are sent to our AI provider strictly to produce these outputs for you. AI-generated output may contain errors and should be reviewed.

4. Legal basis for processing (GDPR)

  • Contract performance: processing necessary to deliver the service you signed up for.
  • Legitimate interest: improving reliability and security of the service.

5. Third-party processors

  • Supabase — database and authentication.
  • AI gateway / Google Cloud — automated processing of financial and document data.
  • Stripe — payment processing (we never see or store your card numbers).
  • Resend — transactional email delivery.

6. Data retention

  • Transaction and financial records are retained for up to 7 years to support tax compliance.
  • Account data is deleted within 30 days after you cancel your account.

7. Your rights

Depending on your jurisdiction (including the EU/EEA under GDPR and California under CCPA), you have the right to access, correct, export, and delete your personal data. You can export your data or request account deletion at any time from your account settings, or by emailing us.

8. Security

Data is encrypted in transit and at rest. Access to production data is restricted, and financial details are excluded from error-monitoring logs.

This policy is provided as a clear summary for the Kora MVP and is not a substitute for tailored legal advice. Before commercial launch, have it reviewed by qualified counsel.

9. Contact

For privacy questions or to exercise your rights, contact privacy@kora.app.

Questions? Contact privacy@kora.app.