Privacy Policy

Kora ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use and store it, and what rights you have over it.

By using the Service, you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

1. Who We Are

Kora is an issue-tracking and ticket management SaaS platform operating under the brand Kora, accessible at usekora.app. For privacy-related enquiries, contact us at founder@usekora.app.

2. Data We Collect

2.1 Account & Profile Data

• Name and email address (provided at sign-up)
• Profile avatar (optional)
• Organisation / workspace name

2.2 Usage & Content Data

• Tickets, comments, attachments, and other content you create within the platform
• Activity logs (ticket status changes, assignments, timestamps)
• API keys and API usage metadata

2.3 Technical Data

• IP address, browser type, and device information
• Pages visited, click events, and session duration (for analytics and debugging)
• Anonymous help-center analytics: a random visitor identifier stored in your browser's local storage is hashed server-side — we keep only the hash, never the identifier, your IP address, or any cross-site profile. Referrer hostnames are recorded in truncated form.
• Email addresses submitted through a help-center "subscribe" box (stored for that workspace's owner to send updates; removable by request at any time)
• Error and performance logs

2.4 Billing Data

Payment information (card number, billing address) is collected and stored exclusively by our payment processor Dodo Payments. We never store raw card details on our servers. We retain transaction records (plan, amount, date) for accounting and support purposes.

3. How We Use Your Data

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Data Storage & Location

All primary data — including your account information, workspace content, and file uploads — is stored on Cloudflare's infrastructure located in Europe. We have chosen European data centres to align with strong data protection standards.

By using the Service, you consent to this transfer and storage of your data within European territory under Cloudflare's security controls.

5. Third-Party Sub-processors

We work with the following sub-processors who may access or process your data as part of delivering the Service:

Each sub-processor is bound by contractual obligations to protect your data and use it only for the specified purpose.

6. AI Features & Your Data

When you use AI-powered features (such as AI Ticket Structuring or the AI Analyst), the content of your tickets and queries may be sent to our AI provider for processing. We instruct our AI providers not to use this data for model training. We recommend not including highly sensitive personal information (e.g. passwords, financial details) in ticket descriptions.

7. Cookies & Tracking

Kora uses strictly necessary cookies (for session management and authentication) and functional cookies (for theme preferences and workspace context). We do not use advertising cookies. To understand which content helps people find Kora, we store in your browser (local storage, for up to 90 days) the page you first arrived on, the website you came from and any campaign labels in the link; if you sign up, this is saved with your account to measure which pages lead to sign-ups. It contains no personal data and is never shared or used for advertising. You can clear cookies through your browser settings; doing so will log you out of the Service.

8. Data Retention

We retain your data for as long as your account is active. After account deletion:

• Your profile and workspace data are permanently deleted within 30 days of the deletion request.
• Anonymised analytics data (with no personally identifiable information) may be retained indefinitely.
• Billing records are retained for up to 7 years to comply with financial regulations.

9. Your Rights

You have the following rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): Request deletion of your personal data by emailing founder@usekora.app. We will process the request within 30 days.
• Portability: Request your data in a structured, machine-readable format (CSV export available to every workspace).
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interest.

To exercise any of these rights, email us at founder@usekora.app. We will respond within 48 hours on business days and fulfil your request within the applicable legal timeframe.

10. Data Security

We implement industry-standard measures to protect your data, including:

• TLS/HTTPS encryption for all data in transit
• Encryption at rest for stored data
• Access controls limiting data access to authorised personnel only
• Regular security reviews and infrastructure monitoring via Cloudflare

No method of transmission over the internet is 100% secure. In the event of a data breach that affects your rights, we will notify you and relevant authorities as required by law.

11. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal data from anyone under 13. If you believe a minor has provided us with personal data, contact us immediately and we will delete it promptly.

12. Grievance Officer

In accordance with applicable law, if you have a grievance about the processing of your personal data, you may contact our Grievance Officer:

• Email: founder@usekora.app
• Response time: We aim to acknowledge your grievance within 48 hours and resolve it within 30 days.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top and notify active users of material changes by email. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

14. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the competent courts in India.