Privacy Policy

This policy explains how KOIA processes personal data on the client workspace at https://my.koia.ai. It is written to meet the EU General Data Protection Regulation (GDPR).

This describes our intended practices. Have counsel review it. It is not legal advice.

1. Who is responsible

The controller is KOIA LLC, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA. Contact: jakub@koia.ai.

When you pay through Stripe managed payments, Stripe (or a Stripe selling entity) is the merchant of record for that charge and processes payment and tax data under Stripe’s own terms and privacy policy.

2. What we collect

• Account data: name, email, password (hashed by our auth provider), company name, role/title, and whether you accepted these terms.
• Project and workspace data: project descriptions, threads, comments, attachments, board tasks, and consultation bookings.
• Billing data: billing name and address, company ID, tax/VAT IDs, invoice email, bank payment references, and invoice contents.
• Technical data: IP address (including for bot checks), browser session, and security logs.

We do not ask for card numbers on the Platform itself. Card data for Stripe-managed charges is collected by Stripe.

3. Why we use it (legal bases)

• Contract (GDPR Art. 6(1)(b)) — creating and running your workspace, delivering the project, sending transactional email, invoicing where we are the seller.
• Legitimate interests (Art. 6(1)(f)) — securing the Platform, stopping bots and abuse, improving reliability.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records for invoices we issue.

You choose to create an account. We do not sell personal data. We do not use it for unrelated advertising.

4. Who processes it for us

We use these providers to run the Platform:

• Supabase — authentication, database, and file storage.
• Resend — transactional email (invites, notifications, invoices, password reset).
• Cloudflare Turnstile — bot protection on public forms. A token is verified with Cloudflare; we do not use it for advertising.
• Google Calendar — consultation scheduling when that feature is used.
• Tatra banka — matching invoice payments when bank integration is enabled.
• Stripe — merchant of record for some subscriptions or worldwide charges (payment, tax, payout to KOIA). See stripe.com/privacy.

Some providers are in the United States or other countries outside the EEA. Where GDPR requires it, transfers rely on appropriate safeguards (such as Standard Contractual Clauses) used by those providers.

5. Cookies and similar tech

We use essential session cookies so you can stay signed in. Cloudflare Turnstile may set cookies or similar storage to complete the bot check. We do not use third-party advertising cookies.

6. How long we keep it

Account and workspace data are kept while the account is active. If the account is closed or never approved, we delete or anonymise it when it is no longer needed, unless we must keep records.

Invoices and related billing records issued by us are kept for the period required by applicable tax and accounting law.

Security logs and bot-check results are kept only as long as needed for security and abuse prevention.

7. Your rights (GDPR)

If GDPR applies to you, you may ask us to:

• access your personal data;
• correct inaccurate data;
• delete data (where the law allows);
• restrict or object to certain processing;
• receive a copy in a portable format (where applicable).

Email jakub@koia.ai. You may also lodge a complaint with a supervisory authority in your EU country of residence or the authority competent for KOIA.

8. Security

Access to customer workspaces is restricted by account, role, and project permissions. Passwords are handled by our auth provider. We use HTTPS and bot checks on public forms. No method of transmission or storage is completely secure.

9. Children

The Platform is for business users. It is not directed at children.

10. Changes

We may update this policy. The “Last updated” date will change. We may also email you if the change is material.

11. Contact

jakub@koia.ai
KOIA LLC
1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA

Related: Terms of Use.