Privacy Policy

We collect personal information from you directly, from the services you connect to Koatask, and automatically when you use the Service. Some information is required: without an email address or a sign-in method we cannot create your account, and without your prompts and files we cannot perform the work you request.

Information you provide to us

• Account details. Your email address and password when you sign up with email. Your password is handled by our authentication provider, which stores it in hashed form; Koatask does not keep it in its own application tables. We may send a confirmation link to your email address to verify your account, and a password reset link when you request one.
• Workspace choices. Choices you make during onboarding and while using the Service, such as the Teams and AI Staff you select or hire.
• Communications. If you contact us, for example at support@koatask.ai, we receive your email address, the content of your message and anything you attach.
• Payment information. Card details and billing information you enter at checkout, such as a billing address or tax ID, are collected directly by our payment provider, Polar. Koatask does not receive or store your full payment card details.

Information we receive from third parties

• Google sign-in. If you choose Sign in with Google, Google shares basic profile information such as your name, email address and profile picture, according to your Google account settings.
• Polar. When you subscribe or buy a Credit Pack, Polar sends us your customer identifier, subscription status, plan, billing interval, billing period dates, cancellation status, and order details such as amount, currency and the Credit Pack purchased.
• AI providers. When AI work runs, the provider returns the generated output together with usage information such as the model used, token counts and cost.

Information collected when you use the Service

• Conversations. The prompts and messages you send in Studio ("Inputs"), the responses and work produced for you ("Outputs"), conversation titles, and the Staff or Team context of each conversation. Information you include in your Inputs may appear in Outputs.
• Uploaded files. Product images (JPEG, PNG, WebP, GIF) and documents (PDF, plain text, Markdown, CSV) you upload, with their file names, types and sizes.
• Generated media and Documents. Text, images and videos generated for you and the Documents you save.
• Task metadata. Timestamps, task status and progress, the model used, and links between messages, outputs and Documents.
• Plan and credit data. Your plan, Free trial dates, paid access period, and your AI Credit ledger: grants, balances, temporary holds, charges, expired subscription credits and per-task usage records.
• Technical and log data. Request information processed by our hosting and authentication providers, which may include your IP address, browser and device information and request times; sign-in events; and application logs. Our logs are designed to record identifiers, file types and sizes, event types and error codes, not passwords, tokens or the full contents of your work.
• Security data. Per-user rate-limit counters; for password reset requests, rate-limit counters keyed by a one-way hash of the email address and IP address rather than the address itself; and records of processed billing webhooks (event identifiers, types and outcomes, not full payloads).
• Cookies. A small number of cookies and browser storage items needed to keep you signed in and remember your preferences. See Cookies and similar technologies.

We use personal information to:

• create and manage your account and authenticate you;
• perform the AI work you request, including sending the necessary prompts, files and media to AI providers and storing the results in your workspace;
• provide subscriptions and Credit Packs, keep your AI Credit ledger, and grant, hold, charge and expire credits;
• secure the Service, enforce plan limits and rate limits, and prevent fraud and abuse;
• diagnose problems and keep the Service running reliably;
• respond to your requests and send you messages about your account, billing and the Service;
• keep records required for accounting, tax and legal purposes; and
• comply with the law and protect our rights and the rights of others.

We do not use your content to train our own AI models, we do not sell your personal information, and we do not use it for targeted advertising.

Where data protection laws such as the GDPR require a legal basis for processing personal information, we rely on the following:

• Contract. To provide the Service you signed up for, including your account, the AI work you request, subscriptions, Credit Packs and support.
• Legal obligation. To keep accounting and tax records and to respond to lawful requests from authorities.
• Legitimate interests. To keep the Service secure and reliable, prevent fraud and abuse, enforce our Terms and fix problems. We rely on these interests only where they are not overridden by your rights and interests.
• Consent. Where we ask for your consent, you can withdraw it at any time. Withdrawal does not affect processing that happened before.

We rely on trusted third-party companies to run the Service, including providers of hosting and background processing, databases and authentication, cloud file storage, AI models, payments, and sign-in. They process personal information on our behalf only as needed to provide their services to us.

How AI processing works

When you make a request, the information needed to perform it is transmitted to our AI infrastructure partners and to the third-party AI model provider handling the request. This can include your prompt, relevant conversation context, instructions for the selected Staff, and files or images you attached or referenced, such as product images used as references for image or video generation. The results are returned to us and stored in your workspace.

How long these AI providers keep this data, and whether they may use it for purposes such as abuse monitoring or improving their services, is governed by their own terms and policies and by the settings that apply to our account. We cannot guarantee that every provider deletes data immediately or never uses it for its own purposes. Please do not include information in prompts or files that you do not want processed by these providers.

• Service providers. With the providers described above, only as needed to provide, secure and support the Service.
• Payments. With Polar, to process payments and manage your subscription and Credit Pack purchases.
• Professional advisors. With lawyers, accountants, auditors and insurers where needed for the services they provide to us.
• Legal and safety. When required by law, regulation, legal process or a valid request from public authorities, or to protect the rights, safety and security of our users, the public or Koatask, including to investigate fraud or abuse.
• Business transfers. As part of a merger, acquisition, financing, reorganization or sale of assets, subject to appropriate confidentiality protections.
• With your consent. When you ask us to, or otherwise with your permission.

• Your content. You can view and delete your conversations and Documents in the app.
• Billing. You can manage or cancel your subscription through Manage billing on the Billing page.
• Account deletion and copies of your data. These are not yet available as self-service options. Email support@koatask.ai and we will handle your request.
• Do Not Track. We do not track you across other websites, so we do not change our practices in response to browser Do Not Track signals.

Depending on where you live, you may also have the right to:

• access the personal information we hold about you and receive a copy, including in a portable format;
• correct inaccurate or incomplete information;
• ask us to delete your information;
• restrict or object to certain processing;
• withdraw consent where we rely on consent; and
• lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@koatask.ai. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law. Some rights have legal exceptions, and we may need to keep certain information as described in Data retention and deletion.

We use only the cookies and browser storage items needed for the Service to work or to remember your preferences:

• Authentication cookies (names beginning with "sb-"), set by our authentication provider through our application. They keep you signed in, refresh your session, and complete Sign in with Google securely. They are required for signed-in use of the Service.
• "sidebar_state" cookie. Remembers whether the workspace sidebar is expanded or collapsed. It expires after 7 days.
• "theme" browser storage item. Remembers your light or dark display preference on your device.

We do not currently use analytics, advertising or cross-site tracking cookies. You can delete cookies in your browser settings, but blocking authentication cookies will prevent you from signing in.

Some parts of the Service take you to pages run by others, such as Polar checkout, the Polar billing portal and Google sign-in, and the Service may link to other websites. Those services collect and use information under their own privacy policies and may set their own cookies. We do not control them and are not responsible for their practices, so we encourage you to read their policies.

We keep your account information, conversations, Documents, files and billing records while your account exists, unless they are deleted earlier as described below.

Records of finished background AI tasks are deleted automatically based on your current plan:

• Free: deleted 7 days after the task finishes.
• Starter: deleted 14 days after the task finishes.
• Growth: deleted 90 days after the task finishes.
• Scale: not deleted automatically.

These task records are separate from your conversations and Documents, which are not affected by this schedule.

• Deleting conversations and Documents. When you delete a conversation or a Document in the app, it is removed from your workspace. The underlying records and stored files are not immediately erased from our systems.
• Rejected uploads. Uploaded files that fail our file checks are deleted from storage.
• Account deletion. When we delete your account at your request, the account-linked records in our database, including conversations, messages, Documents, AI task records, credit and billing records, are deleted with it. Files in our file storage are deleted separately as part of handling your request. We aim to complete deletion within 30 days. Please cancel any active subscription first.
• Polar records. Deleting your Koatask account does not delete the customer and order records Polar keeps under its own policies and legal obligations.
• Backups and legal holds. Our providers may keep backup copies for a limited period, and we may keep information longer where needed to meet legal, tax or accounting obligations, resolve disputes or enforce our agreements.

We use technical and organizational measures intended to protect your information, including:

• encrypted connections (HTTPS) between your browser and the Service;
• row-level security and server-side ownership checks so that users can only access their own data;
• a private storage bucket, with files served only after checking that they belong to the signed-in user, and short-lived upload links fixed to a specific file location, type and size;
• server-only storage of service credentials;
• checks on uploaded file types, sizes and contents;
• rate limiting; and
• signature verification of payment webhooks.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password and keep your sign-in details confidential.

The Service is built for business use and is not directed to children. You must be at least 18 years old to use it, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us at support@koatask.ai and we will take steps to delete it.

Our service providers, including AI model providers, may store and process information in countries other than the one where you live, including the United States. These countries may have data protection laws that differ from those in your country.

Where the law requires it, we rely on appropriate safeguards for these transfers, such as contractual data protection terms offered by our providers.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page shows when it last changed. If we make material changes, we will notify you by reasonable means, such as email or a notice in the Service, at least 14 days before they take effect where required.

Koatask is responsible for the personal information described in this Privacy Policy. Please send questions, requests or complaints about this policy or our privacy practices to support@koatask.ai.