Privacy

We never train AI on your data

This is the core promise. The AI that structures your captures runs on no-train infrastructure. Your contacts, conversations, notes, and documents are never used to train, fine-tune, or improve any AI model, ours or a third party's. Your relationships are yours alone.

What we store

The inputs you capture (text, voice recordings on paid tiers, screenshots) and the structured records KORA extracts from them (contacts, companies, deals, interactions, notes, actions). Free-tier audio is transcribed and then discarded. We keep the transcript, not the recording.

When something goes wrong in the app or on the website, it sends us an error report: what failed and where, the app and operating-system version, and your account if you are signed in. We use these only to find and fix problems.

If you join the waitlist or send feedback through a form, what you type goes to Google Forms and Google Sheets, along with the app version and your account identifier when the form is opened from the app.

Your rights

Once you have an account, you can export all of your data as CSV at any time, and permanently delete your account and everything in it from your settings. Deletion is immediate and irreversible.

Security

Every record belongs to a workspace, and the database enforces that boundary rather than the interface: nobody outside your workspace can read your data. Inside it, the people you have invited can, which is what inviting them is for. Remove someone and their access ends with their membership. Raw inputs are stored in private, access-controlled storage under the same rule.

If you connect Google or Microsoft

Connecting a mailbox is optional and Kora works without it. Google may be used for two separate things, and they ask for different permissions.

Signing in. If you choose Sign in with Google, we receive your name, email address and profile picture, and we use them only to create and identify your account.

Sending email. If you connect Gmail or Outlook so Kora can send follow-ups for you, we request permission to send: gmail.send from Google, or Mail.Send from Microsoft, plus the basic profile details that tell us which address mail leaves from. That permission can only send a message as you. It cannot read, search, list, download or delete anything in your mailbox, and Kora never asks for a permission that could. A message is only ever sent after you have read the draft and pressed send.

To keep sending working, we store the access token and the longer-lived refresh token your provider issues, encrypted, and nothing else from your account. Each message you send is kept in Kora (recipient, subject and body) as the record that it went out, and the members of your workspace can see it. Disconnecting in Settings deletes our tokens straight away, so Kora can no longer send. To withdraw the permission at the provider as well, remove Kora in your Google account permissions or your Microsoft account app access.

Limited Use

Kora's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to others except as needed to provide or improve Kora, to comply with the law, or as part of a merger or acquisition. We do not use it for advertising, we do not sell it, and no human at Kora reads it except where you have asked us to for support or where the law requires it. It is never used to train any AI model.

Contact

Questions about your data? Email us at info@koraxp.com and we'll help.