koris1. Who the controller is
The controller of the data processed to run the website, the waitlist, accounts and billing is [RAZÃO SOCIAL], Brazilian CNPJ [CNPJ], [ENDEREÇO COMPLETO]. You can reach us about your personal data at privacy@koaris.com.
When a workspace processes data about other people, such as contacts who talk to the agents through WhatsApp or Telegram, the customer who owns the workspace is the controller of that data and Koris acts as a processor on its instructions. For that data, contact the business you talked to first.
2. Data we process
- Waitlist: name, email, the date you joined and the version of these documents you accepted.
- Account: name, email, password (stored only as an irreversible hash), an optional profile photo, your Google account identifier when you sign in with Google, and sign-in session data.
- Workspace: name, company website, language, country, currency, time zone, members, roles and invitations, including the email address of each person invited.
- Content: messages, images, audio and its transcripts, files, documents, memories, routines, agent settings, and the content of web pages you ask agents to read.
- Integrations: access credentials, stored encrypted, and the data connected services send or receive, such as channel messages and contacts, calendar items, files or posts, to the extent you authorize.
- Payments: Stripe customer identifier, plan, subscription status, and invoice amounts and dates. Card details are entered directly with Stripe and never reach our servers.
- Usage and technical data: IP address, browser, operating system, pages visited, usage events, koin consumption, and access and security logs. Technical performance metrics do not include conversation content.
3. Why we use it and on what legal basis
- To provide the service, create and maintain your account, and run the agents and integrations you set up: performance of a contract (art. 7, V).
- To bill plans and keep tax records: performance of a contract and compliance with a legal obligation (art. 7, II and V).
- To send service emails, such as invitations and security and billing notices: performance of a contract (art. 7, V).
- To send launch news to people on the waitlist: consent (art. 7, I), which you can withdraw at any time.
- To protect the service, prevent fraud and abuse, and limit sign-in attempts: legitimate interest (art. 7, IX).
- To measure use of the website and docs with Google Analytics so we can improve them: consent (art. 7, I), given in the cookie notice and withdrawable at any time.
- To keep access logs for six months, as required by the Brazilian Internet Civil Framework (Law No. 12,965/2014, art. 15): compliance with a legal obligation (art. 7, II).
- To exercise rights in judicial, administrative or arbitration proceedings: art. 7, VI.
We do not sell personal data. We do not use workspace content to train AI models.
4. Artificial intelligence
To reply, agents send the parts of the conversation, memories and files they need to AI model providers, which process them to generate the reply under their own API terms. Audio sent for transcription is processed by a speech recognition service.
Agents do not make decisions with legal effects on you solely by automated means. If you believe an automated decision affected your interests, you can ask for an explanation and a review at privacy@koaris.com (LGPD art. 20).
6. International transfers
Several of these providers store or process data outside Brazil, mainly in the United States. These transfers follow LGPD art. 33 and rely on contractual clauses and data protection safeguards offered by the providers, in line with the regulations of the Brazilian Data Protection Authority (ANPD).
7. How long we keep it
- Waitlist: until you ask to be removed or we stop sending launch news.
- Account: for as long as it exists. After a deletion request, we delete the data within 30 days, except what the law requires us to keep.
- Workspace: for as long as it exists. Deleting it immediately removes its conversations, files, settings and koins. Backups are replaced in the normal cycle and are not used for anything else.
- Access logs: six months, as required by the Brazilian Internet Civil Framework.
- Billing and tax records: five years, as required by tax law.
- Google Analytics statistics: up to 14 months.
8. Security
We use encrypted connections (HTTPS), hashed passwords, encrypted integration credentials, separation of each workspace’s data and restricted access to our systems. No system is completely secure. If a security incident could cause you significant risk or harm, we will notify you and the ANPD, as LGPD art. 48 requires.
9. Your rights
Under the LGPD (art. 18), you can ask for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or out-of-date data;
- anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
- portability of your data to another provider;
- deletion of data processed on the basis of your consent, and withdrawal of that consent;
- information about who we share your data with, and about the option of not consenting and its consequences;
- objection to processing based on legitimate interest when it does not comply with the law.
Send your request to privacy@koaris.com. We may ask for information to confirm your identity, and we will reply within 15 days. You can also complain to the Brazilian Data Protection Authority (ANPD).
11. Minors
Koris is not intended for anyone under 18, and we do not knowingly collect their data. If you learn of such a case, tell us at privacy@koaris.com so we can delete the data.
12. Changes to this Policy
We may update this Policy. The effective date is at the top of the page, and we will announce material changes by email or in the app before they take effect.
13. Contact
Questions and requests about your data: privacy@koaris.com. Controller: [RAZÃO SOCIAL], Brazilian CNPJ [CNPJ], [ENDEREÇO COMPLETO].