Who is responsible for your data
[LEGAL ENTITY NAME], registered in the United Arab Emirates under commercial licence [TRADE LICENCE NUMBER], at [REGISTERED ADDRESS], decides how your data is used and is responsible for it.
For any privacy question, write to [PRIVACY EMAIL].
What we collect and why
Name and email
To create your account, sign you in, and send you service messages such as receipts and password resets.
Password
Stored only as a scrypt hash. We cannot read your password, and we cannot recover it for you — only reset it.
Brand details you enter
Your brand name, products, tone of voice, colours, goals and target audience. This is the input the strategy engine works from. Without it there is no calendar.
Files you upload
Logos and product photos, used to produce your content. Stored in our file storage and referenced by your project.
Generated content
The calendar, images, videos and captions we produce for you, kept in your account so you can come back to them.
Payment records
Which plan you are on, renewal date, and a history of transactions. We record that a payment happened and for how much.
Support messages
What you send us through the contact form, so we can answer you.
Basic technical data
IP address and browser information from server logs, used to keep the service secure and to diagnose faults.
We do not sell your data. We do not use it to build advertising profiles. We do not share it with anyone except the providers listed below.
Card details
We never see or store your card number. Payments are handled by our payment provider on their own hosted page. We receive only a confirmation that a payment succeeded, the amount, and a reference — never the card itself.
Who else processes your data
Running Koala means using specialist providers. Each one only receives what it needs to do its job:
Hosting
Vercel Inc. hosts the application and runs the code that serves your requests.
Database
Neon stores your account, projects, calendar and transaction records.
File storage
Vercel Blob stores the logos and images you upload and the media we generate.
Payments
Stripe processes card payments and holds the payment details we never see.
AI providers
Your brand brief and prompts are sent to third-party AI models to generate images, video and captions. This is unavoidable — it is how the content gets made.
An email provider delivers account emails such as receipts and password resets.
Where your data goes
Our hosting, storage and AI providers operate outside the United Arab Emirates, mainly in the United States and the European Union. Using Koala means your data is transferred to and processed in those countries.
We choose providers that offer recognised safeguards for international transfers, such as standard contractual clauses.
How long we keep it
While your account is open, we keep your projects and generated content so you can use them.
If you close your account, we delete your projects, uploads and generated content within 30 days. We keep transaction records for as long as tax and accounting law requires, which is typically several years, because we are legally obliged to.
Your rights
You can ask us to:
Show you the data we hold about you. Correct anything that is wrong. Delete your account and its content. Give you a copy of your data in a portable format. Stop processing your data in certain circumstances.
Write to [PRIVACY EMAIL] and we will respond within 30 days. We may need to confirm your identity first.
Cookies
We use a small number of cookies, and none of them are for advertising or cross-site tracking:
Session cookie
Keeps you signed in. Signed, httpOnly, and required — the service cannot work without it.
Language cookie
Remembers whether you chose English or Arabic.
Security
Passwords are hashed with scrypt. Session cookies are signed, httpOnly, and unreadable by scripts in your browser. Traffic is encrypted with HTTPS. Data access is scoped per account, so one customer’s requests cannot read another customer’s records.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority as the law requires.
Children
Koala is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
Changes to this policy
If we change how we use your data in a way that matters, we will tell you by email or in the dashboard before the change takes effect.
Contact
[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
[PRIVACY EMAIL]