Privacy Policy

Kora ("Kora", "we", "us", or "our") provides a WhatsApp Business automation service that lets a business connect its WhatsApp Business number, configure an automated assistant, and manage conversations with its customers (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to businesses that create a Kora account ("you", a "customer") and to the end customers who message a business through WhatsApp.

Information we collect

Account information. When you sign up, we collect your name, email address, and password (stored in hashed form). We also record which organization(s) you belong to and your role.

WhatsApp Business data. When you connect a WhatsApp Business Account through Meta's Embedded Signup, we receive and store your WhatsApp Business Account ID, phone number ID, display phone number, and an access token issued by Meta (encrypted at rest) that lets our Service send and receive messages on your behalf.

Message content. To operate the Service, we process inbound and outbound WhatsApp messages, including the message text, sender phone number, contact name (if shared by WhatsApp), and timestamps. This data is used to display your conversations in the Kora inbox and to generate automated replies.

Configuration data. Prompts, instructions, and settings you create to define how your automated assistant responds.

Billing information. Subscription plan, trial status, and payment confirmation records. We do not directly store full payment card numbers.

Usage data. Technical logs such as IP address, browser type, and actions taken in the dashboard, used for security and troubleshooting.

How we use information

• To operate, maintain, and secure the Service, including authenticating your account.
• To send and receive WhatsApp messages on your behalf via the WhatsApp Business (Cloud API) platform.
• To generate automated responses to your customers using your configured prompts.
• To provide the inbox, billing, and admin features of the dashboard.
• To communicate with you about your account, service changes, or support requests.
• To comply with legal obligations and enforce our terms.

How information is shared

We do not sell your data. We share data only with the service providers necessary to operate Kora, and only to the extent required:

• Meta / WhatsApp Business Platform: messages you send and receive pass through Meta's WhatsApp Cloud API as the underlying messaging infrastructure, subject to Meta's own data policies.
• AI processing provider: message text may be sent to a third-party language model provider to generate an automated reply based on your configured prompt.
• Infrastructure providers: hosting, database, and queueing infrastructure used to run the Service.

We do not share your data with third parties for their own marketing purposes.

Data retention

We retain account data for as long as your account is active. Conversation and message data is retained to provide conversation history within the dashboard until you delete your account or disconnect your WhatsApp number, after which it is deleted within a reasonable period, except where retention is required by law.

Security

Access tokens issued by Meta are encrypted at rest. Passwords are stored using industry-standard hashing. Traffic between your browser, our servers, and Meta's API is encrypted in transit (HTTPS/TLS). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Your rights and choices

You may access, correct, or delete your account information, and disconnect your WhatsApp Business number at any time from the dashboard. You may request deletion of your account and associated data, or request a copy of the data we hold about you, by contacting us using the details below. End customers who message a connected business can contact that business directly to request their conversation data be removed.

Children's privacy

The Service is intended for business use and is not directed at children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date shown on the page. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

Contact us

If you have questions about this Privacy Policy or wish to exercise any of the rights described above, contact us at [email protected].