Privacy Policy

1. Introduction

This Privacy Policy explains what information Kora ERP ("Kora," "we," "us") collects when your organization uses the product, how we use and share it, and the choices available to you. It applies to every module and integration described below, including where we connect to Google APIs on your behalf.

2. About Kora ERP

Kora is a multi-tenant business management platform. Depending on which modules your organization enables, it may be used for projects, time tracking, HR and leave management, invoicing and billing, procurement, vendor management, and related workflows. Your organization ("Controller") remains responsible for the personal data it enters into the product; Kora processes it on your behalf, as described further in our Data Processing Agreement.

3. Information We Collect

3.1 Information You Provide

Your name, work email address, password (if you sign in with a password rather than an OAuth provider), and any profile details you choose to add.

3.2 Organisation Information

The operational data your organization enters into whichever modules it has enabled — for example projects, time entries, invoices, employee records, leave requests, or vendor details. This data belongs to your organization; Kora processes it only to provide the service.

3.3 Google Account Information

If you sign in with Google, we receive your name, email address, and profile picture from your Google Account (scopes: email, profile). If you separately connect a Google Workspace integration (Drive, Calendar, or Gmail), we receive only the additional data that specific integration's scope allows — see Section 4 for exactly what that is.

3.4 Usage and Device Information

Sign-in timestamps, IP address, browser/device information, and the essential cookies described in Section 10 — collected for security, session management, and abuse prevention.

4. Google OAuth and Google User Data

Where you connect a Google integration, Kora only requests the specific, narrow scopes each feature needs, and only after you approve them on Google's own consent screen:

• Google Drive (drive.file): access only to files you specifically create or open through Kora — not your wider Drive. Used to attach or link documents you choose from within the product.
• Google Calendar (calendar.events, calendar.freebusy, calendar.calendarlist.readonly): used to create or update a calendar event when your leave request is approved, or a project milestone is scheduled, and to check free/busy availability where the product surfaces it.
• Gmail (gmail.send, send-only): used only to send notification emails on your behalf where you've configured Kora to do so. This scope cannot read, search, or otherwise access your mailbox.

Kora's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, and we do not sell it. You can revoke Kora's access at any time from your Google Account's security settings, or by disconnecting the integration inside Kora.

5. How We Use Your Information

To provide and operate the service, enforce the roles and permissions your organization configures, secure accounts, respond to support requests, and send service-related notices (approvals, reminders, security alerts).

6. How We Share Information

We do not sell personal data. We share it only: with the infrastructure and service sub-processors necessary to operate Kora (see Section 11); with a third-party integration you explicitly connect, under the permissions granted at that connection's own consent screen; where required by law or to protect Kora's or others' rights and safety; or as part of a merger, acquisition, or asset sale, with notice to you.

7. Data Storage and Security

Data is scoped per tenant at the application layer — users from one organization cannot access another organization's data through the product. Sensitive data categories (employee personal information, multi-factor authentication secrets, custom email credentials you configure, and billing tokens) are encrypted at rest. All traffic is encrypted in transit. Access is governed by the roles and permissions your organization configures, and administrative actions are audit-logged.

8. Data Retention

Data remains accessible for the duration of your subscription, and for a limited period afterward to allow export, per your plan's terms. We retain data only as long as needed to provide the service, meet legal obligations, or resolve disputes.

9. Account and Data Deletion

You can request deletion of your personal account, or of your organization's data on termination of its subscription, by contacting hello@koraerp.com. On a verified request, we delete or anonymize the relevant data within a reasonable period, except where retention is required by law.

10. Cookies and Similar Technologies

Kora uses a small number of essential cookies — for your signed-in session, refresh token, and device recognition — needed for the product to function and to keep your account secure. These are not used for advertising or cross-site tracking, and Kora does not run third-party analytics or advertising scripts.

11. Third-Party Services

Depending on what your organization enables, Kora may connect to: Google Workspace (Drive, Calendar, Gmail) and Microsoft 365 (SharePoint, Outlook, Calendar, Teams) as user-initiated integrations; Slack and Zoom, where connected; a payment processor, for subscription billing; and a transactional email provider, to deliver notifications. Each operates under its own privacy policy for the data it processes.

12. International Data Processing

Your data may be processed in a country other than your own by Kora or its sub-processors. Where that happens, we put in place safeguards appropriate to the transfer, consistent with applicable law.

13. Your Privacy Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or request deletion of your personal data, or to object to or restrict certain processing. Requests can be directed to hello@koraerp.com; where the data belongs to an organization using Kora, we may direct your request to that organization as the data controller.

14. Children's Privacy

Kora is a business product intended for use by organizations and their employees. It is not directed at children, and we do not knowingly collect personal data from children.

15. Changes to This Privacy Policy

We'll update this policy as the product changes, and note material changes here along with a new "Last updated" date.

16. Contact Us

Questions about this policy can be sent to hello@koraerp.com.