Privacy

We collect what is needed to run the software and nothing for advertising. There are no trackers and no analytics scripts on this site. The only cookies are the two that keep you signed in. We do not sell anything about you.

If you work at an agency that uses Koza, we hold your account details and we decide how they are handled.

If you are a client of one of those agencies, the agency put you here. They decide what goes in your portal and what happens to it. We hold and process it on their instructions, not our own. Requests about that data are best sent to your agency, and we will help them answer you.

Team members: name, work email, job title, profile photo, and either a password stored as a hash or a Google sign-in, never a password we can read.

Client portals: the email addresses an agency adds so a sign-in link can reach them, plus the name of the space they belong to.

Work you put in: posts, captions, schedules, comments, documents, and files you upload including photos and video.

Operational records: which files were uploaded and by whom, when something was approved, and similar entries that make the software make sense.

We do not ask for and do not want payment card numbers, health data, or government IDs.

Two, both necessary. cs_session keeps a client signed in to their portal, and cs_team_session keeps a team member signed in. Both are signed so they cannot be forged, and both expire. There is no third cookie and nothing here follows you to another site.

When you upload a video or a photo, your browser takes a few still frames and sends them to Anthropic’s API, which writes the one-line description you see. Caption drafting and the in-app assistant work the same way: content goes out when you use the feature and the answer comes back.

This is an interface to a model, not training data collection. We do not use your content to train models and we do not permit our providers to.

These are the companies that hold or handle data on our behalf, and what for.

• Vercel: hosting, and the storage your uploaded files sit in.
• Supabase: the database, and team sign-in.
• Upstash: the fast store behind sessions, settings and file listings.
• Resend: sending the emails you ask us to send.
• Anthropic: the AI features described above.

Separately, features you switch on connect to services you already use: Google for Drive and Calendar, Meta for publishing to Instagram and Facebook, Canva for designs, Slack for notifications. Those connections send only what the feature needs, and you can disconnect them.

Content stays until you delete it. A deleted file goes to a Trash and stays there until someone empties it, which is deliberate: footage is often the only copy.

Sign-in links expire within days and sessions within a month. When an account closes we keep its data briefly so a mistake can be undone, then remove it.

Everything travels encrypted. Uploaded files are stored privately and are reachable only through a short-lived link the app creates after checking who is asking, so a file marked team-only is not readable by anyone who merely has its address. Sessions are signed. Each agency’s data is separated from every other agency’s.

No system is perfect. If something goes wrong that affects you, we will tell you.

You can ask what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. If you are a client of an agency, ask them first, since it is their data and we act on their instructions.

Depending on where you live you may also have the right to object to certain processing or complain to a regulator.

Koza is a tool for businesses and is not meant for children. We do not knowingly collect data about them.

If this policy changes in a way that matters, we will tell account holders rather than quietly editing the page.

Write to hello@usekoza.com, or [registered company name] at [registered address].