Back to Kota

Privacy Policy

Last updated: 13 August 2026

This Privacy Policy describes how Kota (“we”, “us”, “our”) collects, uses, stores, and shares personal information when you use our website and application (together, the “Service”). We are committed to protecting your privacy in accordance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African law.

Note: This policy is a practical summary for transparency. It is not legal advice. You may wish to have your own legal adviser review it for your circumstances. We may update this policy from time to time; the “Last updated” date above will change when we do.

1. Who is responsible for your information?

The responsible party (operator) for personal information processed through the Service is the entity operating Kota as described on our website or in your agreement with us. For questions about this policy or your information, use the contact details at the end of this document.

2. What personal information do we collect?

Depending on how you use the Service, we may process categories of information including:

3. How we use personal information (purpose)

We process personal information only for legitimate purposes related to the Service, including:

Where POPIA requires a lawful basis, we rely on one or more of: performance of a contract with you, compliance with law, your consent where appropriate, and legitimate interests that are not overridden by your rights (such as securing our systems).

4. How we use AI

Kota is built as a deterministic system: documents, reminders, financial summaries, and answers are generated by our own software from the data in your workspace. Three narrow features are the exception, and we describe them precisely here rather than in general terms.

Proposal writing. When you click the button to draft proposal text from your notes, we send your own business content — your service descriptions, prices, payment terms and the brief you typed — to a third-party AI provider. Your clients' personal information is not included. Client names, company names, email addresses and phone numbers are replaced with placeholders such as {{client_name}} before anything is sent, and the real values are substituted back on our servers after the text returns. This is enforced in code, not by policy: the client fields are never placed in the request, and free text you type is checked against your saved client list and for email addresses, phone numbers and ID numbers first. Your banking details are never sent under any circumstances.

Invoice, quote, estimate and proposal drafting. When you create a finance document by typing a short request instead of filling in a blank form, that request is sent to a third-party AI provider to suggest the client, line items, VAT, due date and payment terms — using the same placeholder mechanism described above, so your clients' personal information is not included. You always see and can edit every suggested field before saving; nothing is created or sent automatically.

The chat assistant on our public website. It answers questions about what Kota is and what it costs. It has no access to any customer workspace, and no account data is in scope.

All three features route through providers contractually bound to zero data retention, meaning your content is not stored after the response is returned. Nothing you type, upload, or store in Kota is used to train AI models — ours or anyone else's. Everything else in Kota involves no AI provider at all.

We do not use your personal information or business content for unrelated purposes such as selling your data to data brokers or building advertising profiles. Processing is for delivering and improving the Service you signed up for, security, and compliance.

5. Subprocessors and sharing

We use the service providers below to operate Kota. They process information on our instructions and for no other purpose. This list is current as at the date at the top of this page; we will update it when it changes.

Cross-border transfers

Most of these providers are located outside South Africa. We rely on section 72(1) of POPIA to transfer personal information to them, on the basis that the transfer is necessary for the performance of our contract with you — the Service cannot be delivered without hosting, payment and email infrastructure — and, where applicable, that the recipient is bound by an agreement upholding principles of reasonable protection materially similar to POPIA's conditions for lawful processing.

We may disclose information if required by law, court order, or competent authority, or to protect our rights, users, or the security of the Service.

6. Retention

We keep personal information only as long as needed for the purposes above. In practice we treat two kinds of data differently.

Your business records — clients, invoices, quotes, expenses, services, deals and tasks — are yours, and we keep them for as long as your account is open. We do not delete them on a timer: South African tax law requires financial records to be kept for five years, and deciding when they go is your call, not ours. You can delete them at any time from within the app, or delete everything at once (section 8).

Operational data we generate about your use of Kota — activity logs, audit trails, usage records, delivery logs and prior versions of documents — is aged out automatically. Typical periods are 30 days for the change-history snapshots that support Undo, 90 days for usage and audit records, and up to a year for document version history.

After you close your account we may retain limited records where the law requires it, for example for tax or to resolve a dispute.

7. Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, or misuse. No online service can guarantee absolute security; you should use a strong password and protect your account credentials.

8. Your rights under POPIA

Subject to POPIA and any applicable exceptions, you may have the right to:

To exercise rights, contact us using the details below. We may need to verify your identity before responding. You may also have rights under the Promotion of Access to Information Act, 2000 (PAIA); a PAIA manual may be published separately where we are required to maintain one.

9. Cookies and similar technologies

We may use cookies or similar technologies for session management, security, preferences, and (where enabled) product analytics. You can control cookies through your browser settings; blocking some cookies may affect functionality.

10. Children

The Service is intended for businesses and adults. We do not knowingly collect personal information from children without appropriate parental authority. If you believe we have collected information from a child in error, contact us and we will take steps to delete it where required.

11. Changes

We may update this Privacy Policy to reflect changes to our practices or legal requirements. We will post the updated version on this page and adjust the “Last updated” date. Where changes are material, we will provide additional notice if required by law (for example by email or in-app notice).

12. Contact and Information Officer

Kota has designated an Information Officer as required by POPIA. For any privacy-related requests — including access, correction, deletion, or objection to processing (Data Subject Access Requests) — please contact:

We will acknowledge your request within 3 business days and respond fully within 30 days as required by POPIA. You may be asked to verify your identity before we process your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator (South Africa):

See also our Terms of Service.