Your data, in plain language

Last updated: 13 August 2026

You're trusting Kota with client names, invoices, and the money side of your business. Here's exactly how that information is handled — no legal maze. (The full legal version is in our Privacy Policy.)

Where your data lives

• Your workspace — clients, documents, invoices, chat history — is stored in a managed Supabase (Postgres) database, protected with row-level security so every record is locked to your organisation. Nobody else's workspace can see yours, and yours can't see theirs.
• Kota is built for South African businesses and operates under POPIA, South Africa's data protection law, regardless of where servers physically sit.
• All traffic is encrypted in transit, and your data is encrypted at rest by our hosting providers.

What the AI sees — and what it never sees

Almost nothing. Your invoices, quotes, reminders, financial figures and the answers Kota gives you in chat are all produced by our own software, reading your workspace directly. No AI provider is involved in any of it.

There is one exception inside the app: when you click the button to draft proposal text from a short brief. That is the only place your content is sent to an AI provider, and only when you ask for it.

What gets sent in that one case, and what does not:

• Sent: your own business content — your service descriptions, prices, payment terms, and the brief you typed. This is information about your business, not personal information about anyone.
• Not sent — your clients' personal details. Client names, company names, email addresses and phone numbers are swapped for placeholders like {{client_name}} before anything leaves our servers, and the real values are put back afterwards. The client fields are never placed in the request at all, and any free text you type is checked against your saved client list — and for email addresses, phone numbers and ID numbers — first. This is enforced in code, not by a policy we promise to follow.
• Your banking details never reach the AI. They're stored server-side and placed onto invoice PDFs by our own export code — they are never included in anything sent to an AI model, under any circumstances.
• Your business phone number, email address, physical address, and website are not sent either.
• Every AI request is routed exclusively to providers with a zero data retention commitment — our preferred provider is SOC 2 and ISO 27001 certified, and any backup provider used during an outage must meet the same zero-retention standard. No provider may store your prompts or use them to train models.

The chat assistant on our public marketing site also uses AI to answer questions about what Kota is and what it costs. It has no access to any customer workspace.

Your POPIA rights — one click, not a paper trail

• Export everything: Settings → Account → “Export your data” downloads your full workspace as a file you own.
• Delete everything: Settings → Account → “Delete account” permanently removes your account and all associated data. No email chain, no waiting period on our side.
• Ask us anything about your data: privacy@getkota.co.za — this inbox is monitored and handles access, correction, and objection requests under POPIA.

What we never do

• We never sell your data, or your clients' data.
• We never email your clients without your explicit approval — every send is reviewed and tapped by you.
• We never use your business content to train AI models.

Questions about any of this? Write to privacy@getkota.co.za — a human reads it.