Your data, in plain language

Last updated: 3 July 2026

You're trusting Kota with client names, invoices, and the money side of your business. Here's exactly how that information is handled — no legal maze. (The full legal version is in our Privacy Policy.)

Where your data lives

• Your workspace — clients, documents, invoices, chat history — is stored in a managed Supabase (Postgres) database, protected with row-level security so every record is locked to your organisation. Nobody else's workspace can see yours, and yours can't see theirs.
• Kota is built for South African businesses and operates under POPIA, South Africa's data protection law, regardless of where servers physically sit.
• All traffic is encrypted in transit, and your data is encrypted at rest by our hosting providers.

What the AI sees — and what it never sees

Kota's assistant needs some context to be useful: client names, invoice amounts, your services and prices, and the messages you type. That's how it can draft an invoice or a follow-up that's actually about your business.

Some things are deliberately kept away from the AI, by design and enforced in code:

• Your banking details never reach the AI. They're stored server-side and placed onto invoice PDFs by our own export code — they are never included in anything sent to an AI model.
• Your business phone number, email address, physical address, and website are also excluded from AI prompts.
• Every AI request is routed exclusively to providers with a zero data retention commitment — our preferred provider is SOC 2 and ISO 27001 certified, and any backup provider used during an outage must meet the same zero-retention standard. No provider may store your prompts or use them to train models.

Your POPIA rights — one click, not a paper trail

• Export everything: Settings → Account → “Export your data” downloads your full workspace as a file you own.
• Delete everything: Settings → Account → “Delete account” permanently removes your account and all associated data. No email chain, no waiting period on our side.
• Ask us anything about your data: privacy@getkota.co.za — this inbox is monitored and handles access, correction, and objection requests under POPIA.

What we never do

• We never sell your data, or your clients' data.
• We never email your clients without your explicit approval — every send is reviewed and tapped by you.
• We never use your business content to train AI models.

Questions about any of this? Write to privacy@getkota.co.za — a human reads it.