Privacy Policy

Data controller

The data controller is Jitka Hořavová, Company ID (IČO) 88201856, registered address Jiráskova 436/8, 789 85 Mohelnice, Czech Republic, trading under the business name Codecron.

For privacy-related questions, contact support@koragate.tech.

What data we process

Identification and contact details: name and email address. We also use your email to verify the address, reset your password, send team invitations and confirm payments.

Access data: passwords are stored only as an irreversible hash.

Workspace data: company/workspace name and team role.

Content you create in the app: projects, tasks, comments, attachments and client requests.

Billing data: for paid plans, the details needed to issue an invoice.

Technical data: IP address, login time and basic operational logs used to secure the service.

Traffic and advertising data (only with your consent): online identifiers, device and browser data and behaviour on the site, processed by Google Analytics, Google Ads and Meta Pixel.

Purpose and legal basis

Operating your account and providing the service, based on contract performance (GDPR Art. 6(1)(b)).

Issuing accounting records and meeting tax obligations, based on legal obligation (GDPR Art. 6(1)(c)).

Security, misuse prevention and technical support, based on legitimate interest (GDPR Art. 6(1)(f)).

Measuring traffic (Google Analytics) and advertising effectiveness (Google Ads, Meta Pixel), based on your consent (GDPR Art. 6(1)(a) and Section 89(3) of the Czech Electronic Communications Act, No. 127/2005 Coll.). Consent is voluntary, you give it separately for each category and you can withdraw it at any time.

Any other optional features requiring consent will always ask for a separate, active opt-in.

Cookies

We use a necessary technical (session) cookie that keeps you signed in, and a functional cookie with your browser time zone (koragate_tz) so that times in the app are shown correctly. The app would not work properly without them, so no consent is required for them.

Your dark/light theme choice is stored locally in your browser (not a cookie in the technical sense).

We store analytics cookies (Google Analytics) and marketing cookies (Google Ads, Meta Pixel) and load the related scripts only after you consent. Until you consent, no measurement script is loaded and nothing is sent. You can change or withdraw your consent at any time via the Cookie settings link in the footer of the public pages. A detailed overview is on the Cookies page.

Who we share data with

DigitalOcean (hosting and backups, data centre in Frankfurt, Germany), which runs KoraGate's infrastructure, acting as a processor under a data processing agreement.

Resend (running on Amazon SES), used to send emails: notifications, invitations, address verification, password reset and payment confirmations, acting as a processor.

Stripe (payment gateway) when activating a paid plan, acting as an independent controller of payment data. You enter your card details directly with Stripe; we neither see nor store them.

Google Ireland Ltd. (Google Analytics, Google Ads) and Meta Platforms Ireland Ltd. (Meta Pixel) receive data about your visit only after you consent to the relevant cookie category, for measuring traffic and advertising effectiveness.

Otherwise we do not share data with third parties for marketing purposes.

International data transfers

Data is primarily stored and processed on servers within the European Union (Frankfurt, Germany).

The payment gateway and email service provider may operate outside the EU/EEA (typically the US); in that case the transfer is safeguarded by standard contractual clauses or another appropriate GDPR safeguard.

Google and Meta may also process data in the United States. Transfers take place only after you consent to the relevant cookie category and on the basis of an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

Retention period

We process data for as long as your account exists. After account closure the account is deactivated and we delete workspace content on your request sent to support@koragate.tech, no later than 30 days after we receive it. Database backups are kept encrypted, 14 days on the server and up to 30 days off the server, and then expire.

Accounting records are kept for as long as required by law (typically 10 years from the end of the relevant tax period).

Your rights

You have the right to access, correct, delete or restrict processing of your data, to data portability, and to object to processing.

Any consent you gave for optional processing can be withdrawn at any time.

We respond to requests regarding these rights without undue delay, no later than one month.

You have the right to file a complaint with the Czech Office for Personal Data Protection (uoou.cz).

Automated decision-making

The application does not perform automated decision-making or profiling that would have legal effects on users.

Security

Data in transit is encrypted (HTTPS), passwords are stored as an irreversible hash, and each workspace's data is kept separate within the application.