Privacy policy

The controller of your personal data is:

• Legal name: Koalab Tech — Cristian Alejandro Muñoz Cardona
• Tax ID (NIT): 1017126012-3
• Address: Calle 45F #77A - 33, Medellín, Colombia
• Contact email: privacidad@koalab.tech
• Website: koalab.tech

Koalab Tech is the trade name under which Cristian Alejandro Muñoz Cardona, an individual, provides the Service. He is the data controller under Colombia's Law 1581 of 2012 and its regulations, and handles inquiries and claims about your data directly.

2.1 Data you provide directly

• Registration data: name, email address and password.
• Billing data: name, country, payment data (handled by our payment processor; we do not store card data).
• Service configuration: connection data for each channel — domain and API credentials for your own stores; access and refresh tokens, seller identifier and market (country) for OAuth-authorized channels —; the credentials of your Sources (the supplier's username and password or token, and the Google Sheets permission if you connect a sheet); plus price rules, inventory split and sync settings.
• Catalogue data: products, variants, prices, stock, categories and images imported from your channels or uploaded by file, including image URLs you provide for us to download.
• Costs and margins: if you upload them, per-product cost and the margin rules Koalab uses to calculate prices.
• Channel movements: price and stock changes that happen inside your channels, received through their notifications or through the optional WooCommerce plugin, with their before and after values.
• Order data from your channels: where the channel allows it, we receive notice of its orders so we can tell why your inventory changed and distinguish a sale from a manual edit. Some channels (such as WooCommerce) send the whole order, with the buyer's details: Koalab discards them on receipt. From each order we keep only its identifier, status, dates and, for each line, the product, variant, SKU and quantity, for 30 days. We do not keep your buyers' name, email, phone or address.
• Communications: messages you send us via support or email.

2.2 Automatically collected data

• Usage data: pages visited, features used, access dates and times.
• Technical data: IP address (anonymized for analytics), browser type, operating system, session identifiers.
• Behavioral analytics: navigation events recorded by Google Analytics and PostHog to improve the product. PostHog knows you by your account's internal identifier, never by your email.
• Visit measurement: Vercel Web Analytics records each page view —its address, without the single-use codes some addresses carry; the page you came from; your approximate country and region; your browser, operating system and device type— to count visits in aggregate. It sets no cookies and stores nothing in your browser, does not keep your IP address, and tells visitors apart only by an identifier computed from the request, which is discarded after 24 hours.
• Conversion events: key actions (registration, subscription) recorded via Meta Pixel and Google Tag Manager to measure and optimize advertising campaigns.
• Cookies and similar technologies: see our Cookie policy.

2.3 Communication preferences

• When you subscribe to marketing communications, we record your preference and consent date.

2.4 Third-party data

• We do not purchase or obtain personal data from external sources other than those indicated.

We process your data on the following legal bases:

• Performance of contract: to provide the contracted Service — synchronizations, account management, billing and transactional communications.
• Legitimate interest: to improve the Service, prevent fraud, analyze internal product performance in aggregate form and count visits to the site without cookies (Vercel Web Analytics).
• Authorization: when you create your account, or accept this policy inside the application, you give prior, express and informed authorization to process your data for the purposes in section 3, as article 9 of Colombia's Law 1581 of 2012 requires. We keep the date and the version you accepted.
• Consent: for analytics cookies (Google Analytics, PostHog), marketing cookies (Meta Pixel, GTM) and sending marketing communications. You may withdraw this consent at any time.
• Legal obligation: when the law requires retaining or disclosing data (e.g. tax obligations).

We do not sell your personal data. We may share it only with the following recipients:

• Vercel Inc. — Frontend infrastructure and visit measurement: The frontend is hosted on Vercel, which may process web traffic data, and we use Vercel Web Analytics to count visits without cookies. See Vercel's Privacy Policy.
• Railway Corp. — Backend infrastructure: The application server is hosted on Railway. See Railway's Privacy Policy.
• MongoDB, Inc. — Database (MongoDB Atlas): User data and settings are stored in MongoDB Atlas. See MongoDB's Privacy Policy.
• Polar Software Inc. — Merchant of Record: Polar handles payments, subscriptions and billing. Koalab does not store card data. See Polar's Privacy Policy.
• Google LLC — Google Analytics and GTM: We use Google Analytics to measure site usage; the IP is anonymized. See Google's Privacy Policy.
• Meta Platforms — Meta Pixel: We use the Meta Pixel to measure conversions and optimize campaigns. See Meta's Data Policy.
• PostHog Inc. — PostHog: Product analytics platform to understand user interaction with the Service. See PostHog's Privacy Policy.
• Cloudflare, Inc. — Image storage (R2): Your catalogue images are stored on and served from Cloudflare R2. See Cloudflare's Privacy Policy.
• Resend Inc. — Email delivery: We use Resend for transactional and marketing emails (with your consent for the latter). See Resend's Privacy Policy.
• Public authorities: when required by law or a court order.

Several providers are located in the United States or other countries outside the European Economic Area (EEA). Specifically:

• Vercel Inc. — USA (Standard Contractual Clauses)
• Railway Corp. — USA (Standard Contractual Clauses)
• MongoDB, Inc. — USA (Standard Contractual Clauses)
• Google LLC — USA (Standard Contractual Clauses, Data Privacy Framework)
• Meta Platforms Inc. — USA (Standard Contractual Clauses)
• PostHog Inc. — USA (Standard Contractual Clauses)
• Cloudflare, Inc. — USA (Standard Contractual Clauses)
• Resend Inc. — USA (Standard Contractual Clauses)
• Polar Software Inc. — USA (Standard Contractual Clauses)

For all providers we ensure that adequate legal safeguards (DPA, SCCs or others) are in place before sharing personal data.

We retain your data for the following periods:

• Active account data: while the account is active.
• Data after requesting deletion: cancelling your plan deletes nothing (you move to the Free plan). If you ask us to delete your account, we delete it within the following 15 business days, except what the law requires us to keep. If you requested an export, we keep the data until we deliver it.
• Billing data: the period required by applicable tax law (typically 5–7 years depending on country).
• History of changes: Koalab keeps 90 days; your plan decides how many of those days you see (7, 30 or 90).
• Security logs: up to 12 months.

Depending on the regulations applicable in your country, you have the following rights:

• Access: know what data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data when no longer necessary.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Restriction: request that we restrict processing in certain circumstances.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise these rights, write to privacidad@koalab.tech. We answer inquiries within 10 business days (extendable by 5, letting you know) and claims within 15 business days (extendable by 8), as Law 1581 sets. If you live in Brazil, we answer access requests within 15 days, as the LGPD requires. If you live in another country, we also honour the rights its data protection law gives you, such as Law 25.326 in Argentina or the Federal Law on the Protection of Personal Data Held by Private Parties in Mexico.

In Colombia you also have the right to know, update and correct your data, to ask for proof of the authorization you gave us, to be told how we use it, to revoke the authorization or ask for deletion when your rights are not respected, and to file a complaint with the Superintendence of Industry and Commerce after claiming with us. In Brazil you can turn to the ANPD, and elsewhere to the competent data protection authority.

The Service is intended for persons over 18 years of age acting as merchants or business owners. We do not intentionally collect data from minors. If you are aware that a minor has provided us with personal data without parental consent, please contact us for deletion.

We implement appropriate technical and organizational measures, including:

• Encrypted transmission via HTTPS/TLS.
• Passwords stored with cryptographic hash (bcrypt).
• Credentials of every connected channel and of your Sources — API keys, access and refresh tokens, supplier usernames and passwords — encrypted at rest using AES-256-GCM.
• Restricted access to production data for the team.
• Authentication via short-lived JWT tokens.

When we make material changes, we will notify you by email or via a prominent notice on the platform with at least 15 days' notice.

For any privacy-related query:

• Email: privacidad@koalab.tech
• Controller: Cristian Alejandro Muñoz Cardona (there is no separate data protection officer: the controller handles requests directly)
• Address: Calle 45F #77A - 33, Medellín, Colombia