Privacy Policy

We use your information to:

• Provide, operate, and improve the Kordinate platform
• Create and manage your account and organisation
• Process subscription payments via Paddle
• Send transactional emails (account confirmations, invoices, password resets)
• Send product updates and announcements (you may opt out at any time)
• Respond to your support requests and enquiries
• Detect, investigate, and prevent fraud, abuse, or security incidents
• Comply with our legal obligations
• Analyse usage trends to improve the platform (using aggregated or anonymised data where possible)

We do not sell your personal information to third parties. We do not use your content for advertising or AI model training purposes.

Where the General Data Protection Regulation (GDPR) applies, we process your personal data on the following legal bases:

• Contract: Processing necessary to provide the Service you have subscribed to
• Legitimate interests: Improving the platform, fraud prevention, and security — where these interests are not overridden by your rights
• Legal obligation: Complying with applicable laws
• Consent: For non-essential communications such as marketing emails, where we have obtained your consent

We share personal information only in the following circumstances:

We retain your personal information for as long as your account is active or as needed to provide the Service. If you close your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it for legal or compliance purposes (e.g. billing records).

Content you have created within Kordinate may be retained for a short period after account closure to allow for data export. After this window, it is permanently deleted.

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that inaccurate or incomplete data be corrected
• Deletion: Request deletion of your personal data (subject to legal retention obligations)
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Request that we restrict processing of your data in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at team@kordinate.app. We will respond within 30 days. You also have the right to lodge a complaint with a relevant data protection authority.

We use cookies and similar technologies solely to operate the platform. These include:

• Essential cookies: Required for authentication and session management. Cannot be disabled.
• Preference cookies: Store your settings (e.g. selected views or filters) to improve your experience.

We do not use advertising or tracking cookies. We do not participate in third-party ad networks.

We implement industry-standard security measures to protect your information, including encrypted data transmission (TLS), database-level Row Level Security (RLS), access controls, and regular security reviews.

While we take reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at team@kordinate.app.

Kordinate is operated by a New Zealand-based sole trader. Our service providers (including Supabase, Vercel, and Paddle) may process your data in various countries. Where required, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses for data transfers from the EEA).

Kordinate is intended for business use by adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a minor, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice within the platform at least 14 days before changes take effect. Your continued use of Kordinate after the effective date constitutes acceptance of the revised policy.

For any questions, requests, or concerns about this Privacy Policy or how we handle your data: