Privacy Policy

1. Introduction

This Privacy Policy explains how Revera Media LLC ("Kora", "we", "us", or "our") collects, uses, shares, and protects information in connection with our services. Kora is an SMS-based AI inventory copilot for cafe and food service operators.

This Policy applies to:

• The Kora website at kora.korhq.ai
• The Kora SMS service (text messages to and from our published phone numbers)
• The Kora web application (including the nightly count form)

For questions about this Policy, contact us at support@korhq.ai.

2. Information We Collect

a. Information you provide directly

• Phone number (required for the SMS service)
• Cafe or business name
• Email address (optional)
• SMS message content (text and photos you send to Kora)
• Inventory data (item names, quantities, suppliers)
• Recipe data
• Supplier contact information (name, channel, contact value)

b. Information collected automatically

• IP address (signup form, web app sessions)
• Browser user agent
• Web app interaction logs
• SMS metadata via Twilio (delivery status, message IDs, timestamps)

c. Mobile information / SMS data

When you opt in to receive SMS from Kora, we collect:

• Your phone number
• The opt-in timestamp
• The IP address used at the moment of opt-in
• The exact disclosure text shown to you
• The content of messages sent to and received from you

This information is treated as a sensitive category. It is never sold or shared for marketing purposes. See the How We Share Your Information section below.

3. How We Use Your Information

We use your information to:

• Deliver the SMS-based service (inventory tracking, briefings, supplier order drafts)
• Process and respond to messages you send
• Analyze inventory and send forecasts and run-out alerts
• Improve the service (using anonymized and aggregated data only)
• Communicate with you about your account
• Enforce our Terms of Service and prevent abuse
• Comply with our legal obligations

4. AI Processing of Your Content

Photos and text messages you send to Kora may be processed by Anthropic (the maker of the Claude family of AI models), which acts as our subprocessor. Anthropic processes this content under contract solely to support the Kora service.

Anthropic does not retain or use your content for their own model training. Content is processed in real time. No data is shared with Anthropic for marketing or for any purpose other than the operation of the Kora service.

5. How We Share Your Information

We use a small number of subprocessors strictly to deliver the service to you. We never engage them for marketing purposes:

• Twilio — SMS delivery and webhook routing
• Anthropic — AI processing of message content (no model training, no marketing)
• Neon — managed Postgres database hosting
• Vercel — application hosting and CDN

We do not sell, rent, or trade your information. We never share your phone number or message content with advertisers, data brokers, or marketing affiliates.

6. Data Retention

• Active accounts: data is retained while you use the service.
• Inactive accounts: archived after 12 months of no activity.
• Deletion requests: honored within 30 days. Email support@korhq.ai to request deletion.
• Audit logs (consent records, payment records): retained for 7 years for legal compliance under applicable law.
• Backups: some backups may retain data up to 60 additional days during normal backup rotation.

7. Your Rights

You have the following rights regarding your personal information:

• Access — request a copy of all data we hold about you
• Correction — ask us to fix inaccurate data
• Deletion — request full erasure (subject to legal retention obligations)
• Portability — receive your data in a machine-readable format
• Withdraw consent — opt out of SMS at any time by replying STOP
• Object to processing — contact us to discuss any concerns

California residents: CCPA grants you the right to know, the right to delete, and the right to opt out of the sale of personal information. We do not sell your data.

EU residents: GDPR rights apply where relevant. The Kora service is currently US-only, but we honor inquiries from EU residents.

To exercise any of these rights, email support@korhq.ai.

8. SMS Opt-Out

• Reply STOP to any Kora message to be unsubscribed immediately. We send a single confirmation message and no further messages until you opt in again.
• Reply HELP at any time for support instructions.
• Standard carrier message and data rates may apply.
• To re-subscribe, text START to (833) 773-8419 or sign up again at kora.korhq.ai/signup.

For full SMS-specific consent terms see our SMS Terms.

9. Children's Privacy

The Kora service is not directed at children under 13. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 13, we will delete it promptly.

10. Security

We protect your information using:

• HMAC signature verification on all incoming webhook messages
• Token-based authentication for web app sessions (no passwords stored)
• Encrypted data at rest (Neon Postgres)
• TLS in transit for all network traffic
• Restricted internal access on a need-to-know basis

In the event of a confirmed data breach involving personal information, we will notify affected users within 72 hours.

11. International Users

Kora is operated from the United States and the service is currently US-only. All data is processed and stored in US-based infrastructure: Neon (US East), Vercel (iad1), Anthropic, and Twilio.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via SMS to active users and posted prominently on kora.korhq.ai. The effective date at the top of this page will reflect the latest update. Continued use of the service after a change is published constitutes acceptance of the updated Policy.

13. Contact Us

Email: support@korhq.ai

Mail: Revera Media LLC, [address on file]

For privacy-specific inquiries, please email support@korhq.ai with the subject line "Privacy".