Legal

Privacy Policy

Last updated: 1 June 2026

1. Who we are

KoalaCast is a Software-as-a-Service platform that enables organisations — including schools, housing societies, and offices — to broadcast announcements to their members and track acknowledgements. KoalaCast is operated by [Your Company Name], registered in India.

When we say "KoalaCast", "we", "us", or "our" in this policy, we mean the company operating this service. When we say "you", we mean any person using our platform, whether as an administrator, moderator, or member.

2. What data we collect

Data you provide directly

Account information: Your name, email address, and phone number when you are added to a KoalaCast workspace.
Organisational data: Workspace name, channel names, and any custom contact fields your organisation administrator configures.
Announcement content: The text, images, and attachments you include in announcements.
Acknowledgements and responses: When you mark an announcement as read, confirm, or respond Yes/No.

Data we collect automatically

Usage data: Which announcements you opened, when you opened them, and how many times.
Device and browser information: Your browser type, operating system, and IP address when you access the platform.
Last active timestamp: The last time you accessed your workspace, used by administrators to understand member engagement.

Data we do not collect

We never store credit card numbers, CVV codes, bank account details, or UPI IDs. All payment processing is handled by Razorpay under their privacy policy.
We do not collect biometric data, government ID numbers, or health information.

3. How we use your data

To provide the service: Delivering announcements to the right recipients, tracking viewership, and maintaining acknowledgement records.
To send transactional emails: Magic link login emails, invitation emails, and workspace notifications. We use Resend to deliver these.
To maintain security: Detecting unauthorised access, preventing abuse, and maintaining audit logs of administrative actions.
To improve the platform: Understanding which features are used most frequently to prioritise development.
To process payments: Passing billing information to Razorpay to process subscription payments.

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

4. Legal basis for processing (GDPR)

If you are located in the European Economic Area, we process your personal data under the following legal bases:

Contract: Processing necessary to provide the KoalaCast service you or your organisation has subscribed to.
Legitimate interests: Maintaining security, preventing fraud, and improving the platform.
Consent: For any marketing communications (we do not currently send marketing emails).

5. Data sharing and third parties

We share your data with the following third-party service providers, each bound by their own privacy policies:

Provider	Purpose	Data shared
Supabase	Database, authentication, and file storage	All user and announcement data
Resend	Transactional email delivery	Name, email address
Razorpay	Payment processing	Billing name, email, payment details
Vercel	Application hosting	Server logs, IP addresses

We do not share your data with any other third parties without your explicit consent, except where required by law.

6. Data retention

Active workspaces: We retain all data for as long as your organisation's workspace is active.
Cancelled accounts: Data is retained for 30 days after cancellation, during which you may request an export. After 30 days, data is permanently deleted.
Audit logs: Retained for 12 months for security and compliance purposes.
Payment records: Retained for 7 years as required by Indian accounting regulations.

7. Data security

We implement the following security measures to protect your data:

All data is encrypted in transit using TLS 1.2 or higher.
Database access is controlled by Row Level Security (RLS) — each organisation's data is isolated at the database level, not just in application code.
Administrative operations use a service role key that is never exposed to the browser.
Authentication uses magic links — no passwords are stored.
Supabase infrastructure is hosted on AWS with SOC 2 Type II compliance.

8. Your rights

You have the following rights regarding your personal data:

Access: Request a copy of all personal data we hold about you.
Correction: Request correction of inaccurate personal data.
Deletion: Request deletion of your personal data (subject to legal retention requirements).
Portability: Request your data in a machine-readable format (CSV export).
Objection: Object to processing based on legitimate interests.

To exercise any of these rights, contact us at hello@koalacast.io. We will respond within 30 days.

9. Cookies

KoalaCast uses only functional cookies necessary for the service to operate. See our Cookie Policy for details. We do not use advertising or tracking cookies.

10. Children's privacy

KoalaCast is designed for use by organisations and their adult administrators. While member accounts may be created for students, we do not knowingly collect personal data from children under 13 without parental consent facilitated through the school administrator. If you believe we have inadvertently collected such data, contact us immediately at hello@koalacast.io.

11. Changes to this policy

We will notify workspace administrators by email at least 14 days before making material changes to this privacy policy. Continued use of the platform after that date constitutes acceptance of the updated policy.

12. Contact

For privacy-related questions or to exercise your rights:

Email: hello@koalacast.io
Subject line: Privacy Request — [Your Name]