Privacy Policy
Effective date: February 22, 2026 · Last updated: July 13, 2026
KoPay ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the KoPay platform and related services ("Service").
By using the Service, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Service.
1. Information We Collect
Information you provide directly:
- Account registration details (name, email address, business name)
- Business profile information (company address, logo, contact details, tax settings)
- Invoice and estimate content you create (line items, amounts, dates, notes)
- Customer records you enter (customer names, email addresses, business details)
- Job descriptions you type or speak when using AI-assisted invoice drafting
- Communications you send to us (support requests, feedback)
Information collected automatically:
- Log data (IP address, browser type, pages visited, timestamps)
- Usage data (features used, actions taken within the platform)
- Device information (device type, operating system)
- Analytics and performance data via Vercel Analytics and Vercel Speed Insights (aggregated, non-identifiable traffic and performance data)
- Website visit analytics via Google Analytics — pages visited, session duration, referral source, approximate location derived from IP address, and device/browser type. This runs on our public marketing site (usekopay.app) only, not inside the KoPay application itself, and uses cookies as described in "Cookies," below.
We do not use advertising/marketing tracking pixels (e.g. Meta Pixel) anywhere in the Service.
Cookies: On first visit to our marketing site, a banner lets you choose "Accept all" or "Essential only." Google Analytics cookies (e.g. _ga, _ga_*) are only set if you choose "Accept all" — choosing "Essential only" keeps your visit untracked. You can change your choice at any time by clearing your browser's site data for usekopay.app, or opt out of Google Analytics across all websites using Google's browser add-on. This choice has no effect on your ability to use the KoPay application, which does not use Google Analytics.
Information we do not collect:
- We do not collect, store, or access your customers' payment card numbers, bank account details, or other sensitive financial data. All payment data is processed exclusively by Stripe.
2. How We Use Your Information
| Purpose | Data Used |
|---|---|
| Providing and operating the Service | Account info, invoice/estimate data, customer records |
| Processing payments via Stripe | Invoice amounts, customer email (passed to Stripe for payment links) |
| Sending invoice and estimate emails | Customer email addresses, invoice content (via Resend) |
| Authenticating your account | Email, password hash (via Supabase Auth) |
| Blocking automated signup/login abuse | Browser/device signals (via Cloudflare Turnstile) |
| AI-assisted invoice drafting and reports insights | Job descriptions, your product/pricing catalog, aggregated financial figures (via Anthropic). See "AI Features," below. |
| Optional accounting sync, if you connect it | Invoice and customer data (via Intuit QuickBooks) |
| Understanding marketing site traffic | Pages visited, session data, referral source (via Google Analytics) |
| Improving the Service | Aggregated usage patterns, feature interaction data |
| Responding to support requests | Email address, message content |
| Legal compliance | As required by applicable law |
We do not sell your personal information to third parties. We do not use your data for advertising targeting or share it with advertising networks.
3. Third-Party Services We Use
The Service relies on the following third-party providers. Each has its own privacy practices:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Stripe, Inc. | Payment processing. Stripe handles all card data. KoPay does not store card numbers. | stripe.com/privacy |
| Supabase | Database, authentication, and file storage infrastructure. | supabase.com/privacy |
| Resend | Transactional email delivery (invoices, estimates, notifications). | resend.com/legal/privacy-policy |
| Vercel | Web hosting, edge delivery, and site analytics/performance monitoring (Vercel Analytics, Speed Insights). May log request metadata. | vercel.com/legal/privacy-policy |
| Google LLC (Google Analytics) | Marketing-site traffic analytics only — not used inside the KoPay application. Sets cookies as described in "Cookies," above. | policies.google.com/privacy · how Google uses data |
| Anthropic, PBC | AI-assisted invoice drafting and the AI reports assistant. Receives job descriptions, your product/pricing catalog, and aggregated financial figures — never customer names, emails, phone numbers, or addresses (blocked before the request is sent). See "AI Features," below. | anthropic.com/legal/privacy |
| Cloudflare, Inc. | Turnstile bot/abuse protection on sign-up, login, and password-reset forms. | cloudflare.com/privacypolicy |
| Intuit Inc. (QuickBooks) | Optional accounting sync. Only activates if you choose to connect your QuickBooks account; syncs invoice and customer data you select. | intuit.com/privacy |
| Apple Inc. | iOS app only. Speech-to-text for the voice invoice feature is processed using Apple's on-device/cloud speech recognition when you use your voice to describe a job. | apple.com/legal/privacy |
4. AI Features
KoPay uses Anthropic's Claude models to power two optional features: AI-assisted invoice drafting (turning a typed or spoken job description into line items) and the AI reports assistant (answering questions about your own reports data in plain English).
Before any request reaches Anthropic, we strip it down to what the feature actually needs — a job description, your product/pricing catalog, or aggregated financial totals — and block requests that ask for or would expose customer names, email addresses, phone numbers, addresses, or raw invoice records. Anthropic processes this data to generate a response and, per their policy linked above, does not use it to train their models.
These features are optional. Declining to use them (e.g. entering line items manually instead of describing a job) means no data is sent to Anthropic.
5. Your Customers' Data
When you use KoPay to create invoices and customer records, you are the data controller for your customers' information. You are responsible for obtaining any necessary consent from your customers to process their data and for complying with applicable privacy laws (including CCPA, if applicable) with respect to your customers.
KoPay processes your customers' data only as a data processor acting on your behalf, solely for the purpose of providing the Service to you. We do not use your customers' information for our own purposes.
6. Data Retention
We retain your account data and User Content for as long as your account is active. During the beta period, we may not guarantee long-term data retention. If you close your account, we will delete or anonymize your data within a reasonable period, except where retention is required by law.
7. Data Security
We implement reasonable technical and organizational measures to protect your information, including encryption in transit (HTTPS/TLS) and at rest, and access controls limiting who can access your data. However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
8. Your Rights
Depending on your jurisdiction, you may have rights regarding your personal data, including the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Object to or restrict certain processing
- Portability of your data in a common format
To exercise these rights, contact us at hello@usekopay.app. We will respond within a reasonable timeframe.
9. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act. We do not sell personal information. You have the right to know what personal information we collect, to request deletion, and to opt out of any sale (which we do not engage in). To exercise your California privacy rights, contact us at hello@usekopay.app.
10. Children's Privacy
The Service is not directed at children under the age of 13, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under 13, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice within the Service at least 14 days before changes take effect. Continued use of the Service after the effective date constitutes your acceptance of the updated Policy.
12. Contact
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:
KoPay
Email: hello@usekopay.app
This Privacy Policy was last updated July 13, 2026.