Privacy Policy

1. Who we are and how to contact us

KodaPlace is operated by [FULL LEGAL NAME OF THE COMPANY], registered under [CNPJ/COMPANY REGISTRATION NUMBER], with its address at [FULL BUSINESS ADDRESS, COUNTRY] (in this Policy, “KodaPlace”, “we”, “us” or “our”).

For questions, requests or complaints about privacy and personal data, write to support@kodaplace.com, preferably with the subject “Privacy”.

Data protection officer (Brazil): [PROVIDE THE NAME AND CONTACT OF THE DATA PROTECTION OFFICER, IF APPLICABLE, OR THE DESIGNATED CONTACT CHANNEL].

Representative in the European Union or the United Kingdom: [PROVIDE THE REPRESENTATIVE’S DETAILS, IF THE LEGAL ASSESSMENT CONCLUDES THAT A DESIGNATION IS REQUIRED].

The fields in brackets must be completed or assessed before this Policy is published as a final version.

2. When this Policy applies

This Policy applies to the KodaPlace website, to the virtual office accessed through the browser, to the desktop apps and other official apps, and to KodaPlace features and integrations that refer to it.

It does not replace the privacy notices of third-party services that you access through links, connect to KodaPlace or use independently. Those services have their own privacy practices and policies.

3. The role of KodaPlace and the role of your company

When a company subscribes to KodaPlace for its team, it can invite users, set permissions and manage its spaces. In that situation, the company usually decides why and how its members’ data is used within the corporate environment — for example, messages, files and recordings that its team decides to create. For that content, the company may act as controller and KodaPlace as processor, processing the data to provide the service and in accordance with the applicable settings and instructions.

KodaPlace also processes certain data for its own purposes, such as managing accounts, handling subscriptions and payments, protecting the platform, preventing fraud, providing support and complying with legal obligations. For these activities, we may act as an independent controller.

If you use KodaPlace at a company’s invitation, that company may also be the appropriate contact for requests about content or information it controls. When necessary, we will forward your request or help the company respond to it. The company remains responsible for having a legal basis to invite its members and for providing them with the information and guidance required by applicable law.

4. What personal data we may process

The data processed depends on how you use KodaPlace, the features enabled and the company’s settings.

4.1. Account, profile and authentication

We may process your name, email address, display name, avatar and its appearance, profile photo when uploaded, credentials and technical authentication information. We may process your date of birth when it is requested to verify age requirements. The authentication provider may store passwords in a protected format, such as a hash; KodaPlace does not need to know your password in plain text to authenticate you.

4.2. Company, spaces, invitations and administration

We may process the names of the company and of the virtual spaces, user identifiers, members, roles and permissions, invitations sent and accepted, records of administrative changes, subscription data, the number of billed users and events related to managing the space. Invitations may include the recipient’s email address, the space they were invited to, an access identifier or token and the status or expiry of the invitation.

4.3. Presence and interaction in the virtual office

To provide the virtual office experience, we may process the position of your avatar on the map, presence status (for example, online or away), rooms or spaces visited, session times and duration, and the interactions needed to connect nearby users. This data helps show colleagues’ presence and makes proximity-based communication work.

4.4. Content you create or share

We may store and process chat messages, direct or channel messages depending on the feature used, reactions, notes, attachments, images, files, links, published maps, space settings, music links and other content that you or your company choose to add to the service. This content may include other people’s personal data. You and your company must have authorization and a legal basis to share it.

Content visibility depends on the type of room, channel, tool and permissions configured in the product. Members and administrators may access content and administrative information according to the features and privileges available to their roles.

4.5. Audio, video and screen sharing

When you enable your microphone, camera or screen sharing, KodaPlace and its real-time infrastructure providers process the data needed to transmit audio, video and content to the selected participants. The browser or operating system permission controls access to the microphone, camera and screen.

These streams are transmitted in real time and, as a rule, are not stored by KodaPlace as recordings, unless someone starts the recording feature or another feature is expressly described as able to store the content. Technical data needed to establish, maintain and protect the communication may be processed by the providers.

4.6. Meeting recordings

When a recording is started, the resulting file may contain audio, video, screen sharing and other elements captured by the recording feature. Recordings are stored so that authorized users of the space can access them according to the product’s permissions and the company’s settings.

The person who starts or organizes the recording and the company responsible for the space must inform participants before recording them and comply with applicable law, including local rules on notice, consent and later use of the recording. Do not record meetings without informing participants or in breach of the law. Before publishing this Policy, KodaPlace must confirm that the interface clearly shows when recording is active and how participants can notice it.

4.7. Technical, security and performance data

We may process IP address, browser type and version, operating system, session identifiers, language, error logs, performance metrics, access times and technical events needed to troubleshoot problems, maintain availability, prevent abuse and protect accounts and infrastructure.

4.8. Billing and transactions

We may process data about the subscribing company, plan, number of billed users, subscription status, billing history, receipts and required tax information. Full card details are sent directly to Stripe for processing; under the current configuration of the service, KodaPlace does not receive or store the full card number. Stripe processes the data under its own terms and privacy notices.

4.9. Support and communications

We may process the content of messages sent to support, emails, bug reports, privacy requests and the information needed to respond to you. We also send operational messages, such as invitations, account verification, access recovery, billing, important service changes and security notices.

4.10. Guests and temporary sessions

If a company allows guest access, we may process the display name, avatar, technical session data and the minimum information needed to let the guest into the space. Guest links may have a limited validity period, according to the settings shown by whoever created them. A session without a registered account does not mean that no personal data is processed: the connection and use of the platform may still generate technical and presence data.

5. Why we use data and the legal basis

We use personal data for the purposes below, limiting processing to what is necessary for each purpose:

Where the law requires consent, we will ask for it before the corresponding processing. Where we rely on legitimate interests, we will consider the rights and expectations of data subjects and the risks involved. You may object to processing where the law grants you that right.

We do not sell personal data and we do not use the content of chats, files, audio, video or recordings for behavioral advertising. If we offer translation or artificial intelligence features that send content to an external provider, we will disclose the feature, the purpose and the data involved before it is enabled or used. We will not authorize the use of space content to train general-purpose AI models without clear prior notice and an appropriate legal basis.

6. Who we share data with

We share personal data only when necessary for the purposes described in this Policy, in accordance with applicable permissions, instructions and laws. Categories of recipients include:

• Infrastructure, database and authentication providers: currently Supabase, Railway and Vercel, according to each service’s role.
• Real-time communication: LiveKit, to enable audio, video and screen sharing.
• Storage of recordings and files: Amazon Web Services (AWS), including S3 for recordings under the current configuration.
• Payments: Stripe, to process subscriptions and payments.
• Operational emails: Resend, to send invitations, notices and transactional messages.
• Enabled integrations: third-party services connected by you or the company, such as Jira, music search or playback and translation tools, when available. Each integration receives the data needed to perform the requested action.
• The company and participants in the space: colleagues, guests and administrators can see the information and content made available to them by the product’s features and permissions.
• Authorities and legally authorized third parties: when required by law, a valid decision, legal proceedings or to protect the rights, safety and integrity of users and the service.
• Corporate transactions: in the event of a reorganization, merger, acquisition or transfer of the service, data may be shared to the extent necessary for the transaction, subject to applicable safeguards.

Providers that process data on our behalf must do so for authorized purposes and with appropriate protection measures. The list of providers may change as the service evolves; material changes to processing practices will be reflected in this Policy.

When you connect a third-party service, you may also be subject to that provider’s policy and terms. We recommend reading them before enabling the integration.

7. International transfers

KodaPlace is operated from Brazil and may use providers whose infrastructure or staff are located in other countries, including the United States. As a result, personal data may be processed or stored in jurisdictions other than the one where you live, subject to different laws and authorities.

When an international transfer is subject to the LGPD, the GDPR/UK GDPR or another data protection law, we will adopt a valid mechanism for that transfer and the safeguards required by applicable law. Depending on the case, this may involve an adequacy decision, applicable standard contractual clauses, data processing agreements or another legally recognized mechanism. Transfers subject to Brazilian rules will also follow the applicable regulations of the National Data Protection Authority (ANPD).

The applicable safeguards depend on the countries involved, the providers used and the nature of the data. Before this Policy is published, KodaPlace must keep an up-to-date inventory of the countries where data is processed and verify the contractual mechanisms actually adopted with each provider.

8. How long we keep data

We keep personal data for as long as necessary to provide the service, fulfil the purposes described in this Policy, meet legal obligations, resolve disputes and protect the platform. The period depends on the type of data and the context:

• Personal account: while the account is active or until its deletion is requested, except for data that must be kept due to a legal obligation or another valid basis.
• Data and content of the company’s space: according to the period of use and the space’s retention rules. Under the operating rule currently published, after paid access ends the space is locked and, 7 days after access ends, the company’s content — including worlds, maps, chat, recordings and attachments — is deleted and cannot be recovered. The company may need to export or save its content before that deadline. A new subscription before deletion may cancel this process, as set out in the Terms of Service.
• A member’s personal account: deleting a company’s space does not necessarily delete the member’s personal account, which they may continue to use with other companies, as set out in the Terms of Service.
• Billing and tax data: for the period required by applicable law and as needed to prove transactions and handle audits or disputes.
• Logs, security and diagnostic records: for the period needed to investigate failures, protect the service, prevent fraud and meet legal obligations. KodaPlace must define and document specific internal periods for these categories.
• Support and privacy requests: for the period needed to respond, document the request, meet obligations and defend rights.
• Backups: where they exist, they will be deleted or overwritten according to the documented technical retention cycle and will not be used for purposes incompatible with this Policy.

When data is no longer needed, we will delete it, anonymize it or keep it only where there is a legal basis for retention. The deletion rule for corporate content must be applied consistently across live systems, file storage and backups, observing the technical and legal periods clearly disclosed.

9. Cookies, local storage and similar technologies

The website and the app may use cookies, browser local storage and similar technologies to keep sessions authenticated, protect your account, save preferences — such as language and theme — and enable essential functions.

The configuration currently published states that the website does not use advertising or tracking cookies. Loading fonts from an external service may send technical information, such as your IP address, to that provider. If we start using non-essential cookies or analytics tools, we will ask for consent where required and provide an appropriate way to manage your preferences.

You can manage cookies and local storage through your browser or device settings, but disabling essential technologies may prevent some features from working properly.

10. Security

We adopt technical and organizational measures proportionate to the risks and the nature of the data. The measures currently described by KodaPlace include HTTPS connections, role-based access controls, server-side secret management and restricted access to production data. We also work to prevent unauthorized access, loss, improper alteration and unauthorized disclosure.

No system is completely risk-free. If an incident involving personal data occurs, we will assess its impact and take containment, investigation and remediation measures, as well as notify data subjects and authorities where required by applicable law.

You should also protect your credentials, keep your devices up to date, review app permissions and let KodaPlace know if you suspect unauthorized access to your account.

11. Your rights and how to exercise them

Depending on the law that applies to your situation, you may have the right to:

• confirm whether we process your data and obtain access to it;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking, restriction or deletion of data, where appropriate;
• request data portability, within legal limits;
• know the categories of data, purposes and recipients of the processing;
• withdraw consent, where processing is based on it, without affecting the lawfulness of prior processing;
• object to certain processing or request its restriction;
• request a review of decisions made solely by automated means, where this right applies;
• not be discriminated against for exercising privacy rights;
• lodge a complaint with the competent data protection authority.

Send your request to support@kodaplace.com, using the subject “Privacy” and describing the right you wish to exercise. We may ask for reasonable information to confirm your identity and protect data against disclosure to unauthorized persons. We will not ask for excessive data for this purpose.

We will respond within the periods set by applicable law. Some requests may be limited when we need to keep certain data to comply with the law, prevent fraud, protect security or exercise or defend rights. When data is under the control of a client company, we may forward the request to that company or ask it to handle the request.

12. Additional information for certain regions

12.1. Brazil — LGPD

For people subject to the LGPD, the rights and guarantees provided by law will be respected, including confirmation of processing, access, correction, anonymization, blocking, deletion in the cases provided by law, portability under applicable regulations, information about sharing and withdrawal of consent where that is the legal basis.

You may also lodge a complaint with the National Data Protection Authority (ANPD). When KodaPlace acts as a processor for a client company, requests about content controlled by the company may also need to be addressed to it.

12.2. European Economic Area, United Kingdom and Switzerland

Where the GDPR, the UK GDPR or Swiss data protection law applies, you may have additional or specific rights, including access, rectification, erasure, restriction, portability, objection and withdrawal of consent, under the conditions set by law. You may also lodge a complaint with the competent supervisory authority where you live, work or where the alleged infringement occurred.

The legal basis for each processing activity is described in Section 5. Where required by law, KodaPlace will provide information about its local representative and/or data protection officer. Whether a representative must be appointed in the European Union or the United Kingdom must be assessed based on actual activities and the applicable legal criteria.

12.3. United States — California and other state laws

Where a United States privacy law applies, you may have the right to know, access, correct or delete certain personal information, obtain a portable copy, opt out of the sale or sharing of personal information for cross-context behavioral advertising, limit certain uses of sensitive information and not be discriminated against for exercising your rights, as provided by applicable law.

KodaPlace does not sell personal data and does not share it for cross-context behavioral advertising, as those terms are defined by applicable law. To exercise your rights, send a request to support@kodaplace.com. We may verify your identity and, where permitted, accept requests through an authorized agent. The specific rights depend on the applicable law and its coverage.

12.4. Other regions

If you live in another country or region, you may have additional rights under local law. This Policy is not intended to limit rights that cannot be waived by contract or privacy notice.

13. Children and adolescents

KodaPlace is a work tool intended for people 18 years of age or older. We do not allow anyone under 18 to create or use accounts. We do not knowingly collect personal data from minors; if we learn that an account belongs to someone under 18, we will take steps to restrict access and delete the personal data, unless retention is legally required. Parents or guardians can contact us at the address given in Section 1.

14. Third-party links and services

KodaPlace may display links, embedded files or integrations with external services. When you access or enable these services, the third party’s processing of data is governed by its own terms and policies, in addition to the permissions you have granted. KodaPlace does not control the privacy policies of independent services.

15. Changes to this Policy

We may update this Policy to reflect changes to the product, providers, processing practices or the law. The date of the last update will be shown at the top of the document. If a change is significant, we will try to let you know by email, in the app or by another appropriate means. Where the law requires consent or specific prior notice, we will follow the applicable procedure.

16. Contact

For questions or requests about this Policy and the processing of personal data, contact us:

KodaPlace — Privacy · Email: support@kodaplace.com · Address of the responsible legal entity: [TO BE COMPLETED BEFORE PUBLICATION]