Privacy Policy

Last updated: October 13, 2026

This policy explains what personal data Kohapu collects, why, who we share it with and how you can control it. It follows Brazil's General Data Protection Law (LGPD) and, for people in the European Union and the United Kingdom, the GDPR.

1. Who is responsible for your data

Vorvar Technology LTDA, CNPJ 50.535.785/0001-75, Av. Paulista, 1106, Sala 01, Andar 16, Bela Vista, São Paulo, SP, 01310-914, Brazil, is the controller of your personal data. For anything about your data, including requests under the LGPD or the GDPR, email support@kohapu.com.

2. Data we collect

• Account: your name, email, password (stored only as a hash by our authentication provider) or your Google account identifier if you sign in with Google and your language preference.
• Instagram: after you connect your account through Instagram's official login, your account ID, username, profile picture, bio, recent posts and captions, performance metrics of posts published through Kohapu (reach, likes, comments, saves, shares) and the access token that lets us publish for you.
• Brand profile: niche, audience, positioning, content pillars, tone of voice, colors, logo and website address, either suggested by Kohapu and confirmed by you or entered by you.
• Your content: posts we generate for you, your edits and approvals, schedules, product photos you upload or import from your Instagram feed and links, PDFs or images you send as references.
• Payments: your plan, payment status and Stripe customer and subscription IDs. Card details are handled by Stripe and never reach us.
• Technical data: IP address, browser and device type and logs of what happens in the app, used for security and to fix problems.

We don't ask for sensitive personal data, such as health, religion or political opinions.

3. Why we use it and our legal basis

• To provide Kohapu (your account, creating, scheduling and publishing posts, showing metrics): performance of our contract with you.
• To access your Instagram account: the consent you give on Instagram's screen, which you can withdraw at any time.
• To charge for plans and keep tax records: contract and legal obligation.
• To keep Kohapu secure and prevent abuse (rate limits, bot checks, blocking repeated use of the free preview, checking content against our rules): legitimate interest.
• To understand how the site is used and improve Kohapu: your consent for analytics cookies, which you can withdraw at any time.
• To email you about your account (for example, a scheduled post that wasn't published): contract.

4. How AI is used

To create your posts, we send your brand profile, the topic of each post and, when needed, your Instagram bio, captions, product photos and references to AI providers that generate text and images. We don't use your data to train AI models. AI suggests content, but every post only goes live after you approve it, so no decision that affects you is made by AI alone.

5. How we treat Instagram data

Data we get from Instagram is used only to run Kohapu for you. We never:

• sell it or share it with data brokers;
• use it for advertising, ad targeting or retargeting;
• use it to train AI models;
• use it to make decisions about you, such as credit or eligibility.

You can remove Kohapu's access at any time in Instagram, under Settings → Website permissions → Apps and websites (instagram.com/accounts/manage_access).

6. Who we share data with

We don't sell personal data. We share it only with providers that process it on our behalf to run Kohapu:

• Supabase: database, file storage and sign-in.
• Vercel: hosting.
• Anthropic, OpenAI, Google (Gemini) and OpenRouter: writing text and checking content.
• fal.ai and OpenAI: generating illustrations.
• Meta (Instagram): publishing your approved posts and reading their metrics.
• Stripe: payments.
• Resend: account emails.
• Upstash: scheduling posts and limiting excessive requests.
• Cloudflare Turnstile: telling people from bots on sign-in forms.
• Google: sign-in with Google and Google Analytics (site usage statistics).
• SerpApi: reading your website during sign-up when we can't access it directly.

We may also disclose data when the law or a court order requires it.

7. International transfers

Most of these providers process data outside Brazil, mainly in the United States. We only use providers that commit, in their data processing terms, to protect personal data, as the LGPD (art. 33) and the GDPR require for international transfers.

8. Security

Data, including the access token for your Instagram account, travels encrypted (TLS) and is stored in a database encrypted at rest (AES-256). Access to production data is restricted, and the app has rate limits, bot checks and automatic content checks. If a security incident puts your data at risk, we will notify you and the competent authority as the law requires.

9. How long we keep data

• Account, brand profile and posts: while your account is active. They are deleted when you ask us to delete your account.
• Payment records: 5 years after payment, as required by Brazilian tax law.
• Instagram account ID and whether it already received the free preview: kept after account deletion, only to prevent repeated use of the free preview.
• Technical logs: deleted automatically after up to 30 days.

10. Cookies

• Essential: keep you signed in and protect forms from bots.
• Preferences: remember your language and light or dark theme.
• Analytics: Google Analytics, to count visits and see which pages are used. Only loaded if you accept it in the cookie banner (legal basis: consent).

Essential and preference cookies don't need your permission because Kohapu doesn't work without them. You can change your choice about analytics cookies at any time with Cookie settings. Your choice is remembered for 6 months. You can also block or delete cookies in your browser; blocking essential cookies prevents you from signing in.

11. Your rights

You can ask us to confirm whether we process your data, give you access to it, correct it, delete it, anonymize or block data that isn't needed, send it to another provider, tell you who we share it with and withdraw consent. People in the EU and the UK can also object to or ask us to restrict processing. Email support@kohapu.com from your account's email address. We reply within 15 days. You can also complain to Brazil's data protection authority (ANPD) or to the authority in your country.

To delete your account and data, see the Data Deletion page.

12. Children

Kohapu is for people 18 and over. We don't knowingly collect data from children.

13. Changes to this policy

If we change how we use your data in an important way, we will email you before the change takes effect and, when the law requires it, ask for your consent again.

14. Contact

Questions about this policy or your data: support@kohapu.com.