Privacy Policy

Depending on how you use KoraSpace, we may collect and process the following categories of information:

KoraSpace uses your data to:

• Authenticate your identity and maintain workspace security;
• Publish and schedule social media content at your explicit direction;
• Compute engagement analytics, ROAS, and audience growth charts;
• Deliver AI-powered copy drafting, repurposing, and brand voice recommendations;
• Execute automated workflows and customer lead triaging as configured by you;
• Prevent fraud, prompt injection, unauthorized API access, and spam;
• Process subscription renewals and invoices; and
• Provide customer support and technical diagnostics.

KoraSpace employs artificial intelligence to provide content generation, sentiment classification, and campaign optimization. When utilizing our AI features:

• Content prompts and brand context are processed transiently through enterprise API endpoints;
• Your proprietary data is never used to train public third-party foundational models;
• All outgoing prompts pass through automated Zero-Trust Prompt Injection and Safety filters; and
• AI recommendations are assistive tools; you retain final editorial discretion over all published assets.

We process personal data based on the following recognized legal grounds:

• Contractual Necessity: To deliver the services requested when you create an account;
• Consent: Where you explicitly authorize a specific social media integration or feature;
• Legitimate Interests: To detect security threats, improve platform reliability, and prevent abuse; and
• Legal Obligations: To comply with applicable statutory, accounting, and tax reporting mandates.

KoraSpace interfaces with social platforms through their official developer APIs. When connecting channels:

• Authentication is handled strictly via official OAuth protocols (we never see or store your social platform passwords);
• You can revoke API permissions at any moment through KoraSpace or directly within the third-party platform settings; and
• Your use of connected platforms remains subject to each provider's independent Terms and Policies.

When you schedule or publish content through KoraSpace, we transmit the media and text payload directly to the chosen network on your behalf. You remain responsible for ensuring your posts comply with the destination platform's community standards and advertising guidelines.

We do not sell, rent, or trade your personal data. We disclose data solely to:

• Trusted cloud infrastructure and database hosts (e.g. Supabase, Vercel, AWS);
• Payment gateways for secure PCI-compliant transaction processing;
• Enterprise AI model endpoints for real-time generative capabilities; and
• Regulatory or law enforcement agencies when strictly mandated by a valid court order or statutory requirement.

All third-party vendors handling data on our behalf are bound by strict Data Processing Agreements (DPAs) requiring equal or greater technical confidentiality, access controls, and encryption standards.

Where personal data is transferred across international borders, KoraSpace ensures appropriate transfer mechanisms (such as standard contractual clauses and robust encryption) to uphold data protection standards equivalent to those required under the Nigeria Data Protection Act 2023.

We maintain comprehensive technical and organizational safeguards:

• End-to-end encryption in transit (TLS 1.3) and AES-256 encryption at rest;
• Strict Row-Level Security (RLS) enforcing multi-tenant isolation across all databases;
• Automated rate limiting and SOC threat event auditing; and
• Role-based least-privilege administrative access with mandatory two-factor authentication.

Social media access tokens are stored in secure vault storage and utilized solely for scheduled actions requested by the user. Expired or revoked tokens are immediately purged upon disconnection.

We retain your personal data for as long as your account remains active. If you deactivate or delete your account, associated operational data is purged from active databases within 30 days, except where retention is legally required for financial audits or fraud investigation.

You may permanently delete your KoraSpace account at any time via Settings > Account > Delete Account or by contacting privacy@koraspace.com. Upon confirmation, all personal profiles, stored social tokens, media assets, and historical analytics are irrevocably erased.

Under the NDPA 2023 and applicable privacy regulations, you have the right to:

• Access and receive a copy of your personal data;
• Rectify inaccurate or outdated account information;
• Request complete erasure of your personal data;
• Object to or restrict specific automated processing;
• Export your content and analytics in standard machine-readable formats; and
• Withdraw previously granted consent at any time without penalty.

KoraSpace is strictly intended for professional creators, businesses, and individuals who have attained the legal age of majority in their jurisdiction. We do not knowingly collect personal information from individuals under 18 years of age.

You may opt out of non-essential product announcement emails at any time using the "Unsubscribe" link in our emails. Critical transactional emails (e.g. password resets, security alerts, billing receipts) will still be delivered.

We use essential cookies strictly required for authentication, security validation, and session integrity. We do not use third-party cross-site behavioral tracking cookies.

KoraSpace may provide links to external partner tools. We are not responsible for the privacy practices of external platforms, and we encourage you to review their independent privacy statements.

We may update this Privacy Policy periodically to reflect technological advances or legal updates. Material updates will be communicated via in-app broadcast or email prior to taking effect.

For any privacy inquiries, data subject access requests, or regulatory questions, please contact our Data Protection Officer: