Privacy Policy

1. Introduction

Kor AI LLC ("Kor", "we", "us", or "our") is a Wyoming limited liability company that operates Kor (korhq.ai), an influencer-marketing application for marketing agencies and brand teams. Kor uses YouTube API Services. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our service, and how we handle public YouTube data about creators.

2. Data We Collect

We collect the following categories of information:

• Account information — name, email address, and authentication details when you create an account. You may also sign up using Google OAuth ("Sign in with Google"), which provides your name and email address from your Google account.
• Workspace data — contacts, outreach records, replies, proposals, campaigns, files you import, screenshots you upload, and other records you create within your workspace.
• Email data (with your authorization) — limited information about replies to your outreach, accessed through your connected mailbox. See Sections 3 and 4.
• AI connection data — when you connect an AI assistant to Kor: the connection, any personal keys you create, and a record of each request, which we use to apply limits and keep the service secure.
• Payment information — processed securely by Stripe. We do not store credit card numbers on our servers.
• Usage data— a log of the changes made in your workspace (who made each change, and when), and standard server logs kept by our hosting provider.
• Public YouTube data — public information about YouTube channels and videos. See Section 6.

3. How We Access and Use Email Data

Kor accesses a mailbox only if you connect it, with your explicit authorization through Google's OAuth flow. Kor supports Google (Gmail) mailboxes and connects to them over IMAP for the following purposes:

• Reply detection — checking mail that arrives after you connect for replies from addresses in your outreach records or contacts.
• Reply labels — reading a matched reply so AI can suggest a label (see Section 5).
• Account identification — displaying your connected email address in settings and associating the connection with your Kor account.

Kor does not send email, and it does not scan mail that arrived before you connected. Mail from any other sender is ignored, and nothing about it is stored.

You can disconnect a mailbox at any time on Kor's mailbox settings page, which deletes its stored access credentials. You can also revoke Kor's access in your Google Account settings.

4. What Email Data We Store

When you connect a mailbox, the following data is stored in our database:

• Mailbox connection records — the connected address, its status, and its access credentials, encrypted with AES-256-GCM.
• Reply records — for each matched reply: the sender's address and name, the subject, the date, message identifiers, and the reply label. Kor does not store the body of the messages it receives.

This data is stored exclusively to power reply detection and the related records in your workspace. It is not used for any other purpose.

5. AI Processing

Kor uses AI (powered by Anthropic Claude) for some features. The following data may be processed by Anthropic's API:

• Email content— the text of a reply that matched your outreach, to suggest a reply label. Where draft replies are enabled for your workspace, the messages in a conversation, to draft a suggested reply for you to review.
• Imported files— the column headers and up to 20 sample rows of a file you import, to propose a column mapping.
• Audience screenshots — images you upload, to read the audience figures they show.
• Workspace records — when an AI agent in your workspace prepares a suggestion, such as a creator shortlist for a brand brief, the relevant records (for example creator names, niches, regions, statistics, and rates) are included as context.

Anthropic does not use data sent via their API for model training. See Anthropic's privacy policy for details.

Your own AI assistant. When the AI connection is enabled for your account and you connect your own AI assistant (for example Claude or ChatGPT), the answers Kor sends to it are processed by that assistant's provider under your own agreement with that provider. Kor does not control how that provider stores or uses them.

5a. Sponsorship Lookup Data

Kor's sponsorship lookups show which brands a creator has worked with, and which creators a brand has worked with. They are built only from public YouTube data (see Section 6). The same lookup data is shown to every subscriber. It is not built from any workspace's data.

Your workspace data (contacts, outreach records, replies, rates, notes, proposals, and email data) is never shared across workspaces and remains exclusively accessible to your workspace members.

6. YouTube Data API

Kor uses YouTube API Services. Kor reads public channel and video data through the YouTube Data API (channels.list, playlistItems.list, videos.list, and search.list) with an API key only. We do not use YouTube OAuth, we never access private or user-authorized data, and we never download audiovisual content.

What we read and why:Kor reads public channel and video information, such as channel names, video titles, publish dates, video descriptions, and public statistics such as subscriber and view counts. When Kor reads a new public video, it checks the description for commercial wording (an affiliate link, a discount code, or a disclosure such as "sponsored by") next to a linked brand website, and records the result: the video, the brand, the date, and which of those markers matched.

Retention: Description text is deleted within one day of retrieval. Channel and video data we keep is refreshed or deleted within 30 days, and data YouTube no longer returns is cleared.

Calculated metrics:Figures Kor calculates itself, such as sponsored videos per creator, creators per brand, and a brand's activity by month, are labeled "Kor calculated". These metrics are not related to YouTube and have been derived by the API client. The official YouTube icon, linked back to YouTube, sits next to YouTube data in Kor.

Sharing: YouTube data is shown to signed-in Kor users. When the AI connection is enabled for an account, it is also included in answers sent to the AI assistant that account connects. Answers never include video descriptions.

Your use of Kor's YouTube-related features is subject to the Google Privacy Policy and the YouTube Terms of Service.

6a. Creator Removal Requests

If you are a YouTube creator, you can ask us to remove your channel from Kor's sponsorship findings. Email support@korhq.ai with a link to your channel. Removals take effect when the lookup data is next rebuilt, and always within 7 calendar days of your request.

7. Google API Services — Limited Use Disclosure

Kor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google API data for the purposes described in this policy.
• We do not use Google API data to serve advertisements.
• We do not sell Google API data to third parties.
• We do not use Google API data for any purpose other than providing and improving the stated features of the Kor platform.
• Human access to Google API data is limited to what is necessary for debugging, security, and legal compliance, and only by authorized personnel.

8. Data Retention

Workspace data, including email data, is retained for as long as your account is active. Disconnecting a mailbox deletes its stored access credentials. Reply records already saved remain part of your workspace data.

YouTube data is handled as described in Section 6: description text is deleted within one day of retrieval, channel and video data we keep is refreshed or deleted within 30 days, and data YouTube no longer returns is cleared.

You may request deletion of your account and data at any time by contacting us at support@korhq.ai. We delete your stored data within 7 calendar days of your request. Payment records held by Stripe are kept under Stripe's own retention rules.

9. Cookies

Kor uses essential cookies to maintain your authentication session. We do not use advertising or tracking cookies, and we do not allow third parties to serve advertisements or other content in Kor.

10. Third-Party Services

We use the following third-party services:

• Stripe— payment processing.
• Neon— PostgreSQL database hosting.
• Vercel— application hosting and deployment.
• Google— YouTube Data API for public channel and video data; Google OAuth for account signup ("Sign in with Google"); and Google OAuth for connecting a Gmail mailbox (when selected by user), which uses a separate OAuth client from signup. Subject to the Google Privacy Policy.
• Anthropic— the AI features described in Section 5. Anthropic does not use API data for model training.
• Your AI assistant's provider — when you connect your own AI assistant, its provider receives the answers your assistant requests from Kor (see Section 5).

Each service processes data in accordance with their own privacy policies. We only share the minimum data necessary for each service to function.

11. Data Security

We implement industry-standard security measures including encrypted data transmission (TLS), encrypted data at rest, AES-GCM encryption for sensitive stored values, and workspace-scoped data isolation to ensure your data is never accessible to other users.

12. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data, which we complete within 7 calendar days.
• Revoke email access at any time.
• Disconnect AI assistants and revoke personal keys.
• Export your workspace data.
• If you are a YouTube creator, ask us to remove your channel from Kor's sponsorship findings (see Section 6a).

To exercise any of these rights, contact us at support@korhq.ai.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date. Continued use of the service after changes constitutes acceptance of the updated policy.

14. Contact

If you have questions about this Privacy Policy or our data practices, contact us at:

Kor AI LLC
Email: support@korhq.ai