Privacy Policy

Information we collect

We collect only the information needed to operate Koral and support publishing workflows across connected platforms.

• TikTok: account identifier data, account display metadata, connection status, publishing permissions, and posting result metadata.
• Instagram: business account/page identifiers provided through Meta login, permission scopes, media publishing metadata, and post status records.
• YouTube: channel identifier metadata, OAuth permission scopes, upload/publish status, and related Shorts publishing metadata.
• Clip, caption, review decision, schedule, and operational log data required for content workflow and reliability.

OAuth tokens and account access

When you connect a platform account, OAuth access and refresh tokens are stored encrypted at rest in Supabase and used only to authenticate approved actions on your behalf (for example, account checks and publishing operations). Tokens are deleted immediately when you disconnect an account.

Data retention

• Workflow metadata (such as clip status, scheduling records, and publishing logs) is retained for up to 12 months.
• OAuth tokens are deleted immediately upon account disconnect.

How to revoke access

You can revoke access at any time by disconnecting accounts in your Koral dashboard and/or revoking app permissions directly in your TikTok, Meta (Instagram), or Google/YouTube account settings.

Third-party processors

Koral relies on the following processors:

• Supabase (authentication, database, encrypted storage)
• Vercel (hosting and application delivery)
• TikTok (account connection and publishing APIs)
• Meta (Instagram account connection and publishing APIs)
• Google/YouTube (channel connection and publishing APIs)

Security

We use TLS encryption for data in transit and encryption at rest for stored data, including OAuth credentials and platform metadata.

GDPR and CCPA rights

Depending on your location, you may have rights to access, correct, delete, or export personal data, and to object to or restrict certain processing. To submit a request, emailhello@dancalabs.comwith the subject line "Koral Privacy Request." We verify ownership before processing and respond within 30 days.

Children's privacy

Koral is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Policy updates

If we make material changes to this policy, we will update the effective date and provide notice through the dashboard and/or by email where appropriate.

Contact

For privacy questions, contacthello@dancalabs.com.