Privacy Policy — Koren
Last updated:
This Privacy Policy describes how Koren AI (Brazilian Tax ID 68.696.613/001-49) processes personal data collected through Koren, in compliance with the Brazilian General Data Protection Law (Law 13.709/2018 — LGPD). By using our services, you agree to the practices described below.
1. Who we are
Data controller: Koren AI, registered under Brazilian Tax ID (CNPJ) 68.696.613/001-49.
Contact channel for questions, requests, and exercising personal-data rights: contato@korenonline.com.
2. What data we collect
To operate the platform, we collect the following categories of data:
- Account data: name, email, phone (optional), and password (stored only as a cryptographic hash).
- Session data: IP address, browser user-agent, device identifiers, and access timestamps, used for security and fraud prevention.
- Two-factor authentication: encrypted TOTP secret and backup codes, when enabled.
- AI content: briefs submitted to Mike and Jess, conversations with the Koren Assistant, and the resulting outputs.
- Plans: marketing plans you create and associated metadata.
- Public leads (landing-page capture form): business description provided, user-agent and language — no account required.
- OAuth integrations: encrypted access tokens and Meta ad account identifiers when you connect your account.
- Historical data from the discontinued Instagram integration: professional profile identifier and username, encrypted OAuth token, captions, and records of posts previously requested.
- Telegram integration: account and chat identifiers, username, display name, and messages sent to the Koren Assistant when you connect the bot.
- Biometric data (optional), only if you create the video clone: reference video, face images, voice samples and the videos generated with your clone.
3. Why we use your data
We process your data for the following specific purposes:
- Authenticate you and keep your session secure.
- Generate marketing plans, visual identity, and strategies and answer questions about workspace data through artificial intelligence.
- Send transactional emails (account verification, password reset, 2FA codes).
- Prevent abuse, fraud, and violations of the Terms of Service.
- Improve our services through aggregated, anonymized analytics.
- Comply with legal and regulatory obligations.
4. Legal basis (LGPD Art. 7)
We process your data based on the following legal grounds:
- Contract performance: to provide the features you have signed up for.
- Compliance with legal or regulatory obligations.
- Legitimate interest: for security, fraud prevention, and service improvement, while respecting your fundamental rights.
- Consent: for non-essential processing such as preference cookies and AI processing — revocable at any time.
- Specific and prominent consent (Art. 11, I): for processing biometric data (face and voice) in the video clone.
6. Data location
The platform’s primary data is stored on a server located in Brazil (Hostinger Brazil VPS). Only specific operations involve foreign subprocessors, as listed in the previous section.
7. International data transfer
Some of our operators are located outside Brazil. When international transfer occurs, we ensure recipients adopt protection standards equivalent to those required by LGPD, through specific contractual clauses, in accordance with Article 33 of the Law.
8. Automated decisions and artificial intelligence
Our agents (Mike and Jess) and the Koren Assistant use OpenAI language models. To answer, the assistant may process conversation history and workspace data, including connected Meta Ads metrics. When a question asks for or depends on public information, the query may be sent to OpenAI web search. When the Telegram channel is enabled, messages also pass through Telegram infrastructure. Outputs are produced probabilistically and may contain inaccuracies.
Under LGPD Art. 20, you have the right to request human review of any decision made solely on automated processing that affects your interests. Requests can be made through our privacy contact channel.
9. Biometric data: face and voice clone
If you choose to create your video clone, we will process images of your face and samples of your voice. This is biometric data, considered sensitive personal data (LGPD Art. 5, II and Art. 11). This processing only takes place with your specific and prominent consent (Art. 11, I), recorded when you create the clone and distinct from your acceptance of the Terms and this Policy. Creating the clone is optional: the rest of Koren works without it.
- Sole purpose: to create your avatar and synthetic voice and to generate the videos you request. We do not use this material to train our own models or for any other purpose, and only you can generate videos with your clone.
- Processors: HeyGen (avatar creation and video rendering) and ElevenLabs (synthetic voice creation), both headquartered outside Brazil, which constitutes an international data transfer (Art. 33).
- Identity verification: to protect you, our video partner requires you to record, live on camera, a statement authorizing the use of your likeness.
- Retention: the reference video and audio files uploaded to train the clone are deleted from our servers as soon as the clone is ready. The clone (kept at our processors) and the generated videos remain while you keep your consent and your account active, so you can create new videos.
- Revocation and deletion: you can revoke consent at any time in “My clone”. When you revoke, leave the workspace, or delete the workspace or the account, we delete your clone, videos and files here and at our processors; if a processor is temporarily unavailable, the deletion is retried until it completes.
10. How long we keep your data
We keep your data for as long as needed to fulfill the purposes described in this Policy, while your account remains active. After account deletion, we may retain certain records (such as access logs) for up to 6 months, as required by the Brazilian Internet Framework (Law 12.965/2014, Art. 15).
Data processed for compliance with legal obligations may be kept for the periods specified by law.
11. Your rights as a data subject
You can exercise the following rights granted by LGPD Art. 18 at any time:
- Confirmation of processing and access to your data.
- Correction of incomplete, inaccurate, or outdated data.
- Anonymization, blocking, or deletion of unnecessary data or data processed in violation of the Law.
- Data portability to another service provider.
- Deletion of personal data processed based on consent.
- Information about public and private entities with which we share your data.
- Revocation of consent, when applicable.
12. Information security
We adopt technical and administrative measures to protect your data, including: session cookies with HttpOnly flag, password hashing, optional two-factor authentication, rate limiting on sensitive endpoints, encryption in transit (TLS), and encryption of third-party OAuth tokens.
14. Children and adolescents
Koren is intended for users aged 18 or older for professional use. We do not knowingly collect data from minors. If you become aware of improper processing, contact us through our privacy channel.
15. Changes to this Policy
This Policy may be updated periodically. The last update date is shown at the top of this page. Material changes will be communicated in advance by email to registered users.
The current version of this policy is v4, dated 2026-10-22.
16. Contact
Contact channel for questions, requests, and exercising personal-data rights: contato@korenonline.com.