Privacy Policy

We collect the following categories of information:

• Account information — your name, email address, profile photo, and a password. We store the password only as a one-way hash, so we can't read it. If you sign in with Google, we receive your name, email address, and a Google account identifier instead of a password.
• Workspace content — what you and your team create in Kokar (tasks, docs, chat, files…). This content belongs to your organization. We store and process it only to run the Service for you; we don't read it, sell it, or use it to train AI models, except when you ask us to (e.g. a support request) or the law requires it.
• Attendance and location data — only if your organization uses Attendance. When you clock in or out, we record the time, your device's location at that moment, how far you were from your office, and whether the location appears to be simulated. If your organization requires a registered phone, we also record which phone was used and whether you confirmed it with your phone's biometrics or passcode. Location is read only when you clock in or out, never in the background. Biometric checks happen on your phone: we never receive your biometric data.
• Form responses — when someone fills out a public form that a workspace has published, with or without a Kokar account, we store their answers (which may include their name, email address and anything else the form asks for) on behalf of that workspace.
• Payment information — when you subscribe to a paid plan or buy AI credits, our third-party payment processor collects your payment details directly. We only receive confirmation of payment and basic transaction metadata, not your full card or account number. We use the country your connection comes from (derived from your IP address) to set your price, and we keep that country with the payment record.
• Usage & device data — IP address, browser type, device type, operating system, pages/features used, and similar diagnostic and log data, collected automatically when you use the Service. If you turn on notifications, we also store a push-notification token for your device or browser.
• Activity records — workspaces keep an audit log of important actions (for example, who changed a permission or deleted an item, and when), which workspace admins can view.
• Communications — if you contact support@kokar.krd, we keep a record of that conversation so we can help you and follow up.

We use the information we collect to:

• Provide, operate, and maintain the Service (e.g. keeping your tasks, docs, and chats in sync in real time).
• Run the features you or your organization choose to use — for example, AI features (see §4), checking attendance clock-ins against your organization's office locations, and sending notifications.
• Create and secure your account, and authenticate you (including via third-party sign-in).
• Process payments and manage your subscription.
• Send you service-related communications — account notifications, security alerts, billing reminders, and replies to support requests.
• Understand how the Service is used so we can fix problems and improve it (see §3, Analytics).
• Detect, investigate, and prevent fraud, abuse, spam, and security incidents — including checking that public form submissions come from a real person.
• Comply with our legal obligations.

We use essential cookies to keep you signed in and to remember basic preferences (like your theme or language). These can't be switched off without breaking core functionality of the Service.

We use a third-party product-analytics tool to understand how people find and use Kokar — for example, which pages and features are used and how often — so we can improve it. It sets a cookie and uses your browser's local storage to recognise your browser, on both our website and the app.

Once you sign in, this usage is linked to your account, and we share your name and email address with the analytics provider for that purpose. If you visited our website before signing up, that earlier visit (for example, the link or campaign that brought you to us) is linked to your account too.

We don't record your screen or sessions, and we don't collect what you type or create in your workspace. We don't use analytics to sell your data or to show you ads — Kokar has no advertising.

You can control cookies through your browser settings. Blocking essential cookies will likely prevent you from signing in or using parts of the Service.

We do not sell your personal data. We share information only with the service providers we rely on to run Kokar, and only to the extent needed for them to perform their function for us:

• Infrastructure providers — host the application, store your workspace data, and store and deliver your uploaded files.
• An authentication provider — used if you choose a third-party sign-in option.
• AI model providers — when you use an AI feature, your request and the content needed to answer it (for example, the doc or tasks you asked about) are sent through our AI gateway to the provider of the model being used. They process it only to return a result, and under the business API terms we use, they do not use it to train their models. If you don't use AI features, nothing is sent to them.
• A calls provider — powers audio/video calls; call metadata and media pass through their infrastructure while a call is active.
• A payment processor — processes payments for paid subscriptions and AI credits.
• A product-analytics provider (see §3).
• Email and push-notification providers — deliver transactional emails (verification, notifications, reminders) and notifications to your phone or browser.
• A bot-protection provider — checks that public form submissions come from a real person.
• Apps you connect — if you connect an AI assistant or another app to your Kokar account (for example through our MCP connector), that app can read and change what your account can, as you authorize it. You can disconnect it at any time.
• Authorities — when the law requires it, or when it's necessary to protect the rights, property, or safety of our users, the public, or Kokar.

Your organization controls its workspace, including who is invited, what roles they have, and what they can see. Depending on those settings:

• The workspace owner can access all content in the workspace, including items marked private — except private chats and direct messages, which only their participants can read.
• Workspace admins, and anyone your organization makes an approver, can see members' attendance records, tracked time, and time-off requests, and admins can view the workspace audit log.
• Other members see what the workspace's sharing and permission settings allow them to see.
• If you leave a workspace or are removed from it, the content you created there stays with the organization.

Some of the service providers listed above operate infrastructure outside Iraq. This means your information may be processed on servers located in other countries, which may have different data protection standards than the Kurdistan Region/Iraq. Where that happens, we choose providers that maintain appropriate security and confidentiality commitments, and we only share what's needed for them to provide their service to us.

We keep your account and workspace data for as long as your account or organization is active, so the Service keeps working the way you expect. Attendance records, tracked time, and audit logs are kept for as long as the workspace exists, because organizations rely on them for payroll and record-keeping. A workspace can choose how long its form responses are kept.

Items deleted inside a workspace go to its Trash first, where they can be restored until someone deletes them permanently.

If a paid subscription ends without renewal, the workspace is locked after the grace period (see §4.2 of our Terms of Service). A locked workspace is not deleted: your data is kept as-is, and full access returns as soon as the organization renews.

When you delete your account, or a workspace owner deletes a workspace, the deletion is scheduled with a 30-day window during which it can be cancelled. After that, we permanently delete the data, except where we're required to keep it for legal, security, or accounting reasons. Deleted data may remain in routine backups for a limited time before it's overwritten. You can also ask us to delete your data at support@kokar.krd.

Wherever you're located, you can ask us to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your personal data (subject to the retention exceptions in §7). You can delete your account yourself from your account settings.
• Export a copy of your data.
• Withdraw consent, where we rely on consent (e.g. location access or notifications, which you can also turn off in your device settings), without affecting the lawfulness of processing before withdrawal.
• Where your request concerns content inside a workspace that another organization controls, we may refer you to that organization, since it decides how that content is used.

We use reasonable technical and organizational measures — such as encryption in transit and at rest, access controls, and relying on reputable infrastructure providers — to protect your information. No method of transmission or storage is 100% secure, so we can't guarantee absolute security, but we work to keep your data safe and will notify affected users if we become aware of a breach that puts their data at risk.

The Service is not directed at, and may not be used by, anyone under 16 years old. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact support@kokar.krd and we will delete it.

We may update this Privacy Policy from time to time, for example when we add features. If we make material changes, we'll update the effective date above and, where appropriate, notify you (by email or a notice inside the Service) before the change takes effect.

If you have any questions about this Privacy Policy or how we handle your data, contact us at support@kokar.krd.