Privacy Policy

This Privacy Policy explains how kōdo ("kōdo," "we," "us," or "our") collects, uses, shares, and protects information when you use the kōdo platform, our website at gokodo.io, and related services (the "Service"). It should be read together with our Terms of Service.

1Our roles

We handle personal information in two capacities:

• As a controller for information about our own users and visitors — for example, your account details, billing information, and how you use the Service.
• As a processor for the contact and CRM information that our users (Arena Owners and their teams) enter about their own leads, contacts, and members. That information is controlled by the user who entered it; we process it on their behalf to provide the Service. If you are such a contact and want to exercise your rights, please contact the Arena Owner who holds your information; we will support them in responding.

2Information we collect

Information you provide

• Account & profile: name, email address, password (stored hashed by our authentication provider), and profile details you add.
• Billing: subscription plan and payment status. Payments are processed by Stripe; we do not store your full card number — Stripe handles card data directly.
• Customer / CRM data: the leads, contacts, pipeline records, notes, tasks, meetings, documents, and messages you create or import, which may include names, email addresses, phone numbers, companies, addresses, and other details about the people you work with.
• Communications: messages, emails, and support requests you send through or to us.

Information collected automatically

• Usage & device data: log data, approximate location derived from IP, browser and device type, pages viewed, and actions taken, used to operate and secure the Service.
• Local storage: we use browser local storage and similar technologies to keep you signed in and remember preferences (see Cookies & local storage below).

3How we use information

• Provide, maintain, secure, and improve the Service;
• Authenticate you and protect accounts (including MFA and fraud/abuse prevention);
• Process subscriptions, billing, and referral credits;
• Provide AI-assisted features you use;
• Send service, security, and transactional messages, and — where permitted — product updates you can opt out of;
• Provide support and respond to your requests;
• Comply with law and enforce our Terms.

We do not sell your personal information, and we do not use your Customer Data to build advertising profiles.

4AI processing

When you use AI features (such as the kōdo Coach), the content you submit and relevant context may be sent to our AI provider (Anthropic) to generate a response. We use these providers under agreements intended to protect your data, and we do not permit them to use your content to train their general models except as allowed by those agreements. AI output can be inaccurate — please review it before relying on it. Avoid submitting information to AI features that you are not permitted to share.

5Cookies & local storage

We use strictly necessary cookies and browser local storage to run the Service — for example, to keep you signed in, remember your preferences, and secure your session. We keep the use of non-essential tracking to a minimum. You can control cookies through your browser settings, but disabling essential storage may prevent the Service from working.

6How we share information

We share personal information only as needed to run the Service:

• With service providers (subprocessors) who process data on our behalf under contract (see below);
• Within your Arena — Arena Owners and authorized team members may see data submitted within their Arena, according to their configuration;
• For legal reasons — to comply with law, respond to lawful requests, or protect the rights, safety, and security of kōdo, our users, and the public;
• In a business transfer — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

7Service providers

We rely on the following key service providers to operate the Service. Each processes only the data needed for its function:

This list may change as our providers evolve; we will keep it reasonably current. Contact us for the latest details.

8Messaging & SMS data

If you use the Service's email or SMS features, we process the recipient information and message content you provide in order to deliver those messages through our providers. As the sender, you are responsible for having the necessary consent to contact your recipients and for honoring opt-outs, as described in our Terms. Mobile phone numbers and messaging opt-in data collected for one purpose are not shared with third parties for their own marketing.

9Data retention

We retain personal information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. If your subscription is cancelled or lapses, your Arena and Customer Data may be retained for a limited grace period and then archived and eventually deleted (for example, our archive process may remove inactive/cancelled Arena data after a defined window of around 90 days). You can request earlier deletion as described below; some records may be retained where required by law.

10Security

We use technical and organizational measures designed to protect personal information, including encryption in transit, access controls that scope data to the authenticated account, row-level protections in our database, and support for multi-factor authentication. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your data and to respond promptly to incidents.

11Your rights & choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of certain regions (for example, under the EU/UK GDPR or the California CCPA/CPRA) have specific rights, including the right not to be discriminated against for exercising them. To make a request about your own account data, contact support@gokodo.io. We will verify your request and respond as required by law. You can also manage much of your information directly in the Service and unsubscribe from non-essential emails using the link in those messages.

12Data about your contacts

If your information was entered into kōdo by one of our users (for example, because you are a lead, contact, or member in someone's Arena), that user is the controller of your information. Please direct access or deletion requests to them. We will assist our users in responding to such requests and will act on their instructions consistent with our agreements and applicable law.

13International transfers

We and our providers may process and store information in the United States and other countries where our providers operate. Where required, we use appropriate safeguards for cross-border transfers of personal information.

14Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

15Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (for example, by posting the updated policy with a new effective date or notifying you in the Service). Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

16Contact us

If you have questions or requests about this Privacy Policy or your information, contact us at support@gokodo.io.