Privacy notice

Who we are

The controller of your personal data is Koala For Work Ltd, a company registered in England and Wales (company number 16171311), whose registered office is 86-90 Paul Street, London, EC2A 4NE, United Kingdom (“we”, “us”, “our”).

We have applied to register with the Information Commissioner’s Office (ICO) and will add our registration number here once it is issued.

Where an employer or organisation buys Koala for its people under a business agreement, that agreement and our data processing agreement set out each party’s role.

For any question about this notice or your data, email hello@koalaforwork.com.

What we collect

We collect only what we need to run Koala:

• Account details. Your name, email address and sign-in details. If you sign in with Google or Microsoft, they tell us your name and email address.
• What you put into Koala. Your actions, tasks, notes, conversations with Koala, voice input, working preferences such as your hours and working days, and a profile picture if you add one.
• Connected services. Only if you choose to connect them, as described under “Connected services” below.
• Billing data. Your plan and billing history. Card details go straight to Stripe, our payment provider; we never see or store your card number.
• Access codes. If your access comes through a licence, such as a Disabled Students’ Allowance licence or an employer licence, the code you redeem and its dates.
• Website sign-ups. If you join our newsletter, register for an event or use one of our free tools, the details you give us on that form.
• Correspondence and feedback. If you email us or send feedback from inside Koala, your name, email address and what you write.
• Usage data. Which features are used, linked to a random account ID rather than your name or email address, and without recording your IP address. Our website counts visits without cookies.

Sensitive information

Koala does not ask whether you have ADHD or any other condition, and we do not collect health data or other special category data. Koala does not diagnose, screen for or assess any condition.

You may choose to mention personal circumstances in your tasks, notes or conversations. We treat everything you add as private, use it only to run Koala for you, and never share it with an employer or anyone else. We suggest adding only what you need to plan your work.

How we use it and why

We use personal data only for the purposes below, each with a lawful basis under the UK GDPR:

• To provide Koala: create your account, plan your work, run the features you use and take payment. Lawful basis: performance of our contract with you.
• To send service emails, such as sign-in codes, your weekly brief and account messages. You can turn optional emails off with the unsubscribe link in each. Lawful basis: performance of our contract, or our legitimate interests.
• To send our newsletter and event updates, if you sign up. Lawful basis: consent, which you can withdraw at any time.
• To reply to you and act on your feedback. Lawful basis: our legitimate interest in answering enquiries and improving Koala.
• To secure and improve Koala, including preventing abuse, stopping free trials being reused and understanding which features are useful. Lawful basis: our legitimate interest in running a secure, working product.
• To keep financial records and meet other legal duties. Lawful basis: legal obligation.

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment. We do not sell your personal data.

How Koala uses AI

Some Koala features use AI to turn what you give it into plans, suggestions and answers. Only the information a feature needs is sent to our AI provider, and it is used only to produce that result.

Koala does not store or use your data for training. We use it only for what Koala needs to work, and our AI providers do not use it to train their models.

You can always review and change what Koala suggests. Koala does not make decisions about you that have legal or similarly significant effects. AI outputs can contain mistakes and are not professional advice.

Connected services

Every connection is optional and off until you turn it on. Each uses permission you grant through that service’s own sign-in. You can disconnect any of them in Koala’s settings, which deletes the connection details we store. Anything Koala already created from a connected service, such as a task, stays in your account until you delete it.

Calendars (Google Calendar and Outlook Calendar). Koala reads event titles, times and identifiers so it can show your meetings and plan around them. If you turn on calendar sync, Koala adds and removes its own focus blocks on the calendar you choose. Events Koala added stay on your calendar until you remove them.

Email (Gmail and Outlook Mail). Koala has read-only access. It reads recent messages to suggest commitments and briefs, and reads matching messages when you ask it about your email. It cannot send, edit or delete email, and we do not keep a copy of your inbox.

Notes (Notion and Granola). Koala looks up pages and meeting notes when you ask it to or when it checks for commitments. We store the connection, not copies of your pages or notes.

For each of these, only the relevant extracts are sent to our AI provider to produce the result you asked for.

Koala for Claude. This works the other way round: it lets your own Claude account read and update your Koala tasks. What Claude does with that information is covered by your agreement with Anthropic. You can remove the connection from Claude or from Koala at any time.

Google user data. Koala does not sell Google user data, use it for advertising or use it to develop, improve or train non-personalised AI or machine-learning models. Koala For Work’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

We use trusted service providers (processors) who handle personal data only on our instructions and under contracts that require them to keep it secure and confidential. They cover hosting and storage, AI, email, payments and product analytics. Each one, what it does and where, is listed on our subprocessors page.

If your access comes through an employer or a licence, we do not share your tasks, notes, conversations or how you use Koala with them.

We may also disclose personal data where the law requires it, to protect our rights or the safety of others, or to a buyer or successor if our business is sold or reorganised, in which case this notice continues to apply.

International transfers

Your account data is stored in London. Some of our providers, including our AI providers, process data in the United States and other countries outside the UK and the European Economic Area. Where personal data leaves the UK, we make sure it is protected by appropriate safeguards, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the safeguards that apply.

How long we keep it

• Account data: while your account is open.
• When you delete your account: we delete your account, tasks, actions, notes, conversations, profile picture and connection details straight away, and cancel any subscription. Copies in our backups are removed as those backups expire, within 30 days.
• Trial record: we keep a record that your email address has used a free trial, so a trial cannot be restarted.
• AI requests: our AI providers keep request data for up to 30 days to monitor for misuse, then delete it.
• Billing records: six years, as UK tax law requires.
• Correspondence and feedback: as long as needed to deal with it, and for up to two years afterwards.
• Usage data: kept in pseudonymous form, linked only to a random account ID.

How we protect it

We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls on every account’s data, and access limited to the people who need it. We hold Cyber Essentials certification. No system is completely secure, but we work to protect your data and will tell you and the regulator about a personal data breach where the law requires it.

Your data rights

Under data protection law you have the right to:

• ask for a copy of the personal data we hold about you (access);
• have inaccurate or incomplete data corrected (rectification);
• have your data deleted (erasure);
• ask us to limit how we use your data (restriction);
• object to processing based on our legitimate interests, including product analytics (objection);
• receive data you gave us in a portable format (portability);
• withdraw your consent at any time, where we rely on it.

You can update your details and delete your account yourself in Koala’s settings. For anything else, email hello@koalaforwork.com. We will respond within one month, which we may extend by two further months for complex requests, telling you if we do. We usually do not charge, and we may ask for information to confirm your identity first. When you ask for your data, we carry out reasonable and proportionate searches for it.

Complaints

If you are unhappy with how we have handled your data, please tell us first at hello@koalaforwork.com so we can put it right. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113. If you live in the European Economic Area, you may complain to your local supervisory authority.

Cookies and local storage

Our website does not use cookies for analytics or advertising. We count visits in a way that does not set cookies or track you across other sites.

Inside Koala, we use your browser’s local storage for things Koala cannot work without, such as keeping you signed in and remembering your layout and preferences. These are strictly necessary, so they do not need your consent.

We also store a random analytics ID in local storage so we can see which features are used. It is not linked to your name or email address, and you can object to it by emailing us. Clearing your browser data removes all of these.

If this changes, we will update this notice and ask for your consent where PECR requires it.

Children

Koala is for working adults and students in higher education. We do not knowingly collect personal data from children under 16. If you believe a child has given us their data, contact us and we will delete it.

Changes to this notice

We may update this notice from time to time. The date at the top shows when it last changed. If we make significant changes, we will tell account holders by email before they take effect.

Contact us

Koala For Work Ltd, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. Email hello@koalaforwork.com.