Legal

Privacy Policy

Effective 27 May 2026

01 What we collect02 How we use it03 Storage04 Sub-processors05 Cookies06 Your rights07 Retention08 Children09 International10 Changes11 Contact

This Privacy Policy explains how NIMUGIRE Business Ltd (Kigali, Rwanda), operator of the KoraStudio platform (“KoraStudio”, “we”, “us”), collects, uses, stores, and shares personal data when you visit korastudio.rw, create an account, or use any KoraStudio service (the “Service”).

We operate primarily under the Rwandan Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy. Where we serve customers in the European Economic Area, we apply equivalent safeguards inspired by the EU General Data Protection Regulation (GDPR), including a clear lawful basis for every processing activity, data-subject rights, and processor agreements with our sub-processors.

Section 01

Information We Collect

TL;DRAccount info you give us, usage data we collect automatically, and minimal data from third-party integrations.
✍️
What you give us
Account data
name, email, password hash, phone
Studio data
name, logo, branding, plan, billing
Client data
your clients' contacts, files, invoices
Support data
messages via contact form or email
⚡
Auto-collected
Usage data
pages visited, features used, timestamps
Device data
IP address, browser, OS, screen size
Cookies
session, CSRF, preference (see §5)
Error logs
what breaks so we can fix it
🔗
From third parties
Social sign-in
name, email, avatar from Google etc.
Payment hooks
Paypack webhooks: status, amount, ref

Social sign-in

If you sign in with a social provider (Google, etc.), we receive your name, email, and avatar URL as authorised by you. If a Paypack payment succeeds or fails, we receive a webhook with the transaction status.

Section 02

How We Use Your Information

TL;DRTo run the platform, process payments, communicate with you, improve the product, keep it secure, and comply with Rwandan law.
  • ✦To operate the Service: authenticate you, render your dashboard, deliver client portals, store files, run AI features.
  • ✦To process payments: initiate mobile-money charges, record invoices, send receipts.
  • ✦To communicate with you: transactional notifications, security alerts, replies to your support requests.
  • ✦To improve the Service: aggregated, de-identified analytics that help us understand what features are useful.
  • ✦To keep the Service secure: detect abuse, prevent fraud, enforce our Terms of Service.
  • ✦To comply with law: respond to lawful requests from Rwandan authorities and meet our regulatory obligations.
Our commitment

We do not sell your personal data, and we do not use Customer Content to train third-party AI models. AI features process content on a per-request basis through providers bound by confidentiality and data-retention controls.

Section 03

Data Storage & Hosting

TL;DRSupabase for your database, Vercel for app hosting, Cloudflare R2 for files. Everything encrypted at rest and in transit.

We use trusted infrastructure providers to operate KoraStudio. Data may be stored in regions outside Rwanda; where this happens we rely on the provider's certifications (ISO 27001, SOC 2 Type II) and contractual safeguards.

  • ✦Supabase: primary database and authentication. Data is hosted in a Supabase project we control.
  • ✦Vercel: application hosting and edge delivery for the web app.
  • ✦Cloudflare R2: file storage for deliverables, portfolio media, and invoice PDFs you upload.

Backups are encrypted at rest and retained for up to 30 days. Network traffic between you and KoraStudio is encrypted in transit (HTTPS/TLS 1.2+).

Section 04

Third-Party Services (Sub-processors)

TL;DRWe share minimum necessary data with 8 carefully selected providers. Each is bound by a data-processing agreement.

We share the minimum necessary data with carefully selected sub-processors to deliver specific features. Each is bound by a data-processing agreement and obligated to handle data on our behalf. Payment processors (Paypack and Stripe) are also subject to their own privacy policies.

Paypack
Mobile-money payments (MTN, Airtel)
Receives: Phone number, amount, reference
Stripe
Card payments (VISA, Mastercard)
Receives: Payment amount, reference, billing country
Africa's Talking
SMS delivery
Receives: Phone number, message body
Resend
Transactional email
Receives: Email address, email content
Cloudflare R2
File storage
Receives: Uploaded files (encrypted)
Supabase
Database & authentication
Receives: All platform data (encrypted)
Vercel
App hosting & edge delivery
Receives: Request metadata, IP
AI Providers
AI cowork, captions, website gen
Receives: Per-request prompt content only

We may add or change sub-processors as the platform evolves. Material changes will be reflected in this Policy with a revised effective date.

Section 05

Cookies & Similar Technologies

TL;DROnly strictly necessary cookies. No third-party tracking, no advertising cookies.

We use a minimal set of cookies, all of them strictly necessary or first-party:

  • ✦Session cookies: keep you signed in; expire when you log out or after inactivity.
  • ✦CSRF tokens: protect against cross-site request forgery on forms and mutations.
  • ✦Preference cookies: remember UI settings (e.g. theme, last-used studio).

We do not use third-party advertising or cross-site tracking cookies. You can block cookies in your browser, but doing so may break sign-in and other essential features.

Section 06

Your Rights

TL;DRAccess, correct, delete, restrict, port, object, or withdraw consent. Email us within 30 days for a response.

Subject to applicable law, you have the right to:

📋
Access
Request a copy of the personal data we hold about you.
✏️
Rectification
Correct inaccurate or incomplete data at any time.
🗑️
Erasure
Ask us to delete your account and personal data.
⏸️
Restriction
Limit how we process your data while a question is resolved.
📦
Portability
Receive your data in a structured, machine-readable format.
🚫
Objection
Object to specific processing activities, including marketing.
↩️
Withdraw consent
Withdraw consent at any time without affecting prior processing.

To exercise any of these rights, contact hello@korastudio.rw. We will respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with the National Cyber Security Authority (NCSA) of Rwanda or with your local data-protection authority.

Section 07

Data Retention

TL;DRAccount data kept while active + 30 days. Billing records 10 years (tax law). Logs 90 days. Backups 30 days.
  • ✦Account & studio data: retained for as long as your account is active, and for 30 days after termination to allow recovery and export.
  • ✦Customer Content (files, projects, invoices): retained for the lifetime of the account; deleted on request or 30 days after account closure.
  • ✦Billing records: retained for up to 10 years as required by Rwandan tax law.
  • ✦Server logs: retained for up to 90 days for security and debugging.
  • ✦Backups: rotated and overwritten within 30 days.
Section 08

Children

TL;DRKoraStudio is not for children under 16. We delete such data immediately if reported.

KoraStudio is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

Section 09

International Transfers

TL;DRSome providers process data outside Rwanda. We rely on their certifications and contractual safeguards.

Some sub-processors (notably Vercel, Cloudflare, Resend, and AI providers) process data outside Rwanda. We rely on the recipient's appropriate safeguards (certifications, contractual clauses) to ensure your data remains protected.

Section 10

Changes to This Policy

TL;DRWe announce material changes 14 days in advance via dashboard banner or email.

We may update this Privacy Policy as the Service evolves. The effective date at the top of this page reflects the most recent revision. Material changes will be announced via dashboard banner or email at least 14 days before they take effect.

Section 11

Contact

TL;DRQuestions about your data? Email hello@korastudio.rw or use the contact form.

NIMUGIRE Business Ltd
Operator of KoraStudio · Data Controller
Kigali, Rwanda
Email: hello@korastudio.rw
Contact form: korastudio.rw/contact

See also our Terms of Service.

Get started free