Privacy Policy

Data we collect

We collect the following categories of personal data:

• Account information — name, email address, and password when you create an account, or profile data from Google if you sign in with Google OAuth.
• Uploaded content — product images and reference photos you upload for AI generation.
• Generated content — images and videos produced by the AI based on your inputs.
• Usage data — pages visited, features used, generation history, and credit transactions.
• Device and technical data — browser type, operating system, IP address, and cookies (see our Cookie Policy).
• Billing data — subscription plan and payment history. Payment details are processed by our billing provider and are not stored on our servers.
• Store integration data — when you connect a Shopify or WooCommerce store, we access and store your store URL, shop name, and product catalog data (titles, descriptions, and existing product images) to enable the integration. For Shopify, we also store an OAuth access token to maintain the connection. For WooCommerce, we store the API credentials (consumer key and secret) you provide.

How we use your data

• Provide the service — process your uploads, generate images and videos, manage your projects and credit balance.
• AI generation — your uploaded images and prompts are sent to third-party AI providers to generate content. We do not use your content to train AI models.
• Improve the service — analyse aggregated usage patterns to improve features and performance.
• Communicate with you — send transactional emails (e.g. email verification, password reset) and, if opted in, product updates.
• Prevent abuse — detect and prevent fraud, spam, and violations of our Terms of Service.

Third-party services

We share data only as necessary to operate the service:

• Google AI (Gemini, Veo) — image and video generation from your prompts and reference images.
• OpenAI — prompt enhancement and image analysis.
• Amazon Web Services (S3, CloudFront) — secure storage and delivery of uploaded and generated content.
• Polar — subscription billing and payment processing. We do not store payment card details on our servers.
• Shopify — when you install the Korall Shopify app, your store grants Korall read access to your product catalog. Shopify processes this data under their own privacy policy. We receive and store an OAuth access token to maintain the connection and sync products on your behalf.
• WooCommerce — when you connect a WooCommerce store, we use the REST API credentials you provide to read your product catalog. These credentials are stored encrypted and used only to fetch product data into Korall.
• Analytics providers — aggregated usage analytics to improve the service.
• Legal compliance — we may disclose data if required by law or to protect the rights, safety, and security of our users or the platform.

Shopify & WooCommerce integrations

When you connect a third-party store, the following applies:

• What we access — we read your product catalog (names, descriptions, and images) to let you import products into Korall projects. We do not read customer orders, customer personal data, or payment information from your store.
• Shopify GDPR — the Korall Shopify app supports Shopify's mandatory GDPR webhooks. Upon receiving a customer data request or erasure webhook from Shopify, we process the request and remove any associated data within the required timeframe. When a store uninstalls the app, we delete the OAuth access token and cease syncing data for that store.
• Disconnecting — you can disconnect your store at any time from the Korall settings page. When you disconnect, we revoke the stored credentials and stop syncing. Product data already imported into your Korall projects is retained until you delete it manually or close your account.
• Published images — when you publish a Korall-generated image back to your Shopify store, we record the publish event (image ID, product ID, and status) to let you manage published assets from within Korall.

Data retention

We retain your account data and generated content for as long as your account is active. Uploaded reference images are stored until you delete them or your account is closed. Usage logs and analytics data are retained in aggregated form.

When you delete your account, we will remove your personal data within 30 days, except where retention is required by law.

Your rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your personal data.
• Export — receive your data in a portable format.
• Objection — object to certain processing of your data.

To exercise any of these rights, contact us at the address below.

Data security

We implement industry-standard security measures including encryption in transit (TLS), secure cloud infrastructure, and access controls to protect your data. However, no method of transmission or storage is completely secure.

International transfers

Your data is primarily stored on servers located in Sweden. However, some of our third-party service providers (such as AI generation and cloud infrastructure providers) may process data in other regions, including the United States. Where applicable, we rely on appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

Children's privacy

Korall is not intended for users under the age of 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

Updates to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page.

Contact

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at hey@korall.ai.