Privacy policy

You sign in with your email and a one-time code. You can also add a password or a passkey. We keep your email address and your sign-in details.

You then add your companies' details and numbers: company number, UTR, VAT and PAYE references, authentication code and any bank details you choose to add. You can also add deadlines and upload files.

When you add a company, Kofolio fetches its public record from Companies House. That includes officers and people with significant control: name, month and year of birth, nationality and service address. This is public register data, published under the Open Government Licence. If it is wrong, ask Companies House to correct it.

If you add other people's details, for example a director's full date of birth, make sure you have the right to.

People you invite to a workspace can see that workspace's companies.

A copy of your cards is kept in your browser so the app opens quickly. It is cleared when you sign out.

• To run your account and show you your companies, deadlines and files. Basis: contract, because you asked for the service.
• To show the public Companies House record of the companies you add. Basis: legitimate interests.
• To count visits and, if you allow it, to see how the app is used. Basis: legitimate interests for the page count, and your consent for full analytics.

We do not sell your data.

Our servers in the European Union hold your account data. Cloudflare stores the files you upload.

• Cloudflare also carries our web traffic.
• Resend sends our emails, such as your sign-in code.
• Anthropic, OpenAI and Amazon Bedrock read your documents with AI when you use a feature that does so, depending on routing.
• PostHog provides analytics from its EU region. Until you choose, we count page views and record errors when a page breaks. Nothing is stored on your device. PostHog sees your IP address to work out your country and does not keep it on the event. If you press Allow, PostHog also uses a cookie and browser storage, a session replay with the text you type masked, and error reports. This is not linked to your account or email. If you say no, analytics is switched off completely.

Some of these providers are based outside the UK. Where data leaves the UK it is protected by UK-approved safeguards.

When you use a feature that reads a document with AI, such as the vault, that document is sent to an AI provider to be read: Anthropic, OpenAI (ChatGPT) or Amazon Bedrock, depending on routing.

If you connect your own AI assistant, you approve it on a consent screen and can remove it at any time; its provider's terms then apply to what it sees.

We keep your data while your account is active. When you delete your account, we delete or anonymise your data, except where the law requires us to keep it.

Analytics data is kept only as long as we need it for these purposes, then deleted.

Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or stop our use of it, or move it to another service. Where we rely on your consent, you can withdraw it at any time. Email us and we will reply within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

See the cookie page.

We will update the date above when this page changes.