Koraslide Privacy Policy

1. Introduction

Welcome to Koraslide ("we", "us", or "our"). Koraslide is a visual social media content studio and automated scheduling platform designed to help creators, brands, and agencies craft high-impact carousel posts, generate AI-assisted copy and artwork, and schedule publications across major social networks.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website at koraslide.com, access our web application, or connect your social media accounts. By using Koraslide, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect several types of information to provide and improve our service:

• Account Information: When you sign up via email or OAuth (Google, LinkedIn, X), we collect your name, email address, profile image, and account password hash (if registering with email/password).
• Connected Social Network Accounts: When you authorize Koraslide to post on your behalf (LinkedIn, X, Facebook Pages, Instagram Professional Accounts), we collect your platform account profile ID, handle, name, and access/refresh tokens.
• Projects, Drafts & Brand Kits: We store the post carousels, slide content, custom brand voice descriptions, uploaded image assets, and scheduled publication intents created in your account.
• Billing & Subscription Data: Payment details, credit card numbers, and billing addresses are processed directly by our Merchant of Record, Lemon Squeezy. Koraslide only stores subscription plan IDs, status, and renewal dates.
• Technical & Usage Data: IP address, browser type, operating system, time zone, rate-limiting timestamps, and server request logs for security and performance optimization.

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Provision: Enabling post editing, carousel slide generation, client approval links, scheduling, and automatic publishing to connected platforms.
• AI Content Generation: Processing your text prompts, topic briefs, or repurposed links (YouTube transcripts, PDFs) to generate post copy and artwork via AI model providers.
• Analytics & Performance Insights: Measuring post performance metrics (impressions, likes, comments, engagement rate) from connected Instagram and Facebook accounts to provide personalized brand recommendations.
• Communication: Sending essential transactional emails (account verification, password resets, client approval updates, and optional weekly performance digests).
• Security & Abuse Prevention: Enforcing API rate limits, detecting unauthorized logins, and preventing fraudulent or malicious activities.

4. AI Providers & Data Processing

Koraslide integrates with leading artificial intelligence model providers—including OpenAI, Anthropic, and Google Gemini—to deliver automated post copy and background-free image generation.

• Prompts and topic inputs sent to AI providers are used strictly to generate your post outputs.
• Your private brand voice guidelines, drafts, and uploaded media are never used to train public foundation models.
• Repurposed content (e.g., YouTube transcripts or uploaded PDF whitepapers) is processed in-memory solely for draft summarization.

5. Third-Party Platform Integration & API Compliance

Koraslide complies with the developer policies and privacy guidelines of all supported social platforms:

• Meta (Facebook & Instagram): We access Facebook Pages and Instagram accounts solely to publish scheduled posts and read post insights. Token deletion callbacks and data deletion requests are processed in compliance with Meta Developer Policies. Learn more at our Data Deletion Page.
• LinkedIn: We use official LinkedIn Share APIs to publish post carousels and text commentaries.
• X (Twitter): Access tokens are used exclusively for authorized post publishing and media uploads.

6. Security & Data Protection

We implement robust technical and organizational security measures:

• Token Encryption: All social network access and refresh tokens are encrypted at rest using industry-standard AES-256-GCM encryption.
• Password Protection: Account passwords are hashed using memory-hard scrypt cryptographic algorithms.
• Secure Communications: All web traffic and API endpoints are transmitted over HTTPS encrypted with TLS 1.3.
• Browser Caching: Draft documents are cached locally in your browser using IndexedDB for speed and offline resilience.

7. Data Retention & Your Rights

We retain your personal data for as long as your account remains active or as needed to provide our services. You have the right to:

• Disconnect Connected Accounts: Revoke social media authorization at any time from the Connections page.
• Export Your Data: Download your saved posts, brand assets, and custom template styles.
• Request Account Deletion: Permanently delete your account and associated data by contacting our support team or initiating a deletion request.
• GDPR & CCPA Rights: Users in the EU/UK and California have rights to access, port, restrict processing of, or erase their personal data under applicable laws.

8. Contact Us

If you have questions, concerns, or privacy requests regarding this Privacy Policy or how your data is handled, please contact us: