Koda holds photographs, video, voices and written memories — some of the most personal data there is. This explains what we hold and what you can ask us to do with it.
Keeper name and email. Guest name and relationship, where a guest chooses to give one. Photographs, video, voice recordings and written memories. Space details such as occasion, date and place. Technical identifiers: device, browser, IP, and basic usage events.
To run your Memory Space, to show the Story to the people it belongs to, to take payment, to prevent abuse, and to support you. Analytics and marketing measurement only with your cookie consent.
A Space is private. It is visible to the Keeper and to people holding the invitation. Koda’s intent is that nobody at Koda browses Spaces, and that access to production data is restricted and recorded. The controls that enforce this are being built and verified before launch. Technical review needed
Koda uses infrastructure, storage, email and payment providers listed on the Trust page. Hosting region and the final subprocessor list are being confirmed. Technical review needed
A Reserved, unpaid Space is retained for 30 days. An activated Space has no arbitrary product expiry — it stays until you choose to delete it, subject to the eventual Terms and the law. A Space or account you delete has a 30-day recovery period before permanent removal from the live service. Shared and organisation ownership consequences are resolved before account deletion completes. Deleted content may persist temporarily in operational backups; the maximum backup period is not set. Binding wording is under legal review. Legal review needed
Access, correction, deletion, portability, objection, and withdrawal of consent. Koda’s product position is that a Memory Keeper can take a Space archive with them, and that an account holder can request a machine-readable copy of the personal data held about that account. Those are different things. Guests can ask for their own contribution to be removed without an account, through Help. Exact legal characterisation remains under review. Legal review needed
Make a data request — the privacy contact address is production configuration and is not yet published. Legal review needed
A Koda account holder — a Memory Keeper — must be 18 or over. Koda does not offer child accounts or child profiles. Children may appear in memories. Koda does not require every person in ordinary event photography to hold an account, and does not offer child profiling or biometric identification. Contributors and Keepers must have appropriate permission to share content. Help is the launch route to raise a removal concern; a request is not an automatic deletion. Organisations remain responsible for their own safeguarding and consent requirements. Binding wording, and any use outside the UK, remain under legal review. Legal review needed