Effective September 29, 2026. Version 2026-09-29.
Khora Audio, Inc., of 2261 Market Street, STE 86811, San Francisco, CA 94114, USA ("Khora", "we", "us"), is the data controller of the information described in this policy.
This policy covers the personal data we handle when you visit khora.audio, join a waitlist, or use the Khora web service (the "Service"), our audio plugins (the "Software") or the content you generate (the "Output").
Privacy contact: [email protected].
If you are in the EU or UK, you may contact our representative at Prighter EU Rep GmbH (Schellinggasse 3/10, 1010 Vienna, Austria) or Prighter Ltd (20 Mortlake, Mortlake High Street, London SW14 8JN, UK), respectively.
Account information. Your email address, username, password (stored only as a one-way hash), profile details, account status, and who referred you, if anyone. If you sign in with Google, we receive your name, email address, profile picture and Google account ID, and use them to create your account, sign you in and fill in your profile.
Billing information. Purchases are processed by Stripe. We receive a customer identifier and your purchase history. We never see your card number, and we don't store your billing address.
Content. Your prompts, Output, generation history, and any ratings or feedback you give us.
Plugin data. License keys, plugin version, a hashed device identifier, and the IP address a license was activated from.
Technical and support data. IP addresses and browser details, used for security and to keep you signed in, and the messages you send us.
Usage data. If analytics is on (Section 4), the pages you visit and the features you use, linked to a pseudonymous identifier.
Waitlist. If you join a waitlist, we store your email address, the date and where you signed up, and send you news and updates until you unsubscribe. You don't need an account.
Required vs. optional. You don't have to give us any of this, but an account needs an email address (or Google sign-in), and Stripe needs billing details to process a purchase.
| Purpose | Data | Legal basis |
|---|---|---|
| Your account and sign-in | Account information | Contract |
| Providing the Service and support | Content, Technical and support data | Contract |
| Payments and subscriptions | Billing information | Contract |
| Plugin licenses | Plugin data | Contract |
| Service emails | Account information | Contract |
| Marketing and waitlist emails | Account information, Waitlist | Consent |
| Site analytics | Usage data | Consent |
| Security, fraud prevention and auditing | Technical and plugin data | Legitimate interests |
| Diagnosing failed generations | Content | Legitimate interests |
| Tax and accounting | Billing information | Legal obligation |
Marketing and waitlist emails always include an unsubscribe link.
We do not use your prompts or your Output to train or fine-tune any AI model, and we do not let any provider do so.
We use the cookies below. Google Analytics and the referral cookie are optional: in the EU, EEA, UK and Switzerland we set them only with your consent; elsewhere they are on by default, and you can turn them off. You can change your choice at any time in Cookie settings. The others are strictly necessary to sign you in and keep your account secure.
| Cookie | Purpose | Duration |
|---|---|---|
| Sign-in and security cookies | Keep you signed in and protect your account | Up to 90 days |
__Host-khora_referral | Remembers a referral link you followed (optional) | 30 days |
_ga, _ga_* | Google Analytics (optional) | 13 months |
We also use your browser's storage to keep you signed in and remember your preferences and cookie choice. A referral code stored there follows the same rules as the referral cookie.
| Recipient | What it handles | Where |
|---|---|---|
| Cloud services, email and site analytics | United States and other countries | |
| Cloudflare | Website hosting, spam protection (Turnstile) and visit counts | United States |
| Resend | Email delivery | United States |
| Stripe | Payments and subscriptions, as an independent controller (stripe.com/privacy) | United States and EU |
We also disclose data where the law requires it. If we merge or are acquired, your data may pass to the successor, which will be bound by this policy.
We and our providers process data mainly in the United States. For transfers from the EU, UK and Switzerland we rely on Standard Contractual Clauses or equivalent safeguards; email [email protected] for a copy.
We keep your account information while your account is active. Depending on your plan, Output is kept while your account exists or may be deleted 30 or 90 days after it was generated. If your plan ends or you downgrade, the 30 or 90 days start from that date.
We keep invoices and purchase records for seven years for tax purposes, and license keys and hashed device identifiers while the license is valid. Security data and support messages are kept only as long as needed. Google Analytics usage data is kept for 14 months.
Waitlist addresses are kept until you ask us to delete them.
You have the right of access, rectification, erasure, restriction, objection and data portability, and to withdraw consent at any time.
Where we rely on legitimate interests (Section 3), you can object at any time.
Delete your account in account settings, or email [email protected] to exercise any right.
Complaints. If you are in the EU or UK, you can complain to your data protection authority or contact our representatives (Section 1).
You can delete your account at any time. Deletion is immediate and permanent, and copies in our backups are deleted within a few months. With a paid account you can instead schedule deletion for 30 days later, and recover the account until then.
We keep purchase records and license keys as described in Section 7, so plugins you bought keep working. Stripe keeps its own records under its own privacy policy. Google Analytics usage data is pseudonymous and is not erased when you delete your account; it expires as described in Section 7.
We protect your data with encryption in transit and at rest, and with access controls.
You must be 18 or older to use the Service. If you think someone under 18 has given us personal data, email [email protected] and we will delete it.
We will post updates here with a new effective date and version. For material changes, we will email account holders before they take effect.