Kotwi Privacy Policy

Last updated: July 11, 2026

At Kotwi, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what information we collect, why we collect it, and how we protect it.

1. Information We Collect

Account information:

  • Full name
  • Email address
  • Password (stored hashed, never in plain text)
  • Profile picture (optional)
  • The name of your business or team

Business data you enter into the system:

  • Ingredients, products, recipes, purchases, and sales
  • Suppliers
  • Contact details of your own customers (see section 3)

Payment information:

Payments are processed by Lemon Squeezy, our payment provider and merchant of record. We never see or store your card details; we only receive the status of your subscription.

Technical information:

  • IP address and browser information from server logs
  • Essential cookies (see section 9)

We do not ask you for your phone number, physical address, date of birth, gender, or national identification number.

2. How We Use Your Information

We use your information to:

  • Provide and maintain the service
  • Calculate the costs, stock, and margins the product exists to show you
  • Notify you about important changes to the service
  • Provide customer support
  • Understand how the service is used in order to improve it
  • Detect, prevent, and address technical and security issues

We never sell your personal data.

3. Your Customers' Data

Kotwi lets you record information about your own customers — names, email addresses, phone numbers — to associate them with sales. For that data, you are the data controller and Kotwi acts as a processor: we store and process it on your behalf, only to provide the service, and we never use it for our own purposes or contact your customers. You are responsible for having the right to store that information.

4. Legal Basis for Processing

We process your personal data based on:

  • Performance of a contract, to provide you the service you signed up for
  • Your consent, when you agree to receive marketing communications
  • Our legitimate interests, such as securing and improving the service, as long as they do not override your fundamental rights and freedoms

5. Sharing Information

We do not share your personal information with third parties, except with the service providers we need to operate:

  • Lemon Squeezy — payment processing, as merchant of record
  • DigitalOcean — hosting infrastructure
  • Email delivery providers — to send you transactional emails (account confirmation, notifications)

These providers process data only as needed to provide their service to us. We may also disclose information when required by law.

6. International Data Transfers

Our servers are operated by DigitalOcean and located in the United States (New York). If you use Kotwi from outside the United States, your data is transferred to and stored there. Where required (for example, for users in the European Economic Area or the United Kingdom), these transfers are protected by appropriate safeguards such as standard contractual clauses.

7. Data Security

We take measures to protect your data, including:

  • Encrypted connections (HTTPS/TLS) for all traffic
  • Passwords stored using secure hashing
  • Access controls that isolate each team's data
  • Periodic backups of the database

8. Data Retention

We keep your personal data for as long as your account is active. When you delete your account, your data is removed from our active systems within 90 days. Copies may persist in backups for a limited time until those backups expire on their normal rotation.

Team activity records. Operations you perform within a team — such as recording purchases, sales, production, or inventory checks — become part of that team's business records and may include your name as it was at that time. If you leave a team, or delete your account while a team you belonged to remains active, those records are retained as part of the team's operating history, based on the legitimate interest of the business in keeping its records. When a team is deleted, its activity records are deleted with it.

9. Cookies

We use only essential cookies: session, authentication, and security (CSRF) cookies required for the site to function. We do not use advertising or third-party analytics cookies. If that changes, we will update this policy first.

10. Your Rights

Depending on your location, you may have the right to:

  • Access and receive a copy of your personal data
  • Rectify your personal data
  • Delete your personal data
  • Object to or restrict the processing of your personal data
  • Data portability
  • Withdraw your consent at any time

To exercise these rights, write to us at [email protected]. We will respond within a reasonable time and, at most, within the period required by applicable law.

11. Email Marketing

We may send you emails about product news and improvements. You can opt out at any time using the unsubscribe link in each email, and we will always keep sending you the transactional emails needed to operate your account.

12. Age Requirement

Kotwi is a business tool intended for adults. You must be at least 18 years old to use it. We do not knowingly collect data from minors.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "last updated" date; if a change is significant, we will notify you by email or within the application.

14. Data Protection Authority

If you are in the European Economic Area and believe we are unlawfully processing your personal data, you have the right to lodge a complaint with your local data protection supervisory authority.

15. Contact

If you have any questions about this Privacy Policy, write to us at [email protected].