Privacy Policy

Effective October 27, 2026. Version 2026-10-27.

1. Who we are

Khora Audio, Inc., of 2261 Market Street, STE 86811, San Francisco, CA 94114, USA ("Khora", "we", "us"), is the data controller of the information described in this policy.

This policy covers the personal data we handle when you visit khora.audio, join a waitlist, or use the Khora web service (the "Service"), our audio plugins (the "Software") or the content you generate (the "Output").

Privacy contact: privacy@khora.audio.

If you are in the EU or UK, you may contact our representative at Prighter EU Rep GmbH (Schellinggasse 3/10, 1010 Vienna, Austria) or Prighter Ltd (20 Mortlake, Mortlake High Street, London SW14 8JN, UK), respectively.

2. Information we collect

Account information. Your email address, username, password (stored only as a one-way hash), profile details, account status, and who referred you, if anyone. If you sign in with Google, we receive your name, email address, profile picture and Google account ID, and use them to create your account, sign you in and fill in your profile.

Billing information. Purchases are processed by Stripe. We receive a customer identifier and your purchase history. We never see your card number, and we don't store your billing address.

Content. Your prompts, Output, generation history, and any ratings or feedback you give us.

Uploads. Any file you upload (a MIDI file or an audio loop) together with the facts we read from it (tempo, key, instruments and similar). If an upload contains a voice, that recording is personal data, and we handle it as Content under this policy.

Plugin data. License keys, plugin version, a hashed device identifier, and the IP address a license was activated from.

Technical and support data. IP addresses and browser details, used for security and to keep you signed in, and the messages you send us.

Region estimate. From your IP address we estimate the country and, where needed, the state or province you are connecting from. We use it to apply the regional restrictions in Section 3, and for that purpose we keep only the estimate, not your IP address. Our web servers also write a short log entry for the request that asks whether the Service is available where you are. It holds the region estimate but no IP address; another log entry for the same request does hold your IP address and the time, so the two can be matched. Both are kept like our other security data (Section 7).

Usage data. If analytics is on (Section 4), the pages you visit and the features you use, linked to a pseudonymous identifier.

Waitlist. If you join a waitlist, we store your email address, the date and where you signed up, and send you news and updates until you unsubscribe. You don't need an account.

Required vs. optional. You don't have to give us any of this, but an account needs an email address (or Google sign-in), and Stripe needs billing details to process a purchase.

3. How we use your information

Marketing and waitlist emails always include an unsubscribe link.

Regional restrictions and sanctions review. US sanctions law bars us from serving some regions. When a request comes from one of them, we refuse purchases, downloads, license activations, generation and other parts of the Service. If you have an account, we record a flag against it so that one of our founders can review whether the account needs action. The flag holds your account identifier, the region estimate, what you were doing when it was first seen (for example signing in or activating a license), when and how often it was seen, and, once reviewed, the outcome, the reviewer's email address and notes. Our legitimate interest is complying with that law. If the flag is raised by a plugin license being used from such a region, the flag says a key was used there; the key's owner may not be the person using it, and the review takes that into account. If an account is flagged, we may pause collection on its subscriptions until a person has reviewed it. Nothing is cancelled or refunded automatically; a person decides what happens next.

We do not use your prompts, your uploads or your Output to train or fine-tune any AI model, and we do not let any provider do so.

4. Cookies and similar technologies

We use the cookies below. Google Analytics and the referral cookie are optional: in the EU, EEA, UK and Switzerland we set them only with your consent; elsewhere they are on by default, and you can turn them off. You can change your choice at any time in Cookie settings. The others are strictly necessary to sign you in and keep your account secure.

We also use your browser's storage to keep you signed in and remember your preferences and cookie choice. A referral code stored there follows the same rules as the referral cookie.

5. How we share your information

We also disclose data where the law requires it. If we merge or are acquired, your data may pass to the successor, which will be bound by this policy.

6. International transfers

We and our providers process data mainly in the United States. For transfers from the EU, UK and Switzerland we rely on Standard Contractual Clauses or equivalent safeguards; email privacy@khora.audio for a copy.

7. How long we keep your information

We keep your account information while your account is active. Depending on your plan, Output is kept while your account exists or may be deleted 30 or 90 days after it was generated. If your plan ends or you downgrade, the 30 or 90 days start from that date.

We keep invoices and purchase records for seven years for tax purposes, and license keys and hashed device identifiers while the license is valid. Security data and support messages are kept only as long as needed. Google Analytics usage data is kept for 14 months.

A file you upload, and the card it becomes in your library, are kept on the same schedule as any other Output (above): while your account is active, or for 30 or 90 days after upload on a plan that limits retention. Deleting the card deletes the file; it does not delete anything you already built from it.

Waitlist addresses are kept until you ask us to delete them.

A sanctions review flag (Section 3) is kept until a founder has reviewed it. After review, a flag that turns out to be a false match is deleted 90 days later; a flag that led to action is kept for up to ten years, because we may need it to show we complied with sanctions law.

8. Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability, and to withdraw consent at any time.

Where we rely on legitimate interests (Section 3), you can object at any time. Where the interest is complying with sanctions law, we weigh your objection against that compliance purpose, and we may be unable to stop the processing.

Delete your account in account settings, or email privacy@khora.audio to exercise any right.

Complaints. If you are in the EU or UK, you can complain to your data protection authority or contact our representatives (Section 1).

9. Deleting your account

You can delete your account at any time. Deletion is immediate and permanent, and copies in our backups are deleted within a few months. With a paid account you can instead schedule deletion for 30 days later, and recover the account until then.

We keep purchase records and license keys as described in Section 7, so plugins you bought keep working. If your account carries a sanctions review flag, deleting the account does not delete the flag until it has been reviewed, and a flag that led to action is kept for up to ten years (Section 7). A flag already cleared as a false match is deleted with your account, and one cleared later is deleted within a day. Stripe keeps its own records under its own privacy policy. Google Analytics usage data is pseudonymous and is not erased when you delete your account; it expires as described in Section 7.

10. Security

We protect your data with encryption in transit and at rest, and with access controls.

11. Children

You must be 18 or older to use the Service. If you think someone under 18 has given us personal data, email privacy@khora.audio and we will delete it.

12. Changes to this policy

We will post updates here with a new effective date and version. For material changes, we will email account holders before they take effect.