This policy explains how Bearworks Limited ("Koo", "we", "us"), a company registered in England & Wales(company number 12215420, registered office Unit J, Williams Yard, Melbourne, Derbyshire DE73 7GQ), collects, uses and protects personal data when you visit koo.co, use the Koo product, or visit a website built and hosted with Koo. Questions: hello@koo.co.
Designed to comply with the UK GDPR and Data Protection Act 2018, the EU GDPR (where applicable), and equivalent laws.
1. Controller
The data controller for personal data described in this policy is Bearworks Limited, Unit J, Williams Yard, Melbourne, Derbyshire DE73 7GQ. ICO registration: 00013248461.
2. Roles: controller and processor
For information collected directly via koo.co and your Koo account, Koo is the controller. For visitors to the websites you publish through Koo, you (the customer) are the controller and Koo acts as a processor on your behalf — see our Data Processing Agreement.
3. What we collect
- Account data: name, email, organisation, hashed password and authentication tokens.
- Billing data (when payments are enabled): company name, billing address, VAT/tax ID and the last four digits of your payment card (full card data is held by our payment processor, never by us).
- Product usage: which features you use, errors you hit, browser, OS and approximate location.
- Site content: the pages, posts, images, forms and form responses you create in Koo.
- Visitor analytics: aggregate, cookie-less analytics for sites built with Koo.
- Communications: emails you send us, support tickets, and replies to product updates.
4. Why we use it & lawful bases (UK GDPR Art. 6)
- Provide the service: performance of a contract with you (Art. 6(1)(b)).
- Secure the service, prevent fraud and abuse: legitimate interests (Art. 6(1)(f)).
- Transactional emails: contract (Art. 6(1)(b)).
- Product updates and marketing: your consent (Art. 6(1)(a)), withdrawable at any time.
- Legal obligations (tax, accounting): Art. 6(1)(c).
5. Sub-processors
We use a small number of carefully chosen sub-processors. Each is bound by a written data-processing agreement. The current list is:
- Cloudflare — edge hosting, DNS, DDoS protection.
- Supabase — database, authentication, storage.
- Inngest — background job processing.
- OpenAI and Anthropic — AI inference under enterprise terms that exclude training on your content.
- Google — Google Analytics 4 on koo.co (only with your cookie consent), Google OAuth sign-in, and Google Business Profile integration where you connect them.
- Lovable Email — transactional and authentication email delivery.
- Semrush — SEO and keyword research data, where used.
The current sub-processor list and any updates are also published on our DPA page. We do not sell personal data.
6. International data transfers
Data may be processed in the United Kingdom, the European Economic Area and the United States. For transfers out of the UK we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and the UK Extension to the EU–US Data Privacy Framework where the importer is certified.
7. How long we keep it (retention)
- Account & site content: while your account is active, plus 30 days after deletion.
- Billing & tax records: 7 years, as required by tax law.
- Support communications: 3 years from the last interaction.
- Server and security logs: 90 days.
- Terms-acceptance audit log: while your account is active, plus 7 years after deletion.
8. Your rights
Under UK GDPR you have rights of access, rectification, erasure, restriction, portability, objection, and to withdraw consent. You can lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Submit requests via hello@koo.co.
9. Children
Koo is not directed to children under 16 and we do not knowingly collect personal data from them.
10. Cookies
Essential cookies. koo.co uses a first-party session cookie for authentication and a CSRF token cookie. These are strictly necessary to run the service and are set without consent (PECR reg. 6(4)).
Analytics cookies (consent required). With your consent, koo.co uses Google Analytics 4 (property G-EQEFK88W69, provided by Google Ireland Limited) to understand how the site is used. It sets _ga and _ga_* cookies, which expire after up to 24 months, and processes your IP address (truncated/anonymised), pages viewed, approximate location, device and browser. Lawful basis: your consent (UK GDPR Art. 6(1)(a); PECR reg. 6). Google acts as our processor for this data; transfers to the United States rely on the UK Extension to the EU–US Data Privacy Framework and the IDTA/SCCs. Google Signals, advertising features and ad personalisation are switched off, and we do not share analytics data for advertising purposes.
No analytics cookies are set until you choose "Accept" on our cookie banner. You can change your mind at any time by clearing this site's cookies and site data in your browser, which removes your stored choice and any Google Analytics cookies, and the banner will appear again. You can also install Google's Analytics opt-out browser add-on.
Customer sites. Websites built with Koo use first-party, cookie-less visitor analytics by default and do not inherit Koo's Google Analytics tag. We do not run third-party advertising cookies or cross-site tracking anywhere.
11. Security
TLS 1.2+ in transit, AES-256 at rest, least-privilege access, MFA-enforced staff accounts, quarterly access reviews, annual third-party penetration tests. Full detail at koo.co/security.
12. Data-breach notification
In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware (UK GDPR Art. 33) and notify affected individuals without undue delay where the risk is high (Art. 34).
13. Contact
Bearworks Limited · Unit J, Williams Yard, Melbourne, Derbyshire DE73 7GQ · Privacy contact: hello@koo.co.