Koda ("we", "us") is a tool for creative social media agencies to manage their clients' accounts. This page explains what data we collect, why, and what we do with it.
Who runs Koda
Koda is operated by Kodasocial.Co.Uk Ltd (trading as Koda), a company registered in England & Wales under company number 17266873 and part of the Arlo Marketing group. Our registered office is Brook View Lodge, New Road, Teignmouth, TQ14 8UD. We are the data controller for the personal data described in this policy.
We are registered with the UK Information Commissioner's Office (ICO) under registration reference ZC171800. If you need to reach us about your data, email [email protected].
What we collect
Waitlist info: while Koda is in private beta we collect your name and email address if you submit the waitlist form on our marketing site. We use this only to email you when we open up signups. You can remove yourself at any time at kodasocial.co.uk/unsubscribe.
Account info: your name, email, and (if you sign up with Google) your Google profile ID.
Workspace data: the clients you add, their profile info, brand notes, captions, scheduled posts, tasks and shoot plans. This is information you provide.
Instagram data: when you connect an Instagram Business or Creator account via Meta, we receive an access token plus account metadata (username, profile, follower count). We also fetch posts, comments and (where permitted) direct messages so you can manage them inside Koda.
Uploaded media: images and videos you upload for scheduled posts. Stored only until the post is published, then deleted.
Usage data: basic logs (IP address, timestamps, error reports) for security and reliability.
Why we collect it
To run the product features you signed up for (calendar, scheduling, inbox, captions, analytics).
To authenticate you and keep your workspace isolated from other agencies.
To prevent abuse, detect bugs, and improve reliability.
To send transactional emails (sign-up confirmations, password resets, billing receipts).
To email waitlist subscribers a single launch announcement when we open signups. We will not use waitlist emails for any other marketing.
What we do not do
We don't sell your data.
We don't share it with advertisers.
We don't train AI models on your content. AI features (caption generation, content ideas) send your prompt to Anthropic's API at the moment you request a generation; Anthropic does not train on API traffic.
Instagram data — specifics
When you connect a client's Instagram account, you grant Koda permission to access that account's data via Meta's Graph API. Specifically we may read:
Account profile (username, biography, follower and post counts)
Recent media (posts, captions, engagement counts, permalinks)
Comments on that media and replies you send
Direct messages (only if you've connected Instagram directly and granted the instagram_business_manage_messages permission)
Insights and analytics provided by Meta
Access tokens are encrypted at rest using AES-256-GCM. They are only ever used by the agency that connected them — never shared across organisations.
You can disconnect an Instagram account at any time from a client's Integrations tab. Disconnecting deletes the stored access token immediately.
Where data is stored
All data is stored on servers in the EU (Frankfurt region), hosted by Railway and AWS. Uploaded media files sit on the application disk and are removed when posts publish or after 24 hours if abandoned.
Retention
Active workspace data is kept as long as your account is active.
If you delete your account, we delete the workspace within 30 days.
Uploaded media for scheduled posts is deleted automatically once the post publishes.
Server logs are retained for 30 days.
Waitlist entries are deleted within 30 days of public launch, or sooner on request via kodasocial.co.uk/unsubscribe.
Your rights
Under UK GDPR you have the right to: access the data we hold about you, correct it, request deletion, object to processing, and request a copy. Email us at [email protected] and we'll respond within 30 days.
If you're unhappy with how we've handled your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. We'd appreciate the chance to address your concern first, so please do contact us before you do.
Cookies
We use one essential cookie to keep you signed in. No tracking cookies, no analytics cookies, no advertising cookies.
Third-party services we rely on
Meta Platforms (Instagram, Facebook Graph API) — for everything Instagram-related
Google — for "Sign in with Google" only
Anthropic — for AI-generated captions and ideas
Stripe — for subscription billing
Resend — for transactional email
Railway, AWS, Cloudflare — for hosting and DNS
Changes to this policy
If we change anything material, we'll update the date at the top and email signed-in users at least 7 days before the change takes effect.