Privacy Policy

Koala is operated by Abhinav Alwarappan. We are not an insurance company, an insurance agent, a broker, an adjuster, or a law firm. We do not sell insurance, we do not place coverage, and we do not represent you in a dispute. Nothing Koala produces is legal advice.

The service is built for the United States market. It is not directed at people outside the US. If you use it from elsewhere, please read the section below on the EU and the UK first.

• Account information: you sign in with Google. When you do, we receive your email address and the basic profile details Google returns with it, such as your name and profile picture. We do not receive your Google password.
• Your profile: the details you choose to enter about what you want covered. This can include your ZIP code and state, the people in your household (their relationship to you, date of birth, and whether they smoke), your vehicles (year, make, model, trim, and rough annual mileage), your pets (species, breed, date of birth), details about a home you own or rent, and your coverage preferences. All of it is optional, and you decide how much to fill in. If you are signed out, this stays in your browser as a local draft and is not sent to us until you sign in.
• Claim documents you upload for a claim check: insurer letters, estimates, photos, and policy paperwork. These commonly contain your name, address, policy or claim number, vehicle or property details, claim amounts, and sometimes information about an injury.
• What you type: your description of what happened, and the messages you send the AI advisor.
• Subscription and billing records: your email address and the identifiers Stripe gives us for your customer and subscription records, so we know what plan you are on. Payment card details go to Stripe, not to us. We never receive or store your full card number.
• A coarse request identifier: derived from your IP address, used only to enforce rate limits and to stop abuse of the service.

We do not ask for, and you should not send us, a Social Security number, a government ID number, or login credentials for your insurer.

Almost everything above comes directly from you: what you type, what you upload, and what you choose to save in your profile. Two exceptions. Your email address, name, and profile picture come from Google when you sign in. Your subscription status comes from Stripe when a payment settles. We do not buy personal information about you from data brokers, and we do not enrich your record from third party sources.

We use your information for these purposes, and no others:

• To run the claim check you paid for: reading your documents, extracting the facts of the claim, researching comparable settlements, estimating a fair value range, and drafting your report and demand letter.
• To answer your questions in the AI advisor, and to explain how your coverage works using the profile you saved.
• To create and secure your account, and to keep you signed in.
• To take payment, manage your subscription, and count your usage against your plan.
• To email you your report, if you ask us to.
• To keep the service running: rate limiting, preventing abuse, debugging errors, and maintaining security.
• To comply with the law, and to establish or defend legal claims.

We do not use your information for advertising, and we do not profile you for marketing.

We rely on a small set of service providers. Each one processes your data only to perform its function for Koala, under its own agreement with us:

• Supabase: sign-in, and the database that holds your account, profile, claim records, and subscription.
• Stripe: processes your payment and holds your card details.
• Google (Gemini): the AI provider. The text of your documents, images of your documents, and the messages you send the advisor are sent to this provider so it can generate the analysis and the answers.
• Exa: runs web searches for comparable settlements.
• Resend: delivers your report by email, if you opt in.
• Upstash: enforces rate limits. It receives only the coarse request identifier, never your documents or your messages.
• Vercel: hosts the site and runs the servers. Its infrastructure processes your requests and keeps operational logs.

We do not share your information with insurers, adjusters, law firms, data brokers, or advertisers. We may disclose information if we are legally required to, for example in response to a valid subpoena, or where it is necessary to protect someone's safety or to defend our legal rights. If Koala is ever acquired or merged, your information may transfer to the acquiring entity, which would remain bound by this policy until you are told otherwise.

The report, the fair value range, the demand letter, and the advisor's answers are generated by an AI model. They can be wrong. They can misread a document, miss an exclusion, or state a number that does not hold up. Everything Koala produces is informational only. It is not legal advice, and it is not a promise about what your insurer will pay.

A human being does not review every output before you see it. You are the one who decides whether to send a letter or rely on a number, so read what we produce before you act on it, and check it against your own policy documents. If you believe an output about you is wrong, email koala.insurance.help@gmail.com and we will look at it and correct our records.

We do not use your claim documents or your advisor messages to train our own models.We do not have our own models. Your inputs are sent to the AI provider named above purely so it can return an answer, and that provider's handling of them is governed by its own API terms, which we rely on. We are not in a position to make promises on that provider's behalf. If how your data is handled at the model layer matters to you, read that provider's current terms before you upload anything.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law and the other state privacy laws listed below. We have never done so. There is no advertising technology on this site: no ad pixels, no ad networks, and no third party trackers. We also do not knowingly sell or share the personal information of anyone under 16.

Koala sets only the cookies it needs to work. There are two: the session cookie that keeps you signed in after you authenticate, and a signed cookie that records that you have an active subscription so we can unlock the features you paid for.

We do not run product analytics, we do not use advertising or tracking cookies, and we do not have a third party error monitoring tool installed. There is nothing here to opt out of today. If we add any of these, we will update this policy and describe what is collected and how to opt out before we turn it on.

The files you upload are not stored. When you run a claim check, your documents are read in memory on our server, converted to text or images, and sent to the AI provider for analysis. The original files are not written to our database or to file storage, and we do not keep a copy of them.

What we do keep, and for how long:

• Your claim record: the description you wrote, the facts the model extracted from your documents, the report and letter it produced, and your advisor messages for that claim. We keep this so you can re-open and re-download your report.
• Your profile: kept until you change or remove it. You can edit or clear any part of it yourself from your profile page at any time.
• Your advisor conversations: the questions you ask the Koala advisor and its answers are saved to your account, private to you, so your history follows you across devices and Learning Progress can show what you've covered. They are scoped to your account and removed when we delete your account.
• Your account and subscription records: kept while your account is open, and afterwards where we need them for tax, accounting, or legal reasons.
• Server logs: kept for a short operational period by our hosting provider. Our own log lines are scrubbed of personal information before they are written, as described below.

To be straightforward with you: we do not currently run an automated deletion schedule, and there is no self-serve delete button yet. That means a claim record stays in the database until you ask us to remove it. Email koala.insurance.help@gmail.com and we will delete your claim, your profile, and your account, and confirm when it is done, unless we are required to retain something for a legal or accounting reason. Setting a defined maximum retention period, and building a delete button, are both on our list.

These are the measures we actually have in place:

• Your data travels over encrypted connections (HTTPS) between your browser, our servers, and every provider listed above.
• Your profile and your claims are protected in the database by row-level security, so the database itself enforces that one user cannot read another user's rows. It is not left to application code to remember.
• We never receive or store your full payment card number. Stripe holds it.
• Our server logs are passed through a scrubber that redacts emails, Social Security numbers, street addresses, phone numbers, ZIP codes, and policy and claim numbers before anything is written. Claim text and uploaded document content are never passed into a log line in the first place.
• Access to production data is limited to the people who need it to operate the service.

We want to be equally clear about what we do not have. Koala has not completed a SOC 2 audit, is not ISO 27001 certified, and holds no other security certification. We are not a HIPAA covered entity and we do not hold your information as protected health information under HIPAA, even where a claim document happens to mention an injury. No service can promise perfect security, and we do not.

Koala is not directed to children. The service is for adults who hold or are considering an insurance policy, and it is intended only for people aged 18 or over. We do not knowingly collect personal information from anyone under the age of 13, which the Children's Online Privacy Protection Act (COPPA) protects, and we do not knowingly collect personal information from teenagers under 18.

If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you are a parent or guardian and you believe your child has given us personal information, email koala.insurance.help@gmail.com and we will delete the information and the account. You do not need to prove anything first, just tell us.

One thing worth being precise about: if you add a child to your household in your profile, you as the adult account holder are the person giving us that information, and it is your choice whether to. We use it only to explain coverage that depends on who is in your household. We do not collect it from the child, we do not let a child interact with the service, and you can remove any household member from your profile at any time.

Several states now give teenagers protections beyond COPPA, including limits on targeted advertising and on selling a minor's data. Those protections are satisfied here by the fact that we do not advertise, do not profile anyone, and do not sell or share personal information, at any age.

Wherever you live, you can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, or delete it. Email koala.insurance.help@gmail.com. We will confirm we received your request, verify that the request really comes from you (normally by checking it against the email address on the account), and respond. We do not charge for this, and we will not treat you worse for asking.

You can also do some of this yourself. Your profile is editable at any time, and you can clear any part of it directly.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights. This section is your notice at collection.

Categories of personal information we collect. In the last 12 months we have collected: identifiers (your name, email address, postal ZIP code, and an IP-derived request identifier); commercial information (your subscription, your purchase of a claim check, and the claim amounts in your documents); internet or network activity (the requests your browser makes to our servers); and other information you volunteer, including your household, vehicle, pet, and property details, your claim description, and your advisor messages.

Sensitive personal information.A claim document likely contains sensitive personal information: your precise street address, your account or policy number, and in some claims, information about your health or an injury. Your profile can contain household members' dates of birth and smoking status. We collect this only because the claim check cannot work without it. We use it solely to perform the service you asked for and for the security and operational purposes described above. We do not use or disclose it to infer characteristics about you. Because our use falls within the purposes California law permits without a limit right, we do not offer a Limit the Use of My Sensitive Personal Information link, and there is nothing for such a link to switch off. You can still ask us to delete the information outright, and we will.

Business and commercial purposesfor collecting it are the ones listed under "Why we use it" above. Categories of third partiesthat receive it are the service providers listed under "Who we share it with" above, all of which are service providers or contractors under California law. Sourcesare described under "Where the information comes from".

We do not sell or share your personal information, and we have not in the preceding 12 months. There is no Do Not Sell or Share My Personal Information link because there is nothing to opt out of.

Your rights are to:

• Know what personal information we have collected, used, and disclosed, and get a copy of it.
• Correct inaccurate personal information.
• Delete personal information we collected from you, subject to the exceptions the law allows.
• Opt out of the sale or sharing of your personal information, which does not arise here because we do neither.
• Limit the use of your sensitive personal information, as explained above.
• Not be discriminated against for exercising any of these rights. We will not deny you the service, charge you more, or give you a worse version of it because you asked.

To exercise any of them, email koala.insurance.help@gmail.com. We will acknowledge your request within 10 business days and respond within 45 calendar days. If we need more time, we will tell you why and take up to another 45 days. An authorized agent may make a request on your behalf if they give us written proof that you authorized them.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, and the other states with a comprehensive consumer privacy law in force, including Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, and Rhode Island, have broadly the same rights: to confirm whether we process your personal data and access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects.

Koala does not carry out targeted advertising, does not sell personal data, and does not profile anyone for decisions that produce legal or similarly significant effects, so there is nothing for those opt-outs to turn off. Several of these states also require us to honor a universal opt-out signal such as Global Privacy Control. We have no selling or targeted advertising for such a signal to govern, so there is no processing for it to stop.

Some of this information is sensitive data under these laws, including health-related details in a claim document and precise location if a document contains it. We process it only to deliver the service you requested, and by using the claim check you are consenting to that. You can withdraw that consent by asking us to delete the data.

Appeals. These laws give you the right to appeal if we refuse your request. If we decline, we will tell you why. You can then appeal by replying to that email, or by writing to koala.insurance.help@gmail.comwith "Privacy appeal" in the subject line. We will respond to the appeal within 45 days, in writing, with our reasoning. If we deny the appeal, we will give you a way to contact your state attorney general to complain. Texas residents can contact the Office of the Texas Attorney General. Residents of other states can contact their own attorney general.

Koala is aimed at the US market and we do not target or market the service in the EU, the EEA, or the UK. If you use it from there anyway, and the GDPR or UK GDPR applies to that use, here is where we stand.

Our lawful bases. We process your account, claim, and payment data to perform our contract with you. We process a coarse request identifier, and keep security logs, on the basis of our legitimate interests in keeping the service running and free from abuse. Where you upload a claim document that contains health information, we rely on your explicit consent, which you give by choosing to upload it, and which you can withdraw by asking us to delete the claim. We keep some records to comply with a legal obligation, such as tax rules.

Your rights. You may request access, rectification, erasure, restriction of processing, and portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting what we did before you withdrew it. Email koala.insurance.help@gmail.com. You also have the right to lodge a complaint with your supervisory authority, or with the Information Commissioner's Office in the UK.

International transfers, stated plainly. Koala and all of its providers operate in the United States, so using the service means your data is transferred to and processed in the US. We have not put a specific transfer mechanism such as Standard Contractual Clauses in place, because the service is not offered to the EU or the UK. If you are subject to the GDPR or UK GDPR and this matters to you, please contact us at koala.insurance.help@gmail.com before you upload anything, rather than assuming a safeguard is in place that is not.

If we discover a breach of security that compromises your personal information, we will investigate it, take steps to contain it, and notify you and the relevant regulators where the law requires it, without unreasonable delay. Our notice will tell you what happened, what information was involved, and what you can do about it. If you believe you have found a security vulnerability in Koala, please tell us at koala.insurance.help@gmail.com.

We will update this policy when our practices change, and we will change the "Last updated" date at the top when we do. If a change materially affects how we handle your personal information, for example if we start using an analytics tool, add a new provider that receives your documents, or change the AI provider, we will make that clear and, where the law requires it, ask for your consent before the change takes effect. The current version always governs.

Questions about this policy, or about anything we hold about you? Email koala.insurance.help@gmail.com. Koala is operated by Abhinav Alwarappan. Please put "Privacy" in the subject line so it reaches the right place. If you are a parent asking us to delete a child's information, say so and we will treat it as urgent.