Privacy Policy

1. Who We Are

Koli (Amir Schechter) operates the website thekoliapp.com. Koli is a speech-confidence application designed to help people who stutter reduce speech-related anxiety.

For the purposes of the GDPR and UK GDPR, Koli is the data controller.

Contact:
Email: [email protected]
Address: Lakish 128, Shoham, Israel

2. What We Collect

When you complete the waitlist form, we collect the following:

• First name — provided by you in the form
• Email address — required to contact you when Koli launches
• Phone number — optional; provided by you in the form
• Country of residence — provided by you via the country selector
• Goal for joining (Q1) — your primary motivation for using Koli
• Avoidance behaviors (Q2) — speech situations you currently avoid
• Personal pain point (Q3) — a free-text description of your experience with stuttering
• Beta program preference (Q6) — whether you opted in to early beta testing

We also collect the following automatically:

• Analytics data — page views, button clicks, and form interaction events via PostHog (see Section 9)

We do not collect payment information, government IDs, or biometric data at this stage.

3. Why We Collect It (Purposes & Legal Bases)

Under the GDPR, we must have a lawful basis for processing your personal data. The table below sets out our purposes and the legal basis for each type of data.

• Name & Email — Notifying you when Koli launches and sending your registration confirmation email. Legal basis: Contract / Legitimate Interest (GDPR Art. 6(1)(b) / 6(1)(f)).
• Phone number — Optionally used for product research outreach. Legal basis: Consent (GDPR Art. 6(1)(a)).
• Country — Understanding our geographic market and complying with region-specific regulations. Legal basis: Legitimate Interest (GDPR Art. 6(1)(f)).
• Goals, avoidance behaviors, pain text — Informing product development; understanding user needs. Legal basis: Explicit Consent (GDPR Art. 6(1)(a) and Art. 9(2)(a) for health-adjacent data).
• Beta preference — Determining which users to invite to early access. Legal basis: Legitimate Interest / Contract.
• Analytics data — Understanding how the website is used to improve it. Legal basis: Legitimate Interest (GDPR Art. 6(1)(f)).

You may withdraw consent at any time by contacting us at [email protected]. Withdrawal does not affect the lawfulness of processing before withdrawal.

4. Sensitive Data — Speech & Stuttering

The free-text answers you provide about your stuttering experience (Q1, Q2, Q3) are health-adjacent. Under GDPR Article 9, processing such data requires an explicit lawful basis. We rely on your explicit consent (Art. 9(2)(a)), which you grant by voluntarily submitting the waitlist form.

This data is used solely for product development purposes. It is never sold, shared with advertisers, or used for automated profiling that produces legal or similarly significant effects.

Under CCPA/CPRA (California), stuttering-related self-disclosures may qualify as Sensitive Personal Information. California residents have additional rights over this data — see Section 8.

5. Data Processors

We share your data only with the following third-party processors, under written data processing agreements:

• Brevo (Sendinblue SAS) — Email delivery and contact management. Brevo is EU-based and GDPR-compliant. Data processing agreement: brevo.com/legal. Your name, email, phone (if provided), country, and form answers are stored in Brevo.
• PostHog Inc. — Product analytics. PostHog is SOC 2 certified and GDPR-compliant. Data processing agreement: posthog.com/privacy. Analytics events (page views, interactions) are stored on PostHog's US servers. See Section 7 for transfer safeguards.
• Cloudflare / Hosting provider — Website hosting and CDN. Cloudflare Pages.

We do not sell your personal data to any third party.

6. Retention

We retain your personal data for the shorter of:

• 3 years from the date of registration, or
• Until you unsubscribe or request deletion, whichever comes first.

Analytics data (PostHog) is retained for 1 year on a rolling basis.

After the retention period, data is securely deleted or anonymized so it can no longer be linked to you.

Under CASL (Canada), we will honor opt-out requests within 10 business days.

7. International Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place:

• Brevo — EU-based processor; no international transfer required for EU users.
• PostHog — US-based. Transfers from the EEA to the US are governed by Standard Contractual Clauses (SCCs) as approved by the European Commission. PostHog also participates in the EU–US Data Privacy Framework.

You may request a copy of the applicable transfer mechanism by contacting us at [email protected].

8. Your Rights

Depending on your jurisdiction, you have the following rights over your personal data:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate data.
• Deletion ("Right to be Forgotten") — Request deletion of your data (subject to legal retention obligations).
• Portability — Receive your data in a structured, machine-readable format.
• Objection — Object to processing based on legitimate interests.
• Restriction — Request that we restrict processing of your data in certain circumstances.
• Withdraw Consent — Where processing is based on consent, withdraw it at any time.

California residents (CCPA/CPRA) additionally have the right to: know what personal information is sold or disclosed; opt out of the sale of personal information (we do not sell data); non-discrimination for exercising rights; and limit use of sensitive personal information.

Brazilian residents (LGPD), Canadian residents (CASL/PIPEDA), Australian residents (Privacy Act), and users in other jurisdictions have equivalent rights under their applicable laws.

To exercise any right, contact us at [email protected]. We will respond within 30 days (or sooner as required by law). We may need to verify your identity before processing requests.

If you are in the EEA or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority (DPA).

9. Cookies & Analytics

We use PostHog for product analytics. PostHog sets cookies and uses local storage to track unique visitors and sessions. No advertising or cross-site tracking cookies are used.

Cookies set by PostHog:

• ph_* session and distinct ID cookies — used to count unique visitors and analyze user flows. Expire after 1 year.

Opt out: You can opt out of PostHog analytics by visiting PostHog opt-out, or by enabling "Do Not Track" in your browser settings. We honor DNT signals.

We do not use Google Analytics, Facebook Pixel, or any advertising networks.

10. Children

Koli is not intended for children. We do not knowingly collect personal data from anyone under the age of 16 (the minimum age under GDPR Article 8). If you are under 16, do not submit the waitlist form without verifiable parental consent.

In the United States, we comply with COPPA and do not knowingly collect data from children under 13.

If we become aware that we have inadvertently collected data from a child, we will delete it promptly. Contact us at [email protected] if you believe a child's data has been collected.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Send an email notification to waitlist members if the changes materially affect how we use their data.

Continued use of thekoliapp.com after changes are posted constitutes acceptance of the revised policy.

12. Contact

For any privacy-related questions, data requests, or concerns:

Email: [email protected]
Company: Amir Schechter
Registration number: 215218710
Address: Lakish 128, Shoham, Israel

We aim to respond to all requests within 72 hours for urgent matters (e.g., data breach notifications) and within 30 days for standard requests.