Privacy policy

1. Introduction

ko.io provides regulatory and market data through its website, REST API and MCP server.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website at ko.io, our API at api.ko.io, and any related services. By using our services, you acknowledge that you have read and understood this policy.

We are committed to protecting your privacy and handling your data transparently. We collect only the minimum data necessary to operate our service, and we never sell your personal information.

2. Information we collect

Account data

When you create an account, we collect your email address, display name, and password. Passwords are never stored in plain text — they are hashed using PBKDF2-SHA-512 with 100,000 iterations. If you sign in with Google OAuth, we store your name, email address and Google account identifier. Google also sends a profile picture URL, which we do not store. We do not access your Google contacts, calendar, or any other Google services.

API usage data

When you make API or MCP requests, or sign in, we log the endpoint and the request parameters (query parameters and the body of non-GET requests; API keys and tokens passed in the URL are removed), the request time, your IP address, your account email and user ID, the API key used (identified by its prefix), your plan, your browser or client user agent, the country the request came from, the response time and the HTTP status code. This data is used for rate limiting, abuse prevention, usage billing and service reliability monitoring, and is kept for 90 days.

Payment data

All payment processing is handled by Stripe. We never receive, process, or store your credit card number, CVV, or full card details. Stripe provides us with a customer ID, subscription status, and billing email for account management purposes.

Technical data

We collect basic technical information from HTTP request headers, including browser type (User-Agent), device type, and operating system. This information helps us ensure compatibility and diagnose technical issues.

Feedback

When you send feedback, we process the message, selected category, related page URL and any screenshot you attach so we can review the issue and track its status.

Email subscriptions

When you subscribe to the Ownership Brief or turn on Disclosure Watch email, we process your email address, language, schedule and watch list, the version of the consent wording you agreed to with its time and a one-way hash of your IP address, and the delivery status of each email. The legal basis is your consent, which you can withdraw with one click in every email. Unconfirmed sign-ups are deleted 30 days after the last confirmation email, or 90 days after sign-up if no confirmation email was sent. For the Ownership Brief, after you unsubscribe your address is deleted after 30 days and the consent record (consent wording version, times and a one-way hash of the address) is deleted after 2 years. For Disclosure Watch email, after you turn it off your address is removed from the email settings after 30 days; the settings themselves stay with your account until you delete it. Each sent email's content is cleared after 30 days and its delivery record is deleted after 400 days. If an address bounces or reports spam, we keep a one-way hash of it so we never email it again.

What we do not collect

• Precise geolocation or GPS data
• Social media profiles or activity
• Browsing history outside of ko.io
• Contacts or address books
• Biometric data

3. How we use your information

Each page of a downloaded PDF report is watermarked with a pseudonymous identifier for the downloading account (not an email address), the download time and a report ID for copyright protection and traceability.

• Provide and maintain the service — authenticate your identity, deliver API responses, and manage your subscription tier.
• Process payments — communicate with Stripe to handle subscription billing, upgrades, downgrades, and refunds.
• Enforce rate limits and prevent abuse — monitor API request volumes to enforce plan limits, detect automated scraping, and protect service availability for all users.
• Service communications — send account-related emails including security alerts, billing confirmations, API key notifications, and service disruption notices. These are transactional, not marketing.
• Improve our service — analyze usage patterns to identify popular endpoints, optimize performance, and prioritize new features. For this we keep weekly call counts per account (total, API and MCP calls; no endpoint, IP address or email), rolled up from the request logs before they expire.

4. Legal basis for processing (GDPR)

As a service operated within the European Union, we process personal data in accordance with the General Data Protection Regulation (GDPR). Our legal bases for processing are:

• Contract performance (Article 6(1)(b)) — processing necessary to create your account, provide API access, manage your subscription, and handle billing.
• Legitimate interest (Article 6(1)(f)) — security monitoring, abuse prevention, fraud detection, and service improvement. We balance these interests against your rights and only process data that is proportionate to the purpose.
• Consent (Article 6(1)(a)) — optional marketing emails and product announcements. These are strictly opt-in. To withdraw consent to marketing emails, use the unsubscribe link in the email or contact admin@ko.io.
• Legal obligation (Article 6(1)(c)) — retention of payment records for tax compliance, and cooperation with law enforcement when legally required.

5. Data storage and security

How and where we store your data:

• Account data is stored with our cloud database provider (Cloudflare), encrypted at rest, with automatic backups.
• API usage logs are kept for 90 days with our cloud database provider (Cloudflare) and then deleted.
• Passwords are hashed using PBKDF2-SHA-512 with 100,000 iterations and a unique salt per account. We never store or log plain-text passwords.
• Data in transit is encrypted with TLS 1.2 or later (HTTPS only) for all connections to our website and API.
• Infrastructureis hosted on Oracle Cloud in Europe (primary) and Asia-Pacific (secondary), with Cloudflare's global edge network providing CDN, DDoS protection, and Web Application Firewall (WAF) capabilities.
• Server-side storage — production data is never stored on developer machines or local systems. All data resides in secured cloud infrastructure.

6. Data retention

7. Cookies and local storage

To enforce daily free limits, we keep a network-address hash that rotates daily and the positions viewed that day, normally deleting them within three days; we do not store the original IP address for this purpose. When you are signed out, the list of positions opened on this device stays in your browser's localStorage.

We take a minimal approach to browser storage. We do not use third-party tracking cookies of any kind.

• Authentication token— a JSON Web Token (JWT) is stored in your browser's localStorage upon login. This token expires after 24 hours, at which point you will need to sign in again. It is used solely for authenticating your requests.
• No advertising or cross-site trackers — we do not use Google Analytics, Facebook Pixel, Hotjar, Mixpanel, or any advertising or cross-site tracking service. Your browsing activity on ko.io is not shared with advertising companies.
• Cloudflare Web Analytics — ko.io pages load a small Cloudflare script (static.cloudflareinsights.com) that reports page views and page-load performance to Cloudflare, such as the page address, referrer, browser type and load timings. It is cookieless: it sets no cookies and does not use local storage or fingerprinting to identify you or follow you across websites. We see only aggregate counts and timings, not individual visitors.
• Product events — the website keeps a random pseudonymous identifier (ko_enroll) in your browser's localStorage and records which paywall was shown and whether a checkout was started or completed. When you are signed in, these events are also linked to your user ID. They contain no email address, token, IP address or page URL. They are stored with our request logs for the request-log retention period (90 days). They set no cookies and use no advertising trackers.
• Cloudflare security cookies — Cloudflare may set a small cookie (e.g., __cf_bm) for bot detection and DDoS mitigation. These are strictly functional and do not track you across websites.

The website also stores interface preferences, such as theme and table view, in your browser. The API playground can retain its API key for the current browser tab.

8. Third-party services

We use the following third-party service providers to operate ko.io. They process personal data on our behalf as sub-processors; the same list, with transfer safeguards, is on our GDPR page:

• Stripe — handles all payment processing. Stripe is PCI DSS Level 1 compliant, the highest level of certification in the payments industry. See Stripe's Privacy Policy.
• Cloudflare — provides CDN, edge compute, database (accounts, API keys, request logs and email subscriptions), object storage (feedback screenshots), static site hosting, DNS, DDoS protection, and cookieless, aggregate website analytics (Cloudflare Web Analytics). Cloudflare processes request metadata at the edge. See Cloudflare's Privacy Policy.
• Google — provides OAuth authentication for users who choose to sign in with Google. Google sends us your name, email address, Google account identifier and profile picture URL; we store only the name, email address and account identifier. See Google's Privacy Policy.
• Oracle — cloud infrastructure hosting our API servers and our regulatory and market dataset (European Union primary, Asia-Pacific replica). See Oracle's Privacy Policy.
• Resend — delivers account and subscription emails. It receives the recipient address and the email content. See Resend's Privacy Policy.

We share personal data only with the service providers listed above, and only as needed to run ko.io, or where required by law. We do not share it with advertising networks, data brokers or social media platforms.

9. International data transfers

ko.io is operated from the European Union and processes personal data under EU data protection law. Some of our service providers process data outside the European Economic Area; where they do, the safeguards below apply.

• API servers — European Union (primary) and Asia-Pacific (secondary, for API availability in that region). The API servers process requests and hold the regulatory and market dataset; account records are not stored on them.
• Cloudflare — global network. Requests are processed at the nearest Cloudflare data center, and account data, request logs and email subscriptions are stored with Cloudflare as our database provider.
• Transfer safeguards— for each service provider that processes personal data outside the European Economic Area (Cloudflare, Stripe, Oracle, Resend, Google): appropriate safeguards under Art. 46 GDPR, such as Standard Contractual Clauses in the provider's data processing terms. Where a U.S. provider participates in the EU-US Data Privacy Framework, that adequacy decision can also apply. The same list is on our GDPR page.

10. Children’s privacy

ko.io is a professional financial data service and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a user is under 18, we will promptly delete their account and all associated personal data. If you believe a minor has provided us with personal information, please contact us at admin@ko.io.

11. Your rights

Under the GDPR and applicable data protection laws, you have the following rights regarding your personal data:

• Right of access — request a complete copy of the personal data we hold about you.
• Right to rectification — correct any inaccurate or incomplete personal data.
• Right to erasure— request deletion of your personal data (“right to be forgotten”). We will remove all personal data within 30 days, except where retention is required by law.
• Right to data portability — request a copy of your personal data in a machine-readable format by emailing admin@ko.io.
• Right to restriction — request that we limit processing of your data while a dispute is resolved.
• Right to object — object to processing of your data based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.

How to exercise your rights: You can update your display name and delete your account in Settings. For access, portability or other data-rights requests, email admin@ko.io. We will respond to all data rights requests within 30 days. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se. For EU-specific details, see our GDPR page.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes:

• We will provide at least 30 days' notice before the changes take effect.
• Registered users will be notified via email.
• The updated policy will be posted on this page with a revised “Last updated” date.
• Previous versions of this policy are available upon request by emailing admin@ko.io.

Continued use of ko.io after the effective date of a revised policy constitutes acceptance of the updated terms.