Privacy Policy.

Effective September 4, 2026. Draft published for provider app verification; subject to counsel review.

Who we are

Koletta is collections operations software for commercial collection agencies, operated by Koletta ("we", "us"). Each agency that uses Koletta (an "Agency") is our customer and the controller of the account and contact records it loads into its own Koletta workspace. This policy explains what Koletta collects, why, and how it is protected. Questions: privacy@koletta.com.

What we collect

• Agency workspace data. Account, debtor and contact records, notes, letters, payment and promise records that an Agency imports or creates. Koletta processes these on the Agency's instructions only.
• Staff accounts. Name, work email, role, login and security data (password hash, multi-factor secrets, session and audit logs) for the Agency's users.
• Connected mailboxes. When a user connects a mailbox by signing in with Microsoft or Google, we receive OAuth tokens and the mailbox address. See "Mailbox access" below.
• Operational data. Server logs, error reports and usage metrics needed to run and secure the service.

Mailbox access (Microsoft 365 and Google Workspace / Gmail)

Koletta lets each collector send collection letters from their own mailbox and reads replies to those letters. To do that with Microsoft or Google, the user signs in with the provider and grants Koletta permission to send mail as that mailbox and read mail in that mailbox. Koletta uses this access only to:

• send the letters and test messages the user or the Agency's rules initiate, which are saved to the mailbox's own Sent folder;
• read unread inbox messages to detect replies and bounces to those letters, record them against the matching account, and mark them read.

Koletta does not read, store or use mail that is unrelated to collection correspondence beyond the header checks needed to decide that it is unrelated, and does not use mailbox data for advertising, for training machine-learning models, or for any purpose other than providing the service to the Agency. Tokens are stored encrypted per Agency; a user can revoke access at any time from their Microsoft or Google account settings, and the Agency can disconnect a mailbox in Koletta. Koletta's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use data

To provide, secure and support the service for the Agency; to send transactional messages (invitations, password resets, operational alerts); and to meet legal obligations. We do not sell personal data and do not share it with third parties except sub-processors that host or deliver the service under contract.

Sub-processors

• DigitalOcean (hosting, United States)
• Resend (transactional email delivery, for Agencies not connected through Microsoft or Google)
• Microsoft and Google (mail APIs, only for mailboxes the Agency connects)
• Anthropic (AI drafting and summaries; account data sent for a request is not used to train its models under our agreements)
• Backblaze (encrypted off-site backups, United States)

Retention

Workspace data is kept for as long as the Agency's subscription is active and deleted on written request or within 30 days after termination, except where law requires longer retention. Encrypted backups are kept for up to 366 days. Logs are kept for up to 12 months.

Security

Encryption in transit (TLS) and at rest, one shared database with row-level separation per agency, encrypted credential storage, multi-factor authentication for every user, audit logging, and daily backups with restore drills.

Your rights

Individuals whose data an Agency holds should contact that Agency, which controls the record. Agency staff may request access to or deletion of their own account data at privacy@koletta.com.

Changes

We will post any change here with a new effective date and notify Agencies of material changes.