KolaRead
Start listening free

Legal

Privacy Policy

Last updated: 8 November 2026

1. Who we are

KolaRead (kolaread.com) is operated by Kola Labs Ltd, company number 17087282, registered in England and Wales at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (“we”, “us”). We are the controller of the personal data described here. For any privacy question or request, email [email protected].

2. The personal data we collect

  • Your account: your email address, name if you give one, and a hashed password, or your name and email from Google if you sign in with Google. Kola Labs Ltd uses one sign-in across its services.
  • What you add: the text you paste, the files you upload, the links you add, the text and pictures we take from them, and the audio and word timings we make from them.
  • How you listen: your place in each reading, the voice and language you chose, and how many hours you listen each month.
  • Payments: your plan, its renewal date and invoices. Card details are handled by Stripe; we never see or keep them.
  • Technical data: your IP address and the country it shows, your browser, a random id for your browser used against fraud, and, if you allow it, how you use the site (see Cookies).
  • Messages: what you send us when you ask for help.

3. Why we use it, and our lawful basis

  • To run your account, read what you add aloud, keep your library and place, and take payments: performing our contract with you.
  • To keep the service secure, prevent fraud and abuse, and improve how well it reads: our legitimate interests.
  • Analytics and advertising cookies in the EU, EEA, UK and Switzerland: your consent, which you can withdraw at any time.
  • Invoices and tax records: legal obligation.

What you add to KolaRead is used only to read it to you. We don't sell it, and we don't use it to train AI models.

4. Who we share it with

We use these providers to run KolaRead. Each processes data only on our instructions.

  • Cloudflare: Delivers the website, protects it from attacks, and checks that an email sign-up comes from a person (Turnstile) (Global network / United States).
  • DigitalOcean: Hosting of the website, database and file storage (your account, what you add and its audio) (London, United Kingdom).
  • DeepInfra: Turns the text you add into speech; the text is processed to make the audio and not kept (United States).
  • Firecrawl: Reading a web page when you add a link (United States).
  • Stripe: Payments, subscriptions, invoices and fraud prevention (United States / EU).
  • Resend: Account emails such as sign-in codes and password resets (United States).
  • Google (sign-in): Only if you sign in with Google: your name and email address (United States / EU).
  • Google Fonts: Fonts used by the website (your browser requests them directly from Google) (United States).
  • Google (Google Analytics): Measuring how the website is used - in the EU, EEA, UK and Switzerland only if you accept analytics cookies (United States / EU).
  • Microsoft (Clarity): Heatmaps and session recordings of how pages are used, with what you type hidden - in the EU, EEA, UK and Switzerland only if you accept analytics cookies (United States).
  • Meta Platforms and Google (Google Ads): Advertising measurement - in the EU, EEA, UK and Switzerland only if you accept advertising cookies (Ireland / United States / EU).

We share data with others only when the law requires it, or to protect our rights or someone's safety.

5. International transfers

Some providers process data outside the UK and EEA, mainly in the United States. Where they do, transfers are covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or by an adequacy decision such as the EU-US and UK-US Data Privacy Framework.

6. How long we keep it

  • Your readings and their audio: until you delete them, or your account.
  • Your account: until you ask us to delete it.
  • Invoices and payment records: as long as tax law requires (usually 6 years).
  • Support messages: up to 2 years after the conversation ends.

7. Cookies and similar technologies

Essential storage keeps you signed in, remembers your cookie choices and your reader settings, and helps prevent fraud. Analytics (Google Analytics, Microsoft Clarity) and advertising (Meta, Google Ads) cookies are used in the EU, EEA, UK and Switzerland only if you accept them. .

8. Your rights

Under the UK GDPR and EU GDPR you have the right to:

  • Access the personal data we hold about you and receive a copy;
  • Rectification of inaccurate or incomplete data;
  • Erasure, including closing your account;
  • Restriction of how we use your data;
  • Data portability - your data in a common machine-readable format;
  • Object to processing based on our legitimate interests;
  • Withdraw consent at any time, without affecting earlier processing.

To use any of these rights, email [email protected] from the address on your account. We reply within one month, free of charge, and may need to confirm your identity. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) in the UK, or the data protection authority where you live or work in the EEA. We would appreciate the chance to deal with your concern first.

9. Security

Data is encrypted in transit (HTTPS) and stored with access limited to the people and systems who need it. Passwords are stored as salted hashes. If a breach affects your data we will tell you and the regulator where the law requires it.

10. Children

KolaRead is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We will post any change on this page with a new date, and tell you by email or in the app before a significant change takes effect.