Privacy Policy

Last updated: June 24, 2026

This Privacy Policy explains how Komora CRM ("Komora", "we", "our", or "us") collects, uses, stores, protects, and deletes personal information when schools, administrators, teachers, and students use our CRM platform at https://komora-crm.com/.

Komora does not sell personal data or Google user data. Komora uses Google user data only to provide the Google Calendar synchronization features requested by the user or the user's school.

Information We Collect

Komora may collect and process the following categories of information:

• Account information, such as name, email address, role, school affiliation, and login details.
• CRM data entered by schools, such as students, teachers, groups, lessons, payments, attendance, notes, materials, and schedules.
• Technical information, such as browser type, IP address, access logs, error logs, and security audit records.
• Support communications sent to us by email, messenger, or other support channels.

Google User Data Accessed

If a teacher connects a personal Google Calendar account, Komora requests access only to the Google Calendar data needed to synchronize CRM lessons with that teacher's calendar. Komora may access or process:

• The teacher's Google account email address, used to show which Google Calendar account is connected.
• OAuth access tokens, refresh tokens, token expiry time, and granted scopes, used by Komora's backend to keep the calendar connection working.
• Google Calendar event data for synchronized lesson events, including event ID, title/summary, start time, end time, status, and Komora private event properties used to match a Google event to a CRM lesson.
• Google Calendar incremental sync metadata, such as sync tokens and webhook/watch channel identifiers, used to detect changes in Google Calendar.

Komora currently uses the Google Calendar Events permission (https://www.googleapis.com/auth/calendar.events) so it can create, update, read, and delete only calendar events needed for lesson synchronization.

How We Use Google User Data

Komora uses Google user data only for these purposes:

• To create Google Calendar events for lessons scheduled in Komora CRM.
• To update Google Calendar events when a lesson is rescheduled, changed, canceled, or deleted in Komora CRM.
• To read changes made to synchronized Google Calendar events and apply supported time/date changes back to Komora CRM.
• To display the connected Google Calendar account status to the teacher or authorized school administrator.
• To maintain secure OAuth authorization, refresh expired access tokens, renew webhook watches, and troubleshoot sync errors.

Komora does not use Google user data for advertising, profiling, sale of data, or unrelated product analytics. Komora does not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

Zoom User Data Accessed and Used

When an authorized teacher connects Zoom, Komora accesses only the Zoom data needed to create and maintain lesson meetings and to determine attendance for the corresponding CRM lesson. This may include the connected Zoom user's identifier and account identifier, OAuth credentials, meeting identifiers and schedule, and participant join and leave events.

• Meeting create, read, update, and delete permissions are used only for lessons managed in Komora.
• Past participant data and signed participant webhooks are used only to calculate attendance for the matching lesson.
• Komora stores attendance aggregates and pseudonymous participant keys; it does not retain participant display names, email addresses, or raw webhook payloads for attendance processing.
• Zoom data is not used for advertising, sale, unrelated analytics, or training generalized AI or machine-learning models.

Data Sharing

Komora does not sell, rent, or trade Google user data. Google user data may be shared only in the limited circumstances below:

• With the connected user's school account inside Komora, so authorized staff can manage lesson scheduling and calendar synchronization.
• With infrastructure and hosting providers that help us operate Komora CRM, such as server, database, storage, monitoring, and backup providers.
• With Google APIs, as required to perform the requested Google Calendar synchronization.
• If required by law, regulation, legal process, or a valid governmental request.

Any third-party service providers are used only to operate, secure, maintain, or support Komora CRM. They are not permitted to use Google user data for their own advertising or unrelated purposes.

Data Storage and Protection

Komora stores CRM, Google Calendar, and Zoom connection data on protected server-side systems. OAuth tokens and Zoom connection secrets are encrypted at the application layer at rest and are not exposed to students or teachers in the browser interface. We protect data using measures such as HTTPS in transit, authentication, role-based access controls, server access restrictions, audit logging where appropriate, and operational monitoring.

Access to school data is limited according to the user's role in Komora. Teachers can connect and manage their own Google Calendar connection, and school administrators can access only the schools they are authorized to manage.

Data Retention and Deletion

Komora retains CRM data and Google Calendar synchronization metadata only for as long as needed to provide the service, comply with legal obligations, resolve disputes, maintain security, and support the school account.

• When a teacher disconnects Google Calendar, Komora disables the connection and removes stored Google OAuth credentials and sync metadata from the active connection record.
• When a teacher disconnects Zoom, Komora revokes the Zoom token when available and deletes the active Zoom connection credentials.
• When a school account is terminated, Komora deletes or anonymizes school data according to the school's agreement and applicable legal requirements.
• Users may request deletion or correction of their personal data, including Google Calendar connection data, by contacting support@komora-crm.com.
• After a verified deletion request, Komora deletes the relevant data unless retention is required by law, security, fraud prevention, billing, or legitimate operational needs.

Google API Limited Use Disclosure

Komora's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

User Choices

• Teachers can choose whether to connect a personal Google Calendar account.
• Teachers can disconnect Google Calendar from their Komora teacher dashboard.
• Users can contact us to request access, correction, export, or deletion of their personal data.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and may notify users through the product or other appropriate channels.

Contact Us

If you have questions about this Privacy Policy or want to request deletion of your data, contact us at support@komora-crm.com.