Privacy Policy

Koala is operated by Abhinav Alwarappan. We are not an insurance company, an insurance agent, a broker, a rating bureau, a payroll provider, a law firm, or an accounting firm. We do not sell insurance, we do not place coverage, and we do not represent you in litigation. Nothing Koala produces is legal, tax, or accounting advice.

Koala is a business-to-business service. It is offered to employers and their advisors, not to individual consumers, and it is built for the United States market. It is not directed at organizations outside the US. If you use it from elsewhere, please read the section below on the EU and the UK first.

• Account information: you sign in with Google. When you do, we receive the email address and the basic profile details Google returns with it, such as name and profile picture. We do not receive your Google password.
• Business profile: details about the employer being reviewed (legal and trade name, federal employer identification number, industry, the states you operate in, entity structure and any affiliated entities, headcount, and the carrier, policy numbers, and policy periods under review).
• Payroll and tax records you submit: payroll registers and wage detail, payroll summaries by job classification code, overtime records, executive officer compensation, federal and state payroll tax filings such as IRS Form 941 and state unemployment wage reports, and general ledger or job cost detail. These records identify individual employees by name and wages, and some state wage reports include Social Security numbers.
• Insurance records you submit: policy declarations and endorsements, carrier audit worksheets and final audit statements, premium billing statements, loss runs, experience modification worksheets, job descriptions, and certificates of insurance for subcontractors. Loss runs describe individual workplace injuries, and can include an injured worker's name, the nature of the injury, and medical and indemnity amounts paid.
• What you type: your description of the audit or dispute, notes about job duties and operations, and the messages you send our AI assistant.
• Engagement and billing records: your business contact details, the terms of your engagement, the findings and filings on your account, the savings realized, and the identifiers Stripe gives us for your customer and invoice records. Payment card details go to Stripe, not to us. We never receive or store a full card number.
• A coarse request identifier: derived from your IP address, used only to enforce rate limits and to stop abuse of the service.

Please redact Social Security numbers from wage reports before you send them wherever your payroll system allows it. We do not need them to classify payroll, and we would rather not hold them. We do not ask for, and you should not send us, banking credentials or login credentials for your carrier, payroll, or tax portals.

Most of what you send us is other people's personal information. A payroll register names your employees and states what they earn; a state wage report can carry their Social Security numbers; a loss run describes their injuries. We cannot review classification or experience rating without those records.

For that information, you are the controller and Koala is your service provider. We process it only on your instructions, only to perform the review and to prepare filings you authorize, and for no purpose of our own. We do not sell it, we do not use it to build profiles, and we do not combine it with data from other clients. You are responsible for having the authority to give it to us, and for any notice or consent your own employment and privacy obligations require. If one of your employees asks us directly to access or delete information we hold about them, we will refer them to you and tell you about the request.

Almost everything above comes directly from you: what you type, the records you upload, and what you save in your business profile. The exceptions are narrow. Account email, name, and profile picture come from Google when you sign in. Billing status comes from Stripe when an invoice settles. And where you sign a letter of agency or an authorization to release records, we may request policy, audit, loss, or experience rating records directly from your carrier, your broker, or the applicable rating bureau on your behalf. We do not buy personal information from data brokers, and we do not enrich your records from third party sources.

We use your information for these purposes, and no others:

• To perform the premium audit review: reading your records, mapping payroll to job classification codes, testing officer payroll limits, excess overtime, subcontractor charges and other inclusions and exclusions, and recalculating your experience modification.
• To produce your findings report, with the calculation and the classification, manual, or bureau rule behind each finding.
• To prepare and support dispute filings you authorize to your carrier, the applicable rating bureau, or a state insurance regulator.
• To answer your questions in the AI assistant.
• To create and secure your account, and to keep you signed in.
• To calculate our contingency fee on verified savings, to invoice you, and to keep the accounting records that go with it.
• To email you your report and filing correspondence, if you ask us to.
• To keep the service running: rate limiting, preventing abuse, debugging errors, and maintaining security.
• To comply with the law, and to establish or defend legal claims.

We do not use your information for advertising, and we do not profile your employees.

Two kinds of third party see your data: the service providers that run Koala, and, only where you authorize a filing, the carrier or bureau the filing is directed to.

Service providers. Each one processes your data only to perform its function for Koala, under its own agreement with us:

• Supabase: sign-in, and the database that holds your account, business profile, review records, and billing status.
• Stripe: processes payment of our invoices and holds card details.
• Google (Gemini): the AI provider. The text of your records, images of your documents, and the messages you send the assistant are sent to this provider so it can generate the analysis and the answers.
• Exa: runs web searches for classification, manual, and bureau rule sources.
• Resend: delivers your report and filing correspondence by email, if you opt in.
• Upstash: enforces rate limits. It receives only the coarse request identifier, never your records or your messages.
• Vercel: hosts the site and runs the servers. Its infrastructure processes your requests and keeps operational logs.

Carriers, bureaus, and regulators. A dispute filing only works if the recipient can see the evidence behind it. When you authorize a filing, we send the specific records supporting it (for example the payroll detail and job descriptions behind a reclassification, or the loss run entries behind an experience modification correction) to your carrier, the applicable rating bureau, or the state insurance regulator. We send what that filing needs and nothing beyond it, and we do not make a filing you have not approved.

We do not share your information with data brokers or advertisers, and we do not share it with your broker or agent unless you tell us to. We may disclose information if we are legally required to, for example in response to a valid subpoena, or where it is necessary to protect someone's safety or to defend our legal rights. If Koala is ever acquired or merged, your information may transfer to the acquiring entity, which would remain bound by this policy until you are told otherwise.

The classification analysis, the savings estimates, the experience modification recalculation, the findings report, and the assistant's answers are generated with the help of an AI model. Models can be wrong. They can misread an audit worksheet, apply the wrong state rule, or state a number that does not hold up.

That is why every finding, and the calculation and rule citation behind it, goes through internal review before it is included in a dispute filing or submitted to a carrier, bureau, or regulator. Nothing is filed on model output alone. Material you view in the product before that review (a preliminary estimate, an assistant answer) has not yet been through it, so read it as a starting point and check it against your own records. If you believe an output about you or your employees is wrong, email koala.insurance.help@gmail.com and we will look at it and correct our records.

We do not use your payroll, tax, loss, or policy records to train our own models.We do not have our own models. Your inputs are sent to the AI provider named above purely so it can return an answer, and that provider's handling of them is governed by its own API terms, which we rely on. We are not in a position to make promises on that provider's behalf. If how your data is handled at the model layer matters to you, read that provider's current terms before you upload anything.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law and the other state privacy laws referenced below. We have never done so. There is no advertising technology on this site: no ad pixels, no ad networks, and no third party trackers.

Koala sets only the cookies it needs to work. There are two: the session cookie that keeps you signed in after you authenticate, and a signed cookie that records your account's entitlement so we can unlock the right features.

We do not run product analytics, we do not use advertising or tracking cookies, and we do not have a third party error monitoring tool installed. There is nothing here to opt out of today. If we add any of these, we will update this policy and describe what is collected and how to opt out before we turn it on.

Our Cookie Policynames both cookies, states how long each one lasts and who can read it, lists the two things we keep in your browser's local storage, and explains what stops working if you block cookies for this site.

The files you upload are not stored. When you submit records for review, they are read in memory on our server, converted to text or images, and sent to the AI provider for analysis. The original files are not written to our database or to file storage, and we do not keep a copy of them.

What we do keep, and for how long:

• Your review record: the description you wrote, the payroll, classification, and loss figures extracted from your records, the findings and calculations produced from them, the filings made, and your assistant messages for that review. We keep this so you can re-open and re-download your report, and because a filing can be reopened or appealed long after it is submitted.
• Your business profile: kept until you change or remove it. You can edit or clear any part of it yourself at any time.
• Your account and billing records: kept while your account is open, and afterwards where we need them for tax, accounting, or legal reasons.
• Server logs: kept for a short operational period by our hosting provider. Our own log lines are scrubbed of personal information before they are written, as described below.

To be straightforward with you: we do not currently run an automated deletion schedule, and there is no self-serve delete button yet. That means a review record stays in the database until you ask us to remove it. Email koala.insurance.help@gmail.com and we will delete your review records, your profile, and your account, and confirm when it is done, unless we are required to retain something for a legal or accounting reason, or need it to support a filing that is still open. Setting a defined maximum retention period, and building a delete button, are both on our list.

These are the measures we actually have in place:

• Your data travels over encrypted connections (HTTPS) between your browser, our servers, and every provider listed above.
• Your profile and your review records are protected in the database by row-level security, so the database itself enforces that one account cannot read another account's rows. It is not left to application code to remember.
• We never receive or store a full payment card number. Stripe holds it.
• Our server logs are passed through a scrubber that redacts emails, Social Security numbers, street addresses, phone numbers, ZIP codes, and policy and claim numbers before anything is written. Payroll detail and uploaded document content are never passed into a log line in the first place.
• Access to production data is limited to the people who need it to operate the service.

We want to be equally clear about what we do not have. Koala has not completed a SOC 2 audit, is not ISO 27001 certified, and holds no other security certification. Workers' compensation records are generally outside HIPAA, and we are not a HIPAA covered entity or business associate; we do not hold the injury information in a loss run as protected health information under HIPAA, though we do treat it as sensitive. No service can promise perfect security, and we do not.

Koala is a business service for employers and is not directed to children. We do not knowingly collect personal information from anyone under 13, and the service is not available to individuals for personal use. If a payroll record you submit happens to include a minor employee, we process it exactly as we process any other payroll line: to classify payroll, and for nothing else.

Whoever you are, you can ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, or ask us to delete it. Email koala.insurance.help@gmail.com. We will confirm we received your request, verify that the request really comes from you (normally by checking it against the email address on the account), and respond. We do not charge for this, and we will not treat you worse for asking.

If you are an employee of a Koala client and your information reached us in a payroll record, wage report, or loss run, we hold it as that employer's service provider. Send your request to your employer, who can direct us; if you send it to us instead, we will pass it to them and tell you we have done so.

California is the state whose privacy law reaches this service most directly, because the California Privacy Rights Act removed the exemptions that used to cover business contacts and employee data. So the CCPA, as amended by the CPRA, can apply both to you as a business contact and to your California employees whose information appears in the records you send us. This section is your notice at collection.

Categories of personal information we collect. In the last 12 months we have collected: identifiers (name, business email address, business contact details, employee names appearing in payroll and loss records, and an IP-derived request identifier); professional or employment-related information (job classification, job duties, wages, hours, overtime, and officer compensation); commercial information (your engagement, our invoices, policy and premium figures, and the amounts in your audit and loss records); internet or network activity (the requests your browser makes to our servers); and other information you volunteer, including your description of the audit and your assistant messages.

Sensitive personal information. Some records contain sensitive personal information: Social Security numbers on state wage reports, and health-related detail about workplace injuries in loss runs and experience modification worksheets. We collect this only because classification and experience rating review cannot be done without it. We use it solely to perform the service and for the security and operational purposes described above. We do not use or disclose it to infer characteristics about anyone. Because our use falls within the purposes California law permits without a limit right, we do not offer a Limit the Use of My Sensitive Personal Information link, and there is nothing for such a link to switch off. You can still ask us to delete the information outright, and we will.

Business and commercial purposesfor collecting it are the ones listed under "Why we use it" above. Categories of third partiesthat receive it are the service providers listed under "Who we share it with", all of which are service providers or contractors under California law, together with the carrier, rating bureau, or regulator a filing you authorize is directed to. Sourcesare described under "Where the information comes from".

We do not sell or share personal information, and we have not in the preceding 12 months. There is no Do Not Sell or Share My Personal Information link because there is nothing to opt out of.

Your rights are to:

• Know what personal information we have collected, used, and disclosed, and get a copy of it.
• Correct inaccurate personal information.
• Delete personal information we collected from you, subject to the exceptions the law allows.
• Opt out of the sale or sharing of personal information, which does not arise here because we do neither.
• Limit the use of sensitive personal information, as explained above.
• Not be retaliated against or discriminated against for exercising any of these rights. We will not decline the engagement, charge more, or give you a worse version of the service because you asked.

To exercise any of them, email koala.insurance.help@gmail.com. We will acknowledge your request within 10 business days and respond within 45 calendar days. If we need more time, we will tell you why and take up to another 45 days. An authorized agent may make a request on your behalf if they give us written proof of authorization. Requests about an employee's information should come through the employer, as described above.

The comprehensive consumer privacy laws in Virginia, Colorado, Connecticut, Utah, Texas, and the other states that have followed them generally exclude personal data processed in a business-to-business or employment context, which is nearly everything Koala handles. So for most of what we process, those laws do not attach in the way California's does.

We would rather not stand behind that technicality. Where one of those laws would give you a right to confirm and access your personal data, correct it, delete it, or obtain a portable copy, we will honor the request on the same terms described under "Your privacy rights" above whether or not the exemption applies. The opt-outs those laws provide (targeted advertising, sale of personal data, and profiling that produces legal or similarly significant effects) have nothing to switch off here, because Koala does none of those things and honors universal opt-out signals such as Global Privacy Control by having no such processing to stop in the first place.

Appeals. If we decline a request, we will tell you why. You can appeal by replying to that email, or by writing to koala.insurance.help@gmail.comwith "Privacy appeal" in the subject line. We will respond within 45 days, in writing, with our reasoning. If we deny the appeal, we will give you a way to contact your state attorney general to complain. Texas residents can contact the Office of the Texas Attorney General. Residents of other states can contact their own attorney general.

Koala is aimed at US employers and we do not target or market the service in the EU, the EEA, or the UK. If you use it from there anyway, and the GDPR or UK GDPR applies to that use, here is where we stand.

Roles and lawful bases. For your business contact and account data we are the controller, and we process it to perform our contract with you. For the employee data inside the payroll, tax, and loss records you submit, you are the controller and we are your processor, acting on your documented instructions. We process a coarse request identifier, and keep security logs, on the basis of our legitimate interests in keeping the service running and free from abuse. We keep some records to comply with a legal obligation, such as tax rules.

Rights. You may request access, rectification, erasure, restriction of processing, and portability, and you may object to processing based on legitimate interests. Email koala.insurance.help@gmail.com. You also have the right to lodge a complaint with your supervisory authority, or with the Information Commissioner's Office in the UK. Requests from your employees should come through you as the controller.

International transfers, stated plainly. Koala and all of its providers operate in the United States, so using the service means your data is transferred to and processed in the US. We have not put a specific transfer mechanism such as Standard Contractual Clauses in place, because the service is not offered to the EU or the UK. If you are subject to the GDPR or UK GDPR and this matters to you, please contact us at koala.insurance.help@gmail.com before you upload anything, rather than assuming a safeguard is in place that is not.

If we discover a breach of security that compromises personal information, we will investigate it, take steps to contain it, and notify you and the relevant regulators where the law requires it, without unreasonable delay. Because much of what we hold is your employees' information and you are its controller, we will notify you promptly enough for you to meet your own notification obligations, and tell you what happened, what information was involved, and what you can do about it. If you believe you have found a security vulnerability in Koala, please tell us at koala.insurance.help@gmail.com.

We will update this policy when our practices change, and we will change the "Last updated" date at the top when we do. If a change materially affects how we handle personal information, for example if we start using an analytics tool, add a new provider that receives your records, or change the AI provider, we will make that clear and, where the law requires it, ask for your consent before the change takes effect. The current version always governs.

Questions about this policy, or about anything we hold about you? Email koala.insurance.help@gmail.com. Koala is operated by Abhinav Alwarappan. Please put "Privacy" in the subject line so it reaches the right place.