Privacy Policy

Koutei PDF at kouteisystems.com is run by Koutei Systems. Koutei Systems is operated by Hugo Molaudzi, a sole proprietor in South Africa. We decide how your personal information is used, which makes us the "responsible party" under South Africa's Protection of Personal Information Act (POPIA) and the "controller" under the EU and UK General Data Protection Regulation (GDPR).

Our Information Officer is Hugo Molaudzi. For any privacy question or request, email privacy@kouteisystems.com.

Business address: 1012 Sagewood Street, Protea Glen Ext 1, Soweto, Johannesburg, 1819, South Africa

Your account

Your email address and, if you sign up with a password, that password. Passwords go straight from your browser to our sign-in provider, Supabase Auth, which stores only a salted hash; our own servers never receive them. If you choose Sign in with Google, see section 3. We use this to create and secure your account. Legal basis: providing the service you signed up for (contract).

The security check on the sign-in page

When you open the sign-in page, it runs Cloudflare Turnstile, a check that tells people from automated bots. The page loads a script from Cloudflare, and Cloudflare looks at your IP address, details of your browser and its connection (such as the user agent and TLS fingerprint) and which site is asking. It doesn't see what you type into the form. The check gives the page a one-time token, which we send to our sign-in provider, Supabase Auth, with your sign-up, password sign-in, or request for a sign-in link or password reset. While the check is switched on in Supabase, Supabase confirms the token with Cloudflare, together with your IP address. We don't store the token or Cloudflare's signals. Cloudflare also uses the signals to improve its bot detection, as described in its Turnstile Privacy Addendum. Legal basis: our legitimate interest in keeping accounts secure and stopping automated abuse.

Your plan, credits and payments

Your plan, subscription status and dates, credit balance, and a record of each payment (amount, currency, date and the Paddle customer, subscription and transaction IDs). We use this to give you the credits you paid for and to keep accurate business records. Legal basis: contract and our legal obligations.

Billing notifications from Paddle

When you pay, Paddle sends us notifications about the payment and subscription. We store them as received so we can check every payment was applied correctly and handle refunds and disputes. They include Paddle's IDs for you and your address, your account ID, what you bought and limited payment-method details: the card type, the last four digits, the expiry date and the name on the card. We never receive or store your full card number or security code. We keep these notifications for up to 5 years after the payment (see section 6). Legal basis: our legitimate interest in accurate billing and our legal obligations.

The documents you create

What you type into a template (for example your business details, your client's name and address, amounts or your work history), and any logo you add to an invoice, is sent over an encrypted connection to our servers and our rendering engine, turned into a PDF or image, and sent back to you. We don't save it to our database or file storage, and our logs don't record it. While you are signed in, we keep a record of each final document you make in the app (a free preview is not recorded) for 90 days, so it is listed under Recent activity on your dashboard: its ID, the template, the page size and language, that it is a final document, whether it is a PDF or an image, that it was made in the app, that it used a credit, a keyed fingerprint of the file (an HMAC-SHA-256 made with a secret key kept on our servers, so without that key it can't be checked against a copy of the file), its size and the time. The record never includes what you typed or the document itself, and it is deleted when you delete your account. For documents made with an API key we keep a similar record, described under "Documents made through the API" below. Legal basis: contract.

If a document includes other people's personal information, such as a client's details, you decide what to include and are responsible for having the right to use it. We process it only to create your document.

Limits on generating documents

While you are signed in, we keep a count of how many documents you start in the current minute, hour and day, and how many of them failed in the current 10 minutes and day, under a keyed code (a pseudonym) instead of your account ID. The counts are deleted automatically within 2 days. We use them only to stop one account from overloading the service. Legal basis: our legitimate interest in keeping the service available and preventing abuse.

The free invoice generator

If you use our free invoice generator without an account, what you type is handled the same way: it is not saved and our logs don't record it. To stop abuse, the generator allows up to 5 invoices an hour and 20 a day from each network. To count them, we store a one-way, keyed hash of your IP address (never the address itself) with counts, and delete them automatically within 2 days. We use them only to enforce these limits. Legal basis: our legitimate interest in keeping a free service available and preventing abuse.

If you use our free invoice generator, the invoices you make there are not listed in Recent activity and get no record in your account, even when you are signed in.

Details you choose to keep in your browser

If you turn it on, the invoice, quote and receipt forms can keep your business details, the clients you save and a list of your invoices (number, client, dates, amounts and whether each is paid) in your browser's local storage, on your device. With “Remember my details” on, it also keeps the day you last made an invoice on the free invoice generator (see “Visitor statistics” below). We never receive this: it isn't sent to our servers, it isn't part of your account and it doesn't follow you to another browser or device. When it fills in a form, what you then put on a document is sent to us to make the PDF, as described above. You can download it as a backup, import a backup, or delete it on the form (“Clear everything saved on this device”); clearing your browser data also deletes it. Because we never receive it, we can't see, recover or delete it for you.

Documents made through the API

If you make a document with an API key, what you send is handled the same way: it is used in memory to create the PDF, the PDF is sent back in the response, and neither is saved. We do keep a record of each document for 90 days: its ID, the template and its version, whether it was a final document or a preview, the page size and language, your reference label if you sent one, that it was made through the API or through our MCP server, the API key that made it, whether it used a credit, a fingerprint (SHA-256 hash) of the PDF, its size and the time. Don't put personal information in the reference label: it is stored, sent back to you in a response header, and can appear in our hosting provider's request logs when you search by it.

Our MCP server lets an AI assistant that you connect with one of your API keys make documents in the same way. What the assistant sends is handled exactly as above: used in memory, never saved, and never recorded in our logs. Each document it makes gets the same record, which says it was made through the MCP server. If the assistant sends no Idempotency-Key for a final document, the server makes one from your API key's ID and the request, and keeps only its one-way hash, as below. The assistant itself is run by its own provider, which handles what you send it under that provider's own terms.

So that a repeated request is not charged twice, we keep for 24 hours a one-way hash of the Idempotency-Key you sent and of the request, with the template, its version, whether it was a final document or a preview, its status and the document's ID. To enforce the API's rate limits and the free preview allowance (which the Generate page, the API and the MCP server share) we store keyed, one-way hashes of your API key's ID, your account ID or your network address (never the address itself) with a count, and delete them automatically within 2 days. Legal basis: contract, and our legitimate interest in preventing abuse.

API keys

If you create an API key in Settings, we store a one-way hash of it, its first few characters (so you can recognise it), the name you gave it, what it is allowed to do, and when it was created and last used. We never store the full key. A key you revoke or replace stays on your account, switched off, until you delete your account.

Technical and security logs

Like any website, our hosting providers record requests to the site: IP address, browser and device type, the page requested, the time and the response. Our sign-in provider records sign-in events with the IP address and browser used. Our own server logs record events such as a failed payment update together with your account ID, never the content of your documents. We use this to keep the service secure, stop abuse and fix faults. Legal basis: our legitimate interest in running a secure, working service.

Visitor statistics

We count visits to our website with Vercel Web Analytics, a feature of our hosting provider. It uses no cookies and stores no identifier in your browser. For each page view it records the time, the page (its address and the general route it belongs to), the address of the page that linked to it, as your browser reports it, your approximate location (country, region and city), your browser and operating system with their versions, your type of device (mobile, tablet or desktop) and the version of Vercel's statistics script. Page views in one visit are linked by a one-way hash of the request, which Vercel deletes after 24 hours, so the statistics can't identify you or follow you to other websites. We send the page address without its search or form parameters, except a link tag (see below), and we don't send anything you type. When a page finishes making an invoice, it also sends one count to these statistics, with the same details as a page view, saying which page made it and the page address's link tag, if any; the count carries nothing from the invoice and nothing you type. We see only totals. Legal basis: our legitimate interest in understanding how people find and use the site.

If you turn on “Remember my details on this device” on the free invoice generator, your browser also keeps the day you last made an invoice there, and when you make one on a later day the page sends one more count to these statistics, with the same details as a page view, saying only roughly how long it has been since then (one day, two to seven days, eight to fourteen days, or longer), never the date, an identifier or anything you type.

How you found us

Some links to our site carry a short tag, such as ?ref=newsletter, or a campaign tag (utm_source). If you create an account after arriving through such a link, we save that tag with your account, once, so we can tell which links bring people who sign up. Before you sign up, the tag travels only in the page address, and we set no cookie or browser storage for it. Once your account exists, the tag is part of your account record, and for email sign-ups it is also included in your sign-in session (held in the sign-in cookie), like your email address. We don't save the page you came from or your IP address with it. Legal basis: our legitimate interest in knowing which links and campaigns work.

To see whether new accounts manage to create their first document, we count sign-ups by tag and whether each account has used any credits, from the account and credit records described above. We don't link these counts to the documents you create or record what is in them, and we leave our own test accounts out of these counts.

Alerts about new accounts

When an account is created, we send ourselves a short message through Telegram, so we notice new sign-ups, including fake ones. It says when the account was created, how it signed up (for example email or Google), its link tag if it has one, whether its email address is confirmed, and the part of the email address after the @ (for example gmail.com). It never includes the rest of your email address, your name or your account ID. Legal basis: our legitimate interest in knowing who signs up and in spotting abuse.

We also send ourselves a short notice through Telegram when someone makes an invoice with the free invoice generator (at most about twenty notices an hour), so we can see that it is being used. It says only when the invoice was made and how many have been made that day. It never includes anything about who made it or what is in it: no IP address, nothing you typed and no file, so it contains no personal information.

Alerts about our billing system

We also send ourselves short notices through Telegram about our billing system: when payment notifications from Paddle need our attention (how many, and of what type) and when a possible duplicate subscription is detected. They say only what happened, when, and what we should check. They never include your name, email address, account ID or payment details, so they contain no personal information.

Messages you send us

If you email us, we keep the message and our reply in our business email so we can help you. Legal basis: our legitimate interest in answering you, or contract when it is about your account.

What we don't collect

• We don't use advertising or cross-site tracking tools, and our visitor statistics use no cookies.
• We don't buy personal information or combine it with data from data brokers.
• We don't ask for sensitive information such as health or ID numbers.

If you choose Sign in with Google, Google shares your name, email address, profile picture and Google account ID with us. We ask only for this basic profile information; we don't access your Gmail, Google Drive, contacts or any other Google data.

• How we use it: to create your account, sign you in and show your name and picture in the app.
• Where it is stored: in our sign-in and database provider, Supabase, with the rest of your account.
• Who it is shared with: no one, except the service providers we need to run Koutei PDF. We don't sell it, use it for advertising or use it to train AI models.
• How to remove it: delete your account in Settings, and you can also remove Koutei PDF's access at your Google account.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy.

We use a small number of service providers to run Koutei PDF. They process personal information for us under their data-processing terms:

• Supabase — sign-in and our database
• Vercel — hosts the website and its server code, and counts visits to it (Web Analytics, without cookies)
• Railway — hosts the engine that renders your PDFs and images
• Paddle — merchant of record: checkout, payments, tax, invoices, receipts and refunds
• Resend — sends sign-up confirmation, sign-in link and password reset emails
• Google (Sign in with Google) — lets you sign in with your Google account, if you choose to
• Google Workspace — our business email, for support and privacy requests
• Cloudflare (Turnstile) — runs the security check on the sign-in page, which tells people from automated bots

We also use Telegram, a messaging service, to deliver the alert about new accounts, the notice about free invoices and the notices about our billing system described in section 2 to us. It receives only those: when the account was created, how it signed up, its link tag, whether its email address is confirmed and the part of the email address after the @; for free invoices, when one was made and how many have been made that day (at most about twenty notices an hour); and, for our billing system, how many payment notifications from Paddle need our attention and of what type, or that a possible duplicate subscription was detected, and when (never anything about who they concern). Telegram offers no data-processing agreement, so we send it nothing else.

The full list, with what each one receives and where, is on our service providers page.

Paddle is the merchant of record for all paid plans. When you buy a plan, you buy it from Paddle.com Market Limited, which handles checkout, payment, tax, invoices and refunds. Paddle collects your payment and billing details directly and uses them as an independent controller under its own privacy policy. We send Paddle your email address and account ID so it can link your payment to your account.

We may also disclose information where the law requires it, to protect people from harm or fraud, or to enforce our terms. If Koutei Systems is ever sold or merged, your information may move to the new owner, and we will tell you before this policy changes as a result.

We don't sell personal information and we don't share it for targeted advertising.

We are based in South Africa. Our database is hosted in the European Union (Ireland). Some of our providers, including our website host, the engine that renders your documents and our email provider, process data in the United States and other countries. So your information leaves the country you live in.

Except for Telegram, we choose providers that protect personal information to a standard comparable with POPIA and the GDPR, and they offer data-processing terms that include the European Commission's standard contractual clauses (and the UK equivalent) for transfers from Europe and the UK. Transfers are also needed to provide the service you asked for.

Telegram offers no data-processing terms or standard contractual clauses, and may process data in any country, so we send it only the alert about new accounts, the notice about free invoices and the notices about our billing system described in section 2.

Paddle keeps its own records of your purchases under its privacy policy.

We use encrypted connections, row-level access rules in our database, hashed passwords and API keys, and separate test and live databases. Full card details go to Paddle and never pass through our servers. No system is perfectly secure; if a breach puts your information at risk, we will tell you and the relevant regulators as the law requires. More detail is on our security page.

Depending on where you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong or incomplete;
• delete your information;
• give you your information in a machine-readable format;
• stop or limit using it, or object to how we use it; and
• withdraw any consent you have given.

You can delete your account yourself in Settings. Deleting your account does not cancel a paid subscription, so cancel it in Settings first. For anything else, email privacy@kouteisystems.com from the address on your account. We may ask you to confirm your identity, and we reply within one month.

If you are unhappy with how we handle your information, please tell us first so we can fix it. You can also complain to a regulator:

• In South Africa: the Information Regulator (South Africa), inforegulator.org.za, POPIAComplaints@inforegulator.org.za.
• In the European Union: the data protection authority in the country where you live or work.
• In the United Kingdom: the Information Commissioner's Office, ico.org.uk.

If you live in the United States: we don't sell or share personal information for targeted advertising, and we don't track you across other websites. Because of that, we treat every visitor the same way whether or not the browser sends a Do Not Track or Global Privacy Control signal.

We use only the cookies needed to keep you signed in. Your browser also keeps your colour theme and, if you turn it on, the details, clients and invoice list you keep on the invoice forms. We don't use advertising or analytics cookies: our visitor statistics work without cookies. Details are in our cookie statement.

The security check on the sign-in page runs in a frame from Cloudflare, which may keep its own information in your browser there to do the check. We set no cookie or browser storage for it.

We send the emails the service needs: sign-up confirmation, sign-in links and password resets. Paddle sends your receipts and invoices. We don't send marketing emails. If we ever do, we will ask first or give you a simple way to opt out, as the law requires.

Koutei PDF is for people aged 18 and over. We don't knowingly collect information about children. If you think a child has given us personal information, email privacy@kouteisystems.com and we will delete it.

We don't make decisions about you by automated means that have legal or similarly significant effects.

We will update this policy when what we do changes, and change the date at the top. If a change is significant, we will tell you by email or with a notice on the site before it takes effect.

Privacy questions and requests: privacy@kouteisystems.com. Other questions: see our contact page.