Privacy Policy

Koti (“we,” “us,” or “our”) is a marketplace that connects Miami homeowners with local home-service professionals. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

1. Information we collect

From homeowners. When you describe a project, we collect the details you provide: your name, phone number, email address, ZIP code, an optional street address, the service category you select, a description of the work, and any photos you choose to upload. We verify your phone number with a one-time SMS code.

From professionals. When a professional joins Koti, we collect business and contact information provided during onboarding, plus payment information needed to unlock leads. Card details are processed directly by our payment provider and are never stored on our servers.

Automatically. Like most websites, we receive basic technical information such as device type, browser, and pages visited, which we use to keep the service running and improve it.

In the mobile app. If you use the Koti app, we also store a device push token when you turn on app notifications, so we can deliver alerts about your requests. The token identifies your device for notifications only; you can turn notifications off in your Koti settings or your device settings at any time. When you use Koti inside the app, the requests and sign-ups you make are marked as coming from the app (a source tag, the same kind we use for a printed flyer) so we can tell app and web activity apart.

Public profiles. Koti creates a public profile for each professional who is ready to receive requests, from the information in their registration and profile. The profile shows their business description, services, service areas, portfolio photos, and any credentials they choose to submit. To protect professionals’ privacy, public profiles, search results, and conversations show a professional by first name and last initial only; business names, full names, and contact details are not displayed — except the license or certificate number Florida law requires in contractor advertising, which appears on the profile of a professional whose license we have verified.

Messages. When you message another user through Koti, we collect the content of the conversation so we can deliver it, keep contact details protected until an unlock, and enforce our safety and anti-circumvention rules.

Reviews. If you review a professional, we collect your review and rating, linked to the completed project it describes.

Browsing public profiles does not require an account; we collect only the basic technical information described above.

2. How we use your information

We use the information we collect to:

• Review your project and match it with a suitable local professional.
• Verify your identity by phone and communicate with you about your request.
• Operate the professional side of the service, including lead delivery and billing.
• Prevent fraud, abuse, and misuse of the platform.
• Improve Koti and comply with legal obligations.
• Operate public profiles and search, so homeowners can discover professionals.
• Deliver messages between users and moderate them — including automated scanning of messages, profiles, and images for contact information shared to bypass an unlock, and for fraud and abuse. If a conversation is reported or flagged, our team may review the messages in it. Messages blocked by these systems are not stored; we keep only a record that a block occurred (the conversation, the time, and the rule involved).
• Publish and manage reviews for completed projects.

If you file a KotiProtect claim. When you ask Koti to review a claim, we collect the documents and information you send us (such as photos of the damage, receipts, and repair estimates) and we review the records of the project the claim is about — the booking, the invoice and payment records, and the project communications. We use this information to evaluate the claim, to prevent fraud, and, where a claim concerns a professional’s work, for the review and enforcement purposes described in these terms. We share the parts of a claim that concern a professional with that professional so they can respond to the review, and claim payments are processed through our payment providers. We keep claim files while a claim is open and afterwards for the period our legal and accounting records require.

3. How your information is shared

With the professional you work with. When a professional unlocks your request — whether Koti matched you or you chose them directly — we share your contact details with that professional so they can reach you about your project. Your exact street address is shared only after an unlock, and only when you provide or confirm it for that project. Before an unlock, a professional you message or send a direct request to can see your first name, your project description and any photos you share with your request, your ZIP code, and the category and urgency of your project — not your phone number or exact street address.

Public profiles. What the public sees on a professional’s profile is limited to: first name and last initial, photo, services and service areas, portfolio, reviews, any verification labels, and — where Florida law requires it in contractor advertising — the professional’s verified license or certificate number. Business names, full names, phone numbers, and email addresses are not displayed publicly. Professionals can edit or remove their profile content from their dashboard at any time. Public profile pages may appear in search-engine results.

We do not sell your personal information. We do not sell, rent, or trade your contact details to data brokers or advertisers.

Service providers. We share limited information with providers that help us operate Koti: SMS verification, payment processing, email delivery, messaging and moderation processing, database hosting, and website hosting. These providers may only use your information to perform services for us.

Legal. We may disclose information if required by law or to protect the rights, safety, and integrity of Koti, our users, and the public.

4. Your choices and rights

• Delete your account. You can delete your own account at any time — professionals under Settings → Delete account, homeowners under Account → Delete account. Deletion is scheduled with a 7-day grace period (sign in and cancel any time before it runs). When it runs, your contact details are removed; past service history is kept in anonymized form (“Former pro” / “Former homeowner”) because the other side of a completed job relies on it. Step-by-step: koti.house/delete-account.
• You may ask us to access, correct, or delete the personal information we hold about you by writing to privacy@koti.house.
• You can opt out of non-essential messages at any time; transactional messages about an active request may still be sent while it is being handled.
• Photos you upload are used only to describe your project to a matched pro.
• Your profile content. Professionals can edit or delete their public profile and portfolio content at any time from their dashboard. Deleting an account removes the public profile and portfolio, including reviews the professional received. Reviews you wrote about a completed project may remain visible in anonymized form (for example, attributed to a “Verified homeowner”), and records of completed projects are kept anonymized, as described under “Delete your account” above.
• Photos you upload with a project request are shared with the professional as described in Section 3. We remove location metadata from photos before they are displayed publicly.

5. SMS communications

Koti sends text messages to (a) homeowners who request phone verification or updates about their request, and (b) professionals who opt in to receive match alerts.

• Consent. You receive these messages because you provided your mobile number and agreed to receive them — homeowners during request intake, professionals during partner registration.
• Message frequency. Frequency varies with your activity: for example, one verification code per request, and match alerts only when new matching leads arrive.
• Your mobile number is never shared. We do not sell, rent, or share your mobile phone number with third parties for their marketing purposes.
• Opt out. Reply STOP to any message to stop receiving texts; reply HELP for help. Message and data rates may apply.

6. Identity verification (professionals)

When a professional completes identity verification, the ID document and the selfie are collected and processed by Stripe, Inc., our identity-verification provider — not by Koti. Stripe checks that the document is genuine and compares the selfie with the photo on the document, using biometric technology (a measurement of facial geometry) to make that comparison.

What Koti stores: the reference and state of your verification session, its dates (created, last changed, and verified), the type and issuing country of your document, and — if a verification does not pass — the error code and reason category. Koti also stores the result of the name check described next (whether the name matched, the state of any review, and who resolved it and when) and the versions of the consent screen and policies you accepted.

Read once, never stored: to check that the person verifying is the account's registered responsible person, our system reads the first and last name from your ID once, compares it with the name registered on your account, and discards it. The name itself is never written to our database; only whether it matched is kept.

Never received: your document number and your date of birth never reach our system — Stripe releases them only under special restricted keys that Koti does not create, so they are not part of the response our system receives.

Received in the response, never used: that response does include the address shown on your document, and can include an email address and a phone number from the verification. Our application never reads, stores, or uses them.

Only at Stripe: your ID photo, your selfie, the biometric measurement, and the rest of Stripe's verification report stay with Stripe. Koti does not request or retrieve them, and Stripe does not send Koti the biometric measurement.

Access — how your ID photo and selfie are protected. Koti's systems never retrieve your ID photo or your selfie. Our integration contains no image-retrieval path, and reaching verification images — or the detailed verification results — through Stripe's API requires special restricted API keys that Koti does not create, so the images are unreachable to our systems and are never stored by Koti. Stripe's Dashboard is different: Stripe account owners and administrators with the appropriate identity-verification permission may technically access identity images through the Dashboard. Koti does not claim that Dashboard access is technically impossible. For team-member accounts, the permission is assignable individually and Koti assigns it only to the team members who administer verification; members without it cannot see those pages at all. Koti policy prohibits viewing or downloading ID or selfie images. Access to your verification result inside Koti is likewise limited to the team members who administer accounts and handle verification support.

Stripe's separate, optional choice. Stripe processes biometric information for identity verification and fraud prevention. Separately, inside its own flow, Stripe may ask for your additional, optional consent to use biometric information to improve its verification technology. That consent is between you and Stripe. Declining or withdrawing it does not affect your Koti verification or your Koti account, and you may change it with Stripe directly (privacy@stripe.com). It is separate from the verification itself and separate from deleting your verification record with Koti, described next.

Retention and deletion. Stripe deletes biometric identifiers within one year of verification. Stripe keeps the rest of the verification record under its own retention schedule — see Stripe's Privacy Policy. You may ask Koti at any time to delete your verification data: contact Koti Support and we will redact your verification session with Stripe (which deletes the personal information Stripe holds for that session as our processor) and delete the result record in your account where the law allows. You may also contact Stripe directly about data it holds as a controller (privacy@stripe.com). Deleting your verification data removes the Identity Verified badge immediately and returns your account to unverified status — with the consequences described in the Pro Terms (no new requests and no public listing until you verify again; a transition deadline that is still running is not extended by a deletion). Records that the law requires Koti to keep — for example, records tied to payments, disputes, fraud investigations, or legal process — may be retained despite a deletion request, for as long as that requirement lasts.

See also our Biometric Information Policy.

7. Data retention and security

We keep personal information only as long as needed for the purposes described here — for example, to service your request, resolve disputes, and meet legal requirements. We keep messages for as long as needed to operate the service, resolve disputes, and enforce our rules. We use reasonable administrative, technical, and physical safeguards, but no method of transmission over the internet is completely secure.

8. Children

Koti is intended for adults. We do not knowingly collect personal information from anyone under 18.

9. Changes to this policy

If we change this Privacy Policy, we will post the updated version here and revise the “last updated” date above. Continued use of Koti after changes take effect means you accept the updated policy.

10. Contact

Questions about this policy? Write to us at privacy@koti.house.