Privacy

Privacy Policy and Cookie Policy for Ko-fi

Policy last updated and effective from 21 May 2026

1. Introduction

We are Ko-Fi Labs Limited, a limited liability company registered in England and Wales under company number 11087704 ('we', 'us' and 'our'). We are registered with the UK's Information Commissioner's Office under number ZB401278.

We operate Ko-fi, a service that allows creators to earn revenue and receive tips from their customers and supporters, as explained further below, and offered through our website, www.Ko-fi.com and, as applicable from time to time, our apps, including any iOS and Android app (Ko-fi).

This privacy policy will inform you as to how we process your personal data when you access and use Ko-fi. This privacy policy also tells you about your privacy rights under applicable data protection legislation, including to the Data Protection Act 2018, UK GDPR and EU GDPR (Data Protection Laws).

2. Who is the Controller of your personal data?

A "controller" is a person or organisation who, alone or jointly, determines the purposes for which and the way any personal data is or is likely to be processed. We are the controller of your personal data when you access and use Ko-fi, apart from when you support a Creator on Ko-fi or process payment through a third-party payment provider.

When you tip, subscribe to, or purchase from a Creator on Ko-fi, your personal information (such as your name, email address, and payment details) is shared with that Creator so they can fulfil your request or respond to your support. In these cases, the Creator is also a data controller, independently of us. This means the Creator:

is responsible for how they use and store your information
may contact you directly about your purchase or support
may be located outside your country or operate under different privacy rules

This privacy policy does not apply to personal data collected by and shared with Creators or any third-party payment processors through Ko-fi. We are not responsible for how a Creator or any third-party payment processor administers or uses personal data which they may collect from you. Please refer to the privacy policy or terms provided by the Creators and/or the third-party payment processors themselves to see how your personal data is collected and processed by them.

3. The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of your personal data which we've grouped together as follows:

Identity Data includes first name, last name, username or similar identifier, title, date of birth and gender
Contact Data includes email address, telephone number and postal address
Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating systems and platforms, device ID and other technology on the devices you use to access Ko-fi
Financial Data includes PayPal email address, PayPal ID, IP Address associated with a transaction or Stripe Connected Account information such as Stripe ID, IP address associated with the transaction as necessary so we can effect payments, as well as Tax Identification Number, VAT (Value Added Tax) or equivalent number, and/or, if applicable, company registration information
Profile Data includes your username and password, your preferences, interests and feedback
Usage Data includes information about how you interact with and use Ko-fi
Marketing and Communications Data includes your preferences in receiving marketing from us (and our third parties) and your communication preferences

4. How is your personal data collected?

We may collect personal data from you either:

Directly, where you give us your personal data so we can transact with you, including for example where you create a Ko-fi account; and
Indirectly, for example through third party cookies on Ko-fi which can be used to better understand your browsing actions and patterns.

5. How we use your personal data

We will only use your personal data when the law allows us to. We will use your personal data in the following circumstances:

Performance of a contract: Where we need to perform the contract we are about to enter into or have entered into with you. For example, when you sign up to Ko-fi and accept our terms and conditions.
Legal obligation: Where we need to comply with a legal obligation. For example, for accounting or legal purposes.
Legitimate interests: Where it is necessary for our legitimate interests or those of a third party and your interests and fundamental rights do not override those interests.
Consent: We do not generally rely on consent as a legal basis for processing your personal data. Where we do rely on consent you have the right to withdraw consent at any time. Please contact us to withdraw consent.

Depending on your relationship with us we process your personal data in the following different ways:

(1) A Creator is someone who runs their own Ko-fi page, personalising it with images, text, and videos to connect with Supporters, and can use their page to receive payments, freely given with no expectation of anything in return, sell products and custom work, offer memberships, send and receive messages, share posts, and publish other types of content.

Processing Activities	Personal Data	Lawful Basis
When you create an account with us	Identity Data and Contact Data, either entered directly or transmitted via a social sign-up facility such as ‘sign up with Google’ or ‘sign up with Facebook’, as is necessary to create a Ko-fi account.	Performance of a contract
When you register with us	Identity Data and Contact Data.	Performance of a contract
When you create a tailored profile	Profile Data and Usage Data, including images, tags, text updates and links to third-party websites or content.	Performance of a contract
Manage payments, fees and charges. Collect and recover money owed to us	Financial Data you enter to send or receive payments.	Performance of a contract
To respond to any enquiries	Identity Data, Contact Data, Profile Data and Usage Data.	Performance of a contract with you, necessary for our legitimate interests to be able to respond to you
To respond to our regulatory reporting requirements under tax reporting rules or its equivalence under law	Identity Data, Contact Data, and Financial Data.	Necessary for our legal obligations under tax reporting rules.

(2) A Supporter is someone who uses Ko-fi to follow Creators, as well as to tip, purchase, follow and/or subscribe to receive Creator Content.

Processing Activities	Personal Data	Lawful Basis
When you create an account with us	Identity Data and Contact Data, either entered directly or transmitted via a social sign-up facility (e.g., ‘sign up with Google’ or ‘sign up with Facebook’) as necessary to create a Ko-fi account.	Performance of a contract
When you create a tailored profile	Profile Data and Usage Data, including images, tags, text updates, and links to third-party websites or content.	Performance of a contract
Manage payments, fees, and charges; collect and recover money owed to us	Financial Data to send or receive payments.	Performance of a contract
When you support a Creator and follow them	Contact Data (when following a Creator). Financial Data and Technical Data when supporting a Creator to enable content you have requested to follow.	Performance of a contract
Guest Supporters (supporting a Creator as a guest)	Contact Data, Financial Data and Technical Data associated with a transaction as a guest supporter.	Necessary for legitimate interests to process your support without creating a profile.
To respond to any enquiries	Identity Data, Contact Data, Profile Data and Usage Data, any information provided in the enquiry.	Performance of a contract and necessary for legitimate interests to respond to enquiries.

Additional information regarding sharing information to Creator. When you support a Creator, we may share your:

Name or username registered with us when you make a payment to a Creator.
Email address.
Physical address (where it is requested by a Creator to deliver a product or calculate applicable taxes).
Any transaction information entered on Ko-fi required to facilitate direct communication between the Creator and Supporter, the fulfilment of transactions or calculation of tax liabilities.
Some aggregated and anonymised information about your support that cannot identify you.

Please note that when a Supporter makes a payment to a Creator using Ko-fi, the Supporter's PayPal or Stripe information may be shared with the Creator through PayPal or Stripe. To find out more, please check the help pages available here.

Creators are responsible for how they use the data collected on Ko-fi. By following, supporting, subscribing or buying from a Creator on Ko-fi you are directing us to share your information in this way. If you do not wish for information to be disclosed to a Creator, please do not use Ko-fi.

Creators may contact you outside of Ko-fi and you agree to contact them directly and when this happens it will be wholly the responsibility of the Creator and not us to use your data in accordance with applicable laws.

Note: For all users (Creator or Supporter) of Ko-fi

If you don't want us to use your personal data for any of the other reasons, you can let us know at any time by contacting us at help.ko-fi.com/hc/en-us/requests/new and we will delete your data from our systems. However, you acknowledge this will remove our ability to provide Ko-fi to you and will not automatically remove that contact or transaction data previously made available to any Creators.

(3) A Visitor is someone who accesses and/uses Ko-fi but is not a Creator or a Supporter.

Processing Activities	Personal Data	Lawful Basis
When you use Ko-fi (purchases/donations)	Identity Data, Contact Data, Financial Data.	Necessary for our legitimate interests so we can provide you with a better experience.
When you sign up or take part in surveys	Profile Data and Usage Data you put into the forms, or surveys on Ko-fi to improve your experience of Ko-fi.	Necessary for our legitimate interests so we can contact you or process your survey responses. We use this information to understand your marketing preferences. Consent – where we provide marketing to you, such as by email or Soft Opt-in consent.
When you contact us via Ko-fi, our forms and other links on Ko-fi	Identity Data and Contact Data.	Necessary for our legitimate interests where we need to be able to respond to you.
To manage our relationship with you which will include notifying you about changes to our terms or privacy policy	Identity Data and Contact Data.	Necessary for our legitimate interests i.e., to keep our records updated.
To administer and protect our business and Ko-fi including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data	Identity Data, Contact Data and Technical Data.	Necessary for our legitimate interests for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise. Necessary to comply with a legal obligation.
To deliver relevant content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you	Identity Data, Contact Data and Technical Data.	Necessary for our legitimate interests i.e., to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy.
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences	Technical Data.	Necessary for our legitimate interests to define types of customers for our products and services, to keep Ko-fi updated and relevant, to develop our business and to inform our marketing strategy. Note: Where applicable consent will be used for data analytics obtained through cookies or similar technologies. See our cookies policy below in Section 12.
Use of non-essential cookies (where the jurisdiction applies and consent is required)	Technical Data.	Consent

(4) Job applicant

Processing Activities	Personal Data	Lawful Basis
When you apply for a job with us	Identity Data, Contact Data, and recruitment information (e.g. resume, right-to-work documentation and references), test results (inc. psychometric), qualifications, accreditations and any additional information we may receive from our recruitment partners.	In contemplation (of performance of a contract).
Assessing you for suitability of role	Identity Data, Contact Data and recruitment information, as required to assess your suitability for our available roles.	In contemplation (of performance of a contract).

6. Marketing communications

We may send you marketing communication. You have the right to object to processing of your personal data for direct marketing purposes. You can unsubscribe from receiving marketing communications from us by using the unsubscribe methods contained in communications we send to you or by contacting us.

Where you opt out of receiving marketing communications this will not apply to personal data provided to us as a result of registering for or using Ko-fi, your service experience or other interactions with Ko-fi and you will still receive service-related communications that are essential for administrative or customer service purposes.

7. Disclosure of personal data to third parties

We sometimes share your personal data with third parties. The types of third parties with which we share personal data are described below:

Category	Details
Internally	Your personal data will be used by our employees and contractors who are working on providing Ko-fi to you.
Creators	When a Supporter supports a Creator the following personal data belonging to the Supporter will be shared with the Creators: Data shared for Tips: - Identity Data - Contact Data Additional data shared for Purchases and Memberships: - Identity Data - Contact Data We collect this personal data to allow the Creator to deliver any physical items you have requested or entitled to as part of a membership. The Creators receive this personal data as it is required for shipping purposes and as such Creators are responsible for their own lawful processing of personal data made available to them on Ko-fi. We facilitate a direct relationship between Creators and Supporters. Creators receive certain contact information from Supporters such as email addresses and transaction information such as delivery addresses and phone numbers when required for shipping providers and as such Creators are responsible for their own lawful processing of information made available to them on Ko-fi.
Third Party Payment Processors	We are not a payment processor. Payments are facilitated directly between users of Ko-fi including the Creators and Supporters, via third party payment providers such as PayPal and Stripe. Before creating an account or making a payment please take a moment to read the privacy policies of these payment providers: - PayPal whose Privacy Policy can be found at https://www.paypal.com/en/webapps/mpp/ua/privacy-full - Stripe whose Privacy Policy can be found at https://stripe.com/privacy
Third Party Service Providers	We may connect users to third party services listed below to perform certain functions. Before using Ko-fi please take a moment to read the privacy policies of these third-party services. Users can authenticate (log in to Ko-fi) via the following services: - Google whose Privacy Policy can be found at https://policies.google.com/privacy. Revoke access at any time directly in your Google account at https://myaccount.google.com/permissions - X (formerly Twitter) whose Privacy Policy can be found at https://twitter.com/en/privacy - Facebook whose Privacy Policy can be found at https://www.facebook.com/privacy/explanation - Twitch whose Privacy Policy can be found at https://www.twitch.tv/p/en/legal/privacy-notice/ Users can connect to Chat and set up Stream Alerts via: - YouTube whose Privacy Policy can be found at https://policies.google.com/privacy. Revoke access at any time directly in your Google account at https://myaccount.google.com/permissions. Ko-fi uses YouTube API Services to connect to YouTube (find out more). - Twitch whose Privacy Policy can be found at https://www.twitch.tv/p/en/legal/privacy-notice/
Third parties where required by law	We may disclose your personal data to a third party if it is necessary to comply with a legal obligation, to enforce or apply our terms of use and other agreements or to protect the rights, property, or safety of our clients or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection or tax reporting purposes laid down in law.
Professional advisors	We may disclose personal data to our professional advisors, such as lawyers, auditors, and insurers, if necessary as part of the professional services they provide us with.
Third parties in connection with a business sale	If we make a sale or transfer of assets or are otherwise involved in a merger, business / asset transfer, we may transfer your personal data to one or more third parties as part of that transaction. If a change happens to our business, the new owners may use your personal data in the same way as set out in this privacy policy.

8. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

The transmission of information via the internet is not completely secure. Although we will take reasonable measures to protect your personal data, we cannot guarantee the security of your information transmitted and any transmission is at your own risk.

9. International transfers of your personal data

Where personal data is shared and disclosed as set out above, these parties may be established outside the European Economic Area (EEA) and the United Kingdom (UK). Whenever we transfer your personal data outside the EEA and the UK, we ensure that a similar degree of protection is afforded to it by ensuring appropriate safeguards are implemented.

This may include, where appropriate, signing up to safeguard mechanisms such as Standard Contractual Clauses endorsed by the UK Government or European Commission. To find out more information regarding the specific mechanism used by us when transferring your personal data outside the EEA and the UK please contact us at help.ko-fi.com/hc/en-us/requests/new.

10. How long do you keep my data for?

We will only retain your personal data for as long as we need it, unless we are required to keep it for longer to comply with our legal, accounting, or regulatory requirements. In some circumstances we may carefully anonymise your personal data so that it can no longer be associated with you, and we may use this anonymised information indefinitely without notifying you. We use this anonymised information to improve the way we work and our services. We delete information relating to purchases from us 7 years after your last order with us.

Other information related to your account will be deleted 2 years after your account has become inactive.

11. Your rights and controlling your personal data

You may exercise certain rights regarding your data, such as the following:

The right to access. If you wish to receive a copy of the personal data we hold about you and to check that we are lawfully processing it, you can do so at any time by contacting us at help.ko-fi.com/hc/en-us/requests/new.
The right to seek rectification. If you believe that any personal data we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us (note that we may need to verify the accuracy of any new data you provide to us).
The right to deletion. You can ask us to delete or remove your personal data from our systems where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below), where we may have processed your personal data unlawfully or where we are required to erase your personal data to comply with local law. Note that we may not always be able to comply with your request for specific legal reasons, which will be notified to you at the time of your request.
The right to object. You have the right to object to the processing of your personal data: (1) at any time for direct marketing purposes (see Section 6 above on how to opt out) and (2) where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data.
The right of restriction. You have the right, under certain circumstances, to restrict the processing of your data.
The right to data portability. You have the right under certain circumstances to be provided with a copy of the personal data we have on you in a structured, machine-readable and commonly used format and for us to transfer it to a third party.
The right to withdraw consent. You have the right to withdraw consent to our processing of your personal data where we have collected and processed it with your consent.

Carrying out your data subject rights

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information or to exercise any of your other rights. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within 1 month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

If you wish to exercise any of the rights set out above, please contact us at help.ko-fi.com/hc/en-us/requests/new. These requests can be exercised free of charge and will be addressed as early as possible and normally within 1 month. If we require an extension of up to 2 months under Data Protection Laws, we will let you know.

12. Concerns and complaints

We would appreciate the chance to deal with your concerns in the first instance. Please contact us at help.ko-fi.com/hc/en-us/requests/new. If you have unresolved issues, you have the right to complain at any time to a data protection supervisory authority for data protection issues, such as the UK data protection regulator - the Information Commissioner's Office (ICO).

If you live or work outside the UK or you have a complaint concerning our personal data processing activities, you may lodge a complaint with a supervisory authority.

13. Cookie Policy

We use cookies to operate Ko-fi and improve it. We use cookies to collect information about your access to Ko-fi. Cookies are pieces of information that include a unique reference code that a website transfers to your device to store and sometimes track information about you. We use CookieYes to deliver this information to you.

We may use:

Strictly necessary cookies: required for the operation, security and functionality of the website and services
Performance and analytics cookies: to understand how visitors use Ko-fi and improve performance
Functionality cookies: to remember settings and preferences
Advertising or targeting cookies: where applicable, to deliver relevant content or measure advertising effectiveness

Some cookies are placed by us and others are placed by third-party providers acting on our behalf.

Most web browsers allow you to control or disable cookies through browser settings. Please note that disabling certain cookies may affect the functionality or availability of parts of Ko-fi.

14. Links to other sites

Ko-fi may include links to websites, plug-ins and applications operated by third parties (Third-Party Sites). We are not responsible for any Third-Party Sites. Please note that our Terms of Use and our policies will not apply to Third-Party Sites. We have no control over how your data is collected, stored or used by Third-Party Sites and we advise you to check the privacy policies of any such Third-Party Sites before providing any data to them.

15. Changes

This privacy policy may be changed from time to time in response to legal, technical or business developments. We will take appropriate measures to inform you when we update our privacy policy.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.