Legal
Privacy policy
Last updated: 9 October 2026
Who we are
- Kosta is garage management software for vehicle repair workshops in the UAE.
- Kosta is a product of Alvara L.L.C-FZ, a company licensed in the Meydan Free Zone, Dubai. Registered address: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE.
- In this policy, "we" and "us" mean Alvara.
- Contact: hello@kosta.ae. Data protection contact: the same address.
Two roles
- Website visitors and garage staff accounts. We decide how this data is used. We are the controller.
- Data a garage puts into Kosta about its own customers and their vehicles. The garage is the controller. We process it only to run Kosta for that garage. We are the processor.
What we collect on this website
- Contact you start. If you message us on WhatsApp or email us, we get your name, number or email address, and what you write. WhatsApp messages also pass through WhatsApp (Meta) under its own terms.
- Technical data. Our host, Cloudflare, sees your IP address and browser details when a page loads, and keeps basic request and error logs to keep the site running. Fonts and pictures come from our own site.
- Analytics. We count visits with Cloudflare Web Analytics. It tells us which pages were viewed, from which country, from which website, and on what kind of device. It sets no cookies and stores nothing on your device.
- Pages viewed and buttons tapped. We also use PostHog, hosted in Frankfurt, Germany, to see which pages are viewed and which buttons are tapped, for example "Request a demo on WhatsApp" or playing the film. It is set up to store nothing on your device and to build no profile of you. It uses your IP address only to work out an approximate location (city and country), and then discards it.
We do not sell personal data. We do not use advertising trackers on this site.
Cookies
- This website sets no cookies.
- If you close the floating film button, your browser remembers that until you close the tab (session storage). It holds no personal data.
- Our analytics (Cloudflare and PostHog) store nothing on your device.
- If we ever add something that needs cookies, we will ask you first and update this page.
What Kosta stores for a garage
- Garage staff accounts: name, login details, role and permissions.
- Sign-in records: the IP address and browser used for each staff sign-in, kept for security.
- Workshop records the garage enters: customers and their contact details, vehicles and plates, job cards and photos, estimates, invoices, payments, suppliers and parts.
- Document links: when a customer opens an estimate or invoice link the garage sent, Kosta records when it was opened and how many times, so the garage can see it arrived.
- We use this data only to provide, support and secure Kosta for that garage, or as the garage instructs.
- The garage is responsible for having a lawful basis to collect its customers' data and for answering its customers' requests. We help where we can.
AI features (beta)
- Some Pro features turn a voice recording or a photo into text: the job card by voice, and supplier invoices and handwritten job cards read by photo. A voice recording is personal data.
- Before these features are switched on for a garage, we will list here the service that processes the recordings and photos, the country where it does so, and how long anything is kept.
Legal basis
We handle personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Our grounds are:
- Contract. To set up and run a garage's Kosta subscription.
- Steps you ask us to take. When you contact us about Kosta, we use your details to answer you and to prepare a quote or agreement.
- Consent. Where we ask for it, for example before sending updates. You can withdraw it at any time.
- Legal duty. For example, keeping tax and invoice records as UAE law requires.
Who we share data with
We share data only with service providers who help us run Kosta and this website. They act on our instructions.
| Service | What for | Where |
|---|---|---|
| Amazon Web Services | The Kosta application, database, photos and files, and the emails Kosta sends (such as password resets) | Frankfurt, Germany. Backup copies in Frankfurt and Ireland. Delivered through Amazon's global network. |
| Cloudflare | This website, its analytics and the scripts it loads | Cloudflare's global network |
| PostHog | Which pages are viewed and which buttons are tapped on this website | Frankfurt, Germany |
| Google Workspace | Our email | Google's data centres |
| Zoho Books | Our invoices to subscribing garages | Zoho's data centres |
| Attio | Our list of garages we are talking to | Attio's data centres |
| WhatsApp (Meta) | Messages you or a garage choose to send | Meta's data centres |
We may also disclose data if UAE law or a competent authority requires it.
Where data is stored
Kosta's data is stored outside the UAE: in Frankfurt, Germany, with backup copies in Frankfurt and Ireland. We transfer it to Amazon Web Services under a contract that requires it to keep the data secure and confidential, and because storing it there is needed to provide the service the garage has signed up for.
How long we keep it
- Enquiries: 12 months after our last contact, unless you become a customer.
- Garage data: kept for as long as the garage is a customer. If a subscription lapses, we do not delete the records.
- Deleting a garage's data: we delete it from Kosta's live systems within 30 days of a written request from the garage, after sending it a full export. Copies in our backups are deleted automatically when each backup expires: daily backups after 35 days, monthly backups after 7 years. Until then they are encrypted and used only to recover from a failure.
- Invoices and tax records: kept as long as UAE tax law requires.
Security
- Each person signs in with their own account.
- The garage owner decides what each person can see and do, and can remove access at any time.
- We limit our own team's access to what is needed to run and support Kosta.
- We keep daily and monthly backups, with a copy in a second region.
- No system is completely secure. If a breach affects a garage's records, we tell that garage without delay so it can meet its own duties. If it affects data we control, such as staff accounts or enquiries, we tell the UAE Data Office and the people affected as the law requires.
Your rights
Under the PDPL you can ask to:
- know what data we hold about you and get a copy
- correct data that is wrong
- delete data, or limit how we use it
- object to how we use it, or withdraw consent
- object to decisions made only by automated means, and ask for a person to review them
- move your data to another provider
If you are a customer of a garage that uses Kosta, please contact that garage first. It controls your records. We will help the garage answer you.
To make a request, email hello@kosta.ae. We will reply within the time the law allows, and sooner where we can. You can also complain to the UAE Data Office.
Changes
We may update this policy. We will change the date at the top. If a change is significant, we will tell subscribing garages directly.
See also our terms.