Privacy Policy

Oku ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our document search service.

Summary: We only collect data necessary to provide the service. Your documents are processed solely to provide the search functionality within Oku and are not used for advertising, profiling, or resale. You can export or delete your data at any time.

1. Data Controller

The data controller responsible for your personal data is:

Oku
Email: hello@oku.systems

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Email address - Used for authentication and account communications
Authentication tokens - Securely stored to maintain your session

2.2 Document Data

When you use Oku to search your documents, we process:

Document content - Text extracted from your uploaded files or Google Drive documents
Document metadata - File names, folder names, and modification dates
Search queries - Questions you ask about your documents

2.3 Google Drive Connection

If you connect Google Drive, we store:

OAuth tokens - Encrypted refresh tokens to maintain the connection
Folder selections - Which folders you've chosen to sync
Sync metadata - File IDs and modification times to enable incremental sync

2.4 Technical Data

We automatically collect:

Error logs - To identify and fix issues (via Sentry, with personal data filtered)
Request metadata - IP addresses and timestamps for security purposes

3. How We Use Your Information

Purpose	Data Used	Legal Basis
Provide the search service	Document content, queries	Contract performance
Authenticate your account	Email, auth tokens	Contract performance
Sync Google Drive files	OAuth tokens, folder selections	Contract performance
Fix bugs and improve service	Error logs (anonymised)	Legitimate interest
Prevent abuse and fraud	IP addresses, request patterns	Legitimate interest

4. Third-Party Services

To provide our service, your data is processed by the following third parties:

Service	Purpose	Data Shared
OpenAI	Generate embeddings and answers	Document text chunks, search queries
Google Cloud	Google Drive API, OAuth	File access requests, authentication
Supabase	User authentication, database	Email, user ID, encrypted tokens
Sentry	Error monitoring	Error context (personal data filtered)

All third-party providers are bound by data processing agreements and comply with applicable data protection laws.

5. Data Retention

Document data - Retained while your account is active. Deleted upon account deletion request.
Account information - Retained while your account is active.
Google Drive tokens - Retained while the connection is active. Deleted when you disconnect or delete your account.
Error logs - Retained for 90 days, then automatically deleted.

6. Your Rights (UK GDPR)

Under UK data protection law, you have the following rights:

6.1 Right of Access

You can view a summary of your stored data at any time in the app, or request a full copy by contacting us.

6.2 Right to Data Portability

You can export all your data in a machine-readable format (JSON) from within the app.

6.3 Right to Erasure

You can delete all your data at any time from within the app. This permanently removes your documents, search history, and all associated data.

6.4 Right to Rectification

You can update your account information or re-sync documents to correct any inaccuracies.

6.5 Right to Object

You can object to processing based on legitimate interests by contacting us.

6.6 Right to Complain

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated. Visit ico.org.uk for more information.

7. Data Security

We implement appropriate technical and organisational measures to protect your data:

All data transmitted over HTTPS (TLS encryption)
Google OAuth tokens encrypted at rest using Fernet symmetric encryption
Tenant isolation ensuring users can only access their own data
Rate limiting to prevent abuse
Regular security reviews and updates

8. International Transfers

Your data may be processed by third-party services located outside the UK (including the US). These transfers are protected by:

Standard Contractual Clauses (SCCs) approved by the UK ICO
The service providers' compliance with applicable data protection frameworks

9. Children's Privacy

Oku is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

Email: hello@oku.systems