Oky Privacy Policy

Version 1.1 — Effective October 6, 2026.

This Privacy Policy explains how Oky (the "app"), available at https://octoid.ai and https://face.octoid.ai, collects, uses, stores, shares and protects personal data, including data obtained from Google APIs. Oky is an octoid.ai product operated by OHL EMPREENDIMENTOS LTDA (CNPJ 24.797.928/0001-07, Brazil), referred to as "we" or "us".

Questions, requests and complaints: talk-to@octoid.ai.

1. What Oky is

Oky is a business productivity application. Employees of customer organizations sign in with a work account and connect business services, such as Google Workspace, so Oky can find information in their email, files and calendar, and run operational workflows they configure. Every action that changes data in a connected service (for example sending an email, creating a calendar event or adding a row to a spreadsheet) requires the user's approval before it runs, unless an authorized administrator has enabled automatic approval for that action. Oky has no image-generation or image-editing features.

2. Information we collect

• Account information: name, email address, organization, workspace role and sign-in records.
• Content you provide: messages and instructions sent to Oky, procedures and workflows you write, and files you upload.
• Data from connected services: the data a user authorizes Oky to access when connecting a service. For Google, see Section 3.
• Connection credentials: OAuth access and refresh tokens and connection settings.
• Technical and usage data: access logs, error logs, approval records (who approved what and when) and usage measurements needed to operate, secure and bill the service. Browser storage is used for sign-in and preferences.
• Business and support data: contact, billing and support communications.

3. Google user data

This section describes specifically how Oky handles data obtained through Google APIs when a user connects a Google account.

3.1 Data accessed

Oky requests only the following permissions, and only after the user grants them on Google's consent screen:

• Gmail — read (gmail.readonly): search and read the user's email messages (sender, recipients, subject, date, body and attachments) when the user asks a question about their email or a workflow they configured needs an email as input. The email address of the connected account is also read from the Gmail profile, to show which account is connected.
• Gmail — send (gmail.send): send an email from the user's account when the user requests it or approves a workflow step that sends it.
• Google Drive — read (drive.readonly): search for and read files in the user's Drive (file names, types and content) when the user refers to a document.
• Google Calendar — events (calendar.events): read events (title, time, attendees, description) and create events the user requests.
• Google Sheets (spreadsheets): read and add data to spreadsheets used in the user's reports and workflows.

Oky does not access Google data the user has not authorized, and does not modify, delete or label Gmail messages or Drive files.

3.2 How we use Google user data

Google user data is used only to provide and improve user-facing features of Oky that the user requested, specifically to:

• answer the user's questions about their own email, files, calendar and spreadsheets;
• prepare drafts, summaries and reports requested by the user;
• run workflows the user or their organization configured, with approval for every action that changes data;
• show the user the results and the history of those tasks.

To produce answers, relevant excerpts of Google user data are processed by the AI model providers listed in Section 3.3, only for the request being performed.

We do not: sell Google user data; use or transfer it for advertising, retargeting or interest-based ads; use it to determine creditworthiness or for lending; use or transfer it to develop, improve or train generalized or non-personalized AI or machine-learning models; or use it to create, alter or distribute sexual or intimate imagery of any person, including AI-generated non-consensual intimate imagery (NCII).

3.3 How we share Google user data

We share Google user data only as needed to provide the features described above:

• AI model providers (currently OpenAI and Anthropic), which process request content through their business APIs to generate Oky's answers, under terms that do not allow them to use that data to train their models.
• Infrastructure providers that host and store Oky's data and run its servers, acting on our instructions.
• Members of the same customer workspace, when a user includes results in a shared conversation, workflow or report within their organization.
• Authorities, when required by law, or to protect against fraud, abuse or security incidents.

Google user data is not shared with any other third party, and is never transferred to data brokers or information resellers.

3.4 Storage and protection

• OAuth tokens are stored encrypted at rest in our database and are used only by Oky's servers to call Google APIs.
• All data is transmitted over encrypted connections (HTTPS/TLS).
• Each customer workspace is logically isolated; users can only access data of workspaces they belong to.
• Access by our staff is restricted to authorized personnel.
• Google data retrieved for a request is kept only as part of the results the user sees (for example a conversation, workflow output or report). We do not build a separate copy of the user's mailbox or Drive.

3.5 Human access

Our staff do not read Google user data, except: with the user's explicit permission (for example to investigate a support request); when necessary for security purposes, such as investigating abuse; to comply with applicable law; or when the data has been aggregated and anonymized for internal operations, as permitted by Google's policies.

3.6 Retention and deletion

• OAuth tokens are kept while the connection is active.
• Results containing Google data are kept as part of the workspace's content while the customer uses the service, or until a user or administrator deletes them.
• A user can revoke Oky's access at any time at myaccount.google.com/connections or by disconnecting the Google connection in Oky. After revocation, Oky can no longer access the user's Google data.
• To delete Google data and tokens stored by Oky, email talk-to@octoid.ai from the account concerned. We verify the request and delete the data, including the stored tokens, except records we must keep by law, which remain restricted to that purpose. Backups are overwritten in their normal rotation.

3.7 Limited Use

Oky's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace API User Data and Developer Policy.

4. How we use other information

We use account, content, technical and business information to provide and secure the service, authenticate users, run the workflows requested, record approvals, provide support, bill customers, prevent abuse and comply with legal obligations. Under Brazil's LGPD, processing relies on performance of contract, compliance with legal obligations, legitimate interests in operating and securing the service, or consent where required. When we process an organization's content on its instructions, the organization is the controller and we act as processor.

5. Sharing of other information

We share information with the services you connect, with providers of hosting, storage, AI processing and email delivery that act on our instructions, and with authorities when required by law. We do not sell personal data.

6. International transfers

Some providers process data outside Brazil. These transfers follow the safeguards required by applicable data-protection law. To request information about recipients, countries and safeguards, contact talk-to@octoid.ai.

7. Security

We use technical and organizational measures to protect personal data, including encryption in transit, encryption of connection credentials at rest, access controls, workspace isolation and logging. No system provides absolute security; we will notify affected customers and authorities of security incidents as required by law.

8. Your rights

Subject to applicable law, you may request confirmation of processing, access, correction, portability, anonymization or deletion of your data, information about sharing, objection to processing, withdrawal of consent and review of decisions made solely by automated means. Contact talk-to@octoid.ai. For data controlled by your organization, you may also contact its administrator. You may file a complaint with Brazil's data-protection authority (ANPD).

9. Children

Oky is a business service and is not directed to children under 18. We do not knowingly collect data from children.

10. Changes to this policy

We publish the current version at this address with its effective date. If we change how we use Google user data, we will notify users and obtain consent where required before the new use.

11. Contact

OHL EMPREENDIMENTOS LTDA — operator of Oky (octoid.ai)
CNPJ 24.797.928/0001-07, Brazil
Email: talk-to@octoid.ai