Privacy Policy
Effective date: September 1, 2026
1. Introduction
This Privacy Policy describes how Oika (“Oika”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards personal data in connection with the Oika platform and related services (the “Services”). For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), Oika acts as the data controller in respect of personal data processed as described in this Policy.
2. Personal Data We Collect
Account and profile data: name or display name, email address, profile description, and published rates. Transaction data: deal terms, negotiation correspondence, briefs, contracts, and delivery records. Payment data: processed by Stripe, Inc.; Oika does not receive or store full payment card numbers. Technical data: device, browser, and usage information collected automatically for security and service-quality purposes.
3. Purposes and Legal Bases of Processing
We process personal data: (a) to provide and administer the Services, including negotiation, contracting, and payment facilitation (performance of a contract, Art. 6(1)(b) GDPR); (b) to maintain the security and integrity of the Services and to prevent fraud and abuse (legitimate interests, Art. 6(1)(f)); (c) to comply with legal obligations, including tax and accounting requirements (Art. 6(1)(c)); and (d) where applicable, with your consent (Art. 6(1)(a)), which you may withdraw at any time.
4. Artificial Intelligence Processing
Deal-related content is transmitted to our artificial-intelligence service provider solely for the purpose of generating negotiation correspondence and content scripts on your behalf, under commercial terms with that provider. Oika does not compile training datasets from your personal data.
5. Disclosure of Personal Data
We disclose personal data only to service providers engaged to operate the Services — currently Stripe (payment processing), Supabase (database hosting), Vercel (application hosting), Resend (transactional email), and Anthropic (AI processing) — in each case limited to the data necessary for the relevant function, and to public authorities where required by law. We do not sell personal data, and we do not share personal data for cross-context behavioural advertising.
6. International Transfers
Personal data may be processed in the United States and other jurisdictions. Where personal data originating in the European Economic Area or the United Kingdom is transferred to a jurisdiction not deemed adequate, such transfers are conducted under appropriate safeguards, including the European Commission's Standard Contractual Clauses.
7. Retention
Personal data is retained for the duration of your account and thereafter only as necessary to comply with legal obligations, resolve disputes, and enforce agreements. Upon verified deletion request, personal data is deleted except where retention is required by law (for example, payment and tax records).
8. Your Rights (EEA and UK)
Subject to applicable law, you have the right to access, rectify, and erase your personal data; to restrict or object to its processing; to data portability; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your competent supervisory authority. Requests may be submitted to info@oika.io and will be answered within the periods prescribed by the GDPR.
9. Your Rights (California and Other U.S. States)
Residents of California and certain other U.S. states have the right to know the categories of personal information collected, to access and delete personal information, to correct inaccurate personal information, and to non-discrimination for exercising these rights. Oika does not sell personal information and has not done so in the preceding twelve (12) months. Requests may be submitted to info@oika.io.
10. Cookies
The Services use a single strictly necessary cookie to maintain your authenticated session. No advertising or third-party tracking cookies are set.
11. Security
We maintain administrative, technical, and organisational measures appropriate to the risk, including encryption in transit, access controls, and audit logging. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security.
12. Children
The Services are not directed to individuals under 18 years of age, and we do not knowingly collect personal data from them.
13. Changes to this Policy
We may update this Policy from time to time. The current version, with its effective date, will be published on this page. Material changes will be notified through the Services or by email.
14. Contact
Enquiries and rights requests should be directed to info@oika.io.
See also our Terms of Service.