Okairo Data Processing Terms

Okairo LLC · Effective November 4, 2026 · Version 2026-11-04.1

These terms supplement the customer agreement when Okairo processes personal information in business records on behalf of a customer. The company admin accepts them for the business together with the customer terms. A separately signed data processing agreement controls a conflict on its subject matter. Privacy questions and instructions: support@okairo.ai.

1 Roles and scope

The customer determines the purpose of its business records and is the controller or business where those terms apply. Okairo acts as its processor or service provider for those records. Okairo's own account, security, billing and legal administration is described separately in the Privacy Notice.

Processing covers hosting, importing, organizing, comparing and exporting reports; tracking POs and supplier performance; preparing and sending authorized requests; collecting supplier answers; support, security and recovery. It continues for the service and the lawful retention period described in the customer terms, unless a lawful deletion instruction ends it sooner.

People concerned can include customer employees, supplier and customer contacts, and other business contacts. Information can include names, business contact details, roles, identifiers and personal information incidentally contained in reports, responses, support messages and activity history. Special-category, government-ID, health, export-controlled and similarly regulated data are not authorized under this standard arrangement without a separate written agreement.

2 Customer instructions

The customer instructs Okairo through the agreement, authorized settings, approved operations and documented support requests. The customer is responsible for having lawful grounds, providing required notices and obtaining required permissions to supply records and contact recipients. The customer must limit records to what is needed and verify recipients and supplier-link access.

Okairo processes business-record personal information only to provide the agreed service and follow lawful instructions, or as required by law. We will inform the customer if an instruction appears unlawful or cannot be followed, and notify it of a legal processing requirement unless law prohibits notice. We do not sell that information, use it for targeted advertising, train generalized AI models with it, or use it for unrelated purposes. Where applicable service-provider law restricts combining information from different customers or sources, those restrictions apply.

3 Confidentiality and safeguards

People authorized to handle customer information are bound by confidentiality obligations and limited to appropriate access. Safeguards include authenticated account access, company-level data restrictions, encrypted transport, protected provider credentials, restricted support access and operational monitoring. Specific controls depend on the service function; this agreement does not claim a particular certification or that every risk can be eliminated.

Okairo will notify the customer without undue delay after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal information processed for the customer. Notices will provide available information about the incident, likely effects and mitigation, with updates as facts become available. Notification is not an admission of liability. The customer remains responsible for determining notices it must give; Okairo will reasonably assist.

4 Service providers

The customer authorizes the following providers for the stated functions as needed: Cloudflare (application hosting, security, service operations and optional question classification); Supabase (authentication, database and file storage); Resend (supported service and support email). Google and Microsoft receive information for the customer-connected mail service; the customer's own account agreement also governs that use. Hosting.com hosts the public website. Stripe handles billing when used and may act independently for payment, fraud and legal obligations.

Okairo remains responsible for its subprocessors' performance of the applicable data-processing obligations and requires appropriate confidentiality, security and use restrictions. We will give advance notice of a material new subprocessor for business-record personal information through the account contact or service. Customers may raise a reasonable data-protection objection by contacting support within 15 days. We will work on a reasonable alternative; if none is available, the parties will address termination of the affected service and any legally or contractually required remedy. This notice period does not delay emergency measures needed to protect information or comply with law; we will explain such changes promptly.

Provider operations may occur in the United States and other countries. These standard terms do not include EU standard contractual clauses, a UK transfer addendum, or a guarantee of location-specific processing. Before supplying information requiring those arrangements, the customer must contact Okairo and obtain an appropriate agreement. The service must not be used to bypass applicable transfer restrictions.

5 Requests assistance and review

Taking account of the processing and information available, Okairo will reasonably assist with applicable individual rights requests, security obligations, breach notices, and required impact assessments or regulator consultations. Requests from an individual about customer-controlled records will be directed to the customer where appropriate, unless law requires another response. We will not respond as though we control the customer's business decisions.

Okairo will make reasonably available information needed to demonstrate compliance with these terms and cooperate with proportionate, confidential review arrangements required by applicable law. A review must protect other customers, credentials and service security; it does not permit unannounced production penetration tests. Parties will agree reasonable timing, scope and costs where lawful. Nothing here removes a mandatory regulator or customer audit right.

6 Return deletion and retained copies

The customer can export supported records during access and the 90-day read-only period described in the customer terms. Original uploads must be downloaded separately where available. Deletion is support-managed, not automatic at day 90. On the customer's verified instruction or agreed end-of-service disposal, Okairo will delete or return business-record personal information as instructed, unless law requires retention. Ask support to confirm the scope and timing before the export window ends.

Restricted backups may remain until the applicable backup lifecycle completes and are not used for ordinary production purposes. Deletion instructions must be reapplied if a backup is restored. We do not promise a fixed maximum backup period in these terms. Required legal records may be retained only as needed, with restricted use; that does not authorize indefinite retention of all operational records.

7 Agreement and contact

These terms are incorporated into the customer agreement through the company's affirmative electronic acceptance. They prevail over conflicting customer terms for processing personal information, while a separately signed data processing agreement prevails over these terms. Liability and dispute provisions in the customer agreement apply to the extent permitted by law; these terms do not exclude nonwaivable duties or rights.

Contact support@okairo.ai for processing instructions, a subprocessor question, security notice or a request for additional contractual safeguards. No paid plan or new sending permission is created by accepting these terms.