Okairo Privacy Notice

Okairo LLC · Effective November 4, 2026 · Version 2026-11-04.1

This notice explains what Okairo collects when you use the portal, connect email, answer a supplier request or contact support. The separate launch-list notice still applies to the interest form. Questions or privacy requests: support@okairo.ai.

1 Information we handle

Account information includes your email, name, title, company, profile photo, company logo, account permissions and sign-in records. Business records can include uploaded reports and files, POs, quantities, prices or job values, dates, supplier and customer contacts, internal departments, supplier responses, approval history and follow-up settings. We also handle support messages, screenshots you choose to attach, and feedback.

We record service activity needed to operate and protect Okairo, including request times, errors, delivery status, session activity and document acceptance. Hosting and security providers may process IP addresses, browser information and device information. Website and walkthrough measurements may include campaign tags, visits and playback events; bot filtering is an estimate, not proof that every counted visit is a person.

Please provide only information needed for your business use. Do not upload payment-card details, government IDs, health information, export-controlled technical data or other regulated or highly sensitive information unless Okairo has expressly agreed in writing to support it. Purchase-order reports can contain confidential commercial information; check files before uploading them.

2 Why we use it

We use information to provide your account, import and compare reports, track orders, prepare authorized follow-ups, receive supplier answers, calculate reports and scorecards, provide support, protect the service and maintain business records. We use contact details for service notices and requests you make. Marketing subscriptions and launch-list preferences are separate from accepting the customer terms.

Your business controls the records it supplies and the people who can use its account. For personal information in those business records, Okairo processes it on your business's instructions under the Data Processing Terms. Okairo separately determines how to handle its own account administration, security, support and legal records. If applicable law requires a legal basis, processing depends on providing the requested service, legitimate operational and security needs, legal obligations, or consent where required.

3 Google and Microsoft email connections

You sign in directly with Google or Microsoft. Okairo receives account identity, sending permission and authorization tokens that keep the connection working. We store protected tokens and the connected address; we do not receive or store your mailbox password. Current permissions are Google account email and Gmail sending, or Microsoft User.Read, Mail.Send and offline_access. These connections do not give Okairo permission to read your inbox.

With your authorization, Okairo prepares and sends follow-ups from the selected connected account. It handles recipients, subjects, message content, PO details and delivery records needed for those messages. Supplier answers submitted through Okairo links are stored in Okairo; they are not obtained by reading your inbox. The customer's chosen settings determine approval or automatic sending where available. Connecting an account alone does not enable automatic follow-ups.

Okairo's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train generalized AI models. Human access to Google user data is limited to the exceptions allowed by that policy, such as specific user-authorized support, security investigations or legal requirements. These restrictions also apply to service providers handling that data for Okairo.

You can disconnect a mailbox in Settings and revoke access through Google or Microsoft's account controls. Disconnecting stops future use of that connection and cancels pending requests where supported. A message already being submitted may still arrive. Disconnecting does not erase messages already delivered or the business activity history retained in Okairo.

4 Okai assistance

When you use Okai, your question may be sent to Cloudflare Workers AI to identify the type of question. It can contain information you type, including a PO number. The current implementation retrieves the matching records within your company and prepares the answer in Okairo; it does not send the full PO report or inbox to the model for that step. Avoid putting sensitive information in questions. Assistance can be wrong; verify important dates, calculations and decisions. Complex questions are directed to support. Okairo does not use customer records or mailbox data to train generalized AI models.

5 Who receives information

Authorized people in your company can see records allowed by their roles. Suppliers and internal escalation contacts receive the PO information included in requests sent to them. Supplier links use possession of the link for access, so do not forward them outside the intended recipients.

We use service providers to host, secure, store and operate the service: Cloudflare for the application, security, service measurements and optional AI assistance; Supabase for accounts, database and file storage; Google or Microsoft for your connected sending account; Resend for supported service and support emails; Hosting.com for the public website; and Stripe for billing when used. Each receives the information needed for its function. The Data Processing Terms list the providers that may process business-record personal information on our behalf. Google, Microsoft and payment providers may also act under their own terms for the accounts you maintain with them.

Authorized Okairo staff may access records for requested support, security, maintenance and troubleshooting, subject to access controls. Available support-inspection controls record access and restrict inspection to reading. We may disclose information when legally required, to protect rights and security, or in a business transfer subject to appropriate confidentiality and applicable law. We do not sell personal information or share it for cross-context behavioral advertising.

6 Retention and deletion

Active business records are retained to provide the service. The customer terms provide a 90-day view-and-export opportunity after trial or paid access ends, subject to lawful security restrictions. There is no automatic day-90 deletion system. Request deletion at support@okairo.ai; we verify the requester and scope before removing company records.

Restricted backup copies may remain until their backup lifecycle completes. This notice does not promise a fixed maximum backup period. Limited acceptance, security, billing, dispute and legal records may be kept as necessary for those purposes, with restricted use. A deletion request does not recall delivered emails or erase records another business must keep. Export available records and separately download original uploaded files before requesting deletion.

7 Security and location

We use access controls, company boundaries, protected connections and credentials, and operational monitoring. No system is perfectly secure. Keep passwords and supplier links private, check recipients, and tell support promptly about suspected unauthorized access. Okairo does not claim a certification or contractual uptime guarantee through this notice.

Okairo is based in Texas. We and our providers may process information in the United States and other countries where services operate; laws may differ from yours. We do not promise that every provider keeps all data in one country. Contact us before sending data that requires a particular location or international transfer agreement. The standard pilot terms do not by themselves supply EU standard contractual clauses or a UK transfer addendum.

8 Your choices and requests

You can edit supported profile details, manage your company's access, export supported records and disconnect email through the portal. Your company admin controls employee access and business records. Requests about data supplied by another business may need to go to that business; we assist it with lawful requests.

Email support@okairo.ai to request access, correction, deletion or a copy, or to ask about other rights available under applicable law. We verify identity and authority, use only information reasonably needed for verification, and explain any lawful limitation. You may appeal a decision about a privacy request by replying with 'Privacy appeal'. We do not discriminate for exercising applicable privacy rights. Applicable law determines the rights and response deadlines; no specific law's applicability is assumed for every customer.

Essential browser storage supports sign-in, session security, theme and similar service choices. You can clear it in your browser, which may sign you out or reset choices. The service is for business users aged 18 or older, not children.

9 Changes and contact

We date and retain each published version. Material changes will be communicated through the service or your account email as appropriate; changes requiring renewed agreement or provider consent will be presented before that new use. This notice does not turn optional marketing into a condition of portal access.

Okairo LLC · Flower Mound, Texas · support@okairo.ai. Ask support for the company mailing address if a written privacy request requires postal delivery.