# Privacy Policy

Last updated: 2026-10-27

## In short

- On the website and at registration, Okami is the controller of your data. Within the account, the data of the firm's clients belongs to the firm, and Okami acts as operator (processor).
- We use data to provide the service, bill, provide support, protect the Platform and, with your permission where required, measure and promote Rakkan.
- We do not sell personal data.
- You can request access, correction, deletion and other rights by email at security@okamiops.com.

_This summary helps you read and does not replace the full text._

## 1. Who we are

This Privacy Policy explains how MARCOS VINICIUS DA SILVA DOS SANTOS LTDA, enrolled in the Brazilian National Register of Legal Entities (CNPJ) under No. 66.637.891/0001-08, with its registered office at Im Grün 24, 76646 Bruchsal, Baden-Württemberg, Germany ("Okami", "we"), processes personal data on the website www.rakkan.org, on the Rakkan pages and on the Rakkan platform ("Platform"), in accordance with Law No. 13,709/2018 (Brazilian General Data Protection Law, "LGPD") and, where applicable, with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and other data protection laws.

Okami's Data Protection Officer (DPO) is Mavis Vermilion, who can be contacted by email at security@okamiops.com.

This Policy forms part of the Terms of Use and Service Agreement. Capitalized terms have the meaning defined in those Terms.

## 2. When we are controllers and when we are operators (processors)

**Okami is the controller** of the personal data it processes for its own purposes, such as the data of website visitors, of those who request a demo, of those who create an account, of account Users and of those responsible for billing.

**Okami is an operator** (or processor, under the GDPR) of the personal data that Customer firms enter or receive on the Platform about their own clients, leads, contacts and staff, such as WhatsApp conversations, proposals, contracts and documents. In this case, the firm is the controller and decides how and for what purposes the data is used. If you are a client or contact of a firm that uses Rakkan and wish to exercise your rights, contact the firm directly. If you contact us, we will forward your request to the firm, where possible.

## 3. Data we process

### Website browsing

- Technical data: IP address, date and time of access, browser, operating system, device, language, pages visited, referring page and campaign parameters (such as UTM).
- Interactions with the page, such as button clicks, use of the calculator and plan selection, recorded in order to measure interest and improve the website.
- The firm name typed on the sales page stays in your browser and in the page address, and is only sent to Okami if you proceed to registration.
- Cookies and similar technologies, described in the "Cookies" section.

### Registration, account and contracting

- Identification and contact data of Users and representatives: name, email, telephone, job title and role in the account.
- Firm data: corporate name, trade name, CNPJ or equivalent registration number, address, units and brand.
- Billing and payment data: plan, billing history and data necessary to issue tax documents. Card data is processed directly by payment companies, and Okami does not store the full card number.
- Platform usage records: logins, actions performed, audit logs, IP address, device and settings.

### Customer service and communication

- Messages, emails, recordings or notes of demo and support meetings, and communication preferences.

We do not request sensitive personal data for registration. We ask that sensitive data not be entered in the customer service channels.

## 4. Purposes and legal bases

We process personal data, as controllers, for the following purposes and on the following legal bases (Article 7 of the LGPD and Article 6 of the GDPR):

- **Providing the Platform**, creating and maintaining the account, authenticating Users and performing the contract: performance of a contract and of preliminary procedures related to it.
- **Charging, invoicing and complying with tax and accounting obligations**: performance of a contract and compliance with a legal or regulatory obligation.
- **Providing support and responding to requests**: performance of a contract and legitimate interest.
- **Ensuring security**, preventing fraud and abuse, and keeping access and audit logs: compliance with a legal obligation (including Article 15 of the Marco Civil da Internet, Law No. 12,965/2014) and legitimate interest.
- **Improving the website and the Platform**, measuring usage and fixing errors: legitimate interest and, for non-essential cookies, consent where required.
- **Promoting Rakkan**, sending marketing communications and showing ads: legitimate interest or consent, as the case may be, always with the option to unsubscribe.
- **Exercising rights** in judicial, administrative or arbitral proceedings: regular exercise of rights.

When processing is based on legitimate interest, we assess whether it is proportionate and respects the expectations and rights of data subjects. When it is based on consent, you may withdraw it at any time, without affecting processing already carried out.

## 5. Artificial intelligence

Rakkan offers artificial intelligence features, such as the agent that replies on the firm's WhatsApp. To generate responses, the necessary content of conversations and the information configured by the firm may be processed by AI providers engaged by Okami, acting as sub-processors, solely for that purpose.

Okami does not use Customer Content to train general-purpose AI models. Rakkan's AI features do not make decisions that produce legal effects on data subjects: responses follow the firm's instructions, and the firm may monitor, take over and end the conversation at any time.

## 6. Data sharing

We may share personal data, to the extent necessary, with:

- **providers that help us operate**: cloud hosting and infrastructure, database, storage, email delivery, communication, support, error monitoring and security;
- **artificial intelligence providers**, to generate the requested responses and features;
- **Integrated Third Parties chosen by the firm**, such as Meta (WhatsApp) and ZapSign, to send messages and collect signatures;
- **payment and tax document issuance companies**;
- **analytics and advertising tools**, such as Google and Meta, when enabled and with consent where required;
- **professional advisors**, such as lawyers, accountants and auditors, under a duty of confidentiality;
- **public authorities**, when there is a legal obligation, a court order or a request from a competent authority, or to protect the rights of Okami, the Users or third parties;
- **successors or acquirers**, in the event of corporate reorganization, merger, acquisition or sale of assets, who will be bound by this Policy.

We require from our providers confidentiality and data protection commitments consistent with this Policy. The up-to-date list of sub-processors may be requested by email at security@okamiops.com.

**We do not sell or rent personal data.**

## 7. International transfers

Some providers, such as cloud, AI and email providers and Meta, may process data outside Brazil and outside the data subject's country, including in the United States. In these cases, we adopt the mechanisms provided for in applicable law, such as the standard contractual clauses approved by the Brazilian National Data Protection Authority (ANPD Resolution CD/ANPD No. 19/2024) and, for data subject to the GDPR, the standard contractual clauses approved by the European Commission or adequacy decisions, where available.

## 8. How long we keep data

We keep personal data for as long as necessary for the purposes described, and then delete or anonymize it, unless the law permits or requires its retention. In general:

- **account and contract data**: during the term of the contract and for up to 5 (five) years after its end, to comply with legal obligations and exercise rights;
- **tax and billing data**: for the period required by tax legislation;
- **application access logs**: for at least 6 (six) months, in accordance with the Marco Civil da Internet, and for up to 2 (two) years for security purposes;
- **Customer Content**: during the term of the contract and for up to 30 (thirty) days after its end, for export, after which it is deleted, including from backup copies in their normal replacement cycle, which does not exceed 90 (ninety) days;
- **business contacts and demo requests**: until unsubscription or for up to 2 (two) years without interaction.

## 9. Security

We adopt reasonable technical and administrative measures to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration or disclosure, such as encryption in transit, integration credentials stored in encrypted form, role-based access control, audit logs and restriction of internal access to the minimum necessary.

No system is completely secure. If a security incident occurs that may result in relevant risk or harm to data subjects, we will notify the Brazilian National Data Protection Authority, the data subjects and, when we act as operator, the controlling firm, in accordance with applicable law and regulations.

## 10. Your rights

Under Article 18 of the LGPD, you may request, with respect to the data that Okami processes as controller:

- confirmation of the existence of processing and access to the data;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law;
- portability of the data, in accordance with the regulations;
- deletion of data processed on the basis of consent, except in the cases of retention provided for by law;
- information about the entities with which we share data;
- information about the possibility of not giving consent and its consequences;
- withdrawal of consent;
- review of decisions made solely on the basis of automated processing;
- objection to processing carried out on the basis of another legal basis, in the event of non-compliance with the law.

To exercise your rights, write to security@okamiops.com. We may ask for information to confirm your identity before fulfilling the request. We will respond within the legal deadlines. Some requests may be limited when the law permits or requires the retention of the data, or when fulfilling them would violate third-party rights or trade secrets.

You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

## 11. Cookies

Cookies are small files stored in your browser. We use:

- **essential cookies and storage**, necessary for the website and the Platform to function, such as session, security and language preference cookies, which do not depend on consent;
- **analytics cookies**, to understand how the website is used, such as those of Google Analytics, when enabled;
- **advertising cookies**, to measure campaigns and show ads, such as those of Meta and Google, when enabled.

Where required by law, analytics and advertising cookies are only used with your consent, which may be refused or withdrawn at any time. You may also block or delete cookies in your browser settings, bearing in mind that this may affect the functioning of some parts of the website.

## 12. Marketing communications

You may stop receiving marketing communications from Okami at any time, through the unsubscribe link in the messages or by email at security@okamiops.com. Communications necessary for the provision of the service, such as billing and security notices and notices of changes to these documents, will continue to be sent while the contract is in force.

## 13. Children and adolescents

The website and the Platform are intended for businesses and professionals over 18 years of age. We do not knowingly collect data of children and adolescents as controllers.

## 14. Data subjects in the European Economic Area, Switzerland and the United Kingdom

If you are in the European Economic Area, Switzerland or the United Kingdom, the following rules also apply to the data we process as controllers:

- the controller is Okami, identified at the beginning of this Policy. Okami has an establishment in the European Union at Im Grün 24, 76646 Bruchsal, Baden-Württemberg, Germany, which is the point of contact for data subjects and data protection authorities;
- the legal bases are those indicated in the section "Purposes and legal bases": performance of a contract (Article 6(1)(b)), legal obligation (Article 6(1)(c)), legitimate interest (Article 6(1)(f)) and consent (Article 6(1)(a));
- you have the right of access, rectification, erasure, restriction of processing, portability and objection, including to direct marketing, and to withdraw consent at any time;
- you may lodge a complaint with the data protection authority of the country in which you live or work, or where the alleged infringement occurred. The authority competent for Okami's establishment is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI Baden-Württemberg);
- transfers outside the European Economic Area follow the section "International transfers".

## 15. Changes to this Policy

We may update this Policy to reflect changes in the Platform, the law or our practices. The date of the last update appears at the top of the page. Material changes will be communicated through the website, the Platform or by email.

## 16. Language

This Policy was originally written in Portuguese. This English version is provided for convenience. In the event of any discrepancy, the Portuguese version shall prevail, unless applicable law requires another version to prevail.

## 17. Contact

Data Protection Officer (DPO): Mavis Vermilion, email security@okamiops.com.

Mail: MARCOS VINICIUS DA SILVA DOS SANTOS LTDA, Im Grün 24, 76646 Bruchsal, Baden-Württemberg, Germany.

---

https://www.rakkan.org/privacy/