Privacy Policy

1.Who we are

This Privacy Policy explains how MARCOS VINICIUS DA SILVA DOS SANTOS LTDA, enrolled in the Brazilian National Register of Legal Entities (CNPJ) under No. 66.637.891/0001-08, with its registered office at Rua Pais Leme, 215, conjunto 1713, Pinheiros, São Paulo/SP, CEP 05424-150, Brazil ("Okami", "we"), processes personal data on the website www.rakkan.org, on the Rakkan pages and on the Rakkan platform ("Platform"), in accordance with Law No. 13,709/2018 (Brazilian General Data Protection Law, "LGPD") and, where applicable, with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and other data protection laws.

Okami's Data Protection Officer (DPO) is Mavis Vermilion, who can be contacted by email at contact@okamiops.com.

This Policy forms part of the Terms of Use and Service Agreement. Capitalized terms have the meaning defined in those Terms.

2.When we are controllers and when we are operators (processors)

Okami is the controller of the personal data it processes for its own purposes, such as the data of website visitors, of those who request a demo, of those who create an account, of account Users and of those responsible for billing.

Okami is an operator (or processor, under the GDPR) of the personal data that Customer firms enter or receive on the Platform about their own clients, leads, contacts and staff, such as WhatsApp conversations, proposals, contracts and documents. In this case, the firm is the controller and decides how and for what purposes the data is used. If you are a client or contact of a firm that uses Rakkan and wish to exercise your rights, contact the firm directly. If you contact us, we will forward your request to the firm, where possible.

3.Data we process

Website browsing

• Technical access and operation data, such as IP address, date and time, browser, operating system, device, language and address of the page accessed, may be processed by the infrastructure that delivers and protects the website and the platform. The landing page keeps technical execution and access records; the recorded addresses may include campaign parameters and identifiers present in the URL. Therefore, information included in the address of a page may appear in these records, in addition to appearing in the browser.
• The website records interaction events in the browser, such as button clicks, use of the calculator and plan selection. Origin or campaign parameters present in the address of the visit may be passed on in the registration or demo links.
• Cloudflare Web Analytics/RUM performance measurement is enabled in the configuration that covers the website and the app. When its component is loaded and run, it sends browsing performance metrics to Cloudflare. Being enabled does not mean that the component is loaded on every visit.
• The firm name typed on the presentation page is used in the browser and in the page address; when you proceed to registration, the information included in the link is transmitted to the destination.
• Cookies and browser storage used for the features to work are described in the "Cookies" section.

Registration, account and contracting

• Identification and contact data of Users and representatives: name, email, telephone, job title and role in the account.
• Firm data: corporate name, trade name, CNPJ or equivalent registration number, address, units and brand.
• Billing and payment data: plan, billing history and data necessary to issue tax documents. Card data is processed directly by payment companies, and Okami does not store the full card number.
• Platform usage records: logins, actions performed, audit logs, IP address, device and settings.

Customer service and communication

• Messages, emails, recordings or notes of demo and support meetings, and communication preferences.

We do not request sensitive personal data for registration. We ask that sensitive data not be entered in the customer service channels.

4.Purposes and legal bases

We process personal data, as controllers, for the following purposes and on the following legal bases (Article 7 of the LGPD and Article 6 of the GDPR):

• Providing the Platform, creating and maintaining the account, authenticating Users and performing the contract: performance of a contract and of preliminary procedures related to it.
• Charging, invoicing and complying with tax and accounting obligations: performance of a contract and compliance with a legal or regulatory obligation.
• Providing support and responding to requests: performance of a contract and legitimate interest.
• Ensuring security, preventing fraud and abuse, and keeping access and audit logs: compliance with a legal obligation (including Article 15 of the Marco Civil da Internet, Law No. 12,965/2014) and legitimate interest.
• Improving the functioning of the website and the Platform, monitoring performance, diagnosing failures and fixing errors: legitimate interest, respecting the rights of data subjects.
• Exercising rights in judicial, administrative or arbitral proceedings: regular exercise of rights.

When processing is based on legitimate interest, we assess whether it is proportionate and respects the expectations and rights of data subjects. When it is based on consent, you may withdraw it at any time, without affecting processing already carried out.

5.Artificial intelligence

Rakkan offers artificial intelligence features, such as the agent that replies on the firm's WhatsApp. The firm connects its own artificial intelligence services and chooses the providers it uses. The access keys, contracts and costs of these services are the firm's responsibility; Rakkan does not pay these providers on the firm's behalf. The chosen providers receive the content sent to them in order to fulfil the firm's requests, under their own terms and policies.

Okami does not use Customer Content to train general-purpose AI models. Rakkan's AI features do not make decisions that produce legal effects on data subjects: responses follow the firm's instructions, and the firm may monitor, take over and end the conversation at any time.

6.Data sharing

We may share personal data, to the extent necessary, with:

• providers that help us operate: cloud hosting and infrastructure, database, storage, email delivery, communication, support, error monitoring and security. This includes Google Drive, to store the encrypted backups of the application database, as described in the section "How long we keep data";
• artificial intelligence providers, to generate the requested responses and features;
• Integrated Third Parties chosen by the firm, such as Meta (WhatsApp) and ZapSign, to send messages and collect signatures;
• payment and tax document issuance companies;
• Cloudflare, for delivery, protection and performance measurement features configured for the website and the platform, including Cloudflare Web Analytics/RUM when its component runs;
• professional advisors, such as lawyers, accountants and auditors, under a duty of confidentiality;
• public authorities, when there is a legal obligation, a court order or a request from a competent authority, or to protect the rights of Okami, the Users or third parties;
• successors or acquirers, in the event of corporate reorganization, merger, acquisition or sale of assets, who will be bound by this Policy.

We require from our providers confidentiality and data protection commitments consistent with this Policy. The up-to-date list of sub-processors may be requested by email at contact@okamiops.com.

We do not sell or rent personal data.

7.International transfers

Some providers, such as cloud, AI and email providers and Meta, may process data outside Brazil and outside the data subject's country, including in the United States. In these cases, we adopt the mechanisms provided for in applicable law, such as the standard contractual clauses approved by the Brazilian National Data Protection Authority (ANPD Resolution CD/ANPD No. 19/2024) and, for data subject to the GDPR, the standard contractual clauses approved by the European Commission or adequacy decisions, where available.

8.How long we keep data

Retention periods vary according to the category of data, the company's situation and the features used. Rakkan does not apply a single automatic deletion period to all account and contract data. Therefore, the end of access or of a company does not mean that all of your data is deleted at the same time.

Company data during the trial: when enabled, the deletion process follows the "Free trial" section of the Terms. The attempt to notify starts from twenty-three days after the effective end of the trial, not from sign-up or the start of the trial. Deletion only becomes eligible after both thirty days from that end and seven days from the recording of the notice have elapsed, whichever is later. The recording does not prove delivery of the email. The routine depends on its configuration and on the company's situation.

Personal accounts and links: deleting a company removes its links with users but preserves global personal accounts, which may take part in other companies. People registered only for use on WhatsApp may be removed when they are not associated with another company. Access logs and minimal deletion records are not deleted together with the company.

Access logs: the retention routine uses a configurable period, with a technical minimum of 183 (one hundred and eighty-three) days. This technical minimum does not define a maximum retention period nor the period for other records, such as audit records, content and documents.

Contact memory used by the AI: each piece of information has an expiry calculated from its creation, according to the memory configuration. The default is ninety days, with options of thirty, ninety, one hundred and eighty or three hundred and sixty-five days. The expiry of this memory does not mean the deletion of the original WhatsApp messages.

Document revisions: the removal of old revisions depends on the configuration and on the criteria protecting versions and sessions in use. The default minimum age of twenty-four hours for a revision to be considered for cleanup is not a maximum retention period for the document or for all of its versions.

External services: deletion from Rakkan's database does not prove the removal of all resources in external services. Removal of WhatsApp connection resources is attempted according to the available integration; rooms and identities of the internal chat may remain on the chat server. Services contracted by the customer also follow the conditions of the respective providers.

Backup copies: the application database has a daily encrypted backup routine, stored outside the main server, on Google Drive. The rotation keeps all complete points from the last 72 (seventy-two) hours and preserves the three most recent complete points, even if some of them are older. If there are fewer than three complete points, they are not removed by this rotation. Therefore, 72 hours is not a maximum retention period for each copy. This backup contains the application database and its verification manifest; it does not include the Evolution and Matrix services or configuration files. Deleting data in the main system does not imply its immediate removal from the copies still kept.

To handle requests about your data and to clarify the situation of an account, contact us at contact@okamiops.com. The rights described in this Policy and the legal grounds for retaining data remain applicable.

9.Security

We adopt reasonable technical and administrative measures to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration or disclosure, such as encryption in transit, integration credentials stored in encrypted form, role-based access control, audit logs and restriction of internal access to the minimum necessary.

No system is completely secure. If a security incident occurs that may result in relevant risk or harm to data subjects, we will notify the Brazilian National Data Protection Authority, the data subjects and, when we act as operator, the controlling firm, in accordance with applicable law and regulations.

10.Your rights

Under Article 18 of the LGPD, you may request, with respect to the data that Okami processes as controller:

• confirmation of the existence of processing and access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law;
• portability of the data, in accordance with the regulations;
• deletion of data processed on the basis of consent, except in the cases of retention provided for by law;
• information about the entities with which we share data;
• information about the possibility of not giving consent and its consequences;
• withdrawal of consent;
• review of decisions made solely on the basis of automated processing;
• objection to processing carried out on the basis of another legal basis, in the event of non-compliance with the law.

To exercise your rights, write to contact@okamiops.com. We may ask for information to confirm your identity before fulfilling the request. We will respond within the legal deadlines. Some requests may be limited when the law permits or requires the retention of the data, or when fulfilling them would violate third-party rights or trade secrets.

You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

11.Cookies

Cookies are small files stored in the browser. The app uses cookies related to the session, the device and the authentication flows, including sign-in through an external service when used. The browser may also store interface preferences and operating information in local or session storage.

The Cloudflare configuration enables Web Analytics/RUM for performance measurement on the website and in the app. According to the documentation of this component, its measurement does not use cookies or the browser's local storage. This does not describe the app's authentication cookies, nor does it mean that all infrastructure services handle data in the same way.

You can check your browser options to block or delete cookies and local data. This may affect sign-in, preferences and other features that depend on this information.

12.Communications about the service

We may use the contact channels provided to respond to requests and send communications necessary for the service, such as messages about registration, access, invitations, billing, security and changes to these documents.

For privacy requests, use contact@okamiops.com. For product support, use support@okamiops.com.

13.Children and adolescents

The website and the Platform are intended for businesses and professionals over 18 years of age. We do not knowingly collect data of children and adolescents as controllers.

14.Data subjects in the European Economic Area, Switzerland and the United Kingdom

If you are in the European Economic Area, Switzerland or the United Kingdom, the following rules also apply to the data we process as controllers:

• the controller is Okami, identified at the beginning of this Policy;
• the legal bases are those indicated in the section "Purposes and legal bases": performance of a contract (Article 6(1)(b)), legal obligation (Article 6(1)(c)), legitimate interest (Article 6(1)(f)) and consent (Article 6(1)(a));
• you have the right of access, rectification, erasure, restriction of processing, portability and objection, including to direct marketing, and to withdraw consent at any time;
• you may lodge a complaint with the data protection authority of the country in which you live or work, or where the alleged infringement occurred;
• transfers outside the European Economic Area follow the section "International transfers".

15.Changes to this Policy

We may update this Policy to reflect changes in the Platform, the law or our practices. The date of the last update appears at the top of the page. Material changes will be communicated through the website, the Platform or by email.

16.Language

This Policy was originally written in Portuguese. This English version is provided for convenience. In the event of any discrepancy, the Portuguese version shall prevail, unless applicable law requires another version to prevail.

17.Contact

Data Protection Officer (DPO): Mavis Vermilion, email contact@okamiops.com.

Mail: MARCOS VINICIUS DA SILVA DOS SANTOS LTDA, Rua Pais Leme, 215, conjunto 1713, Pinheiros, São Paulo/SP, CEP 05424-150, Brazil.