Privacy Policy

Laurynas Slapšys · Individual activity certificate No. 1219693, Lithuania ("Oklixo", "we", "us") is the data controller responsible for your personal data when you use oklixo.com and the Oklixo app (the "Service"). You can contact us about privacy at info@oklixo.com. We have not appointed a Data Protection Officer, as the law does not require one for a business of our size; please write to us directly.

In short:

• We do not sell your personal data.
• We do not use your content or data from connected tools to train AI models, and our AI provider does not either.
• Data from Google Calendar, Outlook and your work tools is never used for advertising and never sent to an AI provider on its own (sections 11–13).
• You can export your data and delete your account yourself in Settings at any time.

1. Data we collect

• Account data: your name, email address and password (stored only as a secure hash by our sign-in provider). If you sign in with Google, we receive your email address from Google.
• Content you create: notes and brain dumps, projects, tasks, time blocks, settings, documents you attach, and the plans and task breakdowns our AI creates for you.
• People you work with: when you invite someone to a project, their email address. Members of a shared project can see the project, its tasks and each other's email addresses.
• Calendar feed link: if you add a calendar subscription (iCal) link, we store that link to read your events. We treat it as a secret and only ever show it to you masked.
• Plan and billing status: your plan, trial dates, AI credit balance, and the subscription and purchase details Paddle sends us (such as subscription status and billing period). We never receive your full card details.
• Newsletter consent record: if you answer our newsletter question, your email address, your choice, where you made it, the exact wording and version you agreed to, your IP address, your browser's user agent, and the time.
• AI usage records: for each AI request, the date, the feature, the model used, the number of tokens, whether it succeeded, and whether a credit was refunded. These records do not contain your notes or results.
• Technical and security data: IP address, browser and device type, pages requested, and server logs, used to run and protect the Service.
• Error reports: when something goes wrong in the app, a report with the error message, the page, the browser and operating system, and the part of the app it came from. We configure error reporting not to collect your name, email address or IP address, and not to include your notes.
• Data kept in your browser: to work quickly and survive a lost connection, the app keeps a copy of your workspace, your recent brain dumps, a plan you chose to keep for later (for up to 7 days), and preferences such as theme and dismissed tips in your browser's local storage on your device. Signing out does not remove it from that device; clearing your browser data does.
• Analytics and advertising data: only if you accept these cookies – see section 9.
• Support messages: emails you send us and our replies.
• Connected tools: limited data from Google Calendar, the Outlook calendar and the work tools you choose to connect, described in sections 11–13.

Payment data – such as card details and billing address – is collected and processed by our Merchant of Record, Paddle, not by us.

You need to give us your email address to create an account, because we cannot provide the Service without it. Everything else is optional or is created by your use of the Service. Oklixo is not meant for sensitive data such as health information; please do not put such data in your notes.

2. Why we use it and our legal basis

• Creating and managing your account, providing planning, AI, calendar and import features, sharing projects you choose to share, and handling your plan and credits – performance of our contract with you (GDPR Art. 6(1)(b)).
• Emailing the people you invite to a project – our legitimate interest, and yours, in letting you collaborate (Art. 6(1)(f)). Invited people can ask us to delete their invitation at any time.
• Keeping the Service secure, preventing fraud and abuse of AI credits, and fixing errors – legitimate interests (Art. 6(1)(f)).
• Service emails such as account confirmation, password reset and project invitations – performance of our contract (Art. 6(1)(b)); these are sent regardless of your newsletter choice.
• Emails about your trial – up to four short emails: help with your first plan, a reminder before your trial ends, on its last day, and once after it ended, including what Pro offers. This is our legitimate interest in telling you about the service you signed up for (Art. 6(1)(f)). Every one has an unsubscribe link, and we stop as soon as you use it or upgrade.
• Analytics and advertising cookies (Google Analytics, Google Ads) – your consent (Art. 6(1)(a)), given in our cookie banner.
• Product news and planning tips by email – your consent (Art. 6(1)(a)). You can withdraw it at any time in Settings → Emails or with the unsubscribe link in every newsletter. We keep a record of when, where and with which wording you agreed, based on our legal obligation to be able to prove consent (Art. 6(1)(c)).
• Responding to support requests – legitimate interests (Art. 6(1)(f)), or our contract if the request is about your account.
• Meeting legal obligations and defending legal claims – legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)).

Where we rely on legitimate interests, you can object at any time (section 6). Withdrawing consent does not affect processing that happened before you withdrew it.

3. Who we share it with

We use the following service providers. They process personal data only on our instructions and under data processing terms.

• Lovable (Lovable Labs Inc., USA): the platform that hosts and runs Oklixo. Our database, sign-in and file storage run on Supabase in the European Union (Stockholm, Sweden). Pages are delivered through Cloudflare's global network, and sign-in, invitation and trial emails are sent through Lovable's email service.
• OpenAI (OpenAI Ireland Ltd; processing in the USA): when you use an AI feature, the notes, files and project details you submit are sent through OpenAI's paid API only to produce your result. OpenAI does not use API data to train its models and keeps it for up to 30 days for abuse monitoring, unless the law requires longer. AI providers never receive Google user data or your Outlook calendar events – see sections 11 and 13.
• Sentry (USA): error monitoring. Error reports are stored in Sentry's EU data centre in Frankfurt, Germany.
• Cookiebot (Usercentrics A/S, Denmark): our cookie banner and the record of your cookie choice.
• Google (Google Ireland Limited): Google Analytics and Google Ads, only if you accept these cookies.
• MailerLite (MailerLite Limited, Ireland): if you opt in to product news, your email address and first name are sent to MailerLite, which sends our newsletter and stores the data in the European Union. If you withdraw consent, you are marked as unsubscribed there; if you delete your Oklixo account, we ask MailerLite to delete your data.
• Zoho (EU data centre): hosts our mailbox info@oklixo.com, where support emails are stored.

These parties decide themselves how they use the data they receive (independent controllers):

• Paddle (Paddle.com Market Ltd, United Kingdom; Paddle.com Inc., USA for US customers): our Merchant of Record, which sells Oklixo subscriptions and credits to you and handles payments, tax, invoicing and payment-related support under its own privacy notice.
• The tools you connect (Google, Microsoft, Atlassian, Notion, Asana, Slack): they handle your data under their own privacy policies; we receive only what sections 11–13 describe.
• Other Oklixo users: people you share a project with.
• Professional advisers (legal and accounting), where necessary, under confidentiality.
• Authorities: only where the law requires it. If we receive such a request, we check that it is lawful and, where allowed, tell you.
• A buyer or successor: if the Service is sold or transferred, your data may move with it, and this policy continues to apply. We will tell you in advance.

4. International transfers

We keep our main database in the European Union. Some providers in section 3 are based in, or process data in, the USA (Lovable, OpenAI, Sentry for account metadata, Google) or the United Kingdom (Paddle). Transfers to the United Kingdom rely on the European Commission's adequacy decision. Transfers to the USA rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses, together with additional safeguards such as encryption. You can ask us for more information about these safeguards.

5. How long we keep it

• Your account, workspace, files, invitations, AI usage records and newsletter consent record: while your account exists. When you delete your account in Settings, we delete them straight away (and cancel your subscription with Paddle first). Copies in our hosting provider's routine backups are removed when those backups are overwritten.
• Data from connected tools: as described in sections 11–13, and deleted when you disconnect the tool.
• Data kept in your browser: until you clear it; a plan kept for later is removed after 7 days.
• Data sent to our AI provider: up to 30 days at OpenAI, as described in section 3.
• Error reports: deleted automatically by Sentry after at most 90 days.
• Google Analytics: detailed usage data for up to 14 months; only aggregated statistics are kept longer.
• Your cookie choice: for up to 12 months, after which we ask again.
• Support emails: as long as needed to resolve your request and any follow-up questions.
• Payment and tax records: kept by Paddle for the periods required by tax law.

6. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected, to have it deleted, to restrict its use, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw consent at any time. We offer these rights to all users, wherever they live.

• Do it yourself: in Settings you can download a copy of your data (JSON), change your name, turn the newsletter on or off, disconnect tools, and delete your account.
• Ask us: write to info@oklixo.com. We may ask you to confirm your identity, for example by writing from the email address of your account. We reply within one month; for complex requests we may extend this by up to two more months and will tell you why.
• Complain: you can complain to a data protection authority in the EU country where you live or work. Our lead authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, 10312 Vilnius, Lithuania, ada@ada.lt. We would appreciate the chance to resolve your concern first.

7. AI and automated decisions

Oklixo's AI turns your notes into suggested projects, tasks, time estimates and schedules. These are suggestions: nothing is added to your plan until you save it, and you can change or delete anything. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI results can be wrong, so please check them before you rely on them.

8. Security

We use technical and organisational measures appropriate to the risk, including:

• encryption in transit (HTTPS, enforced with HSTS) and encryption at rest by our hosting provider;
• access tokens for connected tools additionally encrypted with AES-256-GCM, kept only on our servers and never sent to your browser;
• database access rules (row-level security), so each account can read only its own data and the projects shared with it;
• protection against clickjacking and other common browser attacks.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the supervisory authority and, where the law requires, you, without undue delay.

9. Cookies and similar technologies

We use strictly necessary cookies and browser storage to keep you signed in, remember your cookie choice, keep the app working, and store the data described in section 1 under "Data kept in your browser". These do not need your consent.

Analytics and advertising cookies – Google Analytics and Google Ads – are only set if you accept them in our cookie banner, which is provided by Cookiebot. Until you choose, Google's tag is not loaded and Google's consent settings default to "denied". If you accept advertising cookies, Google Ads may measure whether a visit from an ad led to a sign-up or purchase. Our error monitoring (Sentry) does not use cookies. You can change or withdraw your choice at any time with Cookie settings. The current list of cookies we use:

10. Children

Oklixo is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has registered, contact us so we can remove the account.

11. Google user data

If you connect Google Calendar, Oklixo requests your Google account email address and read-only access to the events on Google calendars you own. If you also turn on Edit Google events in Oklixo, Oklixo asks Google for permission to change and delete events on calendars you own.

• What we read: Google's permission covers the calendars you own; Oklixo reads only your primary calendar. For each event on it, its title, start and end time, whether it is all-day, whether it is marked Busy or Free, whether it was cancelled, and whether you declined it. Attendee lists are read only to detect a declined invitation and are not stored.
• How we use it: only to show your meetings in the Oklixo calendar and to avoid scheduling your work over them. With editing turned on, Oklixo changes an event's title or time only when you edit that event and press Save in Oklixo, and deletes an event only when you press Delete on that event in Oklixo and confirm it. Both apply only to your own events and meetings you organise; guests receive Google's usual update or cancellation email, and for a repeating event only the one occurrence you chose is changed or deleted. Oklixo never creates events in your Google Calendar, never deletes events on its own, and never changes or deletes invitations from other people.
• How we store it: events from 7 days in the past to 90 days ahead, up to 2,000 events, in our database and restricted to your account. Access tokens are encrypted, kept on our servers and never sent to your browser.
• Sharing: we do not sell Google user data, do not use it for advertising, and do not use it to create, train, or improve any AI or machine-learning model. No Google user data – raw, aggregated, anonymised, or derived (such as free time calculated from your events) – is sent to any AI provider. When you use Oklixo's AI planning, the free hours it receives are calculated from your Oklixo work blocks only, without your Google Calendar events. Google user data is otherwise processed only by the hosting providers that run Oklixo.
• Deletion: choosing Disconnect in Settings → Integrations revokes Oklixo's access at Google and deletes the stored events and tokens. You can also remove access at any time at myaccount.google.com/permissions.

Oklixo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. Work tools: Notion, Jira, Trello, Asana, Outlook and Slack

Connecting a work tool is optional. You sign in with that tool and approve read-only access; Oklixo never creates, changes, completes, or deletes anything in it. The Outlook calendar is described separately in section 13.

• Account details: your account ID in the tool, and your name and email address where the tool provides them, so we can show which account is connected.
• Sources: the names of the databases, sites, boards, or workspaces you can choose to follow. Nothing is imported until you follow a source.
• Imported items from the sources you follow, for each item only its title, a link back to it, its due date, a time estimate where the tool has one, whether it is finished, and when it was last changed. We do not store descriptions, comments, attachments, or file contents.
  • Notion: open rows of the databases you shared with Oklixo during sign-in.
  • Jira: open issues assigned to you on the sites you follow.
  • Trello: cards you are a member of on the boards you follow, or all cards on a board where you are the only member.
  • Asana: incomplete tasks assigned to you in the workspaces you follow.
  • Outlook: only emails you have flagged. We store the subject, flag status, and flag due date. Oklixo does not read email bodies or attachments, and does not send email.
  • Slack: only messages you have reacted to with 📌 (or an emoji named :oklixo:). Slack lets Oklixo see only messages you have reacted to; we keep just the tagged ones, storing the first 120 characters as the title and a link to the message. Oklixo cannot browse channels and does not post in Slack.
• How we use it: only to show these items in your Oklixo inbox, to place them in your plan when you choose to (or automatically, if you turn on Auto-plan for that source), and to mark them finished in Oklixo when they are finished in the tool.
• How we store it: in our database, restricted to your account. Access tokens are encrypted, kept on our servers and never sent to your browser.
• Sharing: we do not sell this data, do not use it for advertising, and do not use it to train AI models. Imported items are not sent to our AI provider on their own. If you place an item in your plan and then ask Oklixo's AI to work on that project, its title is processed in the same way as a project you created yourself. This data is otherwise processed only by the hosting providers that run Oklixo.
• Deletion: choosing Disconnect in Integrations deletes the stored tokens, followed sources, and imported items for that tool. Projects you already placed in your plan stay until you delete them. For Asana, Disconnect also revokes Oklixo's access at Asana. For the other tools, you can also remove Oklixo in that tool's connected-apps settings at any time.
• Changes made in the tool: for Jira, we regularly check Atlassian's personal data reports, and for Trello, its compliance feed. If you close your account there, or revoke Oklixo's access in Trello, we delete the data we hold from that account; if you change your Trello profile, we update the name we show.

13. Microsoft Outlook calendar

If you connect your Outlook calendar (part of the Outlook integration), Oklixo asks Microsoft for permission to read your calendars (Calendars.Read). If you also turn on editing, Oklixo asks for permission to change and delete your calendar events (Calendars.ReadWrite).

• What we read: Oklixo reads only your default calendar. For each event, its title, start and end time, whether it is all-day, whether it is shown as Free, whether it was cancelled, and whether you declined it. When you open an event in Oklixo, its location, online meeting link, organiser and attendees are fetched live from Microsoft to show you, and are not stored.
• How we use it: only to show your meetings in the Oklixo calendar and to avoid scheduling your work over them. With editing turned on, Oklixo changes an event's title or time only when you edit that event and press Save in Oklixo, and deletes an event only when you press Delete on that event in Oklixo and confirm it. Both apply only to meetings you organise; Outlook sends its usual update or cancellation to the attendees, and for a repeating meeting only the one occurrence you chose is changed or deleted. Oklixo never creates events in your Outlook calendar, never deletes events on its own, and never changes or deletes invitations from other people.
• How we store it: events from 7 days in the past to 90 days ahead, up to 2,000 calendar events in total, in our database and restricted to your account. Access tokens are encrypted, kept on our servers and never sent to your browser.
• Sharing: we do not sell this data, do not use it for advertising, and do not use it to train AI models. Your Outlook calendar events are not sent to any AI provider. This data is otherwise processed only by the hosting providers that run Oklixo.
• Deletion: stopping the calendar in Integrations deletes the stored events; Disconnect deletes the stored events, tokens, and flagged-email items. You can also remove Oklixo's access at any time at account.microsoft.com (personal accounts) or myapps.microsoft.com (work or school accounts).

14. Changes to this policy

We may update this Privacy Policy when the Service or the law changes. The date at the top shows the latest version. We will tell you about material changes through the Service or by email before they take effect, and we will ask for your consent again where the law requires it.

15. Contact

Laurynas Slapšys
Individual activity certificate No. 1219693
Lithuania
info@oklixo.com