Privacy Policy

Who we are

oktai is operated by Glorya GmbH, Oranienburger Straße 17, 10178 Berlin, Deutschland ("oktai", "we"). For privacy questions contact joshua@primepage.ai.

Data we process

• Account data: your name, email and password hash, created when you sign up (email or Google).
• Brand & marketing data: the website you submit for audit, brand assets, copy, generated creatives, and content you upload or generate in the app.
• Connected accounts: when you connect Meta or Google, we store the access tokens and the ad-account, page and campaign data needed to analyse and manage your advertising.
• Billing data: handled by Stripe; we store your plan, credit balance and invoices, not your card number.
• Usage data: log, device and product-analytics data to keep the service secure and improve it.

Why we process it (legal bases)

To provide the service you requested and perform our contract with you (Art. 6(1)(b) GDPR); to keep the service secure and improve it, based on our legitimate interests (Art. 6(1)(f)); to comply with legal obligations such as tax law (Art. 6(1)(c)); and on your consent where required, e.g. non-essential cookies (Art. 6(1)(a)).

AI processing

oktai uses AI models to audit sites, generate ad creatives, videos, copy and landing pages from the brand context and assets you provide. We do not use your private brand content to train third-party foundation models, and we instruct our sub-processors not to retain it for training where they offer that option.

Sub-processors & sharing

We share data with vendors that run the service on our behalf, under data-processing agreements: cloud hosting and storage, AI model providers, Stripe (payments), and the advertising platforms you connect (Meta, Google). We do not sell your personal data.

International transfers

Some providers process data outside the EEA. Where they do, transfers are covered by an adequacy decision or the EU Standard Contractual Clauses.

Google user data and Limited Use

When you connect a Google account, oktai asks only for the permissions the feature you are enabling needs:

• Sign-in (openid, email, profile): your name, email address and profile picture, used to create and authenticate your oktai account.
• Google Ads (https://www.googleapis.com/auth/adwords): the ad accounts, campaigns, ad groups, creatives and performance metrics you select, so oktai can audit your advertising and create or update campaigns when you ask it to.
• Google Search Console (https://www.googleapis.com/auth/webmasters): the properties, queries and search-performance data of the sites you select, so oktai can analyse how your site performs in search.
• Google Indexing API (https://www.googleapis.com/auth/indexing): submitting the URLs of pages oktai publishes for you, so Google can crawl them sooner.

We use Google user data only to provide these features to you inside your own workspace. We do not sell it, do not use it to serve you advertising, do not share it with anyone other than the sub-processors that operate oktai on our behalf, and do not use it to develop, improve or train generalised AI or machine-learning models. Humans do not read your Google user data except in the narrow cases Google permits: with your explicit consent, for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymised for internal operations.

oktai's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The policy is available at https://developers.google.com/terms/api-services-user-data-policy.

You can disconnect a Google account at any time in oktai's integration settings; this deletes the stored access and refresh tokens and the connected-account data held for that integration. You can also revoke oktai's access directly from your Google Account at https://myaccount.google.com/permissions, and you can ask us to delete the remaining data by emailing joshua@primepage.ai.

How we protect your data

Security procedures are in place to protect the confidentiality of your data. We use technical and organisational safeguards to protect Google user data and other sensitive data against unauthorised access, alteration, disclosure and destruction, and we review these measures as the service changes.

• Encryption in transit: all traffic between your browser, the oktai app and the APIs we call — including the Google APIs — is protected with industry-standard HTTPS/TLS.
• Encryption at rest: our cloud database and file-storage providers encrypt stored data at rest, and Google OAuth access and refresh tokens are additionally encrypted by oktai with AES-256-GCM before they are written to the database, so they are never stored in plain text.
• Access control: authentication, workspace-level authorisation checks and least-privilege access limit data to the authorised personnel and service components that need it to operate and support oktai. Secrets and encryption keys are held in the hosting provider's encrypted environment configuration, separate from the data they protect.
• Scope minimisation: we request only the Google scopes a feature needs, and disconnecting an integration deletes the tokens we hold for it.
• Monitoring and vendor diligence: we log and monitor access to keep the service secure, run on established cloud providers under data-processing agreements, and will notify you and the competent supervisory authority of a personal-data breach where the GDPR requires it.

No system can be guaranteed completely secure, but these measures are designed to keep the risk of unauthorised access, alteration, disclosure or destruction of your personal data as low as we reasonably can.

Retention

We keep account and brand data for as long as your account is active and delete or anonymise it within a reasonable period after closure, except where we must retain records (e.g. invoices) to meet legal obligations.

Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interests. To exercise these, email joshua@primepage.ai. You may also lodge a complaint with a supervisory authority.