Privacy Policy
This policy explains what OKTO Software collects, why, who it goes to, how long it is kept, and what you can ask us to do about it. It covers two different things that are easy to confuse: information about you as an OKTO account holder, and information your brokerage puts into OKTO about its own clients and transactions. We treat those differently, and this policy says how.
1. Our two roles
OKTO Software plays two distinct roles, and the difference decides who controls your information.
Customer Data — we are a service provider
When a brokerage, team, transaction coordinator or agent uses OKTO, they put in information about their own business: clients and contacts, transactions, documents, signatures, deadlines, compliance records and financials. We call that Customer Data. The brokerage decides what goes in, who sees it and when it is deleted. We process it on their instructions only, to provide the service. We do not sell it, we do not share it for advertising, and we do not use it to build products for anyone else.
If you are a buyer, seller or client of a brokerage that uses OKTO and you want your information corrected or deleted, contact that brokerage. They control it. We will support them in responding, but we cannot act on their data without their instruction.
Account Data — we are the business
Separately, we collect information about the people who hold OKTO accounts: name, work email, phone, role, brokerage, sign-in times, billing details and support conversations. We call that Account Data and we control it. This policy governs it directly.
Note that this applies even though OKTO sells to businesses. California's business-to-business exemption expired in 2023, so a work email and login history are personal information in scope.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identifiers | Name, work email, phone, account and user ID | You, or the account administrator who invited you |
| Commercial information | Plan, subscription status, invoices, payment history | You and Stripe |
| Internet activity | Sign-in timestamps, pages used, IP address, browser and device | Automatically, as you use the service |
| Professional information | Role, brokerage, license context, team structure | You or your administrator |
| Communications | Support requests and our replies | You |
| Customer Data | Contacts, transactions, documents, signatures, compliance and financial records | Your brokerage — see section 1 |
We never see or store full card numbers. Payments run through Stripe, which handles card data directly. We store only what Stripe returns to us: the plan, the status, and a reference such as the last four digits and card brand.
Sensitive personal information
We do not collect government ID numbers, financial account credentials, precise geolocation, health information, or information about race, religion or sexual orientation for our own purposes. If a brokerage uploads a document into OKTO that happens to contain such information, it is Customer Data under their control, and we process it only to store and display it back to them.
3. Why we use it
- To provide the service — run your account, store your work, show it back to the right people.
- To bill you — process subscriptions, trials, renewals and invoices.
- To support you — answer requests and investigate problems you report.
- To keep the service safe — detect abuse, prevent unauthorised access, maintain backups.
- To improve the product — understand which features are used, using aggregated and account-level activity, not the contents of Customer Data.
- To meet legal obligations — tax, accounting, and lawful requests.
We collect and keep only what is reasonably necessary for these purposes.
4. Who we share it with
We do not sell personal information and we do not share it for cross-context behavioural advertising. We disclose it to the following service providers, each under contract limiting them to processing on our instructions:
| Service provider | What it does | What it receives |
|---|---|---|
| Stripe | Payments and subscriptions | Name, email, billing details, payment card data (directly) |
| Brevo | Transactional email | Name, email, message content of system notifications |
| DigitalOcean | Hosting, database, file storage | All hosted data, at rest and in transit |
| Anthropic | AI assistance features | Only the text of a request you submit to an AI feature, plus relevant context — see section 5 |
| Voyage AI | Search indexing for AI features | Text excerpts used to build search indexes |
We may also disclose information where required by law, to enforce our Terms, or in connection with a merger or acquisition — in which case this policy continues to apply until it is replaced and you are notified.
5. AI processing
OKTO includes AI features that answer questions, draft documents and check compliance. When you use one, the text of your request and the relevant records are sent to our AI providers to generate a response.
- AI providers process this only to return a response to you.
- Your Customer Data is not used to train third-party or public AI models.
- One brokerage's data is never used to answer another brokerage's question.
- AI output can be wrong. It is informational, not legal, financial or compliance advice, and it does not replace your broker's judgement.
6. How long we keep it
Retention is driven by a specific constraint. Under A.R.S. § 32-2151.01(A), an Arizona broker must retain transaction and employment records for at least five years. Because OKTO holds those records on a broker's behalf, we do not delete Customer Data on a schedule that would undercut our customers' own obligation.
| Category | Retention | Why |
|---|---|---|
| Customer Data (transactions, documents, signatures) | For the life of the account, then five years unless the customer directs otherwise | Broker record-retention obligation |
| Account Data (profile, role, sign-in history) | Life of the account plus 12 months | Support, disputes, security investigation |
| Billing and invoices | Seven years | Tax and accounting |
| Support conversations | Three years | Service history and dispute resolution |
| Backups | Rolling, overwritten in the normal cycle | Disaster recovery |
Deletion from live systems happens first; backups age out on their own cycle rather than being edited in place.
7. Your rights
Depending on where you live, you may have the right to:
- Know what we collect, why, where it came from and who receives it.
- Access a copy of your personal information.
- Correct information that is inaccurate.
- Delete your personal information, subject to the retention obligations above.
- Opt out of sale or sharing — we do neither, so there is nothing to opt out of.
- Limit use of sensitive personal information — we do not collect it for our own purposes.
- Non-discrimination — we will not degrade your service for exercising these rights.
To exercise any of these, email [email protected]. We will verify your identity against the account and respond within 45 days, extending once by a further 45 days where permitted, with notice. An authorised agent may act for you with written permission.
Send it to that brokerage. They decide what happens to Customer Data. If you contact us instead, we will tell you who to reach and let them know the request came in.
8. Security
We use encryption in transit, access controls scoped by role, per-account data separation, session timeouts, and regular backups. Staff access to customer accounts is deliberate and time-limited rather than standing.
No system is perfectly secure. If a breach affects your personal information, we will notify you and any required authority as the law directs.
9. Children
OKTO is a business tool and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has provided information, contact us and we will delete it.
10. Changes and contact
We review this policy at least once a year and update it when our practices change. Material changes will be announced in the product before they take effect, and the date at the top will always tell you which version you are reading.
OKTO Software
Tucson, Arizona, United States
[email protected]
This policy describes how OKTO Software actually handles information. It is not legal advice to you, and it does not create obligations for your brokerage. Your own privacy and record-retention duties as a licensee are yours — talk to your attorney or your designated broker about those.