This policy explains how Octom (“we”, “us”) handles personal data when you use our service. We try to collect as little as possible.
1. Who we are
The operator of Octom is OCTOM, [Your address, Romania]. You can contact us at contact@octom.eu.
2. What data we process
- Account data: your email address and a password. The password is handled by our authentication provider and is stored only in hashed form; we never see it.
- Workspace data: your workspace name and the content you add: contacts (names, companies, emails, phone numbers, notes), follow-ups and the activity history of those records.
- AI usage counters: when you use the AI assistant we record that a request happened (who, when, which type) to apply usage limits. We do not store the prompts or the generated text.
- Team data: if you invite colleagues, they can see and edit the workspace data and can see your email address inside the workspace.
- Email preferences: whether you turned on the optional daily summary email, and whether you agreed to receive news and offers (with the date you agreed).
- Billing data: if you subscribe to a paid plan, your plan, subscription status and the customer reference from our payment provider. Card details are entered with Stripe and never reach us.
- Browser storage: your login session and language choice (see our Cookies page).
We do not ask for payment card data, bank credentials, medical data or passwords to other services, and you should not enter them in notes.
3. Why we process it
- To provide the service you asked for (contract).
- To keep the service secure and prevent abuse, including usage limits (legitimate interest).
- To handle billing and keep the records the law requires (contract and legal obligation).
- To send you news, product updates and offers by email, only if you agreed (consent). You can withdraw it at any time.
- To comply with legal obligations.
4. Your contacts’ data
The contact records you add are about other people. For that content you decide why and how it is used and you are responsible for having a valid legal basis for it. For that content we act as your processor: we process it on your behalf and only to run the service. A data processing agreement is available on request through the contact form.
5. Who we share data with
We use these providers to run Octom. The full list, with purpose and data, is on the Subprocessors page.
- Supabase: database and authentication (project hosted in the EU, Frankfurt).
- Vercel: website hosting.
- Resend: sends the optional daily summary email to you, only if you turn it on.
- OpenAI: some features use AI models provided by OpenAI. When you use the AI assistant, the information needed for your request (your draft, or the selected contact’s name, company, status, notes and recent activity) is sent to OpenAI to produce the text. OpenAI may keep API inputs for a limited period under its own terms.
- Stripe: handles payments for paid plans. We do not store card details.
We do not sell personal data.
6. International transfers
Some providers may process data outside the European Economic Area. In that case we rely on the safeguards provided by law, such as standard contractual clauses or an adequacy decision, where applicable.
7. How long we keep data
We keep your data while your account is active. You can export your contacts at any time from the Import & export page. You can delete your account and all its data yourself from the Account page, or email us at contact@octom.eu. When you delete your account, your workspace data and login are removed and any paid subscription is cancelled. Copies in provider backups expire on the provider’s normal schedule, and we keep billing records for as long as the law requires. AI usage counters are short-lived and contain no content.
8. Your rights
Under the GDPR you can ask for access to your data, correction, deletion, restriction, portability and you can object to processing. Contact us at contact@octom.eu. You can also lodge a complaint with the Romanian data protection authority (ANSPDCP) or the authority in your country.
9. Security
Data is protected with access controls at database level, so each workspace can only be read by its own members, and connections use HTTPS. No system is perfectly secure, but we work to protect your data and fix problems quickly.
10. Children
Octom is intended for business use and is not for people under 18.
11. Changes
We may update this policy. The date at the top shows the latest version, and we will notify you of important changes.