Data processing agreement

1. Parties

• Controller: the coach, being the owner of an okidok workspace (referred to as "you").
• Processor: Cedric Jacob, Siegburg, Germany, operating okidok.io (referred to as "okidok").

Contact for data protection matters: hello@okidok.io.

2. Subject and duration

okidok processes personal data on your instructions so that you can run your coaching business: your subscribers, members, customers and the people who message you. Processing lasts for as long as your workspace exists, plus the retention periods in section 8.

3. Nature and purpose of the processing

Storing, organising, retrieving, sending and deleting the data you and your audience put into the product: contact records, segments, events, bookings, payments metadata, pages, emails, messages from connected social accounts, and the files you upload.

Hosting your public pages and forms on your address ({you}.okidok.io) or your own domain: delivering each page to the people who open it, taking what a visitor sends through a form, adding it to your contact records as your form's settings say (fields, tags, the state, a journey, a course), and sending the one email that asks a visitor to confirm their address when they ticked your box for emails. Keeping your forms usable for people and closed to automated abuse: a time check on every send, a hidden field people never fill, a check that the email's domain can take mail, and a count of sends from one network over ten minutes.

4. Categories of data and data subjects

• Data subjects: your leads, subscribers, members, customers and anyone who contacts you through a page, form or connected inbox.
• Data: name, email address, phone number where you collect it, message content, booking and payment metadata, page and email interaction events, and any custom fields you create.
• okidok does not ask you to store special categories of data. If you do, you remain responsible for the legal basis.
• Data subjects: visitors of your public pages, and the people who send your forms.
• Data: what a visitor types into your form, when they sent it, the page they sent it from and the campaign tags of its address (utm source, medium and campaign) and the page they came from (the referrer); the consent they gave (ticked, the version of your box's words, when the confirmation email went and when they pressed its link).
• Not kept with your records: a visitor's IP address or browser (the technical records of a request, at most 30 days, are the only place they pass through). To limit automated sends, okidok keeps a one-way keyed code made from the visitor's network address for at most one hour, which cannot be turned back into the address. To limit confirmation emails, a one-way keyed code of the email address is kept for at most two days. A confirmation link is stored only as a one-way code of itself, for seven days.

5. Your instructions

okidok processes the data only on your documented instructions, which are: the settings you choose in the product, the actions you run, and this agreement. okidok tells you if an instruction appears to breach applicable data protection law.

6. Confidentiality and security

Everyone with access is bound to confidentiality. Technical and organisational measures include encryption in transit and at rest, least-privilege access, tenant scoping enforced on the server for every request, audit events for every action, and regular backups.

7. Sub-processors

You give general authorisation for the sub-processors below. okidok tells you before adding or replacing one, and you may object.

• Amazon Web Services (AWS): hosting, storage, database and delivery, in eu-central-1, Frankfurt, Germany.
• Amazon Bedrock: the AI assistant inside the product, on an EU inference profile. When you ask it to summarise a conversation or draft a reply, the messages between you and that member are sent to the model for that request; nothing is sent to a member without your own Send.
• Amazon Simple Email Service (SES): sending your email, in eu-central-1, Frankfurt, Germany.
• Meta Platforms Ireland Ltd (the Meta Pixel), a sub-processor you choose: it loads on your public pages only when you connect your pixel in Settings > Tracking, and only after a visitor says yes in the cookie banner. You are responsible for the legal basis of what Meta processes for you; the Privacy page okidok writes for your site names it.

Primary data residency is the European Union. Where a transfer outside the EU cannot be avoided, it rests on the European Commission's standard contractual clauses.

8. Deletion and return

You can export your data at any time. When your workspace is deleted, okidok deletes the data within 30 days, except where a legal retention duty applies. Backups age out on their own schedule, at most 35 days.

The assistant's conversation is kept for 30 days. When the assistant offers a plan of several changes at once, that 30 days includes what each step of the plan would write, so the plan can still be read, retried and taken back after it has run. The words a step would write (a drafted message, a note) are removed from the plan once that step has run, and from every plan when the person they are about is deleted.

A course sheet you import, and the plan okidok reads from it, are kept for 30 days after they were written, and a replaced copy of either for one more day; then they are deleted on their own. They hold what you typed or pasted into the sheet: course and lesson titles, lesson text and links. The record of an import keeps the counts of what it read; when a teammate's account is deleted, it no longer names who started the import.

A community sheet you import, the plan okidok reads from it and the report of what the import wrote are kept for 30 days after they were written; then they are deleted on their own. They hold what you typed or pasted into the sheet: posts and replies, and the names and email addresses of the people who wrote or liked them. What the import writes into your community is kept and deleted like any other post. When you delete a person the import added, everything they wrote goes with them, and importing the same sheet again does not bring them or their words back.

A form's answers are kept until you delete them or the person who sent them, or until your workspace is deleted. When you delete a person, their submissions become a row that reads "An erased person · Answers removed on request" and keep no answer; your counts stay. The codes that limit automated sends and confirmation emails expire on their own after at most one hour and two days; a confirmation link that was not pressed expires after seven days.

9. Assistance

okidok assists you with data subject requests, with security incidents, and with data protection impact assessments, in each case with the information okidok holds.

The Privacy page okidok generates for your public pages from your Imprint describes this processing to your visitors. It is a template; you remain the controller of what your pages collect and why.

10. Audit

okidok gives you the information needed to show compliance with this agreement, and allows audits by you or an auditor you appoint, on reasonable notice and no more than once a year unless an incident makes more necessary.

11. Breach notification

okidok notifies you without undue delay after becoming aware of a personal data breach affecting your data, with what is known at the time.

12. Liability and law

German law applies. The place of jurisdiction is the operator's registered seat, as far as the law allows.

Version 2026-11-05