Data processing agreement

Who it is between

The studio that accepts Okami's terms is the controller of its clients' and team's personal data.

Okami is the processor: whydontwe OÜ, a private limited company registered in Estonia (registry code 17623076), Sepapaja tn 6, 15551 Tallinn, Estonia, hello@withokami.com.

What Okami processes

Okami answers the studio's clients, books, moves and cancels their appointments and keeps the studio's calendar, for as long as the studio uses Okami. When the studio turns them on, Okami also emails its clients after a visit: a question how it was, with a rating an AI reads from an emailed answer, and times to come back. Turning them on is the studio's instruction to send them.

• Whose data: the studio's clients and its team.
• Clients: name, phone number, email address if given, preferred language, bookings, messages on the booking page, by email or on Instagram with the ID Instagram gives them, voice dictation and voice messages turned into text, photos sent on Instagram, looked at by the AI and not kept, and ratings of visits with any words added.
• Team: name, email address, role, photo if added, and what they ask Okami.

Okami doesn't need special categories of data, such as health details, and the studio shouldn't enter them.

Only on the studio's instructions

Okami processes the data only to provide Okami to the studio. The studio's instructions are these terms and what it sets in Okami: its services, hours, team and rules. Okami doesn't use the data for its own purposes, sell it or show ads with it.

If an instruction would break data protection law, Okami tells the studio and doesn't follow it. If the law makes Okami process data otherwise, Okami tells the studio first, unless the law forbids that.

Confidentiality

Only people who need the data to run Okami can reach it, and each of them is bound to keep it confidential.

Security

Okami protects the data with measures fit for the risk, among them:

• Encryption in transit and at rest.
• Each studio's data is separated in the database, so a studio's account reaches only its own.
• Sign-in by a one-time code sent to the team member's email.
• Limits on how many messages one sender can send.
• Access for Okami's own people only where they need it.

Okami reviews these measures as it grows and keeps them at least at this level.

Subprocessors

The studio allows Okami to use these subprocessors, each bound by a data processing agreement with the same protections as this one:

• Vercel Inc.: hosts Okami, and through its AI Gateway passes requests to the AI models below (servers in Dublin, Ireland).
• Supabase Inc.: stores Okami's data and handles sign-in (servers in Ireland).
• Anthropic PBC: the AI model (Claude) that writes Okami's replies and reads the rating in a client's emailed answer, reached through Vercel's AI Gateway (United States).
• OpenAI: turns voice dictation, and clients' voice messages on Instagram, into text, reached through Vercel's AI Gateway (United States).
• Resend Inc.: sends sign-in codes, booking emails and emails after a visit, and the emails between clients and Okami about their bookings (servers in Ireland).
• Functional Software, Inc. (Sentry): collects error reports from Okami's servers, so we can fix what breaks (servers in Frankfurt, Germany).
• API Hero Ltd (Trigger.dev): runs and retries Okami's background work, such as answering messages and sending reminders; it sees only internal IDs, never what clients wrote (servers in Frankfurt, Germany, with records of each run in the United States).
• Meta Platforms Ireland Ltd.: delivers Instagram messages between clients and studios (Ireland).
• ImprovMX: forwards email sent to hello@withokami.com to Okami's inbox (United States and the European Union).

Okami emails the studio's owner at least 30 days before adding or replacing one, and lists the change at withokami.com/en/legal-updates. The studio can object in that time; if we can't resolve it, the studio can leave Okami and its data is deleted as below. Okami stays responsible for what its subprocessors do.

Data outside the EU

Where data leaves the European Economic Area, it goes only under the European Commission's standard contractual clauses or an adequacy decision.

Helping the studio

When a client asks the studio to see, correct, delete or move their data, Okami helps the studio answer. If a client asks Okami directly, Okami passes the request to the studio. Okami also helps with the studio's security, breach reporting and any impact assessment, as far as it concerns Okami.

Data breaches

If personal data is lost, leaked or reached by someone it shouldn't be, Okami tells the studio without undue delay, at most 48 hours after finding out. It says what happened, whose data and what is affected, what it is doing about it, and who to contact, so the studio can meet its own 72-hour duty to report.

When the studio leaves

Until it leaves, the studio can ask for a copy of its data. Once it stops using Okami, Okami deletes the data, backups included, within 90 days, unless the law requires keeping it.

Showing it is done

Okami gives the studio the information it needs to see that this agreement is kept. The studio, or an auditor bound to confidentiality, can also check it, once a year or after a breach, on 30 days' notice and at the studio's cost. Write to hello@withokami.com.

Law and changes

Estonian law governs this agreement. Where it and Okami's other terms differ on personal data, this agreement wins.

When it changes, we update this page and its date, list the change at withokami.com/en/legal-updates, and email studios' owners at least 30 days before a change that matters to them takes effect.