Privacy policy

Who is responsible

Okami is run by whydontwe OÜ, a private limited company registered in Estonia (registry code 17623076), Sepapaja tn 6, 15551 Tallinn, Estonia. Write to hello@withokami.com about anything on this page.

The studio's data and ours

When you book with a studio through Okami, on its booking page or on Instagram, the studio decides what happens with your booking and your details. Okami handles them on the studio's behalf, under its instructions.

For studio owners, their team and visitors to this site, Okami decides, and is responsible for that data itself.

If you book with a studio

When you book, the studio you book with decides what happens with your details and bookings: it is responsible for them (the controller). Okami handles them for the studio (its processor), under a data processing agreement, and this page tells you how, for the studio too.

Replies on the booking page, on Instagram and by email are written by Okami's AI, not by a person at the studio. The studio sees every conversation and can step in, and if you ask, Okami tells you it's an AI.

About your bookings, or to use your rights, write to the studio or to us: we'll help the studio answer.

What we collect

From a studio's clients:

• Your name, phone number, preferred language and, if you give one, your email address.
• Your bookings: service, time, the person doing it, price.
• What you write to Okami on the booking page, on Instagram or by email, and its replies. On Instagram, also the ID Instagram gives you for that studio's account.
• Voice dictation, if you use it: the recording is turned into text and not kept.
• Photos and voice messages you send a studio on Instagram: Okami looks at a photo to understand what you'd like, and keeps only a note that you sent one; a voice message is turned into text and kept as that text. The photo and the recording themselves are not kept. When Okami doesn't answer a photo sent on its own, a short description of it waits ten minutes in case words follow, then is deleted.
• Your rating of a visit, and any words you add to it (below).

From studio owners and their team:

• Your name, email address, role and, if you add one, a photo.
• The studio's details, services, hours and bookings.
• What you ask Okami in the app, and your voice dictation, turned into text and not kept.
• If the studio pays: its plan, seats and invoices. The payment and billing details stay with Stripe (below).

From studios asking for early access on this site: the email address and, if given, the studio's Instagram username, with the language the page was in and when they asked.

From anyone using Okami: your IP address, counted for a short time to stop abuse (see below).

Why we use it

• To book, move and cancel appointments, answer clients' questions, and email clients who give an email about their bookings (confirmation, reminder, changes), as the studio has asked us to.
• To email the studio's clients after a visit, when the studio turns it on (below), as it has asked us to.
• To run the studio's account: sign-in, the team, booking emails, billing. This is our contract with the studio.
• To keep Okami safe and working, for example by limiting how many messages one sender can send. This is our legitimate interest.
• To answer a studio that asks for early access, and invite it to the pilot. This is a step it asks us to take before a contract.

We don't sell personal data, show ads or build marketing profiles.

Emails after a visit

When a studio turns them on, Okami emails the studio's clients who gave an email, for the studio, after a visit:

• A short question how it was, with a rating from 1 to 5, at most once every 90 days. The rating, and any words you add, are kept with your bookings for the studio. If you answer by email, an AI reads the reply to find the rating. After a good rating, the studio may ask you for a public review, for example on Google.
• When it's time to come back, a few free times with the person you usually see, or a time that has just opened up.

The studio sends these to its own clients, about services like the ones they had, which the e-Privacy rules allow without asking first as long as you can stop them at any time. Your booking confirmation says they may come.

To stop them, use the link at the bottom of any of them: one click stops both kinds from that studio. You can also tell Okami in any chat, or ask the studio. Confirmations and reminders still come.

Ratings on a booking page

A studio's booking page may show its rating, such as “4.8 ★ · 37 verified visits”. Only clients who had a visit booked through Okami can rate it, when Okami asks them after the visit. Every rating counts, the low ones too: the rating is the average of the last 12 months, shown once there are at least 5, and the number is how many visits were rated. Names and words aren't shown.

How Okami's AI works

Okami's replies are written by an AI model. To answer you, it receives your message, the conversation so far and what it needs from the studio's calendar. It books only what is free, under the studio's rules.

The model providers, reached through Vercel's AI Gateway, process this data only to produce the reply. Their business terms don't allow them to train their models on it.

Who handles it for us

These services handle personal data for Okami, each under a data processing agreement:

• Vercel Inc.: hosts Okami, and through its AI Gateway passes requests to the AI models below (servers in Dublin, Ireland).
• Supabase Inc.: stores Okami's data and handles sign-in (servers in Ireland).
• Anthropic PBC: the AI model (Claude) that writes Okami's replies and reads the rating in a client's emailed answer, reached through Vercel's AI Gateway (United States).
• OpenAI: turns voice dictation, and clients' voice messages on Instagram, into text, reached through Vercel's AI Gateway (United States).
• Resend Inc.: sends sign-in codes, booking emails and emails after a visit, and the emails between clients and Okami about their bookings (servers in Ireland).
• Functional Software, Inc. (Sentry): collects error reports from Okami's servers, so we can fix what breaks (servers in Frankfurt, Germany).
• API Hero Ltd (Trigger.dev): runs and retries Okami's background work, such as answering messages and sending reminders; it sees only internal IDs, never what clients wrote (servers in Frankfurt, Germany, with records of each run in the United States).
• Meta Platforms Ireland Ltd.: delivers Instagram messages between clients and studios (Ireland).
• ImprovMX: forwards email sent to hello@withokami.com to Okami's inbox (United States and the European Union).

Where data leaves the European Union, it is protected by the European Commission's standard contractual clauses or an adequacy decision.

Okami's plan is sold through Link: Stripe is the seller of record and takes a paying studio's payment and billing details itself, under its own privacy policy (stripe.com/privacy). Okami gets only what it needs to run the plan: whether it's paid, the seats and the invoices to show the owner. Stripe never sees clients' data.

How long we keep it

• Clients' details, bookings and conversations: while the studio uses Okami, or until the studio or you ask us to delete them. After a studio leaves, within 90 days.
• Ratings and the words with them: as the bookings they belong to.
• Studio accounts, and their plan: until the account is deleted. Stripe keeps its own payment records.
• Early-access requests: a year from the last time you asked, or until you ask us to delete them.
• IP address counts: until their time window ends, at most a day.
• Sign-in codes: one hour.

Your rights

You can ask us for a copy of your data, to correct it, delete it, limit how we use it, or move it elsewhere, and you can object to how we use it. If you're a studio's client, you can also ask the studio, and we'll help it answer.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the authority where you live.

Deleting your data

Write to hello@withokami.com and tell us how to find you: the studio you booked with and your phone number, or your Instagram username. We'll delete your details, bookings and conversations within 30 days and confirm when it's done. A studio may need to keep a record of past bookings for its own accounting; we'll tell you if so.

Studio owners and team members can delete their account themselves in Settings. An owner deleting their account closes the studio and its data goes with it.

Cookies and storage

Okami uses only what it needs to work: a sign-in cookie in the app, your language, two cookies that keep the app as you left it (whether the sidebar is open, and the studio's colours), and on a booking page a key in your browser that keeps your conversation with the studio. No analytics, advertising or tracking cookies, so there's nothing to agree to.

Changes

When this policy changes, we update this page and its date, and say what changed at withokami.com/en/legal-updates. If a change matters to you, we'll tell you by email first.