Privacy Policy

1. Our role

For information about website visitors, account holders and our own business contacts, Octaworks is the controller and decides how that information is used.

For the requests, documents, policies and other content that our customers and their users put into Octapipe ("Customer Data"), Octaworks acts as a processor or service provider on behalf of the customer. The customer organization is the controller of that data and decides what goes into the Service. If your organization uses Octapipe and you have a question about your data, please contact your organization first.

2. Information we collect

We collect the following categories of information:

• Account information: name, work email, company, role and password when you create an account or are invited by your organization.
• Customer Data: requests, form fields, attachments such as invoices, receipts and quotes, policies and rules, comments, decisions and the audit trail created in the Service.
• Contact information: name, email, message and language when you fill in our contact form or write to us.
• Billing information: plan, billing address and payment status. Card payments are processed by Stripe, and we do not store full card numbers.
• Usage and device information: pages viewed, features used, log data, IP address, browser type and approximate location, collected to run, secure and improve the Service.
• Website visit information: for every page you visit on octapipe.com, we record the page, your browser language, device type, browser, operating system and campaign parameters (such as utm_source). This does not use cookies.

3. How we use information

We use information to:

• Provide the Service, including running AI agents that review requests against the policies your organization defines.
• Create and manage accounts, authenticate users and provide customer support.
• Process payments and send service, billing and security messages.
• Monitor, secure and troubleshoot the Service and prevent fraud and abuse.
• Understand how the Service is used and improve it, using aggregated or de-identified usage information.
• Send product news and marketing to business contacts, with an option to unsubscribe at any time.
• Comply with legal obligations and enforce our Terms of Service.

4. AI processing

Octapipe uses AI agents to read documents, apply your organization's policies and approve, reject or escalate requests. To do this, Customer Data is processed by AI models, which may be operated by third-party model providers acting as our subprocessors.

We never use Customer Data to train AI models, and we require our AI model providers not to use it to train theirs. Every check and decision made by an agent is recorded in the audit trail, and anything outside your policy is sent to a person in your organization for review.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only:

• With service providers that help us run the Service, such as cloud hosting, AI model providers, payment processing (Stripe), email delivery and customer support tools. They may use the information only to provide their services to us.
• With analytics and marketing providers, only if you accept cookies on our website: Google Analytics (Google LLC) and Amplitude, to measure visits and how people use the website, and Apollo.io, to identify which companies visit it.
• With your organization, when you use the Service through an account it manages.
• When required by law, or to protect the rights, safety and security of our users, Octaworks or others.
• As part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.
• With your consent or at your direction.

6. Security

We protect information with technical and organizational measures, including encryption in transit and at rest, access controls and permissions, two-factor authentication and audit logs. No system is completely secure, but we work to protect your information and will notify affected customers of a security incident as required by law.

7. Data retention

We keep Customer Data for as long as your organization's account is active. Customers can delete content in the Service, and after an account is closed we delete Customer Data within 90 days, unless we must keep it longer to meet legal obligations. Backups are deleted on a rolling schedule.

We keep account, billing and contact information for as long as needed for the purposes described in this policy and to meet legal, tax and accounting requirements.

8. International transfers

Octaworks is based in the United States, and information may be processed in the United States and other countries where we or our service providers operate. When we transfer personal information from the European Economic Area, the United Kingdom, Switzerland or Brazil, we rely on appropriate safeguards such as the Standard Contractual Clauses.

9. Your rights

Depending on where you live, including under the GDPR, the UK GDPR, Brazil's LGPD and US state privacy laws such as the CCPA, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. You also have the right not to be discriminated against for exercising these rights.

To make a request, email support@octaworks.llc. We may need to verify your identity before responding. If your data is in the Service through your organization, we will refer your request to it. You may also complain to your local data protection authority.

10. Cookies and local storage

Our website uses essential cookies and browser storage to remember your language, theme and cookie choice. The application uses cookies needed to keep you signed in and secure.

If you accept cookies in the banner on our website, we also load Google Analytics, Amplitude and Apollo.io, which set cookies to measure visits, follow a visit through to signing up for the application, and identify the companies that visit. If you decline, these tools are not loaded. You can change your choice at any time with the "Cookies" link at the bottom of every page.

11. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new "last updated" date, and notify customers of material changes by email or in the Service.

13. Contact

Octaworks, LLC, 390 NE 191st St STE 8229, Miami, FL 33179, United States. Email: support@octaworks.llc.