oktomerBack to the home pageData processing agreement
Last updated 7 October 2026
This agreement applies when you subscribe to Oktomer. It covers the personal data of your customers that passes through your inbox, and it forms part of our terms. You are the controller, and Oktomer ("we") is your processor under Article 28 of the GDPR.
1. What we process
- Purpose: receive, store, sort and display your customers' messages, send your replies, and alert your team.
- People concerned: your customers and anyone who writes to you through a connected channel, and the members of your team.
- Data: names, email addresses, phone numbers, message contents, attachments, and the dates and statuses of messages.
- Duration: as long as your subscription runs, then until deletion as set out in section 7.
2. Your instructions
We process this data only to run your inbox and on your documented instructions, which are this agreement and the settings you choose in Oktomer. If we think an instruction breaks the GDPR, we tell you.
3. Confidentiality
Only the people who run Oktomer can access the data, and only when they need to: to fix a problem, or because you asked. They are bound by confidentiality.
4. Security
- Encrypted connections (HTTPS) between your browser, our server and the services we use.
- Passwords stored hashed; access to the server limited to named people.
- A backup every night, kept 14 days.
- Each team sees only its own inbox.
5. Subprocessors
You authorise the companies below. We tell you by email at least 30 days before adding or replacing one, and you can object; if we can't meet your objection, you can cancel and get the unused part of your subscription refunded.
| Company | What it does for Oktomer | Where the data is |
|---|---|---|
| Hetzner Online GmbH | Runs the server that hosts Oktomer and stores your conversations | Helsinki, Finland (EU) |
| Postmark (ActiveCampaign, LLC) | Receives the emails you forward to Oktomer and sends your replies and our notifications | United States |
| Cloudflare, Inc. | Domain name service for oktomer.com, and forwarding of emails sent to our own addresses | Worldwide network, United States company |
| Stripe Payments Europe, Ltd. | Takes payments and issues invoices | Ireland (EU) |
| Cal.com, Inc. | Books your calls with us | United States |
| PostHog Inc. | Counts visits and clicks on oktomer.com, without cookies | Frankfurt, Germany (EU) |
WhatsApp messages go through Meta on your own Meta account, under your agreement with Meta: Meta is not our subprocessor.
6. Helping you
We help you answer requests from the people concerned (access, correction, deletion), and with security and impact assessments where our part of the processing matters. We tell you without undue delay, and within 48 hours at most, after we learn of a personal data breach that affects your data, with what we know and what we are doing.
7. At the end
When your subscription ends, or when you ask, we delete your conversations, and they leave our backups within 14 days, unless the law requires us to keep them.
8. Checks
We give you the information you need to check that we keep to this agreement. You can ask for an audit once a year, with 30 days' notice, at your own cost.