Privacy Policy

1. Introduction

This Privacy Policy explains how Roborian, Inc. ("Roborian," "we," "us," or "our"), a Delaware C-Corporation, collects, uses, discloses, and protects your personal information when you access or use the OKiDO platform at okido.io and all related services (collectively, the "Service").

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Information We Collect

2.1 Account & Profile Data

When you register, we collect your email address, name, and an optional profile avatar. Your password is immediately hashed with bcrypt and never stored in plaintext.

2.2 Organization & Billing Data

When you create or join an organization, we store the organization name, URL slug, subscription plan, billing email, and billing cycle. Payment card details are processed and stored exclusively by our payment processor, Stripe. We only retain Stripe customer and subscription identifiers.

2.3 Work Content

The Service stores operational content you create, including tasks, projects, documents, SOP templates, RUN executions (step completions, approvals, form submissions), recordings, workflow diagrams, decision trees, comments, and file attachments.

2.4 AI Interactions

When you use OKiDO's AI features (chat agents, automation code generation, or AI-assisted SOP authoring), we store conversation messages, AI-generated responses, token usage metrics, and execution traces (logs, outputs, error messages). Content you send to AI features is transmitted to our AI provider (currently OpenAI) for processing.

2.5 Third-Party Credentials

If you configure integrations (API keys, OAuth tokens, etc.), those credentials are encrypted at rest using AES-256-GCM with a per-deployment encryption key. They are decrypted only during automation execution and never exposed through the API.

2.6 Communications & Notifications

We store comments you post on tasks, documents, and RUNs, as well as in-app notification records (type, read status, timestamps). If you enable browser push notifications, we store your Web Push subscription endpoint and encryption keys.

2.7 Device & Usage Data

We use Google Tag Manager to collect aggregated analytics on page views and interactions. For users in the EU/EEA, UK, and Switzerland, analytics scripts are only loaded after you provide cookie consent. We also log audit events (action type, user, organization, entity, and timestamp) to maintain a security audit trail.

2.8 Referral & Marketing Data

If you arrive via a referral link, we store a first-touch referral cookie (okido_ref, 30 days). Contact form submissions (name, email, company, phone, message) are stored for sales follow-up.

3. How We Use Your Information

• Provide and operate the Service — task management, SOP execution, project tracking, team collaboration, dashboards, search.
• Process payments — manage subscriptions and billing through Stripe.
• Send transactional communications — account invitations, password resets, and notification emails via Resend.
• Power AI features — process your prompts and operational context through OpenAI to generate responses, code, and recommendations.
• Store and deliver files — host uploaded documents, attachments, recordings, and avatars via Cloudflare R2.
• Analytics and improvement — understand usage patterns and improve the Service using aggregated, non-identifying metrics.
• Security and compliance — maintain audit logs, detect fraud, and enforce our Terms of Service.

4. Third-Party Service Providers

We share personal data with the following categories of service providers, solely to operate the Service:

We do not sell your personal data. We do not share your data with third parties for their own marketing purposes.

5. Cookies & Tracking Technologies

For users in the EU/EEA, UK, and Switzerland, non-essential cookies (analytics) are only set after you provide explicit consent via our cookie banner.

6. Data Security

• Passwords are hashed with bcrypt (10 salt rounds) before storage.
• Third-party credentials are encrypted with AES-256-GCM and a per-deployment encryption key.
• Authentication tokens are stored in HttpOnly, Secure, SameSite cookies to mitigate XSS and CSRF risks.
• Infrastructure is containerized and access-controlled. Database connections are encrypted in transit.

No method of transmission or storage is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Audit logs are retained for compliance purposes. When you delete your account, all associated personal data is permanently removed through cascading deletion. We may retain anonymized, aggregated data that cannot identify you.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your personal data.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to certain types of processing.
• Withdraw consent — where processing is based on consent, withdraw at any time. You can change your cookie preferences at any time by clearing your okido_consent cookie.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or within the period required by applicable law).

9. Additional Information for EU/EEA, UK, and Swiss Users (GDPR)

9.1 Data Controller

The data controller for the purposes of the General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection (FADP) is:

9.2 Legal Bases for Processing

We process your personal data on the following legal bases:

9.3 International Data Transfers

OKiDO is operated from the United States. When you use the Service from the EU/EEA, UK, or Switzerland, your personal data is transferred to the US. We rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• EU-U.S. Data Privacy Framework certifications of our sub-processors (Stripe, OpenAI, Cloudflare, Google) where available.

You may request a copy of the applicable transfer safeguards by contacting us at [email protected].

9.4 Data Protection Rights Under GDPR

In addition to the rights listed in Section 8, EU/EEA and UK residents have the right to:

• Restrict processing — request that we limit processing of your data in certain circumstances.
• Not be subject to automated decision-making — OKiDO does not make solely automated decisions that produce legal or similarly significant effects on you. AI features assist but do not replace human decision-making.
• Lodge a complaint — you have the right to lodge a complaint with your local data protection supervisory authority.

9.5 Data Retention (GDPR)

We retain personal data only as long as necessary for the purposes described in this Policy. Specifically:

• Account data — retained until you delete your account.
• Work content — retained while your organization account is active.
• Audit logs — retained for up to 2 years for compliance.
• AI conversation data — retained while your account is active; deleted on account removal.
• Payment records — retained as required by applicable tax and accounting regulations.

10. Additional Information for California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to know — what personal information we collect, use, disclose, and sell (we do not sell personal information).
• Right to delete — request deletion of your personal information.
• Right to opt-out of sale — we do not sell personal information, so this right does not apply.
• Right to non-discrimination — we will not discriminate against you for exercising your rights.

To exercise your CCPA rights, contact us at [email protected].

11. Children's Privacy

The Service is not directed to children under 16 (or under 13 in jurisdictions where that is the applicable age threshold). We do not knowingly collect personal data from children. If we learn that we have collected data from a child, we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page and updating the "Effective" date. For significant changes, we may also send an email notification. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

Terms of Service