Privacy Policy

1. Overview

Okood ("we," "us," or "our") operates the platform available at okood.app — a professional workspace for creative freelancers to manage contracts, payments, and file deliveries. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding that data.

By creating an account or using Okood in any capacity, you agree to the practices described in this policy. If you do not agree, do not use the platform.

2. Data We Collect

We collect data in three ways: data you provide directly, data we generate automatically as you use the platform, and data your clients provide when accessing your project portals.

2.1 Professional Account Data

When you register as a professional user, we collect:

• Email address — required for authentication and notifications.
• Full name — optional; used to personalize your dashboard and invoices.
• Profession / specialization — optional; used to recommend contract templates.
• Profile avatar — optional; a URL to your profile image if you choose to set one.
• Account role and subscription plan — stored to manage access and enforce plan limits.

2.2 Client Portal Account Data

Your clients access their dedicated project portal via a secure link you share. If a client creates a portal account, we collect:

• Email address — used for portal authentication.
• Password — stored securely as a one-way hash (we cannot reverse it).
• Verification status and timestamp — records whether the account has been email-verified.
• Last login timestamp — stored for security purposes.

Client accounts are scoped to a single project and cannot access any other data on the platform.

2.3 Project and Contract Data

When you create and manage projects, we store:

• Project name, description, status, and timeline information.
• Contract text and clause content.
• Electronic signature data — a base64-encoded canvas image of the signature and a timestamp.
• Milestone and stage information.
• Client name and contact information you add to a project.

2.4 Payment Data

Okood does not process the payments your clients make to you. We track those payment records as part of your project workflow. Specifically, we store:

• Payment amounts, currency, and status. You choose the currency for each client payment record; it is not limited to AED.
• Bank transfer proof files (screenshots or receipts) uploaded by your client.
• Payment approval records and timestamps.

For payments between you and your clients, we do not collect, store, or process credit card numbers, bank account numbers, or any financial credentials. That money movement is handled directly between you and your client via your chosen bank. Subscription fees you pay to Okood are handled separately by Stripe — see Section 2.6.

2.5 Uploaded Files

When you upload deliverable files (photos, videos, designs, or any other creative work), those files are stored on Cloudflare R2 and associated with your project. We also store file metadata (filename, size, content type, upload timestamp).

2.6 Subscription and Billing Data

We store:

• Your current plan (Trial, Starter, or Pro), billing frequency, and subscription status.
• Subscription period dates and renewal dates.
• Invoice records including plan, amount, VAT breakdown, and period.
• Storage usage (in bytes) relative to your plan quota.
• Stripe customer and subscription identifiers used to manage your paid plan.

Paid Starter and Pro subscriptions are billed by card through Stripe, our payment processor. When you subscribe, you enter your card details directly with Stripe via Stripe Checkout, and you can update your payment method or view billing history through the Stripe-hosted billing portal. Stripe collects and stores your card details and billing information under its own privacy policy. Okood does not receive or store your full card number; we store only the Stripe identifiers above and the resulting invoice records.

2.7 Support and Communications

If you contact our support team via the in-app ticket system, we store the content of your messages, their status, and timestamps. Support ticket content may be reviewed by our support agents.

2.8 Technical and Usage Data

We maintain internal logs for platform operation and security, including:

• Email delivery logs (whether notifications were sent, failed, or are pending).
• Internal analytics events (account creation, project creation, contract signatures) stored in our own database — not shared with third-party analytics providers.
• Error logs for debugging purposes. Application errors are also captured by Sentry, our error-monitoring provider, which may receive technical request context (such as the URL, browser information, and IP address) to help us diagnose problems. We redact request bodies and cookies on sensitive routes such as payments, contracts, and webhooks.
• IP addresses and request timestamps for rate limiting and security. Rate-limiting and background job processing are handled with the help of Upstash, which may process limited request metadata.
• Bot-protection signals on the professional login form. We use Cloudflare Turnstile to help distinguish humans from automated abuse, which may process technical signals such as your IP address and browser information.

3. How We Use Your Data

We use the data we collect to:

• Provide the platform: create and manage your projects, contracts, deliverables, and payment records.
• Authenticate users: verify your identity when you log in and protect your account.
• Send notifications: email you about contract signatures, payment confirmations, delivery reminders, file uploads, and subscription activity. You cannot opt out of transactional notifications tied to your active projects or subscription.
• Manage subscriptions: track your plan, enforce storage and project limits, generate invoices, and send renewal reminders.
• Provide support: respond to your support tickets and resolve issues.
• Operate and improve the platform: internal analytics help us understand which features are used and where problems occur. This data is never shared externally.
• Enforce security: rate limiting and error logging protect the platform from abuse.
• Meet legal obligations: maintaining audit logs and records required for compliance.

We do not use your data for advertising, profiling, or sale to any third party.

4. Third-Party Services

We rely on the following infrastructure providers to operate the platform. Each acts as a data processor on our behalf and is bound by appropriate data processing terms.

We do not use advertising networks, social media trackers, or external analytics platforms. We rely on essential infrastructure providers to operate the platform.

4.1 Monitoring and Reliability

We use Better Stack as a monitoring, uptime, and reliability service provider. It helps us detect outages and confirm that scheduled jobs complete. Better Stack receives operational health-check signals and minimal technical data and is not used to process the content of your projects, contracts, or files.

5. Storage & Security

Structured data is stored in a secure database with access controls at the database and application layers so that records are only accessible to the appropriate authenticated user.

Files are stored in Cloudflare R2 with access controlled by time-limited download links. Deliverable files are only accessible to the professional who uploaded them and to the client associated with that specific project, after payment approval.

Client and professional sessions are protected using secure session mechanisms that help prevent unauthorized access from client-side scripts.

We use rate limiting and secure password hashing to reduce brute-force attacks and help protect accounts.

While we implement industry-standard security measures, no system is 100% secure. We cannot guarantee absolute security of your data.

6. International Data Transfers

Okood relies on infrastructure and service providers located in different countries. As a result, your personal data may be stored or processed outside the United Arab Emirates, including in the following locations:

• Database and authentication are hosted by Supabase in Japan (AWS Asia Pacific, Tokyo region).
• Subscription payment processing is performed by Stripe, primarily in the United States.
• Error monitoring is performed by Sentry in the European Union (Germany).
• Rate limiting and background job processing are performed by Upstash, which may process limited request metadata in regions where Upstash operates.
• File storage, content delivery, bot protection, and application hosting are provided by Cloudflare and Vercel using globally distributed infrastructure.

Personal data may be stored or processed in Japan, the United States, the European Union, and other jurisdictions where our service providers operate. These locations may change over time as our infrastructure and providers evolve.

Where personal data is transferred outside the UAE, we take appropriate contractual, technical, and organizational measures intended to protect it, and we work with providers that offer recognized data-protection commitments, where applicable. By using the platform, you understand that your data may be processed in these locations.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the service. Specific retention rules are:

• Active accounts: all data is retained for the duration of your account.
• Subscription cancellation: upon cancellation, your account enters a 30-day grace period during which all data remains intact and the platform is read-only. You can re-subscribe at any time during this period.
• After grace period expires: your account and all associated user data — projects, contracts, deliverables, payment records, invoices, and files stored in Cloudflare R2 — are permanently deleted. This deletion is irreversible, except for records we are required to retain for legal, security, or compliance purposes.
• Account deletion by admin: if an account is deleted by an Okood administrator (e.g., for Terms of Service violations), all associated data is permanently deleted in the same cascade.
• Audit logs: certain security and admin audit logs may be retained for up to 12 months, or longer where required by law, for security and compliance purposes.
• Abuse-prevention records: a one-way cryptographic hash may be retained indefinitely for fraud prevention, abuse detection, and trial-abuse prevention purposes. This is a hash, not your original email address, and it cannot be used to reconstruct the contents of a deleted account.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: update your profile information directly in your account settings at any time.
• Deletion: you can schedule deletion of your account and all associated data yourself from your account settings (a 30-day window applies, which you can cancel before it elapses), or contact us at support@okood.app. Note that deletion of your account is permanent and irreversible once it completes, subject to any records we must retain for legal, security, or compliance reasons.
• Data portability: export your contracts (as PDF) and project data at any time from your dashboard before account deletion.
• Objection: object to certain processing of your data by contacting us.

To exercise any of these rights, contact us at support@okood.app. We will respond within 30 days.

9. UAE & Regional Rights

Depending on where you live, additional regional rules may apply to how we handle your personal data. This section summarizes those, where applicable.

9.1 United Arab Emirates

If you are located in the United Arab Emirates, we process personal data in accordance with applicable UAE data protection laws, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, where applicable. You may exercise the rights described in Section 8 by contacting us, and you may also have the right to lodge a complaint with the competent UAE data protection authority.

9.2 European Union & United Kingdom

If you are located in the EU or UK, we process your personal data on the following legal bases, depending on the activity: performance of our contract with you (to provide the platform), our legitimate interests (to operate, secure, and improve the platform), compliance with legal obligations (such as tax and accounting), and your consent where we ask for it. You may have the right to access, correct, delete, restrict, or object to certain processing, and to data portability, where applicable. You may also lodge a complaint with your local supervisory authority.

9.3 California

If you are a California resident, we confirm that we do not sell personal information and do not share personal information for cross-context behavioral advertising. You may exercise applicable rights to know, delete, and correct your personal information by contacting us, and we will not discriminate against you for doing so.

10. Cookies & Sessions

Okood uses cookies strictly for authentication and session management. We do not use tracking cookies, advertising cookies, or any third-party cookies.

• Professional session cookie (okood_session): set by Supabase to maintain your authenticated professional session. This is an HttpOnly, secure cookie.
• Client portal session cookie (okood_client_session): set when a client signs in to their portal account, granting access to their project portal for 7 days. This is an HttpOnly, secure JWT cookie scoped to the specific project.

These cookies are necessary for the platform to function. You may clear them at any time by logging out or clearing your browser cookies, which will end your session.

11. Age Restrictions

Okood is intended for professional use by individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a minor has created an account, please contact us at support@okood.app and we will delete the account promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. Continued use of Okood after changes take effect constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: