Privacy Policy

1. Who we are

This Privacy Policy explains how KUKLIS Consulting s.r.o. processes personal data when you use Oktio.app, including oktio.app, oktio.media and about.oktio.app (the "Service"). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR).

For any question or request about your personal data, write to support@oktio.app.

2. Summary

• We use your Instagram data to provide analytics, media kits, Auto-Replies and the other features you use. We do not sell your personal data.
• You sign in with Instagram; we never receive an Instagram password. Card details are handled by Stripe and never reach our servers.
• We measure sign-ups and purchases with our own first-party data. Google Analytics and Google Ads measurement run only with your consent in the EEA, the UK and Switzerland; elsewhere you can switch them off at any time.
• Our servers are in Germany. Some providers, such as Stripe, Google, Cloudflare and Anthropic, are based in the United States; transfers are protected as described below.
• You can delete your account and data yourself at any time in Settings, or ask us at support@oktio.app.

3. Personal data we process

From Instagram, when you connect your account

• Profile: account IDs, username, name, profile picture, biography and follower count.
• Content: your posts, reels and stories with captions, links and their statistics (reach, views, likes, comments, saves, shares and similar).
• Comments on your posts, including the commenters' usernames and comment text, which we use for analytics, sentiment analysis, Giveaways and Auto-Replies.
• Audience insights: statistics about your followers that Instagram provides only in aggregated form (for example age groups, gender, countries and cities). We do not receive a list of individual followers.
• Direct messages of your professional account (text, attachments, the sender's username and profile picture, timestamps), if you grant the messaging permission, to show them in the Inbox and to send your replies and automatic replies.
• The access token Instagram issues to us (stored encrypted) and the list of permissions you granted.

Account and contact data

• The contact e-mail address you enter, whether you have verified it, and the name shown in your account (initially taken from Instagram).
• Settings and preferences: time zone, language, market and currency preferences, dashboard settings, competitor accounts you add, and your choices for features such as sentiment analysis.
• Your country and consent region (EEA, US or other), derived from the country of your IP address as reported by Cloudflare. We do not store your IP address with your account.
• The version and time of the Terms of Service you accepted when signing in.
• Access for managers, if you use it: who has access to your account or whose account you manage, the role, when the access was given and removed, open invitations, and a record of the actions a manager takes in an account (time, type of action and the part of the Service, never the content). The account holder sees their managers and this record; a manager sees the data of the managed account within the role the account holder has given. We process this to provide the feature (performance of the contract, Art. 6(1)(b) GDPR) and to protect accounts (legitimate interest, Art. 6(1)(f) GDPR).

Content you create in Oktio.app

• Media kits, campaign reports, Bio Link, Rate Card, goals, auto-replies and their settings, Oktio Verified certificates, collaborations with brands (offers, deliverables, messages and files), videos you generate, and data-export configurations including the access details to your own cloud storage.
• Brand-outreach records you enter, which may contain names and e-mail addresses of contacts at brands. Please enter other people's data only if you are allowed to.

Billing data

• Stripe collects your card or other payment details, billing name and address and, if you enter it, your VAT or tax ID. We receive only your Stripe customer and subscription IDs, plan, billing period, currency, status and payment dates. In addition, we read from Stripe the e-mail address you used at checkout and send billing e-mails, such as the payment confirmation, to it if you have not verified a contact e-mail address.
• For every payment we issue an invoice in Fakturoid, containing your billing name, address, country, VAT ID (if given), e-mail address and the amounts paid.

Usage, measurement and attribution

• First-party events about key steps in our own systems: sign-up, sign-in, Instagram connected, e-mail verified, purchase, renewal, cancellation and account deletion, each with the time, your country and consent region.
• How you found us: campaign parameters (utm_*), ad click IDs (such as gclid, gbraid, wbraid, fbclid, ttclid), the referring site and the landing page, for your first visit and your last visit from a campaign.
• Your Google Analytics client and session IDs from the _ga cookies, if those cookies exist in your browser.
• Your cookie choices: analytics and marketing yes/no, region, banner version, time and where you made the choice (a record of the last 20 choices).

Technical and security data

• When your browser or app talks to our servers, they process your IP address, the requested address, the time and technical request data. This appears in server logs, in short-lived rate-limit counters and, in case of an error, in error reports.
• Session tokens that keep you signed in (stored on our servers and in an HttpOnly cookie).
• Error reports from the web app: if the app fails in your browser, it sends an error report to GlitchTip, error-tracking software we run ourselves on our servers in Germany; the reports are not shared with third parties. A report contains the error message and where in our code it happened, your browser and operating system, the address of the page with sign-in codes, tokens and e-mail addresses removed, and your internal account ID if you are signed in. We use the reports only to find and fix faults, on the basis of our legitimate interest (Art. 6(1)(f) GDPR), and delete them after 90 days. Error reporting sets no cookies, stores nothing in your browser and does not record your IP address.
• Page-speed measurement: when you open a page of the app, your browser sends us how quickly it loaded and responded (the Core Web Vitals LCP, INP and CLS, plus FCP, TTFB and how long the first request to our server took), the type of page (for example the dashboard or a public media kit) and the app version. The report contains no account ID, no page address, no cookie and no other identifier. Our server only adds the country that Cloudflare derives from your IP address, does not store the IP address and keeps nothing but counts per country, page type and app version, for 30 days. The measurement sets no cookies and stores nothing in your browser. In the EEA, the UK and Switzerland the report is sent only if you allowed analytics in the cookie banner; elsewhere until you switch analytics off.

Visitors of pages you publish

• When someone opens your public media kit, we record the visit with a shortened IP address, the referring site and the country, so that you see view statistics. Clicks on your Bio Link are counted too, and verification scans of Oktio Verified certificates are counted with a one-way hash of the IP address to avoid double counting.
• When a brand uses the contact form on your media kit, we store their name, e-mail address and message and forward it to you by e-mail.
• When someone signs up through the e-mail sign-up block of your Bio Link, we store their e-mail address with a record of their consent (time, version and language of the consent text, the page address, your Instagram handle and a one-way hash of their IP address) for you. See the section on e-mail sign-ups on creators' Bio Links.
• When people from a brand open a collaboration you invited them to, we store for you the name and company they enter, their messages, files and decisions, and an activity log with a one-way hash of their IP address that changes every day. See the section on collaboration between creators and brands.

AI inputs

• The text of comments that the AI features process, and your settings for AI replies (instructions, tone, language). With Oktio Pro, also the screenshots of story insights from which the AI reads the numbers. See the section on AI features.

Reports, moderation and 18+ features

• When someone reports a page: what they report (the page, the item, the category and their explanation), their name and e-mail address if they give them, their confirmation of good faith, the time, the language of their browser, and a keyed one-way hash of their IP address that lets us recognise misuse of the report form. In the report record we store only this keyed hash; the IP address itself appears only in server logs and short-lived counters (see technical and security data).
• Our decisions on reports: the measure, its legal or contractual ground and the facts, whether automated means were used, which moderator decided, and the statement of reasons with the time it was sent.
• If you use 18+ features: a record of each time you make or withdraw your 18+ declaration (for 18+ links or for 18+ page mode: the time, the statements you confirmed, the version of the Addendum for 18+ pages and a keyed one-way hash of your IP address), and the websites you ask us to approve as 18+ link targets, with our decision. We do not ask for or store identity documents, dates of birth or photos for age checks.

4. Why we use your data and on what legal basis

We process personal data only for the following purposes:

5. Our legitimate interests

Where we rely on legitimate interest, we have weighed our interest against your rights. In short, for first-party measurement:

• Purpose: to know how many people sign up and buy, from which campaigns and channels, and where they give up, so that we can improve the product and spend our marketing budget sensibly.
• Necessity: we record only a few key steps in our own systems and the campaign parameters of the link you arrived through. We do not follow you on other websites and do not build advertising profiles.
• Safeguards: the events are linked to an internal account ID and your country, not to your IP address; they are deleted automatically after 3 years; nobody outside our team sees them; and they are not used to make decisions about you.
• Your rights: you can object at any time by writing to support@oktio.app. Unless there are compelling legitimate grounds, we then stop this processing for your account.

6. Analytics, advertising measurement and your choices

• We use Google Analytics 4 and Google Ads conversion measurement. The Google tag is loaded from our own server-side tag manager at t.oktio.app, and Google's cookies are set as first-party cookies on .oktio.app. Google Signals is switched off.
• In the EEA, the UK and Switzerland, nothing Google-related is loaded until you allow it in the cookie banner, and you can allow analytics and marketing separately.
• In the United States, analytics and marketing measurement are on until you switch them off. In other countries analytics is on until you switch it off, and marketing is off unless you switch it on. If your browser sends the Global Privacy Control signal, marketing stays off.
• Our server also sends Google Analytics a few events directly (sign-up, Instagram connected, e-mail verified, purchase with its amount, cancellation) with your internal account ID and Google Analytics client ID, under the same rules: in the EEA, the UK and Switzerland only if you allowed analytics.
• Google Analytics data is kept for 14 months. You can change your choice at any time via "Cookie settings" (in the US: "Your privacy choices") at the bottom of every page.

7. AI features

• AI replies to comments: when an auto-reply you create uses the AI option (preselected for auto-replies to comments; you can switch it off for each auto-reply), the text of the comment being answered and your reply settings (instructions, tone, language, emoji) are sent to Anthropic, PBC (USA) to generate the reply. The commenter's username is not sent. Without such an auto-reply nothing is sent.
• Sentiment analysis (Pro): to show the mood of your comments, comments in languages other than English are sent to Anthropic for classification, with no usernames; English comments are analysed on our own servers. It is on by default for Pro accounts and you can switch it off in the settings.
• Reading story screenshots (Pro): when you add a story from a screenshot of its Instagram insights on a Pro account, or choose “Read with AI”, the screenshot image is sent to Anthropic to read the numbers from it; you check the numbers before they are saved. On the Free plan, and when you stop the reading, the numbers are entered by hand and the screenshot is not sent to Anthropic. Screenshots are stored at Amazon Web Services in Frankfurt (eu-central-1) and deleted together with the story or your account.
• Under Anthropic's commercial terms, data sent through its API is not used to train its models. Anthropic may keep it for a limited time to operate the service and prevent abuse.
• If you connect an AI assistant (such as Claude) to Oktio.app through our MCP connector, that assistant reads the Oktio.app data you authorise under your own account with its provider. You can disconnect it at any time.

8. Service providers and other recipients

We use the following providers, who process personal data for us under data processing agreements:

Other recipients:

• Meta Platforms (Instagram) is an independent controller. We receive your data from Instagram through its official API and send it the replies and messages you publish through Oktio.app. Meta's own privacy policy applies to Instagram.
• Anyone with the link can see the pages you publish (media kits, reports, Bio Links, certificates). If you turn on "Allow search engines" for a certificate or a media kit (off by default), search engines such as Google or Bing may index that page and show it in their results. When you turn it off, protect the media kit with a password or delete the page, the page tells search engines not to list it, and they remove it after their next visit.
• If you set up a data export, we send your data to the cloud storage you choose (for example Google BigQuery, Google Cloud Storage or Amazon S3), under your own account with that provider.
• Authorities, courts or advisers (such as our accountant or lawyer) if the law requires it or we need it to establish or defend legal claims.
• If a report concerns child sexual abuse material or a threat to someone's life or safety, we pass the necessary data to the police or other competent authorities. The creator concerned receives our statement of reasons, which does not name the person who made the report unless this is strictly necessary, for example when a rights holder reports an infringement of their rights.
• Error reports, logs and monitoring run on our own servers (self-hosted GlitchTip and Grafana) and are not shared with third parties.

9. International transfers

Where a provider processes data outside the EU and EEA, we rely on the EU–US Data Privacy Framework for providers certified under it (such as Google, Stripe, Cloudflare and Amazon Web Services), and otherwise on the European Commission's Standard Contractual Clauses, which also serve as a fallback for the certified providers. You can ask us for a copy of the relevant safeguards at support@oktio.app.

10. How long we keep data

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• receive the data you provided to us in a structured, machine-readable format (data portability);
• object to processing based on legitimate interest, including first-party measurement;
• withdraw your consent at any time, without affecting processing that took place before;
• lodge a complaint with a supervisory authority: in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz), or the authority in the country where you live or work.

To exercise your rights, write to support@oktio.app from your contact e-mail address or tell us your Instagram username. We reply within one month; if a request is complex, we may extend this by up to two further months and will tell you why. We may ask you to confirm your identity.

12. Deleting your account and data

• In the app: Settings → Danger Zone → Delete account. Your account and the data linked to it are deleted immediately and an active subscription is cancelled. This cannot be undone.
• Through Instagram: if you remove OKTIO.APP in Instagram's settings under Apps and websites and request deletion of your data, Meta sends us a deletion request. We delete your account in the same way and give you a confirmation code with which you can check the status on our Data Deletion page.
• By e-mail: write to support@oktio.app and include your Instagram username.
• After deletion we keep only: invoices and credit notes in Fakturoid (10 years), anonymous tax totals of invoices (3 years), first-party measurement events (up to 3 years), the payment event log (13 months), reports about your page and our decisions, without your account ID and page address (up to 3 years; reports of child sexual abuse material and reports an authority asked us to preserve keep the account ID, see the section on retention), records of your 18+ declarations under a pseudonym (3 years), notifications Instagram sent us about comments and messages (no fixed period yet), error reports and server logs until they expire, backups until they are overwritten (up to about 12 months) and the record of a deletion request made through Meta.

Step-by-step instructions: Data Deletion page

13. E-mail sign-ups on creators' Bio Links

A creator who uses Oktio.app can add an e-mail sign-up block to their Bio Link page. This section is for people who leave their e-mail address in such a block ("you" in this section).

• Controller: the creator whose page you signed up on, named in the consent text, decides why and how your address is used and is its controller. KUKLIS Consulting s.r.o. stores the address on the creator's behalf as a processor (Art. 28 GDPR) and does not use it for any purpose of its own.
• Data: your e-mail address and a record of your consent: the time, the version and language of the consent text, the address of the page, the creator's Instagram handle and a one-way hash of your IP address. Your IP address itself is not stored.
• Legal basis: your consent given to the creator, Art. 6(1)(a) GDPR. You can withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal.
• We do not send you any e-mail. The creator can view, delete and export the list and use it in an e-mail service of their own choice, for which the creator is responsible.
• Retention: until the creator deletes your address or their account; after that the address remains only in backups, for the periods stated in the section on retention.
• Your rights: to unsubscribe, withdraw your consent or exercise your other rights, please contact the creator, for example through the unsubscribe link in their e-mails. You can also write to us at support@oktio.app; we will pass your request on to the creator without delay and support them in handling it.

14. Collaboration between creators and brands

A creator who uses Oktio.app can invite a brand to a shared collaboration space with a link and a PIN. This section is for the people from the brand who open it ("you" in this section); the last point is for creators.

• Controller: the creator who invited you decides why and how the data in the collaboration is used and is its controller. KUKLIS Consulting s.r.o. stores and processes it on the creator's behalf as a processor (Art. 28 GDPR) and does not use it for purposes of its own, apart from the security measures described below.
• Data: the name and company you enter (self-declared, not verified), your messages, the files you upload and their content, your decisions on the offer and on drafts, the record of an offer acceptance (offer version and a SHA-256 hash of its text, time, your name and company), and an activity log (time, action, your country and type of device, and a one-way hash of your IP address that changes every day; the log does not contain your IP address itself). The creator sees all of this; only the creator sees the activity log.
• Purposes and legal basis: to let the creator and your company negotiate, carry out and document the collaboration, on the basis of the creator's legitimate interest (Art. 6(1)(f) GDPR); if you are yourself the creator's contractual partner, also to take steps before concluding and to perform the contract (Art. 6(1)(b) GDPR).
• Accepting an offer records your confirmation of the offer text; it is not an electronic signature. Oktio.app is not a party to the agreement between the creator and your company.
• Security: to protect the collaboration and our systems, we check the real type of every uploaded file and scan it for malware on our own servers (ClamAV) before it can be downloaded; we refuse files with macros or other active content, limit wrong PIN entries, and process your IP address briefly in server logs and rate-limit counters. We do this as controller, on the basis of our legitimate interest in keeping the Service secure and free of malware for everyone who uses it (Art. 6(1)(f) GDPR). A file in which a threat is found is not stored and is never delivered.
• Recipients: the creator and the other people from your company to whom the creator has given access. The data is stored on servers in Germany (Hetzner) and the files at Amazon Web Services in Frankfurt (eu-central-1); traffic passes through Cloudflare. At present we do not send you any e-mails.
• Retention: until the creator deletes the collaboration or their account; your access ends 90 days after the creator closes the collaboration. You can delete the files you uploaded; the creator can also delete messages. Deleted files are removed from storage without delay. Activity-log entries are deleted after 400 days at the latest. After that, data remains only in backups, for the periods stated in the section on retention.
• Your rights: you have the rights described in the section on your rights, including the right to object to processing based on legitimate interest. Please address requests about the content of the collaboration to the creator. You can also write to us at support@oktio.app; we will pass your request on to the creator without delay and support them in handling it.
• If you are the creator: we process your collaborations, offers, deliverables, messages and files to provide the Service to you (Art. 6(1)(b) GDPR). For the data of the brand's people we are your processor under the section "Collaboration with brands" of the Terms of Service. Signed records of your numbers (media kit snapshots and signed campaign reports) can be verified for 365 days after they are issued and are deleted with your account.

15. Verification requests from brands

This section is for people from brands and agencies who ask a creator for an Oktio Verified certificate on oktio.app/v. You do not need an account. We are the controller of the data of your request.

• What we store: the creator's Instagram username you asked about, your brand or agency name, your e-mail address and its domain, the campaign name if you enter one, the groups of statistics you ask for, the language, your consent with its version and time, and a one-way hash of your IP address that changes every day.
• Why: to confirm your e-mail address, run your request and tell you when the creator answers (steps you asked us to take, Art. 6(1)(b) GDPR), and to prevent misuse of the form (legitimate interest, Art. 6(1)(f) GDPR).
• Who sees what: the creator sees your brand or agency name, the domain of your e-mail address (or that it is a free mailbox) and the campaign. When the creator answers with a certificate, they also receive your e-mail address in their Brand CRM, as you agreed in the form; from then on the creator is the controller of that copy. Oktio.app never contacts the creator on your behalf.
• E-mails: we send you only the messages about your request — the confirmation link, the link to your request page and the creator's answer.
• Retention: an unconfirmed request is deleted after 24 hours, a confirmed one 12 months after it was created. You can withdraw it at any time on your request page; it is then deleted at once. A certificate the creator issued stays the creator's.
• You can exercise the rights described in this policy by writing to the contact address at the end of it.

16. Cookies and similar technologies

We use cookies and browser storage in four categories:

• Strictly necessary: sign-in, security, your region and your cookie choice. Always on.
• Preferences: language, currency, theme, layout and similar choices you make yourself. The language and currency you pick are kept in our okt_lang and okt_currency cookies (1 year), which oktio.app and about.oktio.app share.
• Analytics: Google Analytics 4 through our server t.oktio.app.
• Marketing: the campaign you came from (our okt_attr cookie, 90 days) and Google Ads conversion measurement.

Analytics and marketing follow the regional rules described in the section on analytics. Every cookie and storage entry, with its purpose, provider and duration, is listed on the Cookie Policy

You can change your choice at any time:

17. Notice for US residents

This section supplements the policy for residents of US states with consumer privacy laws (such as California, Colorado, Connecticut, Virginia and others).

• Categories of personal information we collect: identifiers (Instagram username and IDs, e-mail address, account and cookie IDs), commercial information (plan and payments), internet activity (the events and campaign data described above), approximate location (country), the content you create, and inferences such as your audience's main market. Sources, purposes and recipients are described in the sections above.
• We do not sell personal information for money. If you have not opted out, Google Ads conversion measurement may count as "sharing" for cross-context behavioral advertising or as "targeted advertising" under some state laws. You can opt out with "Your privacy choices" at the bottom of every page; we also treat the Global Privacy Control signal as a valid opt-out.
• We do not knowingly collect sensitive personal information as defined by these laws and do not use personal information to make decisions with legal or similarly significant effects.
• Your rights: to know and access the personal information we hold, to correct it, to delete it, to opt out of sale, sharing and targeted advertising, and not to be discriminated against for using these rights. Write to support@oktio.app; an authorised agent may also submit a request for you. If we decline a request, you can appeal by replying to our answer, and we will respond within the period required by your state's law.
• Based on our current size, we are not yet required to comply with the California Consumer Privacy Act and similar state laws, but we honour the choices and rights described in this section for all US users.

18. Children

The Service is intended only for people aged 16 or over, as set out in our Terms of Service. We do not knowingly collect data from children. If we learn that an account belongs to someone under 16, we delete it. If you believe this is the case, write to support@oktio.app.

18+ features of Bio Link pages are available only to users aged 18 or over who declare their age in the app, as set out in the Addendum for 18+ pages. Content that sexualises minors is never allowed; see our Content rules.

19. Security

All connections to the Service are encrypted (HTTPS). Instagram access tokens are stored encrypted, backups are encrypted, and access to production systems is limited to the people who operate the Service. There is no Oktio.app password that could leak, and card details never reach our servers. No system is completely secure, so please tell us at support@oktio.app if you notice anything suspicious.

20. Data breaches

If a personal data breach occurs that is likely to put your rights at risk, we will notify the Office for Personal Data Protection within 72 hours of becoming aware of it. If the risk is high, we will also inform you without undue delay, explaining what happened, which data is affected, the likely consequences and what we are doing about it.

21. Automated decision-making

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Analytics, insights and AI suggestions are information for you; you decide what to do with them. The only exception is the interim hiding of content reported as child sexual abuse material (see our Content rules): it happens automatically when such a report arrives, lasts only until a person decides, and you can ask us to review the decision.

22. Changes to this policy

We update this policy when the Service or the law changes. We will tell you about material changes by e-mail or in the app before they take effect. Version history:

• 28 October 2026: added access for managers (what we store when you give another user access to your account or manage someone else's account, who sees it and for how long).
• 28 October 2026: added verification requests from brands (what we store about a brand or agency that asks a creator for a certificate, why, who sees it and for how long).
• 25 October 2026: reports of content and moderation (what we store about the people who report content and about our decisions, the legal bases, recipients and retention), records of 18+ declarations (we collect no identity documents), the interim automatic hiding of content reported as child sexual abuse material, and the records we keep after an account is deleted.
• 22 October 2026: technical data: added the anonymous page-speed measurement (no identifiers, only counts by country, page type and app version, kept for 30 days; in the EEA, the UK and Switzerland only if you allowed analytics), with its purpose and legal basis.
• 22 October 2026: how long we keep data: added the anonymous tax totals of the invoices of a deleted account (country, customer type, year, tax base in Czech crowns; 3 years), which keep our EU VAT thresholds counted correctly.
• 21 October 2026: stories added from a screenshot of their Instagram insights: the screenshots are stored at Amazon Web Services in Frankfurt (eu-central-1) and, with Oktio Pro, their numbers are read by Anthropic’s AI; with the corresponding entries on AI features, data and providers.
• 21 October 2026: new section on collaboration between creators and brands (the creator is the controller and we are the processor; files are scanned for malware on our own servers), with the corresponding entries on data, purposes, providers and retention, including how long signed records of a creator's numbers are kept.
• 19 October 2026: new section on e-mail sign-ups on creators' Bio Links (we store the addresses for the creator as a processor and send them no e-mails), with the corresponding entries on data and retention.
• 16 October 2026: other recipients: added that search engines may index a certificate or media kit for which you turn on "Allow search engines" (off by default), and how to take it out of their results.
• 12 October 2026: billing data: added that we read the e-mail address you used at checkout from Stripe and send billing e-mails to it if you have not verified a contact e-mail address.
• 2 October 2026: the language and currency you pick are kept in preference cookies shared by oktio.app and about.oktio.app (okt_lang and okt_currency; okt_lang_test and okt_currency_test on our staging environment), with a copy of the currency in your browser's storage (oktio.currency); error reports from the web app to our self-hosted GlitchTip added.
• 1 October 2026: rewritten: data categories, legal bases, analytics and consent by region, AI providers, list of providers, international transfers, retention periods, deletion through Meta, notice for US residents.
• 30 September 2026: cookie section updated for the consent banner and Google measurement through t.oktio.app.
• 18 September 2026: direct messages (Inbox) added.
• April 2026: legal bases, AI processing, cookies, service providers and data-breach notification added. The policy first took effect on 13 February 2026.

23. Contact