Privacy Policy.

oka is a product of NCG Invest UG (“oka”, “we”, “us”). NCG Invest UG is the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR).

For any privacy question or request, contact us at privacy@getoka.ai.

Account data: your name, email address, and authentication details when your account is set up or you sign in.

Accounts we set up for you. If you book a call with us and ask for an offer, we may set up an Oka workspace for you during or after that call (Art. 6(1)(b) GDPR — steps taken at your request before a contract). It holds only what you told us in the call: your email, company, profile, round and a first investor list — no mailbox, no network. You get access once you have paid. If you don't go ahead, we delete the account and the workspace after 60 days. After a subscription ends, your workspace stays closed and your data is kept so you can pick up your next round; you can download or delete it at any time once you sign in.

Company and raise data: information you provide about your company and round, including your website, and the funds, notes, and pipeline you create in your workspace.

Connected-account data: with your explicit consent, you can connect your Gmail account (which also connects your Google Calendar) and your LinkedIn account. From Gmail we read the To, From, Cc, and Date headers of your messages; from LinkedIn, your connections (name, company, and role) and basic professional profile fields; and we process contacts you import. We use these to map your network to relevant funds and surface direct connections. We read the content of messages only in the two cases described in the next paragraphs: investor replies, and conversations with investors on your deals. From your calendar we read events — attendees and times, never titles. To find the video link of an investor call (see Oka Notes below), we also look through an event's location and description; we keep neither, and of the link itself we store only a fingerprint (a hash).

Investor replies: when an investor replies to outreach you sent from oka, and you have switched “Read investor replies” on (it is off until you turn it on — we ask you once right after you connect your email, and you can change it anytime in Settings → Connected accounts), our systems read that reply to derive a status — when they replied, the tone, what they asked for, a suggested next step and a summary of at most two sentences — and store that status together with a link to the message in your own mailbox. The status is visible to the editors of your workspace. Switch it off at any time and no further replies are read this way.

Conversations with investors: where oka's agent features are switched on for your workspace (we switch them on per workspace), oka also keeps your conversations with investors, so the assistant can answer from what was actually said. This covers the email threads of each editor who has connected an email account, and the LinkedIn chats of each editor who has switched on “Read LinkedIn chats with investors” — but only conversations with investors on deals in your pipeline: the person is one of the deal's contacts (matched by exact email address or LinkedIn profile), or writes from the fund's own website domain. The text of everything else in your mailbox and chats is never kept. One thing comes from headers alone: when someone oka already knows as an investor, or a new person at a fund on your deals, emails you, oka may put a task card in front of you asking whether to add them — with their name, email address, and when they wrote, never the text. Email and LinkedIn follow different rules. Email: for a matched email conversation we store who wrote to whom and when, the direction, and whether a message had attachments — and, only while that editor has “Read investor replies” switched on, the subject line and the text of each message, both what the investor wrote and what you wrote (up to about 20,000 characters per message). LinkedIn: nothing at all is kept from an editor's LinkedIn chats unless that editor has switched on “Read LinkedIn chats with investors” — off until they turn it on (we ask once right after a LinkedIn connect; it can be changed anytime in Settings → Connected accounts). While it is off, oka keeps nothing from their LinkedIn chats — not even that a message came. While it is on, oka keeps who wrote when, the direction, and the text of each message in a matched chat; switching it off deletes what was kept. For both: attachments themselves are never stored, and the first sync reaches back up to 12 months; after that, new messages are added as they arrive.

Who sees these conversations, and when they go: every editor of your workspace can see them — mainly through the assistant and on task cards. Contributors to your workspace and other oka customers never see them. If you switch “Read investor replies” off, we delete the subject lines and text your mailbox supplied, together with the summaries and drafts derived from them, and keep only the record that a message was exchanged (who, when, which direction); Oka Notes is also taken off your upcoming calls straight away (unless a teammate (editor) who has it on is invited too), while transcripts of calls that already happened stay with the workspace (see Oka Notes below). If you disconnect an account, we delete the conversations synced from it. If you are removed from a workspace, the conversations your account supplied are deleted from that workspace. In each case, a message that a teammate's own mailbox also holds stays, attributed to that teammate. Everything is deleted when the workspace is deleted.

Contacts derived from your email: where a message header identifies a person at an investor you correspond with, we create a contact record for them in your workspace — their name and email address — so you can see who at a fund you already have a relationship with. These records are private to your workspace: other Oka customers never see them, and their email addresses are never shown to anyone outside your workspace. We do not create records for shared mailboxes (such as info@ addresses), and we never derive a person's name from an email address — where the header carries no name, the relationship stays attached to the fund rather than to a person. You can remove any of these people from your network at any time, and they are deleted when your workspace is deleted.

Drafts and messages sent from your account: oka can place a draft in your own Gmail account for you to review and send yourself. Where oka's agent features are switched on for your workspace, oka can also send an email or a LinkedIn message from your own connected account — one message at a time, only to a contact of a fund in your pipeline, and only after you have approved that exact message with a click (from an outside AI assistant connected to oka: with a second, separate confirmation). Before the first message from an account, oka asks you once whether it may send the messages you approve from that account; that consent is recorded, and you can withdraw it anytime in Settings → Connected accounts — nothing is sent from that account afterwards. oka never sends on a schedule, in bulk, or on its own, and never from a teammate's account. Each message sent this way is recorded in your workspace (recipient, channel, subject, text, and time); once the workspace has been closed for 12 months, only the recipient, channel and time remain (section 8). oka never sends LinkedIn connection invitations from your account.

Oka Notes (call transcripts): where oka's agent features are switched on for your workspace, an editor can turn on a notetaker called “Oka Notes” for a single video call (Google Meet, Zoom, Microsoft Teams) on an editor's calendar when an attendee is an investor contact on a deal in your pipeline — only for calendars of editors who have “Read investor replies” switched on. Oka Notes never joins a call on its own: it joins only a call an editor turned it on for, and only after that editor confirmed they told the participants beforehand (we give them a sentence to paste into the invitation); we record who turned it on, when, and that confirmation. It joins as a visible participant and introduces itself in the meeting chat, in German and English, where the host's settings allow that (we cannot always tell whether the message appeared; on Teams its name also says that it is transcribing). Any editor can take it off a call before or during the call, and the call’s host can remove it; if it is removed during the call, nothing from that call is kept. If that editor switches “Read investor replies” off, Oka Notes is taken off their upcoming calls straight away, unless a teammate (editor) who has it on is invited too. We do not keep audio or video. We store the transcript — what was said, with speaker names and timestamps — together with the call's time, platform, and attendee list (names and email addresses from the invitation). The transcript belongs to your workspace, is included in your data export, and is kept until the workspace is deleted, you ask us to delete it, or the workspace has been closed for 12 months (section 8) — also if the editor whose calendar the call came from later disconnects or leaves.

Assistant chats and files: your conversations with the oka assistant are saved so you can return to them (the most recent 100 messages of each chat). Teammates don't see them in the app, and you can archive or delete a chat at any time. They do belong to the workspace, though: the workspace owner's data export includes the chats of everyone in it. Files you attach to a chat (PDF, Word, or text) are read once: we keep the extracted text as part of that chat (up to about 50,000 characters per file), not the file itself. Spreadsheets you attach go through the investor import, which shows you what it found before anything is saved. The assistant can also remember goals and preferences you give it; you can see, edit, and delete these in Settings → Assistant.

Account connections run through our processor Unipile SAS (France, EU) under a data processing agreement. Technically, the authorization you grant when connecting covers broader account access than we use. Our systems fetch message content only for the two purposes above — investor replies and conversations with investors on your deals — and store it only as described there. You can disconnect at any time in Settings, which deletes the connection at Unipile as well as the conversations synced from it.

Investor data: professional information about investors and the funds they work at — names, roles, firms, and public profile links. This is collected from public and third-party professional sources (such as fund websites and professional networking profiles), not from your inbox content.

Usage data: technical logs such as device, browser, and interaction events, used to operate and improve the product. This includes product analytics and session recordings, described in section 7.

To provide the service: matching you with relevant investors, mapping direct connections, keeping track of your conversations and calls with investors, preparing drafts, sending the messages you approve, and powering your fundraising workspace and assistant.

To improve the product: understanding how features are used and where they can be better.

To communicate with you: service messages, support, and — where permitted — product updates you can opt out of.

We process your personal data on the basis of contract (to deliver the service you subscribed to — including the assistant, its chat history, files you attach, and sending the messages you approve), consent (for connecting Gmail and LinkedIn, importing contacts, “Read investor replies” — which covers reading replies, keeping email conversation text, and Oka Notes — “Read LinkedIn chats with investors”, and optional communications), and legitimate interests (to secure and improve the product), balanced against your rights. You can withdraw consent at any time; this does not affect processing that happened before.

Investor data — professional information about investors who are not oka users — is processed on the basis of legitimate interests (Art. 6(1)(f)): helping founders identify and reach relevant investors, using professional information from public and third-party professional sources. We balance this against the investor's interests and rights, and we honour objections (see section 9).

Investors and other people in your conversations and calls: when we keep the messages an investor exchanged with you, or the transcript of a call they took part in (section 2), we process their data on the basis of legitimate interests (Art. 6(1)(f)) — helping you keep an accurate record of a fundraising conversation they chose to have with you. We limit this to investors on your deals, never keep call audio or video, and make Oka Notes a visible participant that, where the platform allows, says in the chat that it keeps a transcript and how to have it taken out. Their objection route is in section 10.

Shared professional profiles: when you import an investor or a professional contact, the professional profile fields — name, the fund or firm they work at, their role or title, and their public LinkedIn profile — become part of oka's shared investor graph, so that other founders can also find and reach that investor. This is processed on the basis of legitimate interests (Art. 6(1)(f)) in maintaining an accurate, collaboratively-built map of the investor community, balanced against the individual's interests and rights, and subject to the same objection and erasure route (see sections 9 and 10). Direct contact details you import — a person's email address and phone number — are NOT added to the shared graph: they remain private to your own workspace and are never shown to other customers.

We do not sell your personal data. We share data only with service providers (processors) who help us run oka, under data processing agreements and only to the extent their task requires:

Hosting and infrastructure: Vercel (application hosting; our application runs in Vercel's Frankfurt region), Supabase (database and sign-in, hosted in Frankfurt), Sentry (error monitoring, EU data region in Germany), and Upstash (rate limiting that protects the service from abuse).

Account connections: Unipile SAS (France, EU) for your Gmail, Google Calendar, and LinkedIn connections (section 2).

AI models: OpenAI, and a DeepSeek model that runs on the infrastructure of Microsoft Azure, DeepInfra, Novita AI, or Baseten, reached through Vercel's AI Gateway (section 6 explains what is sent). For the DeepSeek model, our configuration allows only these hosts: requests are never sent to DeepSeek's own service and never to Alibaba Cloud.

Call transcripts: Recall.ai, a US company, runs the Oka Notes notetaker and produces the transcript; we use its EU region (Frankfurt). We ask it not to create audio or video files. The working copy it needs to produce the transcript is deleted as soon as we have stored the transcript, and expires automatically after 24 hours at the latest.

Search and data collection: Tavily (web searches the assistant runs for you — only the search terms are sent), Jina AI (reads public web pages for us, such as your company website or a fund's site — only the page address is sent), and Serper and Apify (tools we use to gather public information about investors and funds).

Email, booking, and payments: Resend (delivery of service and notification emails), Cal.com (its EU service, when you book a call with us), and Stripe (payments; we never see or store your full card details).

Analytics: PostHog (EU), described in section 7.

Outside AI assistants you connect: if you connect an outside AI assistant to oka through our connector, oka sends that assistant the workspace data it asks for on your behalf — which can include your pipeline, conversation content, and meeting status. What that assistant does with it is governed by your own agreement with its provider.

Investor search without an account: anyone can add oka's public investor search (getoka.ai/api/public/mcp) to an AI assistant such as Claude or ChatGPT without signing in. It answers only from our public investor directory and never returns personal contact data. We receive only what the assistant sends for each request — the search words or the investor asked about — and the IP address it comes from. The search words are used to answer and are not stored. The IP address is kept for up to two days in a request counter (Upstash, above) that limits how often one address can ask, to protect the service from abuse (legitimate interests, Art. 6(1)(f)). We do not receive your conversation with the assistant; what the assistant's provider does with it is governed by your agreement with that provider.

The one exception, described in section 4, is the shared professional profile fields of investors and professional contacts (name, fund, role, LinkedIn), which are visible to other oka customers so the investor graph stays accurate for everyone. Imported email addresses and phone numbers are never shared this way — they stay in the workspace that imported them.

Some of these providers process data outside the EEA — in particular the AI model providers, which may process requests in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, or on an adequacy decision such as the EU–US Data Privacy Framework where the provider is certified under it.

oka's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, that means four commitments about anything we receive from your Google account — email metadata, calendar events, the contacts you import, and, where you allow it, investor replies and your conversations with investors. We use it only to provide and improve the user-facing features described in this policy: mapping who you already know to the funds in your pipeline, keeping track of your conversations and calls with investors, and helping you draft and send outreach. We never use it for advertising, and we never sell it. We do not transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition — and never for their own purposes. And no human at oka reads it, except with your explicit permission (for example when you ask support to look at a problem), where security or the law requires it, or in aggregated and anonymised form for internal operations.

We do not use Google user data to train, develop, or improve generalised artificial intelligence or machine-learning models — neither our own nor anyone else's.

Where a feature you use relies on AI, the details needed for that task are sent to one of our AI model providers (section 5) to produce your result — for example your question to the assistant and the funds and notes it looks up, the text of a file you attach, the professional context of a fund when you ask for a draft, and, where you have allowed it, the investor conversations relevant to your question, a reply summary, or a follow-up draft. These providers process the data on our behalf to produce the result. We use them as business (API) customers, under their business and data-processing terms, which set how long they may keep a request and what they may use it for.

We use PostHog to understand how oka is used and where it falls short. PostHog is hosted in the European Union (Frankfurt) and acts as our processor under a data processing agreement; your usage data is not transferred outside the EEA for this purpose.

No cookies, no tracking across sites. PostHog is configured to store nothing on your device — no cookies and no browser storage — and we do not use it to track you across other websites. Because nothing is stored on your device, no cookie banner is required. This processing rests on our legitimate interests (Art. 6(1)(f)) in operating, securing, and improving the product, balanced against your rights.

What we record: pages viewed, clicks and similar interactions, approximate location derived from your IP address at country level, and technical details such as browser and device. For signed-in users these are linked to your user account so we can understand how real workflows unfold. We also record a small number of named product events — for example that a search was run or an intro was requested — deliberately without the content: we record that a search happened and how many results it returned, never the words you typed.

Session recordings: inside the signed-in product only, we record a replay of the pages you interact with, so we can see where the product is confusing. We do not record our public website — browsing our marketing pages is never captured this way. Everything you type is masked before it leaves your browser — the recording never contains the content of any input field — and areas showing private notes and contact details are blanked out. We use these recordings only to diagnose and improve the product.

You can object to this processing at any time under Art. 21 GDPR by emailing privacy@getoka.ai, and we will exclude your account from analytics and session recording. Setting your browser's “Do Not Track” signal also disables it.

We keep personal data for as long as your account is active and as needed to provide the service. After a subscription ends, your workspace stays closed and your data is kept so you can pick up your next round, until you delete it or ask us to. If a workspace we set up for you never goes ahead, we delete the account and the workspace after 60 days. You can request deletion at any time; we will delete or anonymise data unless we are required to retain it by law.

Some data has its own, shorter life: the text of conversations with investors is deleted when you switch “Read investor replies” off, disconnect the account, or leave the workspace (section 2); a file you attach to the assistant is discarded once its text is extracted; a chat you delete is deleted; and the working copy Recall.ai uses to produce a call transcript is deleted once the transcript is stored, after 24 hours at the latest. Call transcripts themselves stay with the workspace until it is deleted or you ask us to delete them — or until the rule for closed workspaces below applies.

Closed workspaces: once a workspace has been closed for 12 months — counted from the day it closed, and only if it has not been reopened since — we delete the subject lines and text of the conversations stored in it, the subject lines and text of messages drafted in or sent from oka (including the examples oka keeps to learn your writing style), its call transcripts, and what was derived from them (reply summaries, triage notes, drafted replies, recorded pass reasons). What stays is the record that a message was exchanged, drafted or sent, or that a call took place (who, to whom, on which channel, when) and the rest of the workspace — your fund list, pipeline, contacts and notes — so you can still pick up your next round. Nothing is deleted while a subscription for the workspace is running or a payment is pending, or if the workspace is reopened before then; if it closes again later, the 12 months start again from that day.

Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interests. You may also withdraw consent at any time and lodge a complaint with a supervisory authority.

If you're an oka user, you can export everything we hold and delete your account directly from Settings → Your data (once your workspace is closed: from the page you see after you sign in), disconnect Google or LinkedIn in one click, switch “Read investor replies” and “Read LinkedIn chats with investors” off in Settings → Connected accounts. Account deletion runs with a 7-day grace window: signing in again within those 7 days cancels it, and after that your data is erased permanently. In Settings you can also choose to erase everything at once. To exercise any other right, email privacy@getoka.ai.

We may update this policy from time to time. We will post the updated version here and adjust the “last updated” date above. Material changes will be communicated where appropriate.