Privacy notice

Last updated: 29 October 2026

This notice (Article 13 of Regulation (EU) 2016/679, GDPR) explains how we process the data of people who visit okeh.app and of people who sign up to Okeh. If you open or sign a document received from one of our Subscribers, there is a dedicated notice: information for people who open and sign (in Italian).
This English text is a courtesy translation. The Italian version is the one that applies: read it in Italian.

1. Controller and contact details

The data controller is Davide Conte, sole proprietorship (ditta individuale), partita IVA (Italian VAT number) 05388160755, Via Dante Alighieri 51, 73040 Melissano (LE), Italy. For any question about your data, write to me@davideconte.me.

No data protection officer (DPO) has been appointed: for this service it is not mandatory.

2. Who this notice is for

People who visit the site okeh.app.
Subscribers, that is professionals and businesses that use Okeh, and the people who use the account on their behalf (the owner, colleagues added as administrators, billing contacts).

3. Data, purposes and legal bases

3.1 Visiting the site

Data: IP address and technical data of the request (browser, page requested), which every site receives in order to work. We do not keep a log of the pages visited. The web server may log errors together with the IP address.
Purpose: showing the site and protecting it from abuse and attacks.
Legal basis: legitimate interest in running the site securely (Article 6(1)(f)).
Retention: error logs up to 30 days.
Cookies: technical cookies and, only with your consent, the Meta pixel (point 3.12). Details in the cookie policy (in Italian).

3.2 Demo

In the demo, the email you enter stays in a technical cookie in your browser for one hour: we do not save it and we do not send you emails. The IP address is used only to limit repeated attempts and stays in the server's memory for 10 minutes. Legal basis: legitimate interest in offering a trial of the service without abuse (Article 6(1)(f)).

3.3 Sign-up and account

Data: business name, email, password (stored only as a cryptographic hash), chosen address (name.okeh.app), proof of acceptance of the terms (version of the texts, date and time, specific approval of the clauses, declaration that you are acting for your business, fingerprint of the IP address you sign up from), origin of the sign-up (campaign and ad from the utm parameters of the link, first page viewed, name of the referring site). Then the settings you enter: brand and logos, legal text for emails, custom domain, email mailbox (SMTP) with its credentials, email and password of the other administrators.
Purpose: verifying your email with a code, creating and managing the account.
Legal basis: pre-contractual measures and performance of the contract (Article 6(1)(b)); for the origin of the sign-up, legitimate interest in knowing which channels bring in sign-ups (Article 6(1)(f)), without sending it to third parties.
Retention: sign-up requests are deleted after 30 days, whether completed or not (the data needed moves to the account). Account data for the whole life of the account (on the Free plan too) and for 12 months after a request to delete the account or a suspension, then deleted automatically. Only the billing data and the proof of acceptance of the terms remain, for 10 years from the end of the contract.

3.4 Approval of accounts and abuse prevention

What we do: every sign-up is checked by hand before activation. We look at the name, the chosen address and the email; we may search for public information about the business (website, partita IVA) and ask you for clarification. No decision is taken automatically. Repeated requests to the site (sign-up, sign-in) are limited with a counter based on a fingerprint of the IP or the email.
Legal basis: legitimate interest in preventing the service from being used for scam pages, phishing or spam (Article 6(1)(f)).
Retention: outcome of the check with the account; counters 2 days.

3.5 Access to the dashboard

Data: session cookie; sign-in links sent by email and password reset links, stored only as a hash together with a fingerprint of the IP that requested them. The links can be used only once, for 15 minutes (sign-in) or one hour (password).
Legal basis: contract (Article 6(1)(b)) and legitimate interest in security (Article 6(1)(f)).
Retention: as long as the user exists.

3.6 Billing and payments

Data: company name, partita IVA, tax code (codice fiscale), address, recipient code (codice destinatario) or certified email address (PEC); plan, amounts, dates and outcome of payments. You enter card details directly on Stripe: we do not see or store them.
Purpose: collecting the subscription, issuing the electronic invoice, keeping the accounts.
Legal basis: contract (Article 6(1)(b)) and legal tax and accounting obligations (Article 6(1)(c)).
Retention: 10 years (Article 2220 of the Italian Civil Code and tax rules), also after the account is deleted.

3.7 Service emails

What you receive: sign-up code, welcome, reminders during the 14 days of the trial (for example if you have not yet sent a document, or when the trial is about to end), end of the trial and move to the Free plan, failed payments, notifications when your documents are opened and signed, changes to the terms. Opening notifications can be turned off in Settings.
Legal basis: contract (Article 6(1)(b)).
We do not send newsletters or advertising. If we do, it will only be within the limits of Article 130 of the Italian Privacy Code (Codice privacy) and with the option to object in every email.

3.8 AI features

When: only on the Base and Pro plans and during the trial, when you ask the AI to write, edit or review a document or to prepare the studio's memory. The only operations that start by themselves are tied to one you asked for or can be turned off in Settings: the automatic review at the end of a draft written with the AI, and the memory that learns from a signed document.
Review of quotes: the content of the document goes to Google (Gemini) only when you ask for a review, or with the automatic review at the end of a draft written with the AI, which is already an AI operation. To compare prices with the market, the web search only receives generic descriptions of the items (for example "5-page showcase website"), from which we remove the names of the client and the supplier, emails, links, phone numbers and VAT numbers. The searches made stay saved in the review, which you can see in the dashboard.
What we send: to Google (Gemini API) the brief, the instructions, the memory, the brand name and the text of the documents you choose as a reference or to edit. We do not send visits, signatures or IP addresses.
Legal basis: contract (Article 6(1)(b)). Google processes the data as our provider and, on the paid service we use, does not use it to train its models; it keeps it for a limited period only to monitor abuse.
Retention: the history of requests stays in the dashboard during the subscription and is deleted together with the documents, 30 days after a request to delete the account or a suspension.

3.9 Support

If you write to us, we process the data you send us in order to reply (Article 6(1)(b) or, if you are not yet a Subscriber, Article 6(1)(f)). We keep the correspondence for up to 24 months from the closure of the request.

3.10 Defence of rights

In case of disputes we may use the data needed to establish or defend a right, including in court (Article 6(1)(f)), for the time needed to settle the matter.

3.11 Waiting list for people outside Italy

Data: email, country, occupation, language of the page and date of joining the list. Repeated requests are limited with a counter based on a fingerprint of the IP (2 days).
Purpose: writing to you when Okeh opens in your country. When someone joins the list, Davide Conte receives a notification by email with the same data.
Legal basis: consent (Article 6(1)(a)), which you can withdraw at any time.
Retention: until the opening in your country and in any case no longer than 24 months from joining the list, then the data is deleted automatically. To leave earlier, write to me@davideconte.me: we delete your entry within a few days.

3.12 Measuring advertising on Meta (only with consent)

Data: on the site okeh.app the Meta pixel records pages visited and actions (visits to pricing, demo and templates, submission of the sign-up form, email confirmation) with the _fbp and _fbc cookies, the IP address and the browser type. For form submission, email confirmation and trial activation we also send the event from our server (Conversions API), with the email and account identifier only as a SHA-256 hash, and we save the ad click identifier (fbclid) with the sign-up.
Purpose: knowing how many sign-ups our advertising on Facebook and Instagram brings in and showing it to people similar to those who have signed up.
Legal basis: consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code), given through the banner and withdrawable at any time from "Cookie settings" in the footer. Without consent the pixel does not load and no event is sent from the server.
Roles: for collection and transmission we are joint controllers with Meta Platforms Ireland Ltd. (Article 26 GDPR, Meta's joint controller agreement); for subsequent processing Meta is an independent controller with its own privacy policy.
Retention: the cookie choice 6 months; _fbp and _fbc 90 days; the click identifier and the Meta cookies copied to the account are deleted after the trial activation has been sent, and in any case together with the sign-up request after 30 days if the account is not activated.

4. Mandatory data

Sign-up data is necessary to create the account; billing data is necessary to pay and receive the invoice. Without it, we cannot provide the service.

5. Who we share data with

Only with those we need in order to provide the service and, if you accept, with Meta to measure our advertising. We do not sell data. The data of Subscribers' clients never goes to Meta.

LowHosting Services di Davide Gennari (Taglio di Po, Italy): servers that run the site, the application, the database, the document archive and outgoing mail, in a data centre in Frankfurt (Germany). Data processor.
Google LLC (United States): only for the AI features, as described in point 3.8. Data processor.
Stripe Payments Europe, Ltd. (Ireland): card payments, once they are active. For anti-fraud and anti-money-laundering checks Stripe acts as an independent controller, with its own privacy notice.
Accountant and electronic invoicing service, for the accounts; the Italian Revenue Agency (Agenzia delle Entrate) receives invoices through the Exchange System (Sistema di Interscambio), as required by law.
Providers that do not see your data: Cloudflare manages only the DNS of okeh.app (traffic does not pass through its servers); Let's Encrypt issues the HTTPS certificates and receives only the domain names.
Meta Platforms Ireland Ltd. (Ireland): only with your consent, for the advertising measurement described in point 3.12. Joint controller for collection and transmission, then independent controller.
Public authorities, only if the law requires it.

6. Transfers outside the EU

Servers, database and document archive are in the European Union. The only data that may leave the EU is the data sent to Google for the AI features, the Meta pixel data if you accept it (Meta Platforms, Inc., United States) and, once active, some payment data sent to Stripe, Inc. (United States). In all cases the transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (10 July 2023) and on the standard contractual clauses. You can ask us for a copy of the safeguards at me@davideconte.me.

7. Security

Encrypted connections (HTTPS), passwords and codes stored only as hashes, separation between accounts, access to the servers by key only. The full list of measures is in the data processing agreement (in Italian).

8. Your rights

You can request access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest (Articles 15-22 GDPR), by writing to me@davideconte.me. We reply within one month. You can also lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Roma (garanteprivacy.it), or apply to the judicial authorities.

9. Data of Subscribers' clients

When a Subscriber publishes a document, its clients open it, receive it by email or sign it. For this data the controller is the Subscriber; Davide Conte is the data processor (Article 28 GDPR) under the data processing agreement (in Italian), which forms part of the terms.

IP address of whoever opens: kept in full for 30 days, then we keep only the network part (last block set to zero for IPv4, first 48 bits for IPv6) and a fingerprint used to count unique visitors and to exclude the Subscriber's own addresses.
Approximate location: city, region and country are derived on our server from a downloaded database (DB-IP Lite “City”): the IP address is not sent to any external service.
Opens: the details of each open are deleted after 12 months; only the number of opens per document remains.
End of the subscription: after the trial or a cancellation the account moves to the Free plan and documents stay online. If you ask us to delete the account, or if we suspend it, documents and clients' data remain available for 30 days, then they are deleted automatically, files included.

Anyone who has received a document can find the information that concerns them on the page for people who open and sign (in Italian); to exercise their rights they contact the Subscriber who sent them the document.

IP geolocation by DB-IP: database DB-IP Lite “City”, licence CC BY 4.0. Other credits on the credits and licences page.

10. Changes

If we change this notice, we publish the new version here with the date of the update. We notify Subscribers of significant changes by email.