Privacy Policy

Effective date 1st September 2026

Your privacy matters to us. VOKT exists because organisations should be able to use their own information without handing it to someone else, and we hold ourselves to the same standard with the information we collect about you.

A few principles guide how we do that:

We ask for the least information we need, and we tell you why we need it.

We keep information only for as long as there is a reason to keep it.

We keep your account data and the model inference that runs on it in the European Economic Area, and we tell you exactly where. A limited set of named operational and website vendors may handle small amounts of data elsewhere under appropriate safeguards, and we list them below.

We name every company that handles it on our behalf.

We never sell it, and we never use it to train a model.

This policy explains all of that in full.

Sections

Who We Are and What This Policy Covers

VOKT is a business operating system. It connects to the systems, databases and documents an organisation already uses, and lets that organisation search, understand and automate its own work.

VOKT is operated by VOKT AI AS. We are established in Norway. Norway is a party to the Agreement on the European Economic Area, which is how the General Data Protection Regulation applies to us.

This policy applies to information we collect when you visit vokt.ai or ocr.vokt.ai, when you sign in to your VOKT account, when you ask us for a demonstration, and when you correspond with us.

It does not apply to the information inside a customer's VOKT environment. When an organisation connects its own systems to VOKT, that organisation decides what goes in and why. We handle it on their instructions. There is a section further down that explains this, and it matters if you are trying to work out who to contact about your own information.

Information We Collect

We collect information about you only where we have a reason to. It reaches us in three ways.

Information You Give Us

Contact details. When you request a demonstration or write to us, you give us your name, your business email address, and usually your company name and role. You may give us a telephone number.

Account details. If an account is created for you, we hold your name, your business email address, your sign in credentials, and the role you have been given in that account.

Correspondence. When you write to us, we keep a copy of what you sent and what we replied.

Information We Collect Automatically

Log information. Like every web server, ours records the technical details of each request: your IP address, browser type, operating system, the page that referred you, and the date and time. This happens whether or not you have an account.

Usage information. Within an account, we record what was done and when, so that the account holder has a reliable record and so that we can investigate problems and misuse.

Cookies and similar technologies. We store a small amount of information on your device and read it back. Our Cookie Policy explains what, why, and how to turn off everything that is not essential.

Information From Other Sources

We do not buy personal data, and we do not build profiles from outside sources. If you sign in using another service, we receive the information that service passes to us in order to authenticate you.

How and Why We Use Information

We use information about you for these purposes:

To reply to you when you ask us something or request a demonstration

To create, run and support accounts

To keep the service secure, and to detect and prevent misuse

To keep an accurate record of what happened in an account, which our customers rely on for their own audit and compliance obligations

To understand how the website is used, so we can improve it

To meet our legal, accounting and regulatory obligations

Our Legal Grounds

European data protection law requires us to have a lawful basis for each use. Ours are:

Performance of a contract. Creating and running an account, and providing the service to the organisation you belong to.

Legitimate interests. Replying to someone who has approached our business; keeping the service secure; maintaining an accurate activity record; and understanding and preventing problems. In each case we have considered whether our interest is outweighed by your rights, and we have concluded it is not. You can object to any of this, and we explain how below.

Consent. Anything that is not essential, including non essential cookies. You can withdraw consent at any time, and withdrawing it does not make what happened before unlawful.

Legal obligation. Retaining accounting records, and responding to lawful requests from a public authority.

Sharing Information

We do not sell personal data. We share it only in the situations below.

The companies that run our core infrastructure. These are established in the European Economic Area and host the heart of the service:

Hetzner Online GmbH, a German company, which hosts our infrastructure in Helsinki, Finland

Nebius B.V., a Netherlands company, which performs model inference on endpoints in Finland and France. Model requests reach Nebius through a routing layer that may, as a fallback, use other model providers, some of them outside the European Economic Area; where that happens we rely on appropriate safeguards and we do not use the data to train any model

Operational and website vendors. A small number of other companies help us run the website and deliver our messages. Some are established outside the European Economic Area, and where they are we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision:

Cloudflare, Inc., a United States company, which provides DNS, content delivery, security and encryption for our website and therefore sees the technical details of each request, including IP addresses

SMTP2GO, a United States and United Kingdom company, which delivers our transactional email, such as invitations, sign-in links and confirmations, which contain the recipient's name and email address

Google (Google Ireland Limited, and for some services the United States), which provides the Google Tag Manager and Google Analytics on our website, loaded only after you consent, and the Google sign-in you may choose to use

Apollo.io, Inc., a United States company, which provides website visitor analytics, loaded only after you consent

Cal.com, Inc., a United States company, which provides the scheduling link you use to book a demonstration

When you connect your own Google or Microsoft account to VOKT, or connect our assistant to a messaging service such as Telegram, data flows to that account or service on your instruction, under that provider's own terms.

Professional advisers. Our lawyers, accountants and auditors, where they need it to advise us.

Legal and regulatory requirements. We may disclose information where we are required to by law, or in response to a valid order from a court or public authority. We disclose no more than we have to.

Business transfers. If our business is sold or merged, information about you would be among the assets transferred. This policy would continue to apply to it, and we would tell you.

With your permission. Anything else, only if you have asked us to.

Where We Store Information

In our standard configuration, your account data stays in the European Economic Area. The application, the database, uploaded files and backups are held in Helsinki, Finland, and model inference runs primarily on endpoints in Finland and France. A limited set of operational and website vendors, named in the section above, may process small amounts of data outside the European Economic Area under appropriate safeguards — for example email delivery, security and content delivery for the website, and the analytics you have consented to.

Customers can also run VOKT on their own infrastructure, or in a fully isolated configuration with no connection to the internet at all. In those cases the information never reaches us.

A customer may choose to connect credentials for a model provider outside the European Economic Area. If they do, information from that environment goes to that provider on their instruction, and the residency described above no longer applies to that environment. We show a warning and require an explicit acknowledgement before that takes effect.

Transferring Information

Your account data and the model inference that runs on it stay in the European Economic Area. Some of the operational and website vendors named above are established outside it, so a limited amount of data — for example email delivery, website security and content delivery, and analytics you have consented to — may be transferred outside the European Economic Area. Where it is, we rely on the Standard Contractual Clauses approved by the European Commission, an adequacy decision, or another safeguard permitted by Chapter V of the General Data Protection Regulation. If a customer chooses to connect a model provider outside the European Economic Area, that transfer happens on their instruction, as described above.

How Long We Keep Information

We discard information when there is no longer a reason to keep it and no law requires us to.

Enquiries and demonstration requests. We keep these while we are in contact with you and for a reasonable period afterwards, so that we can pick up a conversation where it left off. If you ask us to delete them, we will.

Account details. For as long as the account exists. When an account is closed, we delete the details, except where we need to retain something to meet a legal obligation or to resolve a dispute.

Correspondence. For as long as needed to handle the matter and to keep a record of what was agreed.

Server logs. For a short period, long enough to investigate a problem or a security incident, and no longer.

Activity records. These form part of the audit record our customers depend on, and are kept for the life of the account. Removing an individual entry would leave that record incomplete, so where you ask us to remove one we will tell you what that means and explain what we can do instead.

Accounting records. For the period Norwegian accounting law requires.

Security

No service is perfectly secure, but we take this seriously and we can show our work.

Separation between customers. Each customer's data is walled off from every other customer's at the database level, enforced by the database itself rather than by application code. The application's standard database role cannot bypass that separation. A small number of audited, internal maintenance operations can cross it through a separate, controlled path in our own code; that path is never directed by a customer request or an API key.

An activity record of what happens. Every meaningful action is written to an activity record, kept for the life of the account and protected by strict access controls, so that the account holder has a reliable history of what was done and when.

Access control. Access to personal data is limited to the people who need it to do their work, and everyone with access is under a duty of confidentiality.

Your Choices

Give us less. You do not have to give us anything. If you do not complete the demonstration form we cannot reply to you, and if you do not provide what an account requires we cannot create one. There is no other consequence.

Turn off non essential cookies. Use the cookie settings on the site. The site works either way.

Stop hearing from us. Every marketing message we send has an unsubscribe link, and you can also just tell us. We will still send messages about your account and any legal notices.

Close the account. You can ask for an account to be closed at any time.

Your Rights

If the General Data Protection Regulation applies to you, you have the following rights over the information we hold as controller.

Access. To be told whether we hold information about you, to receive a copy, and to be told how we use it.

Correction. To have anything inaccurate put right, and anything incomplete completed.

Erasure. To have information deleted where we no longer need it, where you withdraw consent and there is no other basis, or where we have handled it unlawfully.

Restriction. To have us pause our use of your information while a question about its accuracy or lawfulness is worked out.

Portability. To receive the information you gave us in a structured, commonly used, machine readable format, and to have us send it to another organisation where that is technically possible.

Objection. To object to any use we base on legitimate interests. If you object to direct marketing, we stop, with no balancing exercise.

Withdrawing consent. To withdraw consent at any time where consent is what we rely on.

Complaining. To complain to a supervisory authority. Ours is Datatilsynet in Norway. You can also complain to the authority where you live or work.

To use any of these, write to us using the details at the end of this policy. We will reply within one month. If your request is complicated we may take up to two months more, and if so we will tell you within the first month and explain why. There is no charge. We may ask you to confirm who you are first, so that we do not hand your information to somebody else.

If we refuse a request, we will tell you in writing and explain why, and you can complain to a supervisory authority or go to court.

Information We Process for Our Customers

This is the part people most often need, so we will be plain about it.

When an organisation uses VOKT, it connects its own systems, databases and documents. That organisation decides what goes in and what it is used for. In the language of the law, they are the controller and we are the processor. We act on their instructions, under a written agreement and a Data Processing Agreement that meets Article 28 of the General Data Protection Regulation.

So if your personal information sits inside some organisation's VOKT environment, and you want to see it, correct it, or have it deleted, that organisation is who to ask, not us. They control it. If you contact us instead, we will not act on the request ourselves, but we will pass it to them promptly, and we will help them answer it.

We encourage every customer to publish a privacy policy of their own that accurately describes what they do with the information they hold.

When You Connect a Google Account

Vokt lets you connect a Google account so that it can work with your Gmail on your behalf. It shows your mail inside Vokt, links it to the right records, lets you search and ask questions across your own mail, and sends replies for you. Google requires us to be specific about what that access means, and you should know anyway.

What we ask for. When you connect a Google account to sync your mailbox, you grant Vokt access to your Gmail through Google's secure sign in. For that mailbox connection the only Gmail scope we request is https://mail.google.com/, alongside the basic sign-in scopes that identify your account. It is the only Gmail scope Google honours for the secure IMAP and SMTP method Vokt uses, and the narrower Gmail permissions do not work over that method, so we cannot ask for less and still do the job. If you also connect Google calendar, contacts or tasks, Vokt requests only the specific scopes those features need — such as calendar events, read-only contacts and read-only tasks, and optionally read-only Drive file metadata. If you sign in with Google, we receive only your basic profile — your name, email address and a Google account identifier. We ask for no Google permission beyond what the feature you turn on requires.

What we do with it. We read messages from the mailbox you connect so we can show them in Vokt, attach them to the matching companies, people and deals, and build a private search and assistant index over your own mail, inside your own workspace. We send mail when you send it from Vokt. That is all.

How we hold it. Your mail, its metadata and its attachments are stored in your workspace's isolated database, in the European Economic Area, in Helsinki, Finland, walled off from every other customer at the database level. Your Google sign in token is stored encrypted with AES-256-GCM. You can disconnect the account at any time in Vokt's settings, which revokes our access, and we delete the synchronised mail on request.

The limits we hold ourselves to. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. We do not transfer your Google data to anyone except as needed to provide the features you use, to comply with the law, or as part of a business transfer. We do not use it for advertising, we do not sell it, and we do not use it to train any general purpose or foundation model. No person reads your Google data except with your explicit permission, for example a support request you raise, where security requires it, or where the law compels it.

Automated Decisions and Model Training

Automated decisions. We do not make decisions about you that produce legal effects or similarly significant effects based solely on automated processing. The VOKT platform does process information automatically to produce answers and run tasks, but a customer decides how to use it and remains responsible for the decisions they take. Every answer is attributed to a source, and every action is recorded.

Model training. We do not use personal data to train, fine tune or otherwise improve any machine learning model, and we require the same of the companies that perform inference for us.

Children

VOKT is sold to organisations and is not directed at children. We do not knowingly collect information from a child. If you think a child has given us information, tell us and we will delete it.

Changes to This Policy

We may update this policy. When we do, we will revise the effective date at the top and record what changed in the change log below. If a change materially affects how we use your information, and we have a way of contacting you, we will.

How to Reach Us

VOKT AI AS,

Årdalsvegen 35, 6884 Øvre Årdal, Norge

Org. nr. 934 881 982

[email protected]

Supervisory authority: Datatilsynet, Norway, www.datatilsynet.no

Change Log

First published 1st september 2026

17th September 2026. Added the section "When You Connect a Google Account", describing how Vokt accesses, uses, stores and shares Google user data when a user connects a Gmail account, including the Limited Use commitment.

14th October 2026. Updated the operator's company name to VOKT AI AS (the same company, organisation number 934 881 982). Named the operational and website service providers we use, and clarified that a limited amount of data may be processed outside the European Economic Area under appropriate safeguards. Clarified the Google permissions we request, and corrected the descriptions of our activity records and internal access controls so they match what the service does.