Okara

GDPR overview

There is no GDPR framework on this site. The word never appears once across any of the fourteen pages collected, the privacy policy included: no legal basis, no named data subject rights, no Article 27 representative, no data processing agreement, no supervisory authority. The policy refers only to "applicable data protection laws" without naming any. What does exist is real but unlabelled: a Data Protection Officer is designated and reachable at privacy@okara.ai, the policy grants access, correction, deletion, restriction, objection and a copy of your data, a subprocessor list is published with locations, and international transfers are acknowledged with unspecified "adequate safeguards". So this is silence rather than refusal — Okara neither claims nor denies compliance, it simply never addresses the question. Hosting is declared in the United States and Singapore.

Who owns the data?

Under the terms of service you keep ownership of everything you submit, and you grant Okara a licence to use, store and process that content strictly to deliver the service. Okara disclaims responsibility for what the models generate. The privacy policy goes further on prompt data: it is encrypted at rest under what Okara calls a zero-access architecture, and the company states that decryption happens only locally on your own device, so that you alone can read your conversation history. You can delete prompt data at any time from the dashboard. Personal data may be shared with service providers, professional advisers and subcontractors, and would transfer with the business in a sale or merger.

Reuse rights

Okara distinguishes three categories: personal data, prompt data and usage data. It uses them to administer accounts, deliver the AI services, gather feedback and, where you have consented, send marketing. Usage data covers timestamps, conversation IDs, model selection and message roles; message content is encrypted and Okara says it does not profile. Prompt data is explicitly excluded from model training. As the customer you retain ownership of your inputs and of the drafts the agents produce, and you may reuse and publish them freely without asking permission — the whole product is built on you approving and shipping that output. One caveat deserves attention: the privacy policy claims all processing happens exclusively on infrastructure Okara owns and that data is never shared with third-party AI providers, while the company's own subprocessor page lists Replicate for AI model hosting and inference. Those two statements cannot both hold.

Data retention & training

Hosting summary

Okara publishes a subprocessor list, current as of 27 October 2025, that names each provider, its purpose and its location. Amazon Web Services carries cloud infrastructure, hosting and file storage from Singapore and the United States. Vercel hosts the front end, Supabase runs the PostgreSQL database and Upstash the Redis, vector and queue layers, all in the United States. Replicate provides AI model hosting and inference from the United States. Stripe processes payments from the United States, Ireland and Singapore, and ConvertKit, Resend, Google Analytics, Google Ads, Rewardful and the Twitter and Reddit advertising pixels complete the list. The privacy policy acknowledges cross-border transfers and says adequate safeguards are in place, but names no mechanism — no standard contractual clauses, no adequacy decision. No jurisdiction of incorporation is published anywhere. The domain resolves to an Amazon anycast address geolocated in the United States.