Privacy Policy
iShopping Inc. — the Oktium platform
This Policy explains what we do with personal data. Please read Section 2 first: what applies to you depends on how you came to Oktium.
1. Who we are
iShopping Inc. ("we", "us", "Oktium") is a corporation incorporated in Delaware, United States. We make Oktium, software that lets a business put a button on its website so a customer can reach a real person on a video call.
Privacy questions: [email protected]
2. Which part of this Policy applies to you
If you work at a business that uses Oktium — you are an account holder, an administrator, or a Seller — we are responsible for your personal data as a controller. This whole Policy applies to you.
If you visit oktium.com — we are the controller for what we collect from the website. Sections 3, 8, 10 and 11 apply.
If you are a customer who called a business through Oktium — the business you called is responsible for your data, not us. We only handle it on their instructions, as their processor, under a Data Processing Agreement. Ask that business for their privacy policy; it will tell you what they do with your data and how to reach them. Sections 5 and 6 below describe what we do with it on their behalf, and Section 7 describes the narrow set of things we do with it for our own purposes.
3. What we collect about business users
- Account and identity — name, work email address, telephone number, job role, the Business you belong to, and your Branch and department.
- Authentication — credentials, session and device information, and security events such as sign-in attempts.
- Billing — the Business's legal name, address, tax identifiers, plan, seats, and invoice history. We do not receive your full card number; card details go directly to our payment provider.
- Usage — which features you use, when you were available to take calls, call volume and duration, and errors and diagnostics.
- Support and sales — what you write to us, and our correspondence with you.
4. Why we use it, and on what basis
| What for | Legal basis |
|---|---|
| Providing Oktium to your Business, and letting you sign in and take calls | Performance of our contract with your Business, and our legitimate interest in administering it |
| Billing, invoicing, collections and tax records | Performance of contract, and our legal obligations |
| Support, and telling you about changes that affect you | Performance of contract |
| Keeping the service secure, preventing fraud and abuse, investigating incidents | Our legitimate interests, balanced against your rights |
| Improving Oktium, using aggregated and de-identified usage data | Our legitimate interests |
| Marketing to business contacts about Oktium | Our legitimate interests, or your consent where the law requires it. You can opt out at any time and every message tells you how |
| Establishing, exercising or defending legal claims | Our legitimate interests, and legal obligations |
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
5. Calls
Video calls are connected directly between the two browsers. In the ordinary case the picture and sound never pass through our systems and are never stored by us. What we hold is the fact a call happened: when, how long, which Branch and Seller, and which in-call requests were sent and how they were answered.
Recording and transcription are off unless the Business turns them on. Where a Business does turn them on, the Customer sees a request in the call and must accept before anything is recorded; declining does not end the call. The recording belongs to the Business, we hold it as their processor, and the Business is responsible for having obtained the consent the law requires.
6. Data we handle for a Business
Where personal data reaches us because a Business put it into Oktium — their customer records, orders, call history, and any recordings — we act only on that Business's documented instructions under our Data Processing Agreement. We do not use it for our own purposes, we do not sell it, and we do not mine it to build profiles.
The Data Processing Agreement lists our sub-processors, the transfer mechanism, our security measures, and what we do in a breach. A current copy is available at oktium.com/dpa.
7. The narrow set of things we do decide ourselves
For a small, defined set of purposes we act as our own controller even over data that arrived through a Business:
- Security and fraud prevention — detecting abuse, attacks and misuse of the platform.
- Legal and tax records — keeping what we must keep to meet our own obligations, including a retention ledger evidencing that records were held for the period the law requires.
- Our relationship with the Business — billing, support and account administration.
We keep this set deliberately small, and we do not expand it without updating this Policy.
8. The website
oktium.com uses only the cookies needed to make the site work. We do not use advertising cookies and we do not embed third-party trackers.
Our analytics are self-hosted on our own servers. They set no cookies, do not follow you between sites, and the data never reaches a third party. That is why you are not asked to agree to analytics here: there is nothing to consent to.
Where you start a Face2 call from our own site, that call is handled the same way as any other: directly between browsers, not recorded unless you are told and agree.
9. How long we keep things
| Record | Retained for |
|---|---|
| Account and profile data | While the Business is a customer, then 90 days |
| Call metadata and history | While the Business is a customer, then per their retention settings |
| Invoices, payments and tax records | The period required by tax law where we and the Business are established — commonly 7 to 10 years |
| Security and access logs | 12 months, longer where an incident is under investigation |
| Support correspondence | 24 months |
| Marketing contact data | Until you opt out, then a suppression record only |
After a Business terminates, its data is available for export for 30 days and is then deleted, except records we must keep by law. Where a record is under a legal hold because of an actual or anticipated dispute, we keep it until the hold is lifted.
10. Where data goes
Your data is held in the European Union. Our databases run in Frankfurt, our file storage is configured to keep data in the European Union, and our application servers are in Europe. Access to production data is limited to staff in the European Economic Area, so personal data reaching us from the EEA, the United Kingdom or Switzerland is not transferred outside it.
We use a small number of service providers: our database host, our object storage provider, our server host, and Microsoft for sending transactional email. Each is engaged under a written contract, acts only on our instructions, and is configured for European data residency. They are listed as sub-processors in the Data Processing Agreement, with their locations, and you may ask us for a copy.
Stripe processes payment details for your Business's own subscription to Oktium. Where your Business takes payments from its own customers, that goes through your Business's own payment provider under its contract, not ours.
11. Your rights
Depending on where you live you may have the right to:
- get a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have data deleted, where we are not required to keep it;
- ask us to restrict how we use it while a question about it is resolved;
- receive it in a portable form;
- object to processing based on our legitimate interests, including profiling;
- withdraw consent at any time, without affecting what was done beforehand; and
- not be treated differently for exercising any of these.
Write to [email protected]. We verify who you are before responding, and we respond within one month — or within 45 days where US state law sets that period. There is no charge unless a request is clearly unfounded or excessive.
If we refuse a request and you are covered by a US state privacy law that provides an appeal, you may appeal by replying to our response and saying so. We will respond within 45 days with our reasons, and if we still refuse you may contact your state attorney general.
If you are a customer of a business that uses Oktium, send your request to that business. Where you send it to us, we will pass it on and tell you we have done so; we cannot act on it ourselves, because the data is theirs.
12. Complaints, and our representatives
If you are not satisfied, please tell us first at [email protected].
You also have the right to complain to a data protection authority — in the EEA, the authority where you live, work, or where you think the problem happened; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.
We have staff established in the European Union, so you can raise any matter with us directly at [email protected] and we will answer it ourselves.
13. Automated decisions
We do not make decisions with legal or similarly significant effects about you based solely on automated processing.
14. Security
We encrypt sensitive fields at rest and all data in transit, restrict access to those who need it, log access to personal data, and review our controls regularly. No system is perfectly secure. Where a breach is likely to present a high risk to you, we will tell you without undue delay, and we will notify the relevant authority where the law requires it.
15. Children
Oktium is a tool for businesses. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe we have, write to [email protected] and we will delete it.
16. Changes
If we make a material change we will tell business users by email before it takes effect and publish the date of the change. Continuing to use Oktium is not treated as agreement to a change in this Policy — where a change needs your consent, we ask for it separately.
Every published version is kept, and you can ask us for an earlier one.