Privacy Policy

At a glance

Okyra provides AI-assisted qualitative research interviews. Interview audio is processed transiently to create a transcript and is not permanently stored by Okyra. Transcripts and AI-generated summaries and insights are stored for the customer’s research project. We do not use customer data to train general-purpose AI models.

This policy applies to the Okyra website, platform and related services (together, the “Service”). It should be read together with any privacy notice supplied by the customer that invited you to participate in research.

1. Who we are

The Service is operated by ENIN BV, trading as Okyra (“Okyra”, “we”, “us” or “our”).

• Registered office: Meersstraat 43, 9000 Gent, Belgium
• Company and VAT number: BE0808506381
• Privacy contact: privacy@okyra.io

2. Scope and our data-protection roles

2.1 When Okyra is a controller

Okyra acts as a data controller when it decides why and how personal data is processed for its own business purposes. This generally includes data relating to visitors to our website, prospective and existing customers, account users, billing contacts, support requests, security, service administration and our own legal obligations.

2.2 When Okyra is a processor

When a customer uses Okyra to conduct research interviews, the customer generally determines the research purpose, selects participants and decides how the resulting research data will be used. The customer is therefore normally the data controller for participant data, and Okyra processes that data on the customer’s documented instructions as a data processor. Our processing in that role is governed by our agreement with the customer, including any applicable data processing agreement.

Customers are responsible for providing appropriate information to participants, identifying a valid legal basis and honouring participant rights. If you participated in an interview arranged by one of our customers, please contact that customer first about the research purpose or a rights request. We will assist the customer as required by applicable law and our contract.

3. Personal data we process

3.1 Data you or a customer provide

• Account and contact data, such as name, business email address, organisation, role and login information.
• Customer and subscription data, such as plan, billing contact, transaction status and customer-service communications. Complete payment-card details are handled by Stripe and are not stored by Okyra.
• Research project data, such as project names, research objectives, interview guides, participant invitations and project configuration.
• Interview data, including participant responses, transcripts and information a participant chooses to disclose during an interview.
• AI-generated research outputs, such as summaries, themes, sentiment indicators and organised insights derived from interview responses.
• Support and feedback data, including the content of requests, correspondence and product feedback.

3.2 Data collected automatically

• Usage and interaction data, including pages or features viewed, clicks, session statistics, referring pages and timestamps.
• Device and connection data, including IP address, browser type and version, operating system, device information and approximate location derived from an IP address.
• Cookie and tracker data, subject to the choices and information described in section 11.
• Security and diagnostic data, including authentication events, error logs, audit events and information used to prevent abuse or protect the Service.

3.3 Interview audio

Audio is captured and transmitted only as needed to run the voice-based interview and generate a transcript. Okyra processes this audio transiently and does not permanently store the audio recording. The resulting transcript may be stored as described in this policy. Participants should avoid providing information that is not relevant to the research or that they do not wish the customer to receive.

3.4 Third-party data

Customers may provide contact details for colleagues or research participants. Customers must ensure that they are permitted to provide this data and that recipients receive any notices required by law. We may also receive limited information from service providers, such as payment status from Stripe or authentication events from Supabase Auth.

4. Why we process personal data and our legal bases

Where Okyra acts as controller, we rely on the legal bases below. The applicable basis depends on the context and the data involved.

Where we rely on legitimate interests, we balance those interests against the rights and freedoms of the people concerned. You may object to this processing in the circumstances described in section 13. Where consent is the legal basis, consent may be withdrawn at any time without affecting earlier lawful processing.

5. AI-assisted processing

Okyra uses artificial intelligence to conduct voice-based research interviews, transcribe participant responses, generate summaries, identify themes, analyse sentiment and organise research insights. AI-generated outputs support qualitative research; they may contain inaccuracies or miss context and should be reviewed alongside the underlying transcript where appropriate.

• Interview audio is processed transiently to create a transcript and is not permanently stored by Okyra.
• Interview transcripts and AI-generated outputs are stored as part of the customer’s research project, subject to the customer’s retention choices and our contractual obligations.
• Okyra does not use customer data, participant responses, interview transcripts or AI-generated research outputs to train general-purpose AI models.
• Customer data is processed to provide, secure and support the requested Service, and not for unrelated model development.

Okyra’s AI features are not intended to make decisions that produce legal or similarly significant effects about participants. Customers remain responsible for their research decisions and any action they take based on research outputs.

6. Service providers and subprocessors

We use carefully selected providers to operate the Service. Depending on the feature used and Okyra’s role, a provider may act as our processor or as a subprocessor supporting services we provide to a customer. Providers may process only the data reasonably required for their function and are subject to contractual confidentiality, security and data-protection obligations.

This list may change as the Service evolves. Where required, we will provide notice of material changes to subprocessors through our contractual or product communication channels.

7. How we share personal data

We do not sell personal data. We may disclose personal data only as described below:

• To the customer that commissioned or administers a research project. Interview responses, transcripts and generated outputs are available to authorised users of that customer.
• To the service providers listed above and other professional advisers or suppliers that support the Service under appropriate obligations.
• To public authorities, courts or other parties when required by law, necessary to protect rights or safety, or needed to establish, exercise or defend legal claims.
• In connection with a merger, financing, acquisition, reorganisation or sale of all or part of our business, subject to appropriate confidentiality and data-protection safeguards.
• With a person’s consent or at that person’s direction.

8. International data transfers

We seek to host core Service infrastructure in the European Union where indicated above. Some providers or their support operations may nevertheless process personal data from, or transfer it to, countries outside the European Economic Area. Where a transfer is not covered by an adequacy decision, we use an appropriate transfer mechanism, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where appropriate. Information about relevant safeguards may be requested at privacy@okyra.io, subject to confidentiality restrictions.

9. Data retention and deletion

We retain personal data only for as long as needed for the purposes described in this policy, to meet contractual commitments and legal requirements, and to resolve disputes or enforce agreements. Retention depends on the category of data and our role.

• Interview audio: processed transiently and not permanently stored by Okyra.
• Research projects, transcripts and AI-generated outputs: retained according to the customer’s configured retention settings, deletion actions and contractual arrangements. Customers may delete project data through available Service controls.
• Account and customer data: generally retained while the account or customer relationship is active and for a reasonable period afterwards for administration, security, dispute resolution and legal compliance.
• Billing and transaction records: retained as required by Belgian accounting, tax and other applicable laws.
• Security logs and backups: retained for limited, risk-based periods. Deleted data may remain in protected backups until overwritten in the ordinary backup cycle, during which it is not used for ordinary business purposes.

When Okyra acts as processor, deletion and return of customer data are governed primarily by the customer’s instructions and our agreement with that customer. We may retain limited data where required by law, provided it remains protected and is used only for that legal requirement.

10. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are selected with regard to the nature of the processing and the risks involved and include access controls, authentication, encryption in transit, provider due diligence, logging, backups and operational security practices where appropriate.

No service can guarantee absolute security. Customers and users should protect their credentials, use strong authentication practices and promptly notify us of suspected unauthorised access. If a personal-data breach occurs, we will investigate and notify affected controllers, individuals or authorities where required by law.

11. Cookies and analytics

We use cookies and similar technologies that are necessary to operate the website and Service, for example to maintain sessions, authenticate users, remember preferences and protect against abuse. We also use privacy-friendly analytics technologies, including TWIPLA configured in a manner that does not require non-essential cookies where applicable, to understand website and product usage, such as visits, interactions, device information and session statistics.

Where we use analytics or other technologies that require consent under applicable law, we will request that consent before activating them. Where applicable, you will be able to manage your choices through the consent mechanism provided on the website, in addition to your browser settings. Blocking necessary cookies may prevent parts of the Service from working. Cookie availability, duration and exact names may change as the website and Service evolve; the cookie interface is the current source for those details.

12. Operational and marketing communications

We use Brevo to send account invitations, authentication or security messages, interview invitations, service notices, support communications and other operational emails. These communications are necessary to provide or administer the Service and generally cannot be opted out of while the relevant account or interaction remains active.

If we send optional marketing communications, we will do so on an appropriate legal basis and include a way to unsubscribe. Opting out of marketing does not stop operational or transactional messages.

13. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• request access to your personal data and information about its processing;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• receive personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a competent supervisory authority.

To exercise a right concerning data for which Okyra is controller, contact privacy@okyra.io. We may ask for information needed to verify identity and locate the relevant data. We will respond within the period required by law. Requests may be limited or refused where permitted by law, and we will explain the relevant reason.

For participant data processed for a customer’s research project, contact the customer that invited you. If you contact us, we will route or support the request as appropriate without acting beyond the customer’s instructions.

In Belgium, the lead supervisory authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données). You may also complain to the supervisory authority in the EEA country where you live, work or believe an infringement occurred.

14. Children

The Service is intended for business customers and research arranged by those customers. Okyra does not knowingly offer accounts directly to children. Customers must ensure that any research involving minors is lawful, age-appropriate and supported by any required parental or guardian authorisation. If you believe we have processed a child’s personal data unlawfully, contact privacy@okyra.io.

15. External links and third-party services

The website or Service may link to websites or services controlled by others. Their privacy practices are governed by their own notices, not this policy. We encourage you to review those notices before providing personal data.

16. Changes to this policy

We may update this policy to reflect changes to the Service, our providers, legal requirements or our processing practices. We will post the revised policy with a new “Last updated” date and, where required, provide additional notice through the Service or by email. Material changes take effect on the date stated in the updated policy unless a later date is specified.

17. Contact

Questions, requests or concerns about this policy or Okyra’s privacy practices may be sent to:

ENIN BV (trading as Okyra)
Meersstraat 43
9000 Gent
Belgium
Company / VAT number: BE0808506381
Email: privacy@okyra.io