Privacy Policy

1. Introduction

At OK2GO, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our consent documentation service.

2. Who We Are

The controller of your personal data is ACORD DIGITAL S.R.L., trading as OK2GO, registered at Bulevardul Carol I, nr. 57A, ap. 18, 020915 Bucharest, Romania. For anything about your data, including exercising any of the rights below, write to contact@ok2go.eu or use the contact page.

3. Information We Collect

We collect the following types of information:

• Personal Information: Name and email address
• Recordings and pictures: a few seconds of video you record of yourself in the app when you make a record, and the still picture taken from it. Both are stored encrypted. The picture is printed on the sealed copy; the recording is playable only by someone holding the private address printed on that same copy, and both are deleted with your half of the record
• Consent Records: What two people agreed to, when, and the signatures on it
• Age confirmation: your statement that you are 18 or older, recorded when you set up your account and again on each record you take part in
• What you agreed to: the statements you confirm when you sign, stored with the record and printed on a sealed copy. Records made while the older optional "what is being agreed" step existed also carry the options and text entered there
• Location: one position, captured only when you tap "Share my location" and your browser's own permission prompt allows it, rounded to about a metre before it leaves your device. It is stored encrypted with the record, printed on a sealed copy together with the distance between the two reported positions, and never collected in the background or after that step. Sharing it is your choice: if you decline, or your device cannot provide one, the record is filed without it and nothing else about the record changes
• Your check-in answer: the one-tap answer to the after-the-fact prompt, visible only to you and never to the other person
• Delivery records: which notification emails we sent about your record, and when
• Record status token: a random code printed on a sealed record, which resolves to a page that shows only whether the record still stands or has been withdrawn, plus the timestamps. It carries no personal data of any kind
• Usage Data: Information about how you interact with our Service
• Device Information: Browser type, IP address, and device identifiers

4. How We Use Your Information

We use collected information to:

• Provide and maintain the record-keeping service
• Verify user identities and sobriety assessments
• Generate and store records securely
• Communicate with you about your account and services
• Improve and optimize our Service
• Comply with legal obligations

A record, the recording in it, and the statements confirmed on it are special-category data under Article 9 of the GDPR. We process them on your explicit consent, which you give as its own tick on the signing screen: a statement naming this policy that must be checked before a record can be filed. Every capture in the flow asks first, and the record is only filed when you press the final button. You can withdraw that consent at any time by deleting your copy of the record, which also deletes your recording and takes its printed address out of circulation.

The location on a record is processed on the same basis: it is captured only by your own tap on "Share my location", after the step has explained what is recorded and who will see it, and it becomes part of the record you file. Deleting your copy of the record deletes your location with it.

5. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption in transit and at rest
• Private storage with row-level access control, so a record is readable only by the people named on it
• Sealed documents that never sit at a public address: no link to one is ever minted, and the file is decrypted and delivered only to a signed-in person named on the record, each time they ask for it
• Regular security audits and updates
• Strict employee access policies

6. Data Retention

Kept for 7 days unless sealed. An unsealed record is deleted 7 days after it was created, together with the recordings, pictures and signatures attached to it. Once a record is complete on both sides, we email both people three days before that happens, and again in the final 24 hours, so nothing disappears without warning.

Sealing changes that. Kept for 7 years. Either person can delete their own copy sooner; the other person's copy is unaffected.

To delete your whole account, contact us from the email address on the account. We will delete your profile and your copy of every record you made, with the recordings, pictures and signatures in them, within 30 days; the other person's copies are unaffected, exactly as when you delete a record yourself. We keep payment records for as long as tax and accounting law requires, and those contain no recordings, pictures, signatures or record contents.

7. Information Sharing

We do not sell your personal information. We may share your information only:

• With your explicit consent
• With the other person named on a record, who holds the same copy you do
• With the service providers named in the next section, who process it only on our instructions
• When required by law or to protect our legal rights

8. Service Providers and International Transfers

These are the providers that touch your data, and what each one holds:

• Supabase (database, file storage, sign-in): everything described in section 3. Our project and its storage are hosted in the EU (Ireland)
• Stripe (payments): your card details go directly to Stripe and never reach our servers. What we hand Stripe is a random record identifier, not your name or what the record contains
• Spaceship (email delivery): the addresses and text of the notification emails we send, described in section 3 under delivery records
• Vercel (website hosting): serves the site itself and, like any host, sees the technical request data in section 3 under device information. Records, pictures and recordings are never stored there
• Google Analytics (usage statistics): runs only if you opt in on the cookie banner, with IP anonymisation on. Declining means no request to Google is ever made

Your records, recordings, pictures and signatures are stored in the EU. Some of the providers above are US companies or run global networks, so limited data, such as technical request data, payment processing, email delivery, and analytics if you opted in, can be processed outside the EU/EEA. Where that happens we rely on European Commission adequacy decisions, including the EU-US Data Privacy Framework, and on Standard Contractual Clauses.

9. Your Rights

You have the right to:

• Access your personal information and receive a copy of it
• Correct inaccurate data
• Request deletion of your data, up to and including your whole account (subject to legal requirements)
• Object to certain processing of your data, and withdraw consent at any time
• Receive the data you gave us in a portable format
• Complain to a supervisory authority; ours is the Romanian ANSPDCP

To use any of these, contact us from the email address on your account. We answer within 30 days. Deleting your own copy of a record needs no request at all; that button is on your dashboard.

10. Cookies

We use cookies and similar technologies to enhance your experience. For more information, please see our Cookie Policy.

11. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

13. Contact Us

If you have questions about this Privacy Policy, please contact us or write to contact@ok2go.eu.