Last updated: 2 August 2026
This policy explains what happens to personal data when you use the Orakis website at www.orakis.com or the Orakis application at app.orakis.com.
We process the data in your account to provide the service and do not use it to train AI models. Our access to it is limited to what operating, supporting and maintaining the service requires. The Data Processing Agreement sets out the binding rules for that access.
Abdullah Emin Koç
Schneideräckerstraße 8
70378 Stuttgart
Germany
Email: info@orakis.com
We have not appointed a data protection officer. Under § 38 BDSG we are not required to.
Orakis takes on two different roles under data protection law.
We are the controller for the personal data about you that arises from your relationship with us as a company. Sections 3 and 4 describe how and why we process it.
We are the processor for the personal data about other people that reaches the service through your work. You decide what happens to it, and we process it on your instructions. Section 5 gives an overview; the binding terms are in the Data Processing Agreement.
When you open a page, on this website or in the application, our hosting provider records technical data such as your IP address, browser type and version, operating system, referring URL and the time of the request. We use this to deliver the page and to defend against attacks, which rests on our legitimate interest under Art. 6(1)(f) GDPR. The recipient is our hosting provider, which processes this data in the United States, and it is kept for one hour. Section 6 covers that transfer.
Our forms store timestamps of your recent submissions in your browser's local storage to prevent automated abuse. This data never leaves your device and is not readable by us, and it does not require consent under § 25(2) no. 2 TDDDG, since it is strictly necessary for a service you requested.
Where a page embeds a video, the player is loaded from the video platform in its extended privacy mode, which sets no cookies until you start playback. Loading the player does contact the platform's servers and transmits your IP address. This rests on our legitimate interest in presenting this content under Art. 6(1)(f) GDPR. The platform is based in the United States; Section 6 covers that transfer.
We do not set cookies for analytics or advertising. The application stores only what is necessary to keep you signed in.
We process the data you enter yourself in order to communicate with you, to provide and administer the service, and to charge for it.
Where the processing serves a contract with you or its preparation, the legal basis is Art. 6(1)(b) GDPR. Where you asked us to notify you about something, it is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time. Where we protect the service against misuse or verify that an address belongs to you, it is our legitimate interest under Art. 6(1)(f) GDPR.
An account and everything in it stays with us until it is deleted, and you can do that yourself at any time. Anything you send us outside of that is deleted once it has been dealt with. Where the law requires us to keep something longer, we keep it for that period, as with invoices under § 147 AO and § 257 HGB, and we limit the data to that purpose rather than continuing to use it.
This data is stored on servers in Frankfurt, Germany. To run the service we also rely on external providers: for our database, for hosting, for the AI models, for payments, and for sending email. A current list naming each of them, with what they do for us, where they are based and the basis for any transfer outside the EU, is available on request at info@orakis.com.
This section covers the data you bring into Orakis: what you create in it, and the content of any external app you connect. For that data you are the controller and we are the processor.
If you use Orakis as a business, the Data Processing Agreement applies and takes precedence over this section. Annex I of that agreement sets out the categories of data in full.
Content from a connected app is retrieved at the moment you need it and is not kept on our systems. One exception is worth understanding. When the assistant works with an item at your request, extracts of that content become part of the conversation and of the assistant's memory, and they remain there until you delete the conversation. To keep a connection working we hold the access credentials the app issues, which you can withdraw at any time in your Orakis settings or in the app itself.
Orakis uses AI models to run the service. When you ask the assistant something, the data in your workspace that is relevant to your request is sent to our AI provider so that it can be answered. You can mark content as private, and the assistant will not read it. The legal basis is Art. 6(1)(b) GDPR, or your instruction under the agreement. Your content is not used to train models, and it is deleted there within 30 days.
Every provider involved, including where it is based and the basis for any transfer outside the EU, is named in the list we provide on request.
How to read AI output. AI models produce plausible text, not verified truth. They can be wrong, and they can be confidently wrong. Do not rely on AI output for decisions with legal, financial or medical consequences without checking it. You are always interacting with an AI system, never with a human being posing as one (Art. 50 EU AI Act).
Orakis also lets you connect your workspace to an external AI client of your own choosing. If you enable that, your data flows to a provider you have chosen, under that provider's terms and privacy policy, and we have no control over what happens to it there. The connection is only ever established after you explicitly confirm it, and you can revoke it at any time in your settings.
Some of our providers are based in the United States or process data there. In those cases the transfer is based on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented where necessary by additional safeguards.
A current list of all providers, including their location and the basis for any transfer, is available on request at info@orakis.com.
You should know that US authorities may, under certain conditions, access data held by US providers, and that legal remedies available to you there may not match those in the EU.
Under the GDPR you can ask us what personal data we hold about you (Art. 15), have it corrected if it is wrong (Art. 16) or deleted (Art. 17), have its processing restricted (Art. 18), and receive it in a machine-readable format so you can take it elsewhere (Art. 20). Where we process something on the basis of your consent, you can withdraw that consent at any time with effect for the future (Art. 7(3)).
Write to info@orakis.com and we will respond without undue delay.
Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to complain. You may lodge a complaint with a supervisory authority. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit
Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart
https://www.baden-wuerttemberg.datenschutz.de
You may also complain to the authority where you live or work.
We use TLS encryption for all connections. Passwords are hashed. Access to production systems is limited to those who need it.
A full description of our technical and organisational measures is in Annex II of the Data Processing Agreement.
We will update this policy when our processing changes. The date at the top shows the current version. If a change materially affects you, we will tell you before it takes effect, by email if you have an account.