Privacy policy

1. Who is responsible

The controller is Ardwins Digital Labs LLC, Wyoming, USA. For any question about your data, write to privacy@oukla.app. We answer within 30 days, usually much sooner.

If the GDPR applies to our processing and requires it, we will appoint a representative in the European Union and name them here: [EU representative].

2. What data we process

We collect data from you, from people you authorise (for example your spouse or assistant), from partners working on your tasks, and from public sources when a task requires it (for example a land register).

Category	Examples	Source
Identity and contact	Name, email, phone, address, language, the same for family members you invite	You
Membership and billing	Plan, country, billing period, payment status, invoices. Card numbers stay with Stripe; we never see them	You, Stripe
Service record	Tasks, messages, deadlines, time spent, partners involved, quotes and orders	You, our team, partners
Vault documents	Passports, permits, insurance policies, contracts, certificates you upload	You
Household	Children, household staff, homes, vehicles, pets, as far as a task needs it	You
Family facts	Health insurer and type of cover (never medical details), schools, languages, nationality and permit type (never document numbers), contact preferences. You see them in your account and can correct or delete them	You, our team
Sensitive data	Health information (appointments, insurance claims), identity documents, data about children	You, with your explicit consent
Identity check (only when you ask for one)	The result, the document's type, country and end date, a keyed fingerprint of its number (never the number), the name and birth date as in the document (encrypted). Never photos of the document or of your face	You and the identity check provider, with your explicit one-off consent
Powers of attorney	The text you signed, for whom, its dates, how it was signed (with a photo or scan of the page signed by hand, if you chose that), the offices it was filed with, its revocation	You, our team
Website and campaigns	Pages visited, device and browser, browser language, approximate country and city from your IP address, your IP address (kept 90 days for protection against abuse and for analysing where enquiries come from), campaign parameters (utm, click ids), the page you arrived on, and with your consent analytics and advertising identifiers and the pages you viewed	Your browser
Partners and candidates	Contact data, company, offer, price lists, CV and application	You, your documents

3. Why we process it and on which legal basis

Purpose	Legal basis (revFADP / GDPR)
Provide the membership and the services you order	Contract (GDPR art. 6(1)(b))
Payments, invoices, accounting (Swiss bookkeeping law: 10 years)	Legal obligation (art. 6(1)(c))
Keep documents safe, log access, prevent fraud and misuse	Contract and legitimate interest (art. 6(1)(f))
Health data needed for a task you asked for	Your explicit consent (art. 9(2)(a)), which you can withdraw
Answer enquiries, partner and job applications	Steps before a contract and legitimate interest
Free family audit and the start of your path: your answers (including when you moved, the kind of your residence status, how you and your partner work, your homes, what matters to you now and the other countries you add to see their deadlines and estimates), the goals you choose (for example a move or one task) and a task you describe, to show estimates and prepare an offer or a price at your request; when you ask to be first in the queue for a country that is not open yet, your name, your email and that country stay on your enquiry so we can write to you when it opens	Steps before a contract at your request
The first task on us after the free audit: a keyed fingerprint of the e-mail address (never the address itself), kept also after your data is erased, so that one address gets one free first task only	Legitimate interest in preventing abuse of a free service
Measure and improve the website and campaigns	Your consent in Cookie settings (art. 6(1)(a))
Improve our work and internal tools, including AI assistants, from pseudonymised task records	Legitimate interest; you may object
Family memory: a short internal summary of your family for our team (section 4)	Legitimate interest (art. 6(1)(f)); you may object at any time
Daily order of your family's open reminders for our team, with a short AI explanation (section 4)	Legitimate interest (art. 6(1)(f)); you may object at any time
Autopilot of our team (section 4): proposals and internal reminders for our team, and at most one short notice a day to you of decisions and dates waiting	Legitimate interest (art. 6(1)(f)) and the membership contract (art. 6(1)(b)); you may object to the part based on legitimate interest at any time
Send news and offers by email	Your consent, or for members information on similar services with an easy opt-out

4. Artificial intelligence

Voice requests in the family account are transcribed by Cloudflare Workers AI (the Whisper model). The recording is sent only to be transcribed and we delete it right away; Cloudflare processes it under its data processing terms and does not use it to train models. We keep only the text. Anthropic’s AI then suggests how to split it into tasks and questions; you see them, edit them and choose before anything goes to your PA.

In the free family audit, a spoken answer is transcribed the same way and Anthropic’s AI only marks which of the listed options it names; neither the recording nor the words are stored. Questions about work (including your employer’s canton and pillar 3a), citizenship, permits and tax at source are answered with buttons only and never reach the AI; what you tell us about your work is never given to the AI later in the cabinet either. Every figure the audit shows is computed by our own published rules, never by AI, and is an estimate until we check it against your documents. What you type in «How can we help?» on our website is kept with your enquiry; when you enter the sign-in code, Anthropic’s AI reads it once, with email addresses and account, document, phone and other identifying numbers removed, only to preselect the goals of your first screen; we keep its answer, not your words, and Anthropic processes it as our processor (sections 5 and 6).

We use AI tools to help our team: for example to read a partner's price list and propose a draft entry, or to prepare a first draft of a message. A person always reviews the result before anything is sent to you or used for a decision. The model is Claude, made by Anthropic, PBC (USA); Anthropic processes these requests as our processor under its data processing terms and does not use them to train its models. In the app this appears simply as “the platform”.

When a partner registers, it may upload the PDF of its LinkedIn profile or paste its “About” text: Anthropic’s AI reads it once to suggest the partner’s professions and services from our catalogue, which the partner confirms itself. We do not keep the file or the text, only the suggestions until the partner saves its profile.

Some work without family data, such as drafts of our journal articles, runs overnight in batches at Anthropic; batches never contain your family’s data, and we delete them at Anthropic as soon as the results are stored. The tools that prepare AI summaries about your family never pass document numbers, nationality or permit details to the AI; for the family memory below, the texts are also masked first.

Letters sent to your family address can be read by Anthropic’s AI to keep your family balance (contracts and regular costs) up to date, only after the owner of the account agrees to it in the app, and you can stop it there at any time. Before a letter is sent, our software removes contract, policy, account, card and customer numbers, document numbers, IBANs, AHV numbers, phone numbers, email and postal addresses, birth dates and the names of your family. If the owner also agrees to it for attachments, the text of PDF attachments is read the same way: the file itself is never sent, only a few lines (the top of the first page and the lines around amounts, dates and terms), masked the same way; scans and password-protected files are not read. Letters that mention health, in the letter or in an attachment, are not read by AI at all. What the AI proposes is a draft: it appears on your balance only after your PA or you confirm it.

To keep our team up to date, Anthropic’s AI writes a short internal summary of your family, at night or soon after an important event such as the start of your membership (who is in it, what matters now, your preferences, open topics, the tone you like), only for our team: you do not see it in the app, but it is part of the export of your data. Before anything is sent, our software replaces your family’s names with codes (P12), removes document, contract, account and phone numbers, IBANs, email and street addresses, and leaves out every sentence about health, work and employer, income, tax at source, pillar 3a, nationality or permits; letters to your family address, documents and the answers of the audit are not used. An answer that still mentions any of these is thrown away. You may object at any time: tell your PA, the summary is erased and not built again.

Every night the same AI also orders the open reminders and decisions of your family for your PA (which comes first today) and writes one short line why, with a suggested next step. It sees only these reminders as codes, the facts you gave us without names or sensitive details, and the summary above; never your messages, documents, health, amounts or numbers. Only our team sees it, it never sends anything to you, and a line that does not rest on your own data is thrown away. If you object to the summary, this stops too.

Our AI also proposes our team's next steps for your family (a task, a draft message, a choice of partners, a reminder) when something happens, such as a new request, a message, a reminder or a date, and also each night (we call this the autopilot). For this it reads your open reminders and dates, the facts you gave us, the summary above and your requests and messages to us, with names replaced and numbers removed as for the summary; never your documents, health details or amounts. A person on our team decides every step that reaches you or a partner, except the two short automatic messages described next. Without a person, and only where we switch it on, our software may do three things. It may act inside our team (a task, an alert to your PA, a suggested fact that has no effect until a person confirms it). It may remind a partner to answer a request we already sent without your name. And it may show or send you a short notice about decisions and dates waiting for you: fixed texts, at most once a day, never during your quiet hours, never with amounts. The AI never writes to you in the chat and never passes your data to a partner. It also chooses the order of the suggestions on your Home ("Oukla advises"); their texts are fixed and the AI writes none of them. If you object to the summary above, this stops too.

When you work with an adviser of your own through Oukla (a lawyer, an accountant, a consultant who invited you), Oukla may automatically check your correspondence with that adviser for breaches of the law (sanctions, money laundering, tax evasion, threats); our staff read it only when there is a suspicion, and every such reading is recorded in our log. The check reads one message at a time without names, addresses or numbers.

Your adviser may also send you their own invoices through your account. They are settled directly between you and the adviser: issued in their name and paid to their bank account; Oukla takes no part in the payment, and our staff do not see the amounts except when we review a suspected breach of the law as described above.

When your adviser invited you to Oukla and you order a service or a membership from us, the order is between you and Oukla: we tell your adviser only that you placed an order, never what or the amount. Once you pay a membership, your adviser receives from Oukla a share of what you pay as its introduction fee, without any of your data.

We do not take decisions about you that are based solely on automated processing and that have legal or similarly significant effects. Our AI providers process data on our instructions and may not use it to train their models.

5. Who receives your data

We find your canton from your postcode with a table built into our own software: nothing is sent to anyone for it. Source: swisstopo.

Our team members assigned to your family, bound by confidentiality. To solve a problem you report or one we found, a senior administrator may open your account as you see it, in a separate tab, read only, for at most 30 minutes; nothing is sent, changed or opened (files stay closed), every entry is recorded with its reason, and the account’s owner and co-owner see its date and reason under Account. The same may be done with a partner’s account. Partners who perform a service you ordered, limited to what that service needs. A partner sees who you are only after you agree to it for that task, and we name the partner before work starts; for some services the partner never learns your name. In an emergency you asked us to handle (an accident, a hospitalisation, a breakdown, a lost passport), we pass on at once only what the partner needs to act. Authorities, only where the law requires it.

At your request, we tell suppliers you choose (your insurer, the school, the bank and others) that they may also write to your personal assistant, and we receive their replies at your family address. Each such letter goes only after you approve it.

When a partner opens your data under your consent, each view is recorded (which partner, what, when) and shown to you under "Partner access"; the record is kept until your account is erased.

If a partner recommended us to you, it learns only that you became a member and, each month, the amount of its referral fee, under a code instead of your name. If the owner of your account agrees in the cabinet, that partner also sees your family's status: your family's name, your PA and whether anything happened in the last 30 days, never your plan, dates, tasks, amounts, documents or messages. It may use this only to keep its relationship with you, and you can stop it at any time in Family → Partner access.

Partners also see, without any family, how many requests of their profession our team received in their area in the last 7 days, only where there were at least 3 (never a name, a family, an amount or a percentage).

Our processors act on our instructions under data processing agreements:

Processor	Role	Location of data	Safeguard for transfers
Cloudflare	Hosting, database, document vault, security	EU (data at rest), global network	EU storage; DPF / standard clauses
Stripe	Payments and invoices	EU / US	DPF / standard clauses
Resend	Transactional email (sign-in links, notifications)	EU (Ireland region) / US	Standard clauses
Identity check provider (to be named before it is used)	Confirms who you are (a document and a selfie), only when you ask for it to sign a power of attorney here or to get back into your account; under its contract it deletes the photos right after the check	EU or Switzerland	Data processing agreement
Qualified e-signature provider (to be named before it is used)	A qualified electronic signature of a power of attorney, only if you choose it	Switzerland / EU	Data processing agreement
Telegram	Notifications and messages, only if you connect the bot (no details in notifications; the text of the team’s replies only if you turn that on). Notifications to our team, in our team’s own group (an office chat only our staff are in), about new enquiries, waiting lists, audits, tasks and partners carry the contact data of the person: name, email, phone if given, country and city, language, device and where the visit came from, and what was asked: the full text of the request or of what was said in «Just say it», the free audit’s answers and figures, a partner’s profession, company, cities, languages, description and order; they stay in that chat; Telegram is a third-party service outside Switzerland and the EU	UAE / global	You choose it; to be confirmed
Apple, Google, Mozilla, Microsoft push services	Delivery of app notifications to your device, only if you allow them (encrypted, no details)	US / global	DPF / standard clauses; to be confirmed
Google (Workspace)	Our team's email and calendar	EU / US	DPF / standard clauses
Google (Analytics, Ads)	Website measurement, only with consent	EU / US	DPF / standard clauses
Meta	Advertising measurement, only with consent	EU / US	DPF / standard clauses
Anthropic	AI assistance for our team (see section 4)	US	DPF / standard clauses
Cloudflare Workers AI	Transcription of voice requests in the family account (section 4). The audio is processed in memory and deleted right after transcription; only the text is kept	EU / Cloudflare global network	DPF / standard clauses
Cloudflare Turnstile	Check against bots on our public forms (contact, partners, careers, waiting list, reminders, orders, joining) and on the email step of the free audit: your browser exchanges technical signals with Cloudflare; no advertising cookies. To limit forms per hour we keep only a salted hash of your connection address, for one hour	Global network	DPF / standard clauses
Unsplash	Photos in journal articles, shown directly from Unsplash servers: when you open an article with a photo, your browser sends your IP address and browser data to Unsplash. No cookies, no account	US / global network	Standard clauses (to be confirmed)

6. Transfers abroad

Our database and document vault are stored in the European Union. Where a processor accesses data from another country, we rely on an adequacy decision of the Swiss Federal Council or the European Commission (for the United States: companies certified under the Swiss-US or EU-US Data Privacy Framework) or on standard contractual clauses recognised in Switzerland and the EU. You can ask us for a copy of the safeguards.

7. How long we keep it

Data	Kept for
Membership, invoices, service record	Duration of the membership plus 10 years (bookkeeping and legal claims)
Vault documents	Until you delete them, and at the latest 3 months after the membership ends
Messages	Duration of the membership plus 2 years
Family facts	Until you delete them, and at the latest 2 years after the membership ends
Family memory (the team’s summary of your family, current and previous version)	While your membership is active (deleted when it is paused or ends, or when your family’s data is erased), or until you object
The AI's daily order of your open reminders (team only)	30 days; the team's ratings of it (codes only) 24 months; deleted with your family's data or on objection
The autopilot's proposals to our team and their drafts	30 days for the text; the decisions on them (codes only) 24 months; deleted with your family's data or on objection
Enquiries that did not lead to a membership	24 months after the last contact
Answers of the free family audit (people, home, facts) if you do not become a member	90 days after your last activity, or at once when you erase them; your email stays with enquiries
Partner and job applications	12 months, unless a relationship follows
Access and security logs	12 months
IP address of a website visit or enquiry	90 days
Identity checks	Until your family's data is erased (the fingerprint and the encrypted name go with it; the provider deletes its session too)
Powers of attorney	The record (text, dates, for whom) for the duration of the membership, its PDF and signed page in your vault until you delete them; after an erasure a revoked or ended one keeps only its dates and the fingerprint of its text
Activity history (what was done and when, never the content)	24 months (document views: 12 months)
AI cost log: which AI task ran for your family, when, how many tokens and at what cost, never the text	90 days; monthly totals for the duration of the membership
Analytics data (with consent)	14 months

8. Security

Documents are encrypted in transit and at rest. Staff sign in with two-factor authentication; members use two-factor authentication to open the vault. Access is limited to the people assigned to your family, and every document view or upload is logged and visible in your account. We review access regularly, train our team, and test our systems before each release.

If a breach is likely to result in a high risk for you, we notify the Swiss Federal Data Protection and Information Commissioner (FDPIC) as soon as possible and, where the GDPR applies, the competent authority within 72 hours, and we inform you when the law requires it or when it helps you protect yourself.

9. Cookies and similar technologies

Necessary cookies are always on. Analytics and advertising are off until you switch them on in the banner or in Cookie settings at the bottom of every page. You can change your choice at any time.

Name	Purpose	Type	Duration
po_session	Keeps you signed in	Necessary	30 days
po_consent	Remembers your cookie choice	Necessary	6 months
po-theme (local storage)	Remembers day or night mode	Necessary	Until you clear it
po_src	Remembers which campaign brought you, to attribute an enquiry	Necessary for the enquiry record	90 days
po_intent	Remembers the goal a link named (for example a move), to preselect it when you start	Necessary for the start of your path	30 days
po_ref	Remembers the partner whose link brought you, to credit the recommendation	Necessary for the referral record	90 days
po_aid	Anonymous visitor id for our own measurement	Analytics, with consent	12 months
_ga, _ga_*	Google Analytics 4 (IP addresses are not stored)	Analytics, with consent	Up to 2 years
_gcl_*, _fbp	Google Ads and Meta conversion measurement	Advertising, with consent	Up to 90 days

10. Your rights

You can ask for information about your data, a copy in a portable format, correction, deletion, restriction, and you can object to processing based on legitimate interest or to direct marketing. You can withdraw any consent at any time, without affecting what was done before. Most of this you can do yourself in your account; otherwise write to privacy@oukla.app. We may ask you to confirm your identity.

You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, if you live in the EU or EEA, to the data protection authority of your country.

11. Children

Our services are for adults. We process data about children only when a parent or guardian gives it to us for a task, for example school enrolment, and only for that task.

12. Changes

We publish every change here with a new version number. If a change matters to members, we tell you by email before it takes effect.