.svg)
Privacy Policy - Okiros (EN)
Last updated: 28 September 2026
1. Who we are
Okiros is a service operated by LEANO, a company registered in France. Okiros provides a software agent, named Charlotte, that assists our business customers' teams in managing accounts receivable: tracking invoices, sending dunning emails, following up on payment promises, and reporting.
This policy describes how we handle the data Okiros accesses, including data from your Google Account when you choose to connect a mailbox.
In most cases Okiros acts as a processor within the meaning of Article 28 of the GDPR, on behalf of the customer company, which is the controller. A Data Processing Agreement is signed with every customer before any processing begins.
2. In short
Okiros processes only the mailboxes your organisation explicitly chooses to connect. Charlotte synchronises the exchanges associated with contacts known to your organisation, and may recognise new authenticated correspondents on certain of your customers' domains. Such recognition does not automatically authorise them to receive dunning emails. Okiros' primary infrastructure is hosted on AWS in the Paris region. Model processing may run in various AWS regions within the European Union. We do not sell any data, we do not transfer it to advertisers or data brokers, and we never use your data to train or improve an artificial intelligence model.
3. The Google data we access
3.1 Permissions requested
When you connect your mailbox, Google shows you the list of permissions requested. Okiros requests the following:
We do not request the https://mail.google.com/ scope, which would allow permanent deletion of messages. We never delete a message.
3.2 What Charlotte reads — and what it does not
What is processed: emails associated with contacts known to your organisation. Okiros reconstructs context from the synchronised messages attached to the receivable, within the limits of the available history. On connection, Okiros imports by default up to 90 days of relevant history.
What is not processed: messages that do not match the synchronisation scope, and any mailbox your organisation has not explicitly connected. Exchanges involving known contacts may be imported, in particular where they contain internal input useful to following up a receivable.
Technical detail. Some messages may be retrieved temporarily in order to verify whether they fall within scope, based on their sender and recipients. Excluded messages are not imported; their body is neither extracted for the service, nor retained, nor sent to the language model.
3.3 How access is granted and revoked
Access is granted exclusively through OAuth 2.0, a delegated authorisation. Okiros never receives, requests or stores any password for your Google Account.
You can revoke this access at any time, without going through us, at myaccount.google.com/permissions. If you use Google Workspace, your administrator can also revoke it from the admin console. Revocation withdraws Okiros' authorisation to access your mailbox. Access stops once Google refuses that authorisation.
4. What we do with this data
Data from your mailbox is used exclusively to provide the features visible in the Okiros interface:
- reconstruct and display the history of each customer account;
- detect payment promises made by your customers and track their due dates;
- draft and send dunning emails, and process the replies received;
- produce the collection metrics shown in your dashboard and reports.
No other purpose. Should we ever use this data for a new purpose, we will update this policy and ask for your consent before any new processing takes place.
5. Limited Use commitment (Google API Services User Data Policy)
Okiros' use of information received from Google APIs, including Google Workspace APIs, adheres to the Google API Services User Data Policy, including the Limited Use requirements. These commitments apply to raw data obtained from the scopes as well as to data aggregated, anonymised or derived from it.
Limited use. We limit our use of this data to providing and improving user-facing features that are visible and prominent in the Okiros interface.
No transfers. We do not transfer this data, except: to provide or improve those user-facing features, with your consent; for security purposes, such as investigating abuse; to comply with applicable law; or as part of a merger or sale of assets, after obtaining your explicit prior consent.
No human reading. No Okiros employee reads the content of your messages, except: after your affirmative agreement to view specific messages; where necessary for security purposes, such as investigating an incident or a malfunction; where required by applicable law; or where the data is aggregated and used for internal operations in accordance with applicable law.
Absolute prohibitions. We do not sell or transfer this data to third parties such as advertising platforms, data brokers or information resellers. We do not use it for advertising, including retargeting, personalised or interest-based advertising. We do not use it to determine credit-worthiness or for lending purposes.
No model training. We do not retain or use data obtained through Google Workspace APIs to create, train or improve a machine learning or artificial intelligence model, including foundation models. The model service used through AWS Bedrock does not retain your data to train or improve its models. Okiros separately retains the records necessary to operate and monitor the service; where telemetry is enabled, these exchanges may also be recorded in our observability tool.
We ensure that our employees, agents, contractors and successors comply with these same commitments.
6. Where your data is hosted
Okiros favours European hosting and processing. The location of optional services depends on their configuration.
7. Subprocessors
Your data does not transit through the model provider's own servers and is not used to train its models — this is a contractual guarantee from our hosting provider.
This list is appended to the DPA signed with each customer. Any change is notified thirty days in advance.
8. Security
Databases, backups and stored objects are encrypted at rest using AWS-managed mechanisms. Public connections to the service are protected by HTTPS. Internal exchanges between application components remain confined to its hosting environment. Each organisation's data is logically isolated through application-level access controls.
Any security incident affecting your data is notified to you within twenty-four hours, together with the exact scope concerned.
Okiros undergoes an annual security assessment by an independent Google-approved laboratory, under the App Defense Alliance's CASA programme.
9. Retention and deletion
Disconnecting a mailbox deletes the credentials for that mailbox. Information already incorporated into receivables, into conversations with Charlotte and into the service's records remains subject to its own retention rules and to the deletion procedure.
You may request an export of your data from Okiros. You may also request its deletion.
At the end of the contract, your data is retained for thirty days so that you can export it, then irreversibly deleted. Backups containing that data are purged at the end of their rotation cycle, within sixty days at the latest after the contract ends. On request, we carry out complete deletion within thirty days, in accordance with Article 17 of the GDPR.
These periods apply to your data — messages, invoices, history. They do not cover LEANO's own accounting records, in particular the invoices we issue to you, which are subject to a statutory ten-year retention obligation.
If you revoke the OAuth authorisation, Google withdraws Okiros' authorisation to access your mailbox. Data already processed remains subject to the retention rules above and can be deleted on request.
10. Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data. Where Okiros acts as a processor, such requests should first be addressed to the customer company acting as controller; we assist them in handling those requests.
For any question about this policy or your data: contact@leano.fr. To report a security issue: contact@leano.fr.
You also have the right to lodge a complaint with the French data protection authority (CNIL).
11. Changes
If we change the way Okiros uses data from your Google Account, we will update this policy and ask you to accept the new version before using your data in a new way or for a purpose different from the one originally disclosed.
