Customer privacy notice
How Oak handles information
This notice explains the personal and business information processed when a customer creates and uses an Oak AI CFO workspace.
Information we process
Oak processes account details such as names, business email addresses, authentication records and workspace roles; business profile details; financial files and accounting records a customer chooses to import; questions, conversations, reports and actions created in the service; billing identifiers and subscription status; and security, device, usage and diagnostic records. Stripe processes card details on its hosted payment pages, and Oak does not receive full payment-card numbers.
Why we use it
We use information to provide and secure the contracted service, isolate each company workspace, import financial evidence, generate requested analysis, operate subscriptions, support customers, prevent abuse, investigate failures and meet legal obligations. Our usual lawful bases are performance of a contract, legitimate interests in operating and protecting the service, and compliance with legal obligations. We use consent where the law requires it.
AI processing and automated output
When a customer asks Oak a question, relevant authorised company evidence and conversation context may be sent to the configured AI service to produce the response. Oak’s output supports human decision-making; it does not make a decision that produces legal or similarly significant effects by itself. Customers remain responsible for reviewing recommendations and deciding whether to act.
Service providers and international processing
We use specialist providers for hosting, databases and authentication, AI processing, payment processing, transactional email and—when a customer authorises it—accounting-data connections. Current core providers include Vercel, Supabase, Anthropic, Stripe and Resend. Information may be processed outside the United Kingdom. Where required, we rely on recognised transfer mechanisms and contractual safeguards.
Retention and deletion
Workspace information is retained while the account is active and for limited periods afterwards where required for security, billing, dispute resolution or legal compliance. Oak removes completed operational records according to its retention schedule and provides authenticated account export and deletion controls. Some records may be retained where deletion would conflict with a legal obligation or the rights of another party.
Security and access
Oak uses authenticated company workspaces, role-based access, database row-level security, encryption in transit, server-only credentials, rate limits and audit records. Customers must protect login credentials, enable multi-factor authentication where appropriate and upload only information they are authorised to use.
Cookies and browser storage
Oak uses only what the service needs to work. Sign-in session cookies keep you securely signed in, and your browser’s local storage remembers display and voice preferences and whether you have completed the welcome guide. Oak does not use advertising, analytics or tracking cookies, so no consent banner is shown. Payment pages are hosted by Stripe, which sets its own cookies under its privacy policy.
Your rights
Depending on the circumstances, individuals may have rights to access, correct, erase, restrict or object to processing, receive portable information, withdraw consent and complain to the UK Information Commissioner’s Office. Requests must be verified so that financial and account information is not disclosed to the wrong person.
Contact
Questions about this document or the Oak service can be sent to info@oakmontkingsley.com.