Privacy Policy

Last updated: October 12, 2026

This policy explains how Oakview IT LLC, doing business as OpenWake AI ("Openwake", "we", "us") handles personal data. Openwake helps organizations understand and govern how artificial intelligence tools are used on the devices and in the browsers they manage.

It covers three situations, because our role is different in each:

1. You visit our website or contact us. We decide how that data is used, so we are the controller.
2. You have an Openwake account, for example as an owner or administrator for your organization. We are the

controller of your account and billing data.

1. Your employer or another organization uses Openwake on a device or browser you use. That organization decides

what is observed and why. It is the controller, and we process the data on its behalf under a Data Processing Addendum. Section 3 explains what this means for you.

1. Website visitors and people who contact us

What we collect. Our web servers keep standard request logs, which include IP address, time, the page requested and browser user agent, for security and troubleshooting. To count visits to our public pages we use a first-party measure that does not use cookies or third-party scripts and does not store your IP address: a keyed hash that changes every day is computed from the IP address and user agent, and only that hash is kept, together with a second hash whose key changes every month, so that we can count how many visitors return within a month and nothing more; neither can be reversed. Beside those hashes we keep the page you arrived on, the site that linked you to us (its domain only, or the campaign tag carried in the link), the number of pages you opened that day, how long you stayed, and an approximate location (country, region and city) read from the IP address at the time by a database on our own server; the address itself is not kept with it. Separately, and for 30 days, we keep the address, time and path of requests that probe for files or pages we do not publish, such as configuration files or administration panels: those are reconnaissance by scanners, not visits. If you write to us or use the contact form, we receive your name, email address and message.

Cookies. Our public website sets no cookies. The signed-in portal uses only the cookies needed to keep you signed in and to remember which organization you are viewing. We do not use advertising or analytics cookies.

Why we use it. To run and secure the website, understand in aggregate how it is used, and answer you. Where the GDPR or UK GDPR applies, we rely on our legitimate interests in operating and securing our service and in responding to inquiries.

2. Account holders

What we collect. Your work email address, your name if you give it, your organization's name, your role in the account, sign-in records, and security settings such as whether an authenticator app is enrolled. We do not set or store passwords: you sign in with a one-time code sent to your email and, if you add one, an authenticator app, or, where your organization has set it up, through its identity provider. Email addresses are encrypted at the application level in our database. If your organization buys a paid plan, our payment processor Stripe collects the payment method and billing address; we receive billing contact details, the plan and payment status, and never the full card number. The sign-in form may be protected by Cloudflare Turnstile, which checks that the request comes from a browser and, for that purpose, processes your IP address and browser characteristics; Cloudflare does not receive your email address from us.

We also keep records of actions taken in the account, such as invitations, policy changes and any reveal of retained evidence, because an audit trail is part of the service.

Why we use it. To create and secure your account, provide the service, bill for it, send service messages such as sign-in codes, alerts you have configured and notices about the service, and meet legal obligations. Where the GDPR or UK GDPR applies, we rely on performance of our contract with your organization, our legitimate interests in securing and improving the service, and legal obligations for tax and accounting records.

We do not send marketing email without your consent, and every such message will include a way to stop.

3. If your organization uses Openwake on your device or browser

Organizations deploy Openwake to see which AI tools are in use and to protect company data and credentials. When your organization installs Openwake software on a device or browser you use, it is the controller of the data that software reports. It chooses what is observed, whether any content is retained and whether anything is warned on or blocked, and it is responsible for telling you about this. Please read your organization's own notice or policy, and send questions or requests about your data to your organization first. If you write to us, we will pass your request to the organization concerned and help it respond.

So that you know what the service can do, depending on how your organization has configured it, Openwake may record:

• the device: its name, operating system, hardware and security settings, and the account signed in to it;
• the AI tools, coding agents and related tool servers installed or running on the device, and the internet

services those programs connect to;

• for coding agents such as Claude Code and Codex: that a prompt or tool call happened, the kind of data

detected in it, and the service it went to;

• for an enrolled browser: visits to AI websites and other software providers, by domain only and never the page

address, title or contents. Your organization can choose to include all websites, again by domain only. On AI websites, the kind of account in use (personal or company) and the kind of data detected in what is pasted into, attached to or submitted from the prompt box, such as a credential, contact details or source code. A large paste, or one that contains something like a credential, is recorded when it happens, whether or not it is then sent. For attached files, the name, type and size are recorded, never the contents;

• whether a warning was shown or a submission was blocked, and what happened next.

The kind of data is worked out on your device. By default Openwake keeps these labels and not what you wrote. It does not log keystrokes and does not take screenshots: nothing is read while you type, only what you paste, attach or submit on an AI website. If an owner of your organization's account turns on the Evidence Vault, excerpts or full copies of what was pasted or submitted can be retained, either when it matches the organization's policy or for all monitored activity on AI websites, as the organization chooses. That content is encrypted before it is stored, only people your organization has authorized can reveal it, and each reveal is recorded with who did it and why.

4. The Provider Registry

We maintain a public record of what AI and software providers state in their own public documents. It is built from published company documents and is not about individuals. If a representative of a provider contacts us to claim a profile or request a correction, we keep their name, work email address and the request, and we may publish the request and its resolution without personal details. See our corrections policy at openwake.ai/legal/corrections.

5. Who we share data with

We do not sell personal data, and we do not share it for advertising. We share it only with:

• service providers that host the service, send email and process payments for us, under contracts that limit

what they may do with it. The providers that process customer data are listed at openwake.ai/legal/subprocessors;

• your organization, which can see the data the service holds for its account;
• authorities, when the law requires it. Where we are allowed to, we will tell the organization concerned first;
• a successor, if Openwake is involved in a merger, acquisition or sale of assets, under commitments consistent

with this policy.

No AI provider receives customer data from us under our current configuration. If that changes, the subprocessor page will say so before it does.

6. Where data is processed

Openwake is operated from the United States, and the service is hosted in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States. For data we process on behalf of customers, that transfer is covered by the standard contractual clauses in our Data Processing Addendum.

7. How long we keep data

• Account data: for as long as the account is open, and deleted within 30 days after the account is closed, except

records we must keep for tax, accounting or legal reasons.

• Data reported by the sensors, in three kinds that are kept apart:
• Raw events (a submission, a connection, a tool call, with its labels) are kept for 90 days on the Free plan and

365 days on the Team and Business plans, then reduced to daily counts. An event that a detection cites is kept while the detection is open and for 12 months after it is resolved, and while a retained excerpt refers to it.

• Retained content (a redacted excerpt or, where the organization has chosen it, an exact submission) is kept for

the period the organization sets, at most one year, and is deleted when that period ends whatever the event window.

• Records of decisions (detections and their reviews, policies and their versions, the audit trail of who changed

what and who opened retained content) are kept for as long as the account is open.

• Web server logs: for a limited period needed for security and troubleshooting.
• Backups: copies age out on a rolling schedule.

8. Security

We protect data with encryption in transit, disk encryption at our hosting provider, application-level encryption of the most sensitive fields, access limited to the people who need it, and audit trails. No system is perfectly secure. If you believe you have found a vulnerability, write to security@openwake.ai.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the use of your personal data, to receive a copy of it, and to withdraw consent. If we process your data on behalf of an organization (section 3), please contact that organization. Otherwise write to privacy@openwake.ai. We will not treat you differently for using your rights. You may also complain to your data protection authority.

United States state privacy laws. We do not sell personal information and do not share it for cross-context behavioral advertising. For data we process on behalf of organizations we act as a service provider or processor.

10. Children

The service is for organizations and is not directed to children. We do not knowingly collect personal data from anyone under 16.

11. Changes

We will post changes to this policy here and change the date above. If a change is significant, we will tell account owners by email or in the portal.

Contact

Privacy questions and requests: privacy@openwake.ai Oakview IT LLC, doing business as OpenWake AI, Buffalo, New York, United States. Notices by email to privacy@openwake.ai; a postal address for service of process is provided on request.