How Oak handles information

Information we process

Oak processes account details such as names, business email addresses, authentication records and workspace roles; business profile details; financial files and accounting records a customer chooses to import; questions, conversations, reports and actions created in the service; lasting facts you tell Oak’s AI agents in chat, which they remember for your workspace until you delete them in Settings, and the check-ins they schedule at your request; if you turn on phone alerts, the push address your browser gives Oak for that device, until you turn them off; billing identifiers and subscription status; and security, device, usage and diagnostic records. Stripe processes card details on its hosted payment pages, and Oak does not receive full payment-card numbers.

Why we use it

We use information to provide and secure the contracted service, isolate each company workspace, import financial evidence, generate requested analysis, operate subscriptions, support customers, prevent abuse, investigate failures and meet legal obligations. Our usual lawful bases are performance of a contract, legitimate interests in operating and protecting the service, and compliance with legal obligations. We use consent where the law requires it.

AI processing and automated output

When a customer asks Oak a question, relevant authorised company evidence and conversation context may be sent to the configured AI service to produce the response. Oak’s AI agents also work when nobody is signed in: when an automation spots something in the books, or a check-in you asked for falls due, they run on the same evidence with the same safeguards, and post what they find in your workspace and by email. Oak’s output supports human decision-making; it does not make a decision that produces legal or similarly significant effects by itself. Customers remain responsible for reviewing recommendations and deciding whether to act.

Connected email accounts (Gmail and Outlook)

A customer can choose to connect a Google or Microsoft email account so that Oak can send messages on their behalf, such as invoice reminders and summaries. Oak asks only for permission to send email and to read the connected account’s email address. Oak does not read, search, store or delete the messages in your inbox. Oak sends only messages you write, approve, or have switched on to send automatically, and each message is recorded in your workspace. Access tokens are stored encrypted, are used only to send those messages, and are deleted when you disconnect the inbox in Oak or delete your account. You can also remove Oak’s access at any time from your Google or Microsoft account settings.

Oak’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never used for advertising, and never used to develop, improve or train artificial intelligence or machine-learning models. Oak staff do not read it unless you ask us to for support, it is needed for security, or the law requires it.

Service providers and international processing

We use specialist providers for hosting, databases and authentication, AI processing, payment processing, transactional email and—when a customer authorises it—accounting-data connections. Current core providers include Vercel, Supabase, Anthropic, Stripe and Resend. If spoken answers with premium voices are switched on, the text of each answer being read aloud is sent to ElevenLabs to produce the audio. Information may be processed outside the United Kingdom. Where required, we rely on recognised transfer mechanisms and contractual safeguards.

Retention and deletion

Workspace information is retained while the account is active and for limited periods afterwards where required for security, billing, dispute resolution or legal compliance. Oak removes completed operational records according to its retention schedule and provides authenticated account export and deletion controls. Some records may be retained where deletion would conflict with a legal obligation or the rights of another party.

Security and access

Oak uses authenticated company workspaces, role-based access, database row-level security, encryption in transit, server-only credentials, rate limits and audit records. Customers must protect login credentials, enable multi-factor authentication where appropriate and upload only information they are authorised to use.

Cookies and browser storage

Oak uses only what the service needs to work. Sign-in session cookies keep you securely signed in, and your browser’s local storage remembers display and voice preferences and whether you have completed the welcome guide. Oak does not use advertising, analytics or tracking cookies, so no consent banner is shown. Payment pages are hosted by Stripe, which sets its own cookies under its privacy policy.

Your rights

Depending on the circumstances, individuals may have rights to access, correct, erase, restrict or object to processing, receive portable information, withdraw consent and complain to the UK Information Commissioner’s Office. Requests must be verified so that financial and account information is not disclosed to the wrong person.

Contact

Questions about this document or the Oak service can be sent to info@oakmontkingsley.com.