Privacy Policy

Who we are

Optakt Labs OÜ (registry code 16248104, VAT EE102380068, Viru väljak 2, 10111 Tallinn, Estonia) builds AI agents and deploys them in companies. For the personal data described here, we are the controller, except where we work with your company’s data on your behalf (see below). You can reach us at max@optakt.io.

What this policy covers

This website, optakt.io, and our consulting work: talking with you, discovery, and deploying an AI agent in your company. The Optakt One software itself is covered by its own policy at optakt.ai/privacy ↗ (opens in a new window).

This website

The site has no forms. Our hosting provider, Vercel, processes the technical data every web request carries (such as your IP address and browser) to deliver the page and protect it from abuse. We use the country of your request only to show prices in euros or dollars; we do not store it.

We count visits with Vercel Web Analytics, for every visitor. It sets no cookies and keeps no identifier beyond a hash that expires within a day, so it cannot follow you across sites or visits.

We also use Google Analytics, to see how people find and read the site, and Google Ads, to measure whether our ads lead to visits and to requests for a call. Google sets cookies (such as _ga and _gcl) and receives your IP address, your browser and device, the pages you visit and those clicks. We send those clicks to Google from our own server as well, so they are counted when a browser blocks Google’s script. Where the law requires your consent first, as in the European Economic Area, the United Kingdom and Switzerland, none of this loads and nothing is sent to Google until you accept. Elsewhere it runs unless you opt out. If your browser sends a Global Privacy Control signal, Google still counts our ad results, but in its restricted data processing mode: the data is used only to measure our campaigns, never to personalise ads. Once measurement runs, our server re-issues Google’s cookies on our own domain so they last their normal lifetime (up to 13 months) rather than the few days some browsers allow. You can change your choice at any time under Cookie settings at the bottom of every page.

When we talk and work together

Meta Pixel and Conversions API measure visits and contact clicks from our Facebook and Instagram ads. Where prior consent is required, neither runs before you accept. Elsewhere you can opt out under Cookie settings. Meta receives the page address, browser information, IP address, advertising cookies (_fbp and _fbc) and a shared event identifier that prevents browser and server reports counting the same contact twice. Global Privacy Control enables Meta Limited Data Use. Meta Platforms is a recipient of this measurement data.

LinkedIn Insight Tag measures visits and contact clicks from our LinkedIn ads. LinkedIn receives technical browser and page information and may set advertising identifiers, including the first-party li_fat_id cookie. The tag follows the same consent choice and stays off when you decline or send Global Privacy Control. LinkedIn is a recipient of this measurement data.

The X website pixel and Conversion API measure visits and contact clicks from our X ads. X receives the page address, IP address, browser information, X click identifiers where available and a conversion identifier. The browser pixel and server reports follow the same advertising consent choice and stay off when you decline. Global Privacy Control enables X's Restricted Data Use for measurement without advertising optimisation. X is a recipient of this measurement data.

When you write to us, meet us or work with us, we process:

• Your name, contact details, company and role
• What you tell us in emails, messages and calls
• Proposals, agreements, invoices and payment details

We run our own company with our own AI agent. It reads our correspondence and meeting notes so it can keep track of what we agreed and prepare our work. To do that, it sends the relevant text to the AI model providers we use, such as Anthropic and OpenAI, which process it under their business terms.

Recorded calls

Our AI assistant, Zero, may join video calls to record and transcribe them for us. It joins under its own name and introduces itself when it does. If you would rather not be recorded, say so, before or during the call: we will take it out of the call and delete what it recorded.

Recordings and transcripts help us remember what was said and do the work we agreed. They are made through Recall.ai and transcribed by ElevenLabs; Recall.ai deletes its copy after seven days. We keep ours in our own Google Workspace and Notion, for as long as our work together needs them, and delete them sooner if you ask.

When we deploy at your company

The agent we deploy runs on your infrastructure, and the data it works with stays there. To build and tune it, we use the access you grant us, for the duration of the engagement.

For the personal data in your systems, your company is the controller and we act as its processor (GDPR Art. 28): only on your instructions, under the data processing terms in our agreement, and bound to confidentiality. We do not copy your data to our own systems beyond what the work needs. When the engagement ends, we hand back or remove our access and delete anything we still hold, unless you ask us to keep it or the law requires us to.

Why, and on what basis

• Preparing and carrying out an engagement, and invoicing it: to take steps toward and perform a contract (GDPR Art. 6(1)(b))
• Answering you, keeping track of our conversations, recording calls, and protecting our website: our legitimate interest in running our business (Art. 6(1)(f))
• Visit counting with Vercel Web Analytics, and Google Analytics and Ads where no consent is required: our legitimate interest in understanding and growing our audience (Art. 6(1)(f)), which you can object to under Cookie settings
• Google Analytics and Ads where the law requires consent: your consent (Art. 6(1)(a)), which you can withdraw at any time under Cookie settings
• Keeping accounting records: our legal obligation (Art. 6(1)(c))

How long we keep it

Correspondence and notes for as long as we are in touch, and up to two years after our last contact. Agreements and invoices for as long as Estonian accounting law requires, currently seven years. Call recordings as described above. Analytics data for 14 months, after which Google deletes it; Google’s cookies expire after at most two years, and your cookie choice stays in your browser until you clear it.

Who else processes it

We share data only with the providers who help us work: Vercel (website hosting and visit counting), Proton (email), Google Workspace (calendar and documents), Notion (notes), Recall.ai and ElevenLabs (call recording and transcription), our AI model providers, our accountants, and, on this website, Google (Analytics and Ads, as described above). Some are based in the United States; transfers rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. We do not sell data, and we share none with data brokers.

Your rights

You can ask us for access to your data, a copy in a portable format, correction, deletion or restriction, and you can object to processing based on our legitimate interest. Write to max@optakt.io; we answer within 30 days. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority where you live.

Changes

When this policy changes, the date at the top changes with it. If a change matters for how we use the data of a client, we tell that client before it takes effect.