Your data: the minimum, for the minimum time, for a single purpose.
This page explains, without legalese, what this site collects, why, who it passes through, and for how long. It covers okamiops.com and the site's forms. The products have their own policy, and it fits in one sentence: the data stays on your device.
- Cookies0no cookies, no banner
- Trackers0no analytics, no pixel, no third-party script
- Legal basisLGPD + GDPRBrazil and the European Union
- Response to requests15calendar days, the LGPD deadline
Five data sources. None of them invisible to you.
Everything that reaches us goes through a form you filled in or an email you sent. The exception is edge logs, which exist to keep the site running and disappear on their own.
| Data | What for | Kept for | |
|---|---|---|---|
| Contact form | Name, email, company and the message you wrote | Reply to the request and prepare the discovery call | While the conversation lasts; 24 months after the last contact |
| SecOps Baseline | Name, email, company, role and CI/CD stack | Send the material and, if you want, talk about the pipeline | 24 months, or until you ask us to delete it |
| Okami Mentor waitlist | Name, email and the module you're interested in | Notify you when the cohort opens | Until the cohort opens, or until you leave the waitlist |
| Edge logs | IP, user agent, URL, status and request time | Security, abuse blocking and error diagnosis | Days, at the edge provider; we don't export it for audience analysis |
| Direct email | What you write to contato@ or security@ | Reply; in a disclosure, coordinate the fix | While the matter is open; security reports, 5 years |
- okami.lang
- Your language preference (pt, en or de), in localStorage. It never leaves the device and identifies no one.
- contact draft
- When an AI agent pre-fills the form, the draft sits in sessionStorage and is cleared as soon as the page reads it.
- cookies
- None. That's why there's no consent banner: there's nothing to consent to.
- We don't use Google Analytics, Meta Pixel, Hotjar or any audience-measurement script.
- We don't sell, rent or trade contact data with anyone.
- We don't put you on an automatic email cadence for downloading a resource.
- We don't make automated decisions or build profiles from the site's data.
- We don't collect data from minors: the site is aimed at businesses.
Who controls it, under what basis, and through whose hands the data passes.
The controller is OKAMIOPS, CNPJ 66.637.891/0001-08, operating in Brazil and Germany. For data subjects in the European Union, the GDPR applies in parallel with the LGPD. The data protection officer replies at contato@okamiops.com.
Request from the data subject
When you fill in a form or write to us, we process the data to do what you asked: reply, send the material, notify you about the cohort.
Legitimate interest
Edge logs and abuse blocking exist to keep the site secure and available. It's the minimum interest of any operation, and it builds no profile of anyone.
Legal obligation
We keep what tax and contract law requires once a contact becomes a client. At that point the contract sets retention, and it overrides this page.
Cloudflare: serves the site, logs access and blocks abuse. Servers across the global network, including Brazil and the European Union.
USA · standard contractual clausesResend: carries the form content to our inbox. It doesn't keep the data beyond what's needed to deliver it.
USA · standard contractual clausescontato@okamiops.com and security@okamiops.com, where messages stay for the period in the table above, in a corporate account with two-factor authentication.
Brazil · GermanyData may move between Brazil, Germany and the processors above. We cover it with standard contractual clauses, LGPD art. 33 and GDPR art. 46.
no sale, no assignmentOne email is enough. No form, no account, no proof of life.
LGPD art. 18 and GDPR art. 15 to 22 give you these rights. We reply within 15 calendar days; under the GDPR, within one month. We only ask for identity confirmation when the request comes from an email different from the one on file.
Access and confirmation
Know whether we process your data and get a copy of what we hold, in a readable format.
Correction
Fix incomplete, inaccurate or outdated data. Changed companies? Tell us and we'll update it.
Erasure
Delete the data from forms and emails, except what the law requires us to keep. We confirm in writing.
Portability
Receive your data in JSON or CSV to take to another provider.
Objection and withdrawal
Leave a waitlist, ask not to be contacted, or withdraw a consent. It applies from the moment it arrives.
Information about sharing
Know which processors your data has passed through. The list is on this page and is updated when it changes.
Complaint to the authority
You can appeal to the ANPD in Brazil or to your state's data protection authority in the European Union.
No retaliation
Exercising a right doesn't change how we treat you. A deletion request doesn't close the door on a conversation later.
For the products, the policy fits in one sentence: the data stays with you.
No OkamiOps product has one of our servers in the path. They talk directly to the providers you connected, and every repository and App Store listing repeats this with the product's specifics.
Zero
No usage, no crash reports, no prompts, no code sent to OkamiOps. Whatever the app queries goes only to the provider you chose.
On your device
Tokens and keys sit in macOS or iPhone Keychain; history and memory, in local SQLite. Delete the app, delete the data.
By contract
When we operate a gateway, monitor or infrastructure for a client, data processing is defined in the contract and in a data processing agreement (DPA), which overrides this page.
What changes on this page gets logged here.
- Security
- Encrypted transport with HSTS, database-free forms, two-factor email accounts. The technical details are at /security/.
- Incidents
- If an incident affects personal data, we notify the affected data subjects and the ANPD or the competent European authority within the legal deadlines: 3 business days under the LGPD, 72 hours under the GDPR.
- Changes
- Material changes are logged here with the date. If we change the purpose of something you already sent us, we ask again.
- Version
- September 2026 · first complete version, replaces the earlier summary.
Have a question about your data? Ask.
One email to the data officer resolves access, correction, deletion and portability. Reply within 15 days, almost always well before.