Privacy statement

Who we are

Woodst B.V., Carolieweg 22, 9354 TM Zevenhuizen, the Netherlands, Chamber of Commerce (KvK) number 83100172. For anything about your data, email support@okayiris.com.

Who else sees your data

The companies that handle personal data for Iris are in one list here, and we tell you by email before we add one that touches your data in a new way.

Hetzner Online GmbH (Germany): the servers your assistant, her memory and her files live on, and this website.

OpenRouter (United States): the gate that sends your text to an AI model and brings the answer back.

The model providers behind that gate: for the chat on this website Anthropic (United States), and for your assistant the model we use at the time, currently DeepSeek (China). They read what is sent and write the answer.

Vultr (United States and the Netherlands): the machines that run models for the parts that need one.

Apple (United States): push notifications, and turning your voice into text on your own iPhone or Mac. Apple's own terms and privacy statement cover that part.

neopay (the Netherlands, with Stripe underneath): payments. We never see or store your card number.

Umami (we run it ourselves, in Germany): visit counts, without cookies.

No advertising network is in this list, and there is none we would add: we do not sell or rent your data, and we do not hand it to anyone for their own use.

Your assistant and the Iris apps

Your assistant runs in its own space on our servers at Hetzner in Germany. It keeps your conversations, notes, files and memory there, so it can help you later. Nothing is shared with other customers.

To write an answer, what you say, type or show your assistant is sent to AI models of other companies: OpenRouter (currently the DeepSeek model) and Vultr Inference. They process it only to produce that answer, and may do so outside the European Union. The apps ask for your permission before the first conversation; if you don't agree, the app disconnects.

Speech: on iPhone and Mac your voice is turned into text on your device by Apple's speech recognition. Her voice is made on our own servers. The apps use the camera, microphone, screen and location only when you allow it in your device settings, and send what they capture only to your own assistant. Notifications go through Apple's push service; their content is fetched from your assistant, not sent through Apple.

Sign-in and account emails are sent by Maillog, our own email platform. Payments for a plan are handled by Stripe; we never see your full card number.

We keep your assistant's data until you delete your account. You can do that in the app under Settings, "Delete account", or by emailing support@okayiris.com. It removes your assistant, your conversations and everything stored for it.

The waitlist

When you join the waitlist, we store your email address and the language of the page. We use them only to send your invite and a few messages about the launch of Iris. The legal basis is your consent. We keep your address until Iris launches for you or until you ask us to remove it, whichever comes first. Reply to any of our messages or email us, and we remove you.

The chat with Iris

What you type in the chat is sent to an AI model to write the answer. We reach the model through OpenRouter; the model provider behind it (Anthropic) processes the text only for that purpose, and may do so outside the European Union. We store the conversation under a random id, without your name or IP address, for at most 12 months, and a short summary goes to the Iris team so we can follow up on questions. The legal basis is our legitimate interest in answering you. Please do not type sensitive personal information in the chat. If you ask for a call, we also store the name, email address and time you give us.

How long we keep it

Your assistant's conversations, memory, notes and files stay as long as your account exists, because that is what makes her yours. You can delete any of it in the assistant whenever you want.

A conversation you have with the chat on this website: at most 12 months, under a random id, and the team also keeps the short summary it reads.

The waitlist: until Iris opens for you, or until you ask us to remove you.

A deleted account: out of the running system at once, and out of our last backup within 30 days.

Visit counts in Umami: totals only, without addresses. The visitor id used for the funnel lasts a year, the session id half an hour of quiet, and the campaign you arrived with ninety days.

The hour of memory that stops abuse on our web server: an hour, in memory, then nothing.

Invoices and payment records: seven years, because Dutch tax law asks for that.

Outside Europe

Our servers are in Germany, and so is everything we run ourselves. Part of the work cannot happen there: the AI models that write answers sit at companies in the United States and in China, and Apple's push service is in the United States. That is why the apps ask your permission before the first conversation.

When your text goes abroad, it travels under the European rules for that (the standard contractual clauses, with a written assessment of what the country does with data), and the company that receives it may use it for that one answer only: not to train models, not to advertise, not to profile you.

If you would rather nothing leaves Europe, say no when the app asks, or ask us at support@okayiris.com which parts of Iris work without it and we will tell you honestly what you lose.

Statistics

We count visits with Umami, which we run ourselves. It uses no cookies and stores no IP addresses or anything else that identifies you. We only see totals, such as visitors per page, country and language. If you choose Decline in the notice at the bottom of the page, your browser tells Umami not to count your visits at all.

If you accept, we also count visits in our own store, so we can see which campaign brought somebody and whether that same person came back later. That uses three first-party cookies of ours: a visitor id (a random number, no name or address attached, kept for a year), a session id (expires after half an hour of quiet on the site) and the campaign or ad you arrived with (kept for ninety days). That id stays on our own server, is never shared with a third party, is not used to follow you on other sites, and no advertising network sees it. Choose Decline, or have Do Not Track on in your browser, and none of this is stored.

Your browser

The language suggestion and your answer to the statistics notice are kept in your browser and are never sent to us. If you accepted statistics, three cookies of ours are set for the funnel (the visitor id, the session id and the campaign you arrived with); if you declined, or your browser says Do Not Track, no cookie is set at all. Fonts and images come from our own server, and nothing is loaded from third parties.

Hosting

The site, the waitlist and the chat run on our own server at Hetzner in Germany. The web server keeps no access logs. To stop abuse, the server remembers for one hour how often an address asked something, in memory only.

How we keep it safe

Your assistant has her own space, sealed off from other customers and from our own tools. What travels between your device and our server is encrypted, and so is what we store, and only your sign-in opens your space. Our staff work with the systems, not inside your conversations; if we need to look at something to help you, we ask you first, and it shows in your assistant's log.

If a leak ever touches your data, we tell you without delay, in plain words, and where the law asks for it we tell the Dutch Data Protection Authority within 72 hours.

Found a weakness in Iris, our apps or this site? Email support@okayiris.com. Good-faith research that does not touch other people's data, does not take anything out and gives us time to fix it will never get you in trouble with us.

Your rights

You can ask which data we hold about you, and have it corrected, deleted or sent to you. You can object to how we use it and withdraw your consent at any time. Email support@okayiris.com and we answer within a month. If you are not satisfied, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.