Security and privacy

1. Our commitment

At Oquarto we treat the data of our users and of the customers of our professional tools with the utmost care. This page summarizes, transparently and verifiably, how we protect information: which security measures the platform applies, where the data resides, which providers we work with and how we comply with European data protection regulations.

For any privacy or security inquiry, you can write to us at privacy@oquarto.com.

2. Platform security

• Two-factor authentication (TOTP): all accounts can enable a second authentication factor based on time-based codes (apps such as Google Authenticator or 1Password) from their profile.
• Data isolation by user and team: the database applies Row Level Security, so that each query can only access the data of the authenticated user or team. Policies are reinforced for sessions that have verified the second factor.
• Integration credentials encrypted at rest: access tokens for third-party integrations (email, WhatsApp, Google) are stored encrypted in the database.
• Encryption in transit and at rest: all communications take place over TLS and all our infrastructure providers encrypt data at rest.

3. Data residency in the European Union

• Database and primary storage: our Supabase project (database, authentication and files) is hosted in a European Union region.
• Knowledge base documents: they are stored in Cloudflare R2 with European Union data jurisdiction.
• Auxiliary servers: hosted with an ISO 27001 certified European provider, in data centers in Germany and Finland.
• Artificial intelligence providers: processing takes place in the US under Standard Contractual Clauses (SCC) and, where the provider is certified, under the EU-US Data Privacy Framework.

4. Subprocessors and providers

We work with recognized infrastructure and service providers. The certifications listed belong to the providers themselves and can be verified on their official security and compliance pages, linked below.

The full categories of subprocessors, with their roles and the applicable international transfer mechanisms, are available in our Privacy Policy. The detailed named list is provided to customers under the data processing agreement (DPA) and can be requested at privacy@oquarto.com.

5. Responsible AI

• The phone assistant always identifies itself as a virtual assistant at the start of the call.
• Agencies can enable an AI assistant notice on the text messages sent by their AI workers.
• The actions of AI workers are logged and can be supervised by people from the platform.
• No automated decisions are made that produce legal effects concerning people or that similarly significantly affect them.
• The AI providers we work with do not use the data sent through their APIs to train their models, in accordance with their enterprise terms.

6. Regulatory compliance

• We comply with the General Data Protection Regulation (GDPR) and Organic Law 3/2018 (LOPDGDD).
• We internally maintain a record of processing activities.
• Exercising your rights: you can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacy@oquarto.com. We respond within a maximum of one month.
• Breach notification: we have a procedure to notify the Spanish Data Protection Agency (AEPD), within 72 hours, of security breaches that pose a risk to people’s rights, and to inform those affected when the risk is high.
• DPA for CRM customers: the data processing agreement is included as Annex I to our Terms and Conditions.

7. Cookies

Our cookie banner lets you reject non-essential cookies in the first layer, as easily as accepting them. Consent can be withdrawn at any time from the link available in the footer. More information in the Cookie Policy.

If you detect a security vulnerability or have any question about this page, write to us at privacy@oquarto.com.