What we keep about you, why, and what you can do about it.

1. Who we are

Oikos is a brand of Solarinvest IKE, a company registered in Greece ("we"). For questions about your data, write to privacy@oikos.sarl. We are the controller of the personal data described here, except where a family has asked us to hold its records, in which case we hold them on that family's behalf.

2. What we collect

On this website. If you use the early-access form we keep what you type: your name, email, country, your role, the size of your situation and your message. We count visits to pages in aggregate. We do not use advertising or tracking scripts, we set no tracking cookies, and we do not store visitors' IP addresses.

When you use Oikos. Your account (email, a protected form of your password, your two-step verification settings), the records you enter and the documents you upload, the history of changes, and the people you have given access to. We keep a sign-in record, including the device and country of recent sign-ins, to protect your account.

When you contact us. Your messages, our replies, any feedback you send, and email delivery records (who, when, delivered or not).

What we do not collect. Oikos never asks for or stores passwords, PINs, recovery phrases or private keys for your accounts. It can record where something is kept, not what it is.

3. Why we use it

• To provide Oikos to you and the people you share it with (contract).
• To keep it secure, prevent abuse and fix faults (our legitimate interest, and a legal duty where one applies).
• To answer your messages and requests (contract, or our legitimate interest).
• To send you product updates if you asked for them, which you can stop at any time (consent).

4. Who else sees it

Inside a family workspace, only the people the owner has given access to, and only the parts they have been given. People at Oikos cannot read a family's records unless the owner switches on time-limited support access, which is logged and shown to the family.

We use a small number of service providers who process data for us: Supabase (database, sign-in and file storage, in an EU region), Cloudflare (delivering the website and the app) and Resend (sending email). They may only use the data to provide their service to us. Some of them are based outside the EU. Where data is processed outside the EU or the UK, we rely on the standard contractual clauses approved by the European Commission.

We do not sell your data, share it for advertising, or give it to anyone else unless the law requires it.

5. Artificial intelligence

Today Oikos does not send your family's records or documents to any AI model. Document reading uses fixed rules on our own systems. We use an AI model only to help draft text for this public website, and only from public material.

If we add features that send your data to an AI service, we will say so here first, name the provider and give you a choice.

6. How long we keep it

• Your family's records, documents and history: while the family exists. They are deleted when the owner deletes the family, or when we do so at your request.
• Your login: while you belong to a family. It is deleted with the family if you belong to nothing else.
• Sign-in attempts: 30 days.
• Job and system logs: 60 days.
• Email delivery records and feedback: until you ask us to erase them.
• Early-access requests: until declined or until the end of the beta, then erased.
• Backups: encrypted nightly copies are kept for 14 days. A deleted family disappears from backups within 14 days.
• Records of what administrators did, which hold no personal content: kept, with names replaced when a person is erased.

7. Your rights

You can ask for a copy of your data, for it to be corrected, for it to be erased, to restrict or object to how we use it, and to receive it in a form you can take elsewhere. Inside Oikos you can download everything and delete your family yourself. For anything else write to privacy@oikos.sarl. We will reply within one month.

If you are unhappy with how we handle your data you can complain to your data protection authority. In Greece this is the Hellenic Data Protection Authority (www.dpa.gr).

8. Security

We protect Oikos with two-step sign-in, separate workspaces enforced in the database, access logs and encrypted backups. Our security page lists what is built and what is not yet. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

9. Children

Oikos is for adults. We do not knowingly collect data from children. A family may record facts about its own children as part of its records.

10. Changes

We will update this notice when what we do changes. We will tell people who use Oikos before a change that matters to them takes effect.