Privacy
This is a short summary while our full privacy policy is reviewed by counsel. Every sentence here describes what the software does today.
What we collect. Your name and email when you ask for a report or sign in, the questions you ask the assistant, and what you choose to put into Ocho Tools about your practice and your clients.
How it is kept. Each firm's records are encrypted with that firm's own key before they are written to disk. Passwords are stored only as salted hashes, and two-factor sign-in is available. When you delete a client, a household or your whole firm, it is removed from Ocho including older saved versions; nightly backups age out within 30 days.
Who else processes it. Answers are written by an AI model from xAI, called through its API. Client names are replaced with placeholders before most requests; voice conversations currently include names. Ocho does not use the content of your records, questions or answers to train models, and does not sell your data. The site is served through Cloudflare, which also counts page visits without cookies, and runs on Amazon Web Services. Email from Ocho (password resets, invitations and notices to people at your firm) is sent through Resend; those emails never name a client. If you connect Wealthbox or Calendly, Ocho reads from them with the token you provide, and deletes that token when you disconnect.
How the product is used. Ocho records how it is used: which pages and tools, how long things take, errors, and whether an answer was helpful. That record never contains the words of your client records, questions or answers. It is kept to run and fix the service. Only if your firm's owner turns on "Help improve Ocho" is it linked to the person who did it and used to improve and train Ocho. Feedback notes you send us are read by the Ocho team.
Your clients. A client who answers your questionnaire is sharing their answers with you, their advisor. To have them deleted, they ask you, and you can delete them in one step.
Questions: [email protected].