Política de privacidad

Effective date: October 7, 2026
Last updated: October 7, 2026

1. Introduction

This Privacy Policy explains how Aureon Solutions LLC, doing business as OkkO ("OkkO," "we," "us," or "our"), collects, uses, shares, and protects personal information when you visit our website at https://getokko.com, use our web dashboard or mobile applications, apply for a business account through OkkO, or otherwise interact with us (together, the "Services").

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood it. If you do not agree with this Privacy Policy, please do not use the Services.

2. Who We Are

OkkO is a brand of Aureon Solutions LLC, a limited liability company located at:

Aureon Solutions LLC (d/b/a OkkO)
208 North 29th Street, Suite 201
Billings, Montana 59101
United States

OkkO provides a technology platform that gives companies an application, onboarding, and dashboard experience for multi-currency and multi-country business accounts. OkkO is not a bank. Business accounts, payment services, and the holding of customer funds are provided by our licensed partner Sokin (operated by Plata Capital Limited) and, where applicable, other licensed banking and payment partners. Those partners act as the principal provider of the account and related financial services. OkkO acts as the technology and API interface that collects application and know-your-customer ("KYC") information and facilitates onboarding with those partners.

For personal information we collect through the Services, Aureon Solutions LLC is responsible for that information under this Privacy Policy. Our account provider partners may also process your personal information as independent controllers or businesses under their own privacy notices, which we encourage you to review when you apply.

3. Scope

This Privacy Policy applies to personal information about:

• Business customers and applicants, including the individuals who act for them, such as directors, officers, authorized representatives, account users, and ultimate beneficial owners ("UBOs");
• Website visitors to https://getokko.com and related pages;
• Mobile app users, if and when we make OkkO mobile applications available; and
• Other people who contact us, such as prospective customers, partners, and introducers.

This Privacy Policy does not apply to the information practices of third parties, including Sokin / Plata Capital Limited or other partners, or to third-party websites and services that we link to. Those parties have their own privacy policies.

The Services are designed for businesses. We do not offer accounts to individuals for personal, family, or household purposes.

4. Information We Collect

The information we collect depends on how you interact with us. We collect information that you provide directly, information collected automatically, and information we receive from third parties.

4.1 Information you provide

Identity and KYC information. When a company applies for an account, we collect information about the individuals connected to it (such as directors, authorized representatives, and UBOs), which may include:

• Full name, date of birth, nationality, and country of residence;
• Residential address and contact details (email address and phone number);
• Government-issued identification documents (such as a passport, national ID card, or driver's license) and the information shown on them;
• Tax identification numbers or national identification numbers, where required;
• Photographs or "selfie" images and video used for identity verification and liveness checks;
• Job title, role within the company, and ownership percentage; and
• Information needed for customer due diligence ("CDD") and enhanced due diligence, such as source of funds, source of wealth, and politically exposed person ("PEP") status.

Company information and documents. We collect information about the business applying for an account, which may include:

• Legal name, trading names, registration number, tax ID or EIN, and date and place of incorporation;
• Registered and operating addresses;
• Formation documents, such as certificates of incorporation, articles of organization, operating agreements, shareholder registers, and ownership charts;
• Business licenses and regulatory registrations, where applicable; and
• Website, industry, business description, and the countries in which the business operates.

Financial and account application information. We collect information about how the business intends to use its account, which may include:

• Expected transaction volumes and values, currencies, and countries of activity;
• Information about customers, suppliers, and counterparties, where needed to assess the application;
• Bank statements, financial statements, or proof of address documents; and
• Account preferences and selected products.

Account and login information. When you create a dashboard login, we collect your name, business email address, password or other credentials, security settings, and user roles and permissions.

Communications. When you contact us by email, through forms on our website, through in-app chat, or otherwise, we collect the content of your messages, your contact details, and any attachments you send. We may also keep records of our communications for quality, support, and compliance purposes.

Marketing and event information. If you sign up for updates, request a demo, or attend an event, we collect your name, company, job title, contact details, and your communication preferences.

4.2 Information collected automatically

Device and usage information. When you use our website, dashboard, or apps, we and our service providers may automatically collect:

• IP address and approximate location derived from it;
• Browser type and version, operating system, and device type;
• Device identifiers, such as mobile advertising identifiers or app instance IDs, where permitted;
• Pages and screens viewed, features used, links clicked, and the date and time of your activity;
• Referring and exit pages; and
• Log, error, and crash information.

Security and fraud-prevention information. We may collect information such as login timestamps, IP addresses, device characteristics, and session information to help secure accounts, detect suspicious activity, and prevent fraud.

Cookies and similar technologies. We use cookies, pixels, local storage, software development kits ("SDKs"), and similar technologies. See Section 10 (Cookies and Similar Technologies) for more information.

4.3 Information from third parties

We may receive personal information from:

• Sokin / Plata Capital Limited and other banking and payment partners, such as the status of your application, account details, and information needed to support your account;
• Identity verification and KYC/AML service providers, such as identity verification results, document authenticity checks, liveness check results, and screening results against sanctions, PEP, and adverse media lists;
• Public sources and business registries, such as company registries, official gazettes, and public websites;
• Introducers, referral partners, and affiliates that refer your business to us, such as your name, company, and contact details; and
• Analytics and marketing providers, such as aggregated information about how visitors use our website.

4.4 Information about others

If you provide information about other people, such as directors, UBOs, or colleagues, you confirm that you have the authority to do so and that you have informed them about how their information will be used as described in this Privacy Policy.

5. How We Use Information

We use personal information for the following purposes:

• To provide the Services, including processing account applications, operating the dashboard and apps, and managing user access and permissions;
• To facilitate onboarding with our partners, including sharing application and KYC information with Sokin / Plata Capital Limited and other licensed partners so that they can review and open accounts and provide financial services;
• To verify identity and perform due diligence, including KYC, CDD, sanctions and PEP screening, and ongoing monitoring;
• To comply with legal and regulatory obligations, including anti-money laundering ("AML"), counter-terrorist financing, sanctions, tax, and recordkeeping requirements, and responding to lawful requests from regulators, law enforcement, and courts;
• To prevent fraud and protect security, including detecting, investigating, and preventing fraud, unauthorized access, and other harmful or illegal activity;
• To communicate with you, including responding to inquiries, sending service and account notices, and providing customer support;
• To improve and develop the Services, including analyzing usage, troubleshooting, and developing new features;
• For marketing, including sending updates about OkkO products and services where permitted by law. You can opt out at any time (see Section 12);
• To enforce our terms and protect rights, including establishing, exercising, or defending legal claims; and
• For business transactions, as described in Section 6.

We may also create de-identified or aggregated information that does not reasonably identify you. We will maintain and use de-identified information in de-identified form and will not attempt to re-identify it, except as permitted by law.

6. How We Share Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under applicable US state privacy laws.

We share personal information only as described below and as needed for the purposes in this Privacy Policy:

• Account provider and payment partners. We share application, company, KYC, and CDD information with Sokin / Plata Capital Limited, which provides the business accounts and related financial services, and with other licensed banking and payment partners where needed to provide the services you request. These partners use your information under their own privacy notices and legal obligations.
• Identity verification and KYC/AML vendors. We share information with service providers that help us verify identity, check documents, perform liveness checks, and screen against sanctions, PEP, and adverse media lists.
• Cloud hosting and IT providers. We use third-party providers for hosting, data storage, email, communications, customer support tools, and other technology services.
• Analytics providers. We use providers that help us understand how our website and apps are used.
• Professional advisers. We may share information with lawyers, auditors, accountants, compliance consultants, and insurers as needed.
• Affiliates and introducers. We may share limited information with our affiliates, and with introducers or referral partners that referred your business, only as needed (for example, to confirm that a referral resulted in an application or to manage referral arrangements). We do not share KYC documents with introducers unless you direct us to or the law requires it.
• Regulators, law enforcement, and legal process. We may disclose information to government authorities, regulators (including, where applicable, the Financial Crimes Enforcement Network ("FinCEN") and state financial regulators), law enforcement agencies, and courts when we believe disclosure is required by law, regulation, or legal process, or is necessary to protect the rights, property, or safety of OkkO, our customers, or others.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, personal information may be transferred to the relevant parties, subject to appropriate confidentiality protections.
• With your consent or at your direction. We may share information with other parties when you consent or direct us to do so.

We require our service providers to use personal information only to provide services to us and to protect it appropriately.

7. Legal Bases for Processing (EU/UK Visitors)

OkkO is based in the United States and our Services are primarily directed to US businesses. If you are located in the European Economic Area ("EEA") or the United Kingdom and data protection laws such as the EU or UK General Data Protection Regulation ("GDPR") apply, we rely on the following legal bases:

• Contract: to process applications and provide the Services you request;
• Legal obligation: to comply with AML, KYC, sanctions, tax, recordkeeping, and other legal requirements;
• Legitimate interests: to operate, secure, and improve our Services, prevent fraud, communicate with business contacts, and conduct business-to-business marketing, where these interests are not overridden by your rights; and
• Consent: for non-essential cookies, certain marketing communications, and any other processing where we ask for your consent. You may withdraw consent at any time.

Where we process special category data, such as biometric data used for identity verification, we do so only where permitted by applicable law, for example where necessary for reasons of substantial public interest such as preventing fraud and money laundering, or with your explicit consent.

8. International Data Transfers

OkkO is based in the United States, and our partners and service providers may be located in the United States, the United Kingdom, the European Union, and other countries. Sokin / Plata Capital Limited and some of our service providers may process information outside the country where you live. These countries may have data protection laws that are different from those in your country.

Where required by law, we take steps to protect personal information transferred internationally, such as using standard contractual clauses approved by the European Commission, the UK International Data Transfer Agreement or Addendum, or other lawful transfer mechanisms.

9. Data Retention

We keep personal information for as long as needed to fulfill the purposes described in this Privacy Policy, including:

• For as long as your business has an application or account with us or our partners; and
• After an account is closed or an application is withdrawn or declined, for the period required by AML, KYC, tax, recordkeeping, and other laws. These requirements often call for keeping identity and transaction-related records for several years (for example, five years or more is typical under many AML rules).

We may also keep information longer where needed to resolve disputes, enforce our agreements, comply with a legal hold, or protect against fraud. When information is no longer needed, we delete it, de-identify it, or securely store it until deletion is possible. Our partners, including Sokin / Plata Capital Limited, set their own retention periods under their own legal obligations.

10. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Operate the Services (strictly necessary cookies), such as keeping you logged in, remembering security settings, and preventing fraud;
• Remember your preferences, such as language and display settings;
• Understand usage (analytics cookies), such as which pages are visited and how users navigate our website; and
• Measure marketing, such as understanding whether visitors came to our website from a campaign, where permitted by law.

You can control cookies through your browser settings and, where available, through our cookie banner or preference tools. Blocking strictly necessary cookies may cause parts of the Services not to work. Where required by law, such as for EEA and UK visitors, we will ask for your consent before setting non-essential cookies.

Do Not Track and Global Privacy Control. Some browsers send "Do Not Track" signals. Because there is no common standard for these signals, our website does not currently respond to them. Where required by applicable law, we treat recognized opt-out preference signals, such as Global Privacy Control, as a valid request to opt out for that browser or device.

11. Mobile App Permissions

If and when we offer OkkO mobile applications, the apps may request access to certain device features. We will only access these features when you enable the relevant functionality, and you can change permissions at any time in your device settings:

• Camera and photos: to capture or upload identity documents, company documents, and selfie or liveness images for verification.
• Biometrics (such as Face ID, Touch ID, or fingerprint login): if you enable biometric login, authentication is handled by your device's operating system. OkkO receives only a confirmation of whether authentication succeeded and does not receive or store your device biometric data. Separately, identity verification selfies or liveness checks may be processed by our KYC vendors as described in Section 4.
• Push notifications: to send account alerts, security notices, and service updates. You can turn these off in your device settings.
• Device identifiers and diagnostics: to secure your account, prevent fraud, support crash reporting, and understand app performance.
• Location (if used): approximate location derived from your IP address may be used for security and compliance. We will ask for permission before accessing precise device location, if any feature requires it.

12. Your Choices and Rights

12.1 Choices available to everyone

• Marketing emails: You can unsubscribe at any time by using the link in our emails or by contacting privacy@getokko.com. We will still send service, account, security, and legal notices.
• Cookies: You can manage cookies as described in Section 10.
• App permissions: You can manage permissions in your device settings, as described in Section 11.
• Account information: Authorized users can update certain information through the dashboard or by contacting support@getokko.com.

12.2 US state privacy rights

Depending on where you live, and subject to exceptions under applicable law, residents of certain US states (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others with comprehensive privacy laws) may have the right to:

• Know and access the personal information we have collected about them and to obtain a copy in a portable format;
• Correct inaccurate personal information;
• Delete personal information;
• Opt out of the sale of personal information, targeted advertising, and certain profiling (as noted above, we do not sell personal information or use it for targeted advertising);
• Limit the use of sensitive personal information, where applicable; and
• Not be discriminated against for exercising these rights.

Some rights may not apply, or may be limited, where information is subject to other laws such as the Gramm-Leach-Bliley Act, or where we must keep information to meet AML, KYC, and recordkeeping obligations. Certain state laws also exempt information collected in a business-to-business context. If we deny a request, we will explain why where required, and, where state law provides one, you may appeal our decision by replying to our response or emailing privacy@getokko.com with the subject line "Privacy Appeal." If your appeal is denied, you may contact your state Attorney General.

12.3 EU/UK rights

If GDPR or UK GDPR applies, you may have the right to access, correct, delete, restrict, or object to the processing of your personal information, the right to data portability, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority.

12.4 How to exercise your rights

To make a request, email privacy@getokko.com or write to us at the address in Section 20. We will need to verify your identity before responding, which may require you to provide information that matches our records. You may use an authorized agent to make a request on your behalf where permitted by law; we may require proof of the agent's authority and may ask you to verify your identity directly. We will respond within the time required by applicable law.

13. California Privacy Notice

This section provides additional information for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). It applies to the extent the CCPA applies to OkkO.

Categories of personal information collected in the past 12 months. Depending on how you interact with us, we may have collected the following categories:

Sources. We collect these categories from you, from your business and its representatives, automatically from your devices, and from the third parties described in Section 4.3.

Purposes. We use and disclose these categories for the business and commercial purposes described in Sections 5 and 6.

Sale and sharing. We do not sell personal information and do not share personal information for cross-context behavioral advertising. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

Sensitive personal information. We use and disclose sensitive personal information only for purposes permitted under the CCPA, such as providing the Services, verifying identity, ensuring security and integrity, preventing fraud, and complying with law. We do not use it to infer characteristics about you.

Retention. We retain each category of personal information as described in Section 9.

Rights. California residents may exercise the rights described in Section 12.2 by contacting privacy@getokko.com.

Shine the Light. California Civil Code § 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

14. Notices for Other US States

Colorado, Connecticut, Virginia, and other states. Residents of states with comprehensive privacy laws may exercise the rights described in Section 12.2, including the right to appeal a denied request. We do not sell personal information, process personal information for targeted advertising, or engage in profiling in furtherance of decisions that produce legal or similarly significant effects based solely on automated processing. Our account provider partners make their own decisions about whether to open and maintain accounts.

Nevada. Nevada residents may submit a request to opt out of the sale of covered information. We do not sell covered information as defined under Nevada law, but you may contact privacy@getokko.com with any questions.

15. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. These measures may include access controls, encryption of data in transit and at rest where appropriate, and contractual requirements for our service providers.

No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for notifying us promptly at support@getokko.com if you believe your account has been compromised.

16. Children's Privacy

The Services are intended only for businesses and for individuals who are at least 18 years old and are acting on behalf of a business. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact privacy@getokko.com and we will take steps to delete it.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, partners, or legal requirements, including any changes related to money services business registration or state licensing. When we make changes, we will update the "Last updated" date above. If we make material changes, we will provide additional notice, such as by email or a notice in the dashboard or app, where required by law. Your continued use of the Services after the changes take effect means you acknowledge the updated Privacy Policy.

18. Regulatory and Compliance Disclosures

OkkO is a technology platform and is not a bank. Business accounts, payment services, and customer funds are provided and held by Sokin / Plata Capital Limited and, where applicable, other licensed partners, which are responsible for the regulated services they provide. Aureon Solutions LLC may register with FinCEN as a money services business and may obtain state money transmitter licenses or other authorizations over time. As part of our AML and KYC compliance program, we collect, verify, and retain information about our customers and their representatives and beneficial owners, and we may be required by law to report certain information or activity to regulators and law enforcement. Where the law prohibits us from telling you about such a disclosure, we will not do so.

19. Governing Law

This Privacy Policy is governed by the laws of the State of Montana, United States, without regard to its conflict of law principles, except where the privacy laws of your place of residence require otherwise.

20. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or would like to exercise your rights, please contact us:

Privacy inquiries: privacy@getokko.com
General support: support@getokko.com
Mail:
Aureon Solutions LLC (d/b/a OkkO)
Attn: Privacy
208 North 29th Street, Suite 201
Billings, Montana 59101
United States

Website: https://getokko.com