This policy explains how okurra.com handles personal data. It covers this website, the customer panel and the licence verification performed by the O!kurra Expert Advisor.
1. Who is responsible
The controller is MMDTEC LTD, registered in England & Wales under number 12577319, registered office 590 Kingston Road, London, SW20 8DN, United Kingdom. Contact for any data-protection matter: [email protected].
(The policy published at mmdtec.com covers the company’s own website only. This one covers okurra.com.)
2. What we collect, why, and on what basis
Account — name, e-mail address, password (stored only as a hash), optional avatar, interface language, and the roles/limits assigned to your account. Basis: performance of our contract with you. Without these we cannot give you a panel, a licence or downloads.
Licences and MetaTrader accounts — licence key, its label, the MetaTrader 5 account numbers you register, and the broker server, EA version, MT5 build and IP address recorded at each verification. Basis: performance of the contract (the licence has to be verifiable) and our legitimate interest in preventing licence sharing. Each verification attempt, successful or not, is written to a verification log.
Purchases — order and licence records, invoices and payment status. Card data never reaches us: payments are processed by Stripe. Basis: contract and our legal obligation to keep accounting records.
Panel activity — conversations with the assistant, settings files you generate or upload in the Creator, your Granary ledger (“grains”), material you publish in the Tester Zone, ratings and translation reports. Basis: contract (these are the features themselves) and, for moderation, legitimate interest.
Support correspondence — what you write to us and our answers. Basis: legitimate interest in handling your case.
Marketing e-mail — only if you switch it on in the panel. Basis: your consent, which you can withdraw at any time in the panel or via the unsubscribe link in every message. Transactional e-mail (password reset, account and licence matters) is sent on the basis of the contract and cannot be switched off.
Analytics and advertising — see the cookie policy. Our own traffic statistics (Umami) run without cookies and without identifying you; Google and Meta tools load only after you consent in the banner.
Server logs — technical logs including IP address, needed to run and secure the service. Basis: legitimate interest in security and diagnostics.
3. Who else processes the data
We use a small number of providers, each only for what it does:
| Provider | Purpose | Where |
|---|---|---|
| Our own infrastructure (application and database servers) | hosting the service, the panel and account data | United Kingdom and European Economic Area |
| Cloudflare | traffic delivery and protection (tunnel) | global |
| Amazon Web Services (SES) | sending e-mail | United States |
| Stripe | payment processing | EU / United States |
| Anthropic | language model behind the Creator, Creator PRO and translations — receives the content you send to those features | United States |
| Assistant (our Dify instance at chatbot.okurra.com) | the chat assistant; conversations are stored to keep the thread | our infrastructure |
| Google (Tag Manager, Analytics, Ads) | statistics and advertising — only with consent | United States |
| Meta | advertising — only with consent, if enabled | United States |
We do not sell personal data and we do not share it with anyone else, except where we must comply with the law.
Where our servers are. The service, the panel and the account database run on infrastructure kept in the United Kingdom and the European Economic Area. Which data centre we use is a technical decision and may change within that area — including keeping the user database on servers separate from the rest of the application. Should we ever need to move account data outside that area, we will tell registered users in advance.
Transfers outside the UK/EEA happen only with the providers marked above. They take place under the European Commission’s standard contractual clauses and the UK addendum (or an equivalent safeguard).
4. Publicly visible data
The Tester Zone shows the author of a published set. We publish only the first name — never your surname or your e-mail. Everything in the customer panel is visible to you alone (and to our administrators when handling your case).
5. How long we keep it
Account and licence data: for as long as you have an account, and afterwards for as long as we may need it to defend or pursue claims (up to 6 years). Accounting records: 6 years, as required by law. Verification logs and server logs: up to 12 months. Assistant and Creator conversations: until you delete them or your account. Marketing consent and its withdrawal: for as long as we send marketing plus proof of consent.
6. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to withdraw consent at any time (without affecting what happened before), and to receive your data in a portable format.
You can do much of this yourself: your data is in the panel (Account, Licence keys), marketing consent is a switch, and account deletion is available there too. For anything else write to [email protected]; we answer within one month.
If you think we handle your data badly, you may complain to a supervisory authority — in the UK the Information Commissioner’s Office (ico.org.uk), in Poland Prezes UODO (uodo.gov.pl), or the authority where you live.
7. Security
Passwords are stored as hashes, traffic runs over HTTPS, licence tokens are signed cryptographically, and administrative access is limited and logged. No system is perfectly secure; if a breach ever affects your data we will notify you and the relevant authority as the law requires.
8. Children
The service is not intended for people under 18 and we do not knowingly collect their data.
9. Changes
We may update this policy. The current version, with the date of the last change, is always here; material changes are announced by e-mail to registered users.