Privacy policy
Last updated: 4 October 2026
In short: Okarga analyses your emails inside your browser. The body and subject of your emails never leave your computer. Your team's server, in the European Union, only receives ratings, trade history (company, date, route and amount) and the result of each check.
Who is responsible
This website and the Okarga extension are provided by Okarga (see the legal notice). For any privacy question, write to hola@okarga.com.
When a company uses Okarga with its team, the company is the controller of its team's data and Okarga processes that data on its behalf, as a processor, under the agreement we sign with the company.
What the extension does in your browser
When you open an email in Gmail, Okarga reads the sender, the subject and the visible text in your browser to compute the traffic light. That analysis runs on your computer. Your browser also stores:
- your name and your team code;
- the list of senders already verified (domain, or email address for free email providers);
- the IDs of emails already counted for usage measurement, without their content;
- for 7 days, the results of the public lookups described below.
All of this is deleted when you uninstall the extension.
What data leaves your browser and where it goes
| Recipient | What is sent | Purpose |
|---|---|---|
| Team server (Supabase, Frankfurt, EU) | Your name; the ratings you create (email or domain of the rated company, reason and note); the trade history the extension recognises in your emails (company, document type, date, route, amount and reference); usage measurement (traffic-light level, reason codes, your vote and comment, sender domain) | Sharing the team's memory and measuring the quality of the warnings |
| Supported freight exchanges where you are signed in in Chrome | The sender's email address, domain, VAT number or exchange code, and the IDs of your own offers | Checking whether the sender viewed your offer and is registered. The request uses your own session and the answer is kept only in memory for a few minutes |
| RDAP (public domain registries, via rdap.org) | The sender's domain | Finding out when the domain was created |
| Cloudflare public DNS (cloudflare-dns.com) | The sender's domain | Checking whether the domain is protected against spoofing (DMARC) |
| VIES (European Commission) | The VAT number found in the email | Checking that the VAT number exists |
Never sent: the body or subject of your emails, your passwords or your sessions. Okarga does not sell data, does not show ads and does not use data for anything other than the service.
Legal basis
- Team data: the contract with the customer company. Okarga acts as a processor.
- Sender data (email, domain or VAT number of whoever writes): the customer company's legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).
- If you write to us at hola@okarga.com: your consent, so we can reply.
Retention
Team data is kept while the company uses Okarga. When the company leaves, it is deleted within 30 days. Data in your browser is deleted when you uninstall the extension.
Google user data
Okarga uses Gmail content only for the feature you see: warning you whether a sender is who they claim to be. Okarga's use of information received from Gmail adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: it is not transferred to third parties except as described above, it is not used for advertising and no human reads it.
This website
okarga.com uses no cookies, analytics or third-party services. Fonts are served from this website.
Your rights
You can request access, rectification, erasure, objection, restriction or portability by writing to hola@okarga.com. If your data is processed by your employer through Okarga, you can also contact your employer. You may lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with your local supervisory authority.