Privacy Policy

1. Introduction and Scope

OTTERS.AI LIMITED ("Otters", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Collaboration Execution Platform.

This policy complies with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

2. Who We Are

EU Representative (GDPR Article 27)

For EU data subjects, we are in the process of appointing an EU Representative. In the meantime, please contact us at support@otters.ai for any GDPR-related enquiries.

3. Information We Collect

We collect information in several categories, as required for CCPA/CPRA disclosure:

3.1 Identifiers

• Name and email address
• IP address and device identifiers
• Account credentials (securely hashed)

3.2 Commercial Information

• Subscription and billing details
• Transaction history
• Service usage records

3.3 Internet or Network Activity

• Pages visited and features used
• Session duration and interaction data
• Browser type and operating system
• Referring URLs and access times

3.4 Professional Information

• Company name and job title
• Business contact information
• Professional role within your organisation

3.5 Content You Create

• Partners, deals, and mutual action plans
• Notes, updates, and communications
• Documents and files you upload

4. Legal Basis for Processing (UK/EU GDPR)

We process your personal data based on the following legal grounds:

• Contract Performance:
  Processing necessary to provide the Otters service as agreed in our Terms of Service.
• Legitimate Interests:
  Improving our services, ensuring security, conducting analytics, and preventing fraud.
• Consent:
  For marketing communications and optional analytics cookies, where you have given explicit consent.
• Legal Obligations:
  Compliance with applicable laws, regulations, and legal processes.

5. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments and questions
• Analyse usage patterns to improve user experience
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

6. Information Sharing and Sub-processors

We do not sell your personal information. We may share your information with:

• Service Providers:
  Third-party vendors who assist in our operations (hosting, analytics, email delivery)
• Collaboration Partners:
  Other users you choose to collaborate with through the platform
• Legal Requirements:
  Law enforcement or regulatory bodies when required by law
• Business Transfers:
  In connection with a merger, acquisition, or sale of assets

A list of our sub-processors is available upon request. Contact support@otters.ai for details.

7. International Data Transfers

Primary Hosting Location: Dublin, Ireland (European Union)

For EU Data Subjects: Your data is primarily stored and processed within the European Union. No international transfers are required for core service delivery.

For UK Data Subjects: The EU-UK adequacy decision allows for the lawful transfer of personal data between the UK and EU without additional safeguards.

Sub-processors: Some of our service providers may process data in jurisdictions outside the EEA. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs).

Google Analytics: Analytics data may be processed outside the EEA under Google's data processing terms. See our Cookie Policy for more information.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption of data in transit (TLS) and at rest
• Access controls and authentication requirements
• Regular security assessments and monitoring
• Incident response procedures
• Employee training and confidentiality agreements

9. Data Retention

We retain your information for as long as your account is active or as needed to provide services:

• Active Accounts:
  Data is retained for the duration of your subscription.
• After Termination:
  We retain Customer Data for twelve (12) months after termination, unless otherwise required by law or you instruct us to delete it earlier.
• Legal Requirements:
  Certain information may be retained longer to comply with legal, regulatory, or contractual obligations.

10. Your Rights

Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data:

UK Supervisory Authority: Information Commissioner's Office (ICO) – ico.org.uk

EU Supervisory Authorities: Contact your local Data Protection Authority.

To exercise any of these rights, please contact us at support@otters.ai.

11. California Consumer Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (as amended by the California Privacy Rights Act):

Your California Privacy Rights

• Right to Know:
  Request disclosure of personal information collected, sources, purposes, and third parties with whom we share it.
• Right to Delete:
  Request deletion of your personal information, subject to certain exceptions.
• Right to Correct:
  Request correction of inaccurate personal information.
• Right to Opt-Out:
  We do not sell your personal information or share it for cross-context behavioural advertising.
• Right to Non-Discrimination:
  We will not discriminate against you for exercising any of your privacy rights.

How to Submit a Request

Email support@otters.ai with the subject line "California Privacy Request". Include your full name and the email address associated with your account.

Verification

We may need to verify your identity before processing your request.

Response Timeframe

We will respond to verifiable requests within 45 days, with a possible 45-day extension if needed.

12. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us at support@otters.ai so we can take appropriate action.

13. Analytics and Cookies

We use cookies and similar technologies to enhance your experience on our platform:

• Essential Cookies: Required for the platform to function properly (authentication, security).
• Analytics Cookies: Help us understand how you use the platform (Google Analytics).

Google Analytics: We use Google Analytics to collect anonymised usage data. You can opt out by declining analytics cookies in our consent banner or by installing the Google Analytics Opt-out Browser Add-on.

For more details, please see our Cookie Policy.

14. Data Processing Terms

When you use Otters to process personal data of your end users or customers ("Customer Data"), the following terms apply:

• Roles: You act as the Data Controller for Customer Data. Otters acts as the Data Processor.
• Processing Purposes: We process Customer Data solely for the purpose of providing the Otters service.
• Sub-processors: We may engage sub-processors to assist in providing the service. A list is available upon request.
• Security: We implement appropriate technical and organisational measures to protect Customer Data.
• Data Breach Notification: We will notify you of any personal data breach within 72 hours as required by GDPR.
• Data Subject Rights: We will assist you in responding to requests from data subjects.
• Deletion: Upon termination, Customer Data will be handled in accordance with our retention policy (Section 9).

For enterprise customers requiring a separate Data Processing Agreement, please contact support@otters.ai.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page
• Updating the "Last updated" date at the top of this policy
• For material changes, sending an email notification to registered users

16. Governing Law

This Privacy Policy is governed by the laws of England and Wales. For EU data subjects, nothing in this policy affects your rights under EU GDPR or the jurisdiction of your local courts and Data Protection Authorities.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

For EU data subjects with GDPR-specific enquiries, please include "GDPR Request" in your email subject line.