Privacy Policy

OtoLab ("we," "our," or "us") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website, use our products (OtoChat, OtoDocs, OtoOps, OtoSocial), or interact with our services.

By accessing or using our services, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not access our services.

Information You Provide

• Account Information: Name, email address, company name, job title, and phone number when you create an account or request a demo.
• Payment Information: Billing address and payment card details (processed securely through our PCI-compliant payment processor — we never store full card numbers).
• Communication Data: Messages, emails, and form submissions you send to us.
• Customer Content: Documents, conversations, and data you process through our platform.

Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps, click patterns, and session duration.
• Device Information: Browser type, operating system, device identifiers, and screen resolution.
• Log Data: IP addresses, access times, referring URLs, and error logs.
• Cookies & Tracking: We use essential cookies for authentication and preferences, and analytics cookies (with your consent) to improve our services.

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve our products and services.
• Account Management: To create and manage your account, process transactions, and send service-related communications.
• Customer Support: To respond to your inquiries, troubleshoot issues, and provide technical assistance.
• Product Improvement: To analyze usage patterns and develop new features (using aggregated, anonymized data only).
• Security: To detect, prevent, and address fraud, unauthorized access, and other security issues.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Marketing: To send promotional communications (only with your explicit consent, and you can opt out at any time).

Important: We never use your customer content (documents, conversations, or processed data) to train our AI models. Your data is used solely to provide the services you have subscribed to.

We do not sell your personal information. We may share your information only in the following circumstances:

• Service Providers: Trusted third-party vendors who help us operate our platform (cloud hosting, payment processing, email delivery). All providers are contractually bound to protect your data.
• Legal Requirements: When required by law, subpoena, court order, or governmental regulation.
• Business Transfers: In connection with a merger, acquisition, or sale of assets (you will be notified of any change in ownership).
• With Your Consent: When you explicitly authorize us to share your information with specific third parties.

We require all third parties to maintain the confidentiality and security of your personal information and to process it only in accordance with our instructions.

We implement robust security measures to protect your information:

• Encryption: All data is encrypted at rest using AES-256 and in transit using TLS 1.3.
• Access Control: Role-based access control with mandatory multi-factor authentication for all team members.
• Infrastructure: SOC 2 Type II certified cloud infrastructure with geographic redundancy and automatic failover.
• Monitoring: 24/7 security monitoring, automated threat detection, and incident response procedures.
• Testing: Regular penetration testing, vulnerability assessments, and third-party security audits.
• Employee Training: Mandatory security awareness training for all employees with annual recertification.

While we implement industry-leading security practices, no method of electronic storage or transmission is 100% secure. We continuously evaluate and improve our security posture.

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy:

• Account Data: Retained while your account is active and for 30 days after deletion request.
• Customer Content: Retained according to your subscription plan settings. You can delete content at any time through the platform.
• Usage & Analytics Data: Retained in anonymized, aggregated form for up to 24 months.
• Financial Records: Retained for 7 years as required by tax and financial regulations.
• Backup Copies: Purged within 90 days of data deletion.

When data is no longer needed, it is securely deleted or anonymized using industry-standard methods.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw previously given consent at any time.

Australian residents have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.

OtoLab operates globally, and your information may be transferred to and processed in countries other than your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Compliance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• Standard Contractual Clauses (SCCs) approved by the European Commission for EU/EEA data transfers
• Data Processing Agreements with all sub-processors
• Compliance with all applicable data transfer frameworks in each jurisdiction we operate

For Australian residents, we comply with APP 8 (cross-border disclosure of personal information) and take reasonable steps to ensure overseas recipients handle your data in a manner consistent with the APPs. For EU/EEA residents, all international transfers comply with GDPR requirements. You may request a copy of the applicable safeguards by contacting us.

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for authentication, security, and core functionality. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with our website (requires consent).
• Preference Cookies: Remember your settings and preferences for a personalized experience.

You can manage your cookie preferences through your browser settings or our cookie consent banner. Disabling non-essential cookies will not affect the functionality of our core services.

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us immediately, and we will take steps to delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes:

• We will update the "Last Updated" date at the top of this page.
• We will notify you via email or a prominent notice on our website.
• For significant changes, we may require you to re-acknowledge or re-consent.

We encourage you to review this policy periodically to stay informed about how we protect your information.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Address: OtoLab, Sydney, NSW, Australia
• Privacy Officer: [email protected]

For Australian residents, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. For EU residents, you have the right to lodge a complaint with your local data protection authority.