Privacy Policy

1. Scope

This Privacy Policy describes how Ottonomous Technologies Inc ("Ottonomous", "we", "us") handles personal information when you:

• visit ottonomous.ai (the "Site");
• use the Ottonomous platform, apps, and APIs as an employee or administrator of a business customer (a "User" of a "Customer"); or
• interact with a business that uses Ottonomous to communicate with you, run its website, or manage its marketing (an "End Customer").

If you are an End Customer, the business you dealt with decides why and how your information is used, and we process it on that business's behalf as its service provider. Please direct privacy requests to that business first. We will help it respond, and you can also contact us directly at [email protected].

This policy does not cover the practices of Customers, of third-party services you connect, or of websites we link to.

2. Information we collect

Information you give us

• Account and profile. Name, work email, phone number, job title, password, and the Store and Locations you belong to.
• Customer Content. Knowledge documents, inventory and vehicle data, customer and lead records, conversations, uploaded files and media, website content, routine and automation settings, and anything else you or your team put into the platform.
• Communications. Messages you send through the platform (SMS, MMS, email, web chat, social messaging) and the content of phone calls placed or received through platform numbers, including recordings and transcripts where the Customer enables them.
• Support and marketing. Messages you send us, demo requests, survey answers, and event sign-ups.
• Payment. Billing contact and address. Card details go directly to our payment processor, Stripe; we store only a token, card brand, and last four digits.

Information from accounts you connect

When a Customer or User connects a third-party account, we receive the data that account's permissions allow, and only for the features in use. Examples:

• Google. Google Ads, Google Analytics, Search Console, Merchant Center, Business Profile, and Calendar data. See Google user data below.
• Meta. Facebook Pages, Instagram accounts, ad accounts, lead-ad submissions, and Messenger or Instagram conversations you route into the platform. See Meta platform data below.
• Dealer systems. Inventory, deals, service appointments, and customer records from a dealer management system, CRM, or inventory feed the Customer connects.
• Telephony. Phone numbers, call and message logs, and delivery status from our messaging provider, Twilio.
• Other integrations. Any other service a Customer connects through our integrations directory or an API, limited to the scopes granted.

We store access tokens for connected accounts encrypted at rest and delete them when the connection is removed.

Information collected automatically

• Usage. Pages viewed, features used, actions taken in the platform, and timestamps.
• Device and log. IP address, browser and device type, operating system, referring URL, and error logs.
• Cookies and similar technologies. See our Cookie Policy.

Information from other sources

Business contact information from public sources or data providers for sales outreach, and information from Customers about their Users (for example, when an administrator invites you).

3. How we use information

We use personal information to:

• provide, operate, secure, and support the Services, including the AI Features described below;
• carry out a Customer's instructions for End Customer Data, such as sending a message the Customer's team or assistant composed, updating a CRM record, or publishing a vehicle page;
• set up and register messaging campaigns with carriers, and route calls and messages;
• process payments and manage subscriptions;
• send service communications such as verification codes, security alerts, receipts, and product updates;
• send marketing to business contacts about Ottonomous, with an easy way to opt out;
• measure and improve the Services, diagnose problems, and develop new features;
• detect, prevent, and respond to fraud, abuse, security incidents, and violations of our terms; and
• comply with legal obligations and enforce our agreements.

AI processing

The Services use AI models from third-party providers, including Anthropic, OpenAI, and Google, to power assistants, routines, media generation, transcription, and recommendations. When a feature runs, the relevant Customer Content or End Customer Data is sent to a model provider to perform that task, under contracts that require the provider to process it only for us, keep it confidential, and not use it to train their models.

We do not use your personal information, Customer Content, or End Customer Data to develop, improve, or train generalized AI or machine-learning models. We may use aggregated, de-identified usage metrics (for example, how often a routine type is approved) to improve the platform.

Legal bases (EEA, UK, and similar jurisdictions)

Where these laws apply, we process personal information to perform our contract with you, to pursue legitimate interests such as securing and improving the Services, with your consent where required (which you can withdraw), and to comply with law.

4. Google user data

This section applies when a Customer or User connects a Google account. Depending on the features enabled, we may request access to Google Ads, Google Analytics, Search Console, Merchant Center, Business Profile, or Calendar.

• What we access. Only the data covered by the OAuth scopes you approve, such as campaign performance, site analytics, search performance, product listings, business profile posts and reviews, or calendar availability.
• How we use it. To display it in the platform, to let your assistant answer questions and produce reports about it, to run routines you set up (for example, adjusting a budget or drafting a Business Profile post for approval), and to book appointments on a connected calendar. We do not use Google user data for advertising to you, for profiling unrelated to the feature, or for any purpose you did not authorize.
• Who sees it. Google user data is visible to the Users in your Store who are allowed to see it. Our staff do not read it except with your permission, for security or abuse investigation, to comply with law, or after it has been aggregated and de-identified. It may be transmitted to our AI model providers solely to perform the task you requested, under the no-training terms above.
• Storage and deletion. We cache Google data only as long as needed for the feature, and delete tokens and cached data when you disconnect the account, when the Customer deletes its Store, or when the data is no longer needed. You can revoke our access at any time at myaccount.google.com/permissions.

5. Meta platform data

This section applies when a Customer connects a Facebook Page, Instagram account, ad account, or messaging channel through Meta.

• What we access. Page and account details, content and comments, ad account performance and campaign settings, lead-ad form submissions, and Messenger or Instagram conversations you route into the platform, limited to the permissions granted during connection.
• How we use it. To publish and schedule posts you approve, to reply to messages and comments through the platform, to receive leads, to manage and report on ad campaigns, and to let your assistant draft content and answers for review. We comply with the Meta Platform Terms and Developer Policies.
• Deletion. You can disconnect Meta at any time in Ottonomous Settings, or remove Ottonomous from your Facebook account settings, which sends us a deletion request. Details are in our Data Deletion instructions.

We do not sell Meta platform data or use it to build or augment user profiles for advertising outside the Customer's own campaigns.

6. Mobile information and text messaging

The platform sends text messages in two ways: messages from Ottonomous to platform Users (for example, verification codes and account alerts), and messages from a Customer to its End Customers, which the Customer controls. Our Messaging Terms describe both programs, how consent is collected, and how to opt out.

Mobile numbers and consent records are used only to send the messages a person agreed to receive, to honor opt-outs, and to keep the records carriers and law require.

7. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only:

• With service providers that process it for us under contract, such as cloud hosting, databases, AI model providers, messaging and email delivery, payment processing, and analytics. Our current list is on the Sub-processors page.
• With Connected Services at your direction, for example when you publish a post to Meta, send a message through a carrier, or update a record in your CRM.
• Within a Customer's Store. Information Users put into the platform is visible to other Users in that Store according to the permissions administrators set.
• For legal reasons, to comply with law, a subpoena, or a lawful request; to protect the rights, safety, or property of Ottonomous, our Customers, or others; or to investigate fraud or abuse.
• In a business transfer, such as a merger, acquisition, or sale of assets, with notice to affected Customers.
• With your consent or at your direction.

8. Retention

We keep personal information for as long as needed for the purposes above. In general:

• Account and Customer Content: for the life of the subscription and for 90 days after it ends, unless a Customer deletes it sooner or we are required to keep it longer.
• Messaging and call records: for the life of the subscription, and consent and opt-out records for at least four years after the last message, as carrier and TCPA record-keeping guidance recommends.
• Connected-account tokens and cached data: until the connection is removed or the data is no longer needed.
• Logs and security records: typically 12 to 24 months.
• Billing records: as required by tax and accounting law.

Backups are retained on a rolling schedule and overwritten within 35 days.

9. Security

We protect personal information with administrative, technical, and physical safeguards appropriate to its sensitivity, including encryption in transit and at rest, access controls and audit logging, per-Location data isolation within the platform, encrypted storage of connected-account tokens, and vendor due diligence. No system is perfectly secure. If we learn of a breach affecting your information, we will notify you and any regulator as the law requires. Report security concerns to [email protected].

10. International transfers

We are based in the United States and process information there and wherever our service providers operate. If you are outside the United States, your information will be transferred to, stored, and processed in the United States. Where the law requires, we rely on safeguards such as standard contractual clauses for those transfers.

11. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to certain processing, to withdraw consent, and to not be discriminated against for exercising these rights.

• Platform Users can update profile details in Settings and can ask an administrator to remove them from a Store.
• Customers can export or delete Customer Content in the platform, and administrators can delete a Store.
• End Customers should contact the business they dealt with. We will pass along any request we receive and support the business in responding.
• Everyone can email [email protected]. We will verify your identity, respond within the time the law allows (30 days in most cases), and tell you if we cannot honor a request and why.
• Marketing email. Use the unsubscribe link in any marketing email. We will still send service messages.
• Text messages. Reply STOP to any message to opt out from that sender. See Messaging Terms.
• Connected accounts. Disconnect in Settings, at myaccount.google.com/permissions, or in your Facebook settings. See Data Deletion.
• Cookies. See our Cookie Policy.

You may appeal a decision on your request by replying to our response. You may also lodge a complaint with your local privacy regulator.

12. California and other U.S. state privacy notices

This section supplements the rest of the policy for residents of California and other states with comprehensive privacy laws.

Categories collected in the last 12 months. Identifiers (name, email, phone, IP address, account IDs); customer records (billing contact, business address); commercial information (subscriptions, features used); internet and device activity (usage and log data); audio and electronic information (call recordings and messages where a Customer enables them); professional information (employer, job title); geolocation inferred from IP address; and inferences drawn from usage to personalize the platform. We collect these from you, your employer, connected accounts, and automatically, for the purposes in Section 3, and share them with the categories of recipients in Section 7.

Sensitive personal information. Account log-in credentials and connected-account tokens. We use them only to provide the Services and secure your account.

No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Your rights. To know, access, correct, delete, and port your personal information, and to limit use of sensitive personal information, subject to legal exceptions. Submit requests to [email protected] or through the platform. An authorized agent may submit a request on your behalf with written permission; we may ask you to confirm it. We will not discriminate against you for exercising your rights.

Retention. See Section 8.

13. Children

The Services are not directed to individuals under 18, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact [email protected] and we will delete it.

14. Do Not Track

Our Site does not currently respond to browser "Do Not Track" signals. Where required by law, we honor Global Privacy Control signals as a request to opt out of sale or sharing, which we do not do in any case.

15. Changes to this policy

We will post any changes here and update the date at the top. If a change materially reduces your rights, we will notify Customers by email or in the platform before it takes effect.

16. Contact us

Privacy requests: [email protected]
Security reports: [email protected]