Privacy Policy

Last updated: 22 August 2026

This Privacy Policy explains how OTTO ("OTTO," "we," "us") handles information in connection with our services.

1. What data OTTO touches

OTTO's agents operate inside your existing systems, your CRM, outbound tools, calendar, and Slack. We do not copy your customer or pipeline data into a separate OTTO-owned database or platform. Data stays in your systems; our agents read and act on it there, scoped to the access explicitly granted during the Blueprint process.

2. Information we collect directly

We collect information you provide directly, such as:

  • Contact information (name, email, company, role) submitted through the booking form or the Blueprint process
  • Information shared during scoping calls and the Blueprint engagement
  • Account and billing information for active clients

3. How we use information

  • To deliver, operate, and maintain the agents scoped in your engagement
  • To communicate with you about your account and engagement
  • To improve how we scope and operate agents across engagements, in aggregate and de-identified form only

We do not use client data to train any AI model that leaves your business.

4. Data access and security

Access to your systems is scoped to what each agent needs, not standing administrative access. Every action an agent takes is logged. Credentials and permissions granted to OTTO are revoked at the end of an engagement. See our Security & Governance FAQ for more detail.

5. Sub-processors and third parties

Delivering our services involves third-party AI model providers, hosting, and infrastructure vendors. Where an agent runs against your own vendor accounts, that vendor's terms and data handling apply to that processing. A current list of the sub-processors OTTO relies on is available to clients and prospective clients on request.

6. Data retention

Logs, audit trails, and engagement records are retained for the duration of an engagement and for a limited period afterwards, to support handover, security review, and our own record-keeping obligations. Contact information submitted through the booking form is retained until you ask us to delete it. Specific retention periods for a given engagement are set out in the applicable order form.

7. Your rights

Depending on your location, you may have rights to access, correct, or delete personal information we hold about you. To make a request, get in touch through the contact form and we will respond.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "last updated" date above.

9. Contact

Enquiries about this policy, including requests relating to your personal information, are handled through the contact form.