Privacy Policy

This Privacy Policy (hereinafter this "Privacy Policy" or this "Policy") is issued by Ottomato (hereinafter "Ottomato", "we", "us", or "our"). This Policy explains what information Ottomato collects when you interact with our website located at https://ottomato.ai (the "Site"), our artificial-intelligence voice agent named Otto (the "Voice Agent"), the private online learning community Ottomato operates on a Third-Party Service (hereinafter the "Academy" or the "PPA"), any application Ottomato builds, distributes, or otherwise operates through the Academy or through a custom engagement (each, an "Application"), our electronic-mail newsletter titled The Builder's Report (the "Newsletter"), and any other service Ottomato operates (collectively, the "Services"). This Policy also explains the lawful bases Ottomato invokes as a matter of European data-protection law, with whom we share data, how long we retain it, and how you can exercise your rights.

Ottomato also operates OttoPortal, a client portal available at https://portal.ottomato.net/ (the "OttoPortal"), for authorized clients to access engagement-related resources, communications, status information, and deliverables. This Policy applies to OttoPortal where Ottomato operates it as part of the Services.

Ottomato generally acts as a controller for Site inquiries, Newsletter subscriptions, and its own business communications. When Ottomato processes personal data in Client Content solely on a client's documented instructions, Ottomato acts as that client's processor or service provider. The applicable signed Master Services Agreement, Statement of Work, or Data Processing Agreement controls those engagement-specific roles and instructions.

If any part of this Policy is unclear, contact us at [email protected].

A. Definitions

For purposes of this Policy, the following capitalized terms have the meanings given below. Additional terms may be defined parenthetically on first use in the body of this Policy and carry that defined meaning throughout.

• "Academy" or "PPA" means the private online learning community Ottomato operates on a Third-Party Service, available at https://skool.com/ppa.
• "Application" means any software application Ottomato builds, distributes, or otherwise operates through the Academy or through a custom engagement, including applications that run on the user's own device and applications that run on third-party infrastructure.
• "Application Programming Interface" or "API" means a defined set of protocols and tools for building software and for enabling communication between software components.
• "Artificial Intelligence" or "AI" means computational systems that perform tasks typically associated with human cognition, including language understanding, language generation, voice synthesis, and voice recognition.
• "California Consumer Privacy Act of 2018" or "CCPA" means the California Consumer Privacy Act of 2018, California Civil Code Section 1798.100 et seq.
• "California Privacy Rights Act of 2020" or "CPRA" means the California Privacy Rights Act of 2020, which amended the CCPA.
• "Children's Online Privacy Protection Rule" or "COPPA" means the rule at 16 Code of Federal Regulations Part 312, which governs the online collection of personal information from children under thirteen (13) years of age.
• "Client Content" means data, documents, media, code, or other material provided to Ottomato by a client in connection with a paid engagement.
• "Community Content" means posts, replies, reactions, direct messages, and other content shared by a member inside the Academy or any other community surface Ottomato operates.
• "Data Processing Agreement" or "DPA" means a written contract that governs the processing of personal data by a processor on behalf of a controller.
• "Data Subject Access Request" or "DSAR" means a request by an individual to exercise a right granted under the General Data Protection Regulation, the California Consumer Privacy Act of 2018, or an equivalent statute.
• "Domain Name System" or "DNS" means the hierarchical and decentralized naming system that translates human-readable domain names into machine-readable network addresses.
• "European Economic Area" or "EEA" means the twenty-seven (27) Member States of the European Union together with Iceland, Liechtenstein, and Norway.
• "General Data Protection Regulation" or "GDPR" means Regulation (European Union) 2016/679 of the European Parliament and of the Council of 27 April 2016.
• "Internet Protocol address" or "IP address" means the numerical label assigned to a device connected to a network that uses the Internet Protocol for communication.
• "Newsletter" has the meaning given in the introductory paragraph of this Policy.
• "OttoPortal" means the client portal Ottomato operates at https://portal.ottomato.net/ for authorized client access to engagement-related resources, communications, status information, and deliverables.
• "Output" means content, data, or media generated by an Artificial-Intelligence model in the course of delivering a Service.
• "Personal Data Protection Act B.E. 2562 (2019)" or "PDPA" means the Personal Data Protection Act B.E. 2562 (2019) of the Kingdom of Thailand.
• "Personal Information Protection and Electronic Documents Act" or "PIPEDA" means the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, of Canada.
• "Services" has the meaning given in the introductory paragraph of this Policy.
• "Site" has the meaning given in the introductory paragraph of this Policy.
• "Standard Contractual Clauses" or "SCCs" means the contractual clauses approved by the European Commission pursuant to Commission Implementing Decision (European Union) 2021/914 for the transfer of personal data to third countries.
• "Third-Party Service" has the meaning given in Section 5 of this Policy.
• "Transport Layer Security" or "TLS" means the cryptographic protocol that provides secure communication over a computer network.
• "United Kingdom General Data Protection Regulation" or "UK GDPR" means the United Kingdom General Data Protection Regulation as given effect in United Kingdom law by the European Union (Withdrawal) Act 2018.
• "United States", "United States of America", or "U.S." means the United States of America.
• "Voice Agent" has the meaning given in the introductory paragraph of this Policy.

1. Scope

This Policy applies to:

• The Site at https://ottomato.ai and its staging mirrors.
• OttoPortal at https://portal.ottomato.net/, including authenticated workspaces, dashboards, resources, and deliverables Ottomato makes available through it.
• The Voice Agent, wherever it is embedded, including the inline embed on the contact page and the floating widget on other pages.
• Forms Ottomato hosts on the Site, including the contact form and any future inquiry or waitlist form.
• The Academy, to the extent Ottomato controls the information you share with Ottomato directly. The community-platform provider has its own privacy policy and acts as an independent controller for your community-platform account.
• The Newsletter.
• Anonymous, cookieless website analytics as described in Section 7.

Applications are governed by their own individual privacy policies as described in Section 11, not by this Policy.

This Policy does not cover third-party platforms Ottomato links to but does not operate, including X, formerly known as Twitter (X Corp., available at https://x.com), YouTube (YouTube LLC, available at https://youtube.com), LinkedIn (LinkedIn Corporation, available at https://linkedin.com), and community-platform surfaces outside the Academy.

2. Information We Collect

2.1 Information you provide to Ottomato directly

• Contact data: your name, electronic-mail address, company name, and the content of the message you submit through the contact form, support channel, or electronic mail. Ordinary contact details and a high-level description of your request are appropriate for these intake channels.
• Voice and chat data: if you speak with or type to the Voice Agent, the audio, text, transcript, and related interaction metadata are processed to generate a response and may be received by the conversational-AI provider identified in Section 5. Ottomato may receive conversation content and summaries to classify, prioritize, route, and respond to your inquiry. See Sections 5 and 12.
• Transcript-request data: if you ask Ottomato to send a Voice Agent transcript to you, Ottomato collects your electronic-mail address, the transcript, the page where the conversation happened, and the time of the request. A transcript request does not subscribe you to the Newsletter.
• Community data: if you join the Academy, your profile, posts, reactions, and direct messages are stored on the third-party community platform identified in Section 5. Anything you share with Ottomato directly, such as a support ticket or a question sent to the founder, is handled under this Policy.
• Newsletter data: if you make a separate affirmative choice to subscribe, Ottomato stores your electronic-mail address and subscription status. You may unsubscribe at any time using the link in any Newsletter message.
• OttoPortal and engagement data: if you access OttoPortal or work with Ottomato, Ottomato may collect your name, electronic-mail address, organization, portal profile details, workspace membership, messages, comments, project requests, requirements, order or quote information, uploaded files, task or status updates, support requests, deliverable-access records, and other information you submit to or access through OttoPortal. Client Content uploaded to OttoPortal remains Client Content under the Terms and any applicable signed agreement.
• Confidential-intake data: if you ask to arrange a confidential exchange, Ottomato initially requests only contact details and a brief request without confidential details. Ottomato uses that limited information to review existing confidentiality obligations, arrange a mutual nondisclosure agreement when appropriate, confirm the necessary data-processing terms, and identify an approved channel.

Confidential Information is business information protected by an agreement, the circumstances of disclosure, or law. Personal data is information relating to an identifiable person. Special-category or similarly sensitive personal data receives additional protection under some laws. Credentials, access tokens, private keys, and payment-card data are security or payment secrets. These categories may overlap, but they are not interchangeable. Do not send detailed Confidential Information, special-category or similarly sensitive personal data, credentials, or payment-card data through an ordinary inquiry channel unless Ottomato has confirmed that the channel and processing arrangements are appropriate.

2.2 Information we collect automatically

• Analytics: Ottomato collects anonymous page views, referrers, browser and operating-system family, and country-level geolocation using a privacy-focused, cookieless analytics tool. This tool does not identify individual users. See Section 7.
• Server logs: the third-party hosting providers identified in Section 5 record standard request metadata on Ottomato's behalf: Internet Protocol address, user agent, timestamp, path, and response code. Logs are retained for up to thirty (30) days for security and performance reasons.
• Form metadata: when you submit the contact form, Ottomato records the originating Internet Protocol address and user agent alongside your message to deter spam.
• OttoPortal access metadata: when you sign in to or use OttoPortal, Ottomato and its access-control providers may process login method, access decisions, timestamps, Internet Protocol address, user agent, requested hostname or path, session metadata, and security or audit logs.

3. How We Use Your Information and Our Lawful Bases

• To respond to and route your inquiry. Ottomato uses contact, voice, chat, support, and project-request data to classify, prioritize, route, summarize, and respond to messages, determine whether Ottomato is the right fit for your project, and, when appropriate, share a Google Calendar appointment link so you can book a conversation with Ned Malki. Lawful basis: taking steps at your request before entering a contract, performance of a contract, and Ottomato's legitimate interest in operating a business, depending on the context.
• To operate the Academy. Ottomato uses Community Content and Ottomato-side support data to moderate, answer questions, publish learning material, and improve member experience. Lawful basis: performance of a contract and Ottomato's legitimate interest in operating a healthy community.
• To operate OttoPortal. Ottomato uses OttoPortal data and access metadata to authenticate authorized users, administer workspace access, communicate about engagements, coordinate work, provide support, deliver resources and deliverables, and maintain security and audit records. Lawful basis: performance of a contract and Ottomato's legitimate interest in client service delivery, access control, and platform security.
• To operate the Voice Agent. Voice and chat data is processed to generate a response in real time, qualify and route inquiries, create a conversation summary, share a Google Calendar appointment link when appropriate, and, when you request it, send a transcript to the electronic-mail address you provide. Lawful basis: taking steps at your request before entering a contract and Ottomato's legitimate interest in handling inquiries. Where applicable law requires consent for microphone access, recording, transcription, or another specific action, Ottomato must obtain that consent before the relevant processing.
• To improve the Services. Anonymous analytics, aggregated form-intake patterns, and non-identifying feedback inform design and content decisions. Lawful basis: Ottomato's legitimate interest in improving a product it offers.
• To send the Newsletter. If you separately opted in, Ottomato sends occasional essays about building with Artificial Intelligence. A service request or transcript request does not by itself provide marketing consent. You can unsubscribe from any Newsletter message. Lawful basis: consent.
• To comply with legal obligations. Tax, accounting, anti-fraud, and law-enforcement requests where a valid order exists. Lawful basis: legal obligation.
• To protect the Services. Server logs, rate limits, honeypot fields, and abuse detection protect Ottomato and its users from spam, scraping, and attacks. Lawful basis: Ottomato's legitimate interest in platform integrity.

4. Where Your Data Is Stored

The Site is hosted on third-party shared infrastructure in the United States. Domain-Name-System records and Transport-Layer-Security certificates are administered through third-party providers identified in Section 5.

If you are located in the European Economic Area, the United Kingdom, or any other jurisdiction outside the United States, your personal information will be transferred to the United States. For transfers from the European Economic Area and the United Kingdom, Ottomato uses the European Commission's Standard Contractual Clauses and, where the applicable third-party provider supports them, complementary safeguards. You can request a copy of the Standard Contractual Clauses by electronic mail at [email protected].

5. Third-Party Services and Subprocessors

Certain Services interoperate with third-party services, platforms, or infrastructure providers (each a "Third-Party Service"). Your direct use of a Third-Party Service may be subject to that provider's terms, conditions, and privacy practices. Ottomato does not control a provider's independent policies, availability, performance, security, or pricing. This allocation does not limit Ottomato's obligations under applicable law or a signed agreement when Ottomato selects or uses a provider to process personal data on its behalf.

The following providers may receive personal data from the Site, the Voice Agent, the Newsletter, the Academy, or OttoPortal to deliver the described function. Ottomato does not sell personal data to these providers. Ottomato may add or remove providers as the Services evolve and will update this list when a change materially affects the processing described in this Policy.

For OttoPortal, the list also includes providers that receive login, identity, access-control, or portal-use metadata to provide authorized client-portal access. OttoPortal is currently protected by Cloudflare Access and may offer Google sign-in and electronic-mail login-code flows through Cloudflare Access.

Ottomato also uses Listmonk, a self-hosted electronic-mail management system, to maintain the Newsletter list, the master electronic-mail database, lead-summary messages, and requested transcript messages. Listmonk stores electronic-mail addresses, subscription status, unsubscribe records, lead-summary data, and transcript-message delivery data for Ottomato's internal use. Ottomato does not sell this information. If you ask Ottomato to delete it, Ottomato will delete it subject to legal retention limits and unsubscribe-suppression records needed to honor your opt-out.

• Hostinger International Ltd. (hereinafter "Hostinger"), available at https://hostinger.com — static website hosting for the Site. Receives standard request metadata (Internet Protocol address, user agent, path, timestamp) for any request served.
• Cloudflare, Inc. (hereinafter "Cloudflare"), available at https://cloudflare.com — Domain-Name-System resolution, Transport-Layer-Security termination, and edge caching for ottomato.ai subdomains. Cloudflare acts as a processor for any request it proxies on Ottomato's behalf. For OttoPortal, Cloudflare also provides Cloudflare Access identity-aware access control and may receive login and access metadata such as electronic-mail address, identity-provider response data, Internet Protocol address, user agent, timestamps, requested hostname or path, and access decisions.
• Porkbun LLC (hereinafter "Porkbun"), available at https://porkbun.com — domain registrar and secondary Domain-Name-System provider. Receives minimal registration and WHOIS metadata necessary to maintain the ottomato.ai domain.
• SpaceXAI LLC (hereinafter "xAI"), available at https://x.ai — provider of the Grok conversational Artificial-Intelligence service that powers the current Voice Agent. Receives voice audio, text chat, conversation transcripts, and related request metadata when you interact with the Voice Agent.
• Google LLC (hereinafter "Google"), available at https://google.com — operator of Google Workspace, which Ottomato uses for electronic-mail delivery to and from [email protected], and of Google Calendar Appointment scheduling. Receives the content of electronic-mail messages exchanged with Ottomato. When you book a conversation through a Google Calendar appointment link shared by the Voice Agent or by electronic mail, Google receives the name, electronic-mail address, and booking metadata you submit on that scheduling page. Google also receives OAuth request metadata and returns basic profile and electronic-mail data to Cloudflare Access when you choose Google sign-in for OttoPortal.

Ottomato uses self-hosted n8n workflow-automation software to route contact-form submissions and configured internal notifications. The use of n8n software does not by itself mean n8n GmbH receives the workflow content. The hosting, integration, and destination providers used by a workflow may receive data according to the route described elsewhere in this Policy.

Planned provider: Ottomato is evaluating Jev, provided by TypeSafe AI, Inc., for future AI-assisted classification, prioritization, routing, summaries, and response assistance. Jev is not an active recipient of customer data as of the date above. Ottomato will provide required notice and obtain any required authorization before introducing Jev as a recipient, and will update this Policy before activation if the change materially affects the processing described here.

6. How Long We Keep Data

• Contact-form submissions: up to twenty-four (24) months from receipt, then deleted unless they have matured into an active engagement.
• Voice Agent transcripts: up to ninety (90) days unless they are tied to an active engagement, in which case they are retained for the duration of that engagement. Transcript messages you request by electronic mail may also remain in Ottomato's electronic-mail management system until you ask for deletion, subject to legal retention limits and unsubscribe-suppression records.
• Newsletter subscribers: until you unsubscribe. Bounced electronic-mail addresses are removed automatically.
• OttoPortal account, workspace, and access records: for the duration of portal access or the relevant engagement, plus a reasonable archival period for service delivery, security, audit, legal compliance, and dispute-resolution purposes.
• Server logs: up to thirty (30) days.
• Analytics: aggregated only. No per-visitor retention.
• Electronic-mail correspondence: for the duration of the business relationship plus a reasonable archival period for reference and legal compliance, generally not exceeding seven (7) years.

7. Cookies and Tracking

The Site does not set tracking cookies. The privacy-focused analytics tool Ottomato uses is intentionally cookieless and collects anonymous page-level data. Ottomato does not integrate Google Analytics, Facebook Pixel, or any advertising network on the Site.

The Voice Agent does not use an embedded third-party widget. Browser requests are made to Ottomato's voice runtime, which proxies xAI realtime requests from Ottomato's backend.

OttoPortal may use authentication cookies, session cookies, login tokens, or equivalent security technologies that are necessary to keep authorized users signed in and enforce access controls. These technologies are used for authentication, security, and session management, not advertising.

8. Your Rights

Depending on where you live, you may have the following rights:

• Access — you may request a copy of the personal information Ottomato holds about you.
• Rectification — you may ask Ottomato to correct inaccurate or incomplete data.
• Erasure — you may ask Ottomato to delete your personal data, subject to legal retention limits.
• Portability — you may receive your data in a structured, machine-readable format.
• Restriction — you may ask Ottomato to limit how it uses your data.
• Objection — you may object to processing based on legitimate interest, including direct marketing.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time. Past processing remains lawful.

For residents of the European Economic Area or the United Kingdom: you have the above rights under the General Data Protection Regulation and the United Kingdom General Data Protection Regulation.

For California residents: you have the right to know what personal information Ottomato collects, the right to delete it, the right to correct it, and the right to non-discrimination for exercising these rights under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020. Ottomato does not sell or share personal information for cross-context behavioral advertising.

For residents of Canada, Thailand, and the wider European Economic Area: equivalent rights apply under the Personal Information Protection and Electronic Documents Act, the Personal Data Protection Act B.E. 2562 (2019), and local implementations of the General Data Protection Regulation.

To exercise any right, send a Data Subject Access Request by electronic mail to [email protected] from the address associated with your data. Ottomato responds within thirty (30) days or sooner where required.

9. Age and Children

The Services have the following minimum-age requirements:

• Free surfaces (Site, contact form, Newsletter, free Academy preview content): users must be at least thirteen (13) years of age, consistent with the Children's Online Privacy Protection Rule.
• Residents of the European Economic Area and the United Kingdom: users must be at least sixteen (16) years of age, consistent with Article 8 of the General Data Protection Regulation.
• Paid Academy tiers and custom engagements: users must be at least eighteen (18) years of age and have legal contractual capacity in their jurisdiction.

Ottomato does not knowingly collect personal data from children below the applicable minimum age. If you believe Ottomato has collected data from a child below the applicable minimum age, contact [email protected] and Ottomato will delete it.

10. Security

Ottomato applies reasonable technical and organizational safeguards to protect your data. These include Transport Layer Security for data in transit, encrypted storage where supported, least-privilege access controls, content-security-policy headers and HTTP Strict Transport Security on the Site, subresource integrity on pinned third-party scripts, and audit logging of administrative actions. No system is perfectly secure, and Ottomato cannot guarantee absolute security.

OttoPortal access is protected by Cloudflare Access and limited to authorized users. Ottomato may review portal access logs and revoke access where needed to protect clients, deliverables, Confidential Information, or the Services.

To report a suspected vulnerability, send an electronic-mail message to [email protected]. Refer also to the security-contact file at /.well-known/security.txt.

11. Applications

Ottomato develops and distributes Applications through the Academy and through custom engagements. Each Application is governed by its own privacy policy and terms of use, which are provided with or within the Application. Some Applications are designed to run entirely on the user's own device and do not transmit data to Ottomato or to any third party. Other Applications may collect, process, or transmit data as described in their specific policies. Users are responsible for reviewing the privacy policy and terms of use of each Application before use.

This Privacy Policy governs the ottomato.ai website, the Voice Agent, the Newsletter, the Academy, and general interactions with Ottomato. It does not govern individual Applications, which have their own policies.

12. Artificial-Intelligence Disclosure

The Voice Agent is an Artificial-Intelligence software agent. When you speak with the Voice Agent, you are speaking with software, not a human being. Conversations are processed in real time by the conversational-AI provider identified in Section 5. Ottomato may also use Artificial Intelligence to classify, prioritize, route, and summarize inquiries and to assist with responses. An Artificial-Intelligence suggestion is not by itself professional advice or a contractual commitment. Any offer, quote, order acceptance, payment authorization, amendment, or other commitment follows the acceptance process that applies to the relevant Service, transaction, or signed agreement. Where appropriate, Ottomato will follow up in writing from [email protected].

Do not send detailed Confidential Information, special-category or similarly sensitive personal data, credentials, private keys, access tokens, or payment-card data through an ordinary AI-assisted intake channel. To arrange a confidential exchange, contact [email protected], or tell the Voice Agent only that you need a confidential exchange, and provide no more than contact details and a brief request without confidential details. Ottomato will review existing confidentiality obligations, arrange a mutual nondisclosure agreement when appropriate, confirm the necessary data-processing terms, and identify an approved channel before detailed information is shared. A nondisclosure agreement does not by itself authorize disclosure to every Artificial-Intelligence provider or replace a necessary Data Processing Agreement.

13. Complaints

If you believe Ottomato has mishandled your data, send an electronic-mail message to [email protected]. If you are not satisfied with Ottomato's response, you may lodge a complaint with your local supervisory authority: in the European Economic Area, your national data-protection authority; in the United Kingdom, the Information Commissioner's Office; in California, the California Privacy Protection Agency.

14. Changes

Ottomato will update this Policy when the Services or applicable law changes. The "Last Updated" date at the top of this Policy reflects the most recent version. For material changes, Ottomato will notify Newsletter subscribers by electronic mail and post a notice at the top of the Site for at least fourteen (14) days. Where a separate service or privacy notice is required, Ottomato will provide it through the contact details or Service channel associated with the processing; Newsletter subscription status is not a substitute for that notice.

15. Contact

Ottomato. All inquiries: [email protected].