Privacy Policy

1. Who we are

OttoSM ("we", "us", "our") is operated by INTEGRITY SOFTECH LLP, registered at FIRST FLOOR, MF-119, Sanghavi Tower - 4, ADAJAN, Adajan, Surat, Surat, Gujarat, 395009 , India. We are the data controller for the information described in this policy.

For any privacy question, or to exercise any of the rights described below, contact privacy@ottosm.com.

2. Information you give us directly

When you create an account and use OttoSM, we collect:

• Your name, email address and password (stored only as a one-way hash that cannot be reversed)
• Your business name, industry, business type and website address
• Products or services you add, including descriptions, prices and images
• Posts, captions, images and videos you create, or that Otto drafts for you
• Billing records: your plan, invoices, and payment identifiers from our payment processor

3. Data we receive from Facebook and Instagram

When you connect a Facebook Page or Instagram account, Meta gives us access to the data listed below. We only ever receive it after you explicitly grant permission on Meta's own consent screen, and only for the accounts you choose to connect.

• Facebook Page name and Page ID
• Facebook Page access tokens, which allow us to publish on your behalf
• The Instagram professional account ID and username linked to that Page
• IDs and permalinks of the posts we publish for you
• Post performance metrics: impressions, reach, reactions, comments, shares, saves and link clicks
• Page and account level metrics: follower counts, and aggregated audience demographics such as country, city and age band
• Advertising data, where you run paid campaigns: campaign, ad set and ad structure, budgets, spend, reach and conversion counts

Just as importantly, here is what we do not receive. We never get your Facebook or Instagram password. We do not read your private messages or direct messages. We do not access personal profiles or friend lists — only the professional Pages and accounts you deliberately connect.

4. Why we use it

We use the data above only to provide the service you asked for:

• To publish and schedule the posts you approve
• To generate captions, images and videos with AI, based on your brand, products and instructions
• To create, launch, pause and manage the advertising campaigns you set up
• To show you analytics, return-on-ad-spend reporting, and AI-written insights
• To apply your plan's usage limits and bill you correctly
• To send service email such as address verification, password resets and scheduled reports

We do not sell your data. We do not share it with advertisers or data brokers. We do not use your content or your customers' data to train our own AI models.

5. Who we share it with

We rely on a small number of processors, and each one receives only what it needs to do its job:

• Meta Platforms — to publish your content and run your advertising campaigns on Facebook and Instagram
• Razorpay — to take subscription payments. They receive billing details, never your social media data
• Replicate — to generate AI images and video from the prompts you or Otto write
• Our hosting provider — to run the servers and database that store your account

We may also disclose data where the law requires it, or where it is necessary to protect our rights, our users, or the safety of others.

6. How long we keep it

• Access tokens: deleted immediately when you disconnect a channel or delete your account
• Posts, products and media you created: kept while your account remains open
• Performance metrics: kept for [RETENTION PERIOD], so your historical reporting stays useful
• Billing and invoice records: kept for as long as tax and accounting law requires, even after your account closes

When you delete your account, we remove your personal data and social connections within 30 days, apart from the billing records noted above.

7. Your rights

You can ask us to:

• Give you a copy of the data we hold about you
• Correct anything that is inaccurate or out of date
• Delete your data
• Export your data in a portable format
• Stop a particular use of your data

Email privacy@ottosm.com and we will respond within 30 days. Our Data Deletion page describes the fastest self-serve routes, which take effect immediately.

8. Grievance Officer (India)

Under India's Digital Personal Data Protection Act, 2023, you may contact our Grievance Officer:

• Name: Amar Panchal
• Email: privacy@ottosm.com
• Address: FIRST FLOOR, MF-119, Sanghavi Tower - 4, ADAJAN, Adajan, Surat, Surat, Gujarat, 395009 , India

We acknowledge complaints promptly and respond within 30 days.

9. International transfers

OttoSM is operated from India, and the processors listed in section 5 operate globally. This means your data may be processed outside the country you live in. Where that happens we rely on the processor's own safeguards and contractual commitments to protect it.

10. Security

Access tokens and API credentials are encrypted at rest. Passwords are stored as one-way hashes and can never be recovered, only reset. Access to production data is limited to the staff who need it to operate and support the service.

No system is perfectly secure. If we ever discover a breach affecting your data, we will tell you and the relevant authority without undue delay.

11. Children

OttoSM is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us their data, email privacy@ottosm.com and we will delete it.

12. Changes to this policy

If we make a material change, we will update the date at the top of this page, and where the change affects how we use your data we will tell you by email. Continuing to use OttoSM after a change takes effect means you accept the updated policy.