Privacy Policy

1. Who We Are

Otogent AI is operated by OtogentLabs ("we," "us," "our"). Our platform lets founders, engineers, and operators build, code, and scale products using autonomous AI agents.

Contact: privacy@otogent.ai — we respond within 30 days.

2. What Otogent AI Does

Otogent AI is an AI-powered launchpad: you describe what you want to build, and our autonomous agents design, code, and help deploy it. Using the platform requires creating an account. A freemium tier is available; paid plans unlock higher usage and advanced features.

3. Information We Collect

What We Do NOT Collect

We want to be upfront. Otogent AI does not collect:

• Government-issued IDs, social security numbers, or tax IDs
• Contact lists, address books, or social graphs
• Precise GPS location data
• Biometric data, health data, or any special-category personal data under GDPR Art. 9
• Payment card numbers — these are processed entirely by our payment processor (Stripe) and never touch our servers

Account Data

When you sign up: email address, username or display name, and (if you use OAuth) the public profile data the provider shares (name, avatar URL). We use this to identify your account and deliver the service.

Data You Submit (Prompts, Uploads, Inputs)

Any text, code, files, or URLs you send to our agents are processed to generate output and return it to you. Your submitted data is not used to train, fine-tune, or improve AI models — by us or by the underlying model providers we use via API (see §6 and §4).

Generated Output

AI-generated content (code, text, assets) is returned to your browser/dashboard. Output may be stored in your account workspace so you can access it later. We do not use your generated output to train AI models.

Analytics Data

We use Google Analytics 4 (GA4) to understand aggregate usage patterns — page views, feature usage, device/browser type, country-level location, session duration. Analytics data does not identify you individually. GA4 sets cookies listed in §5.

Usage and Log Data

Our servers automatically collect standard access logs: IP address, request path, HTTP method, response status code, and timestamp. These are used for security monitoring, debugging, and abuse prevention. Logs are retained for 30 days.

Payment Data

If you subscribe to a paid plan, Stripe processes your payment. We receive only the last 4 digits of your card, card type, expiry, and billing country — enough to display your subscription status. We never receive or store full card numbers.

4. How We Use Information

• Service delivery: processing your requests, generating output, maintaining your workspace
• Account management: authentication, billing, plan limits
• Security and abuse prevention: detecting fraud, misuse, and unauthorized access
• Product improvement: aggregate analytics to understand which features work and which don't
• Legal compliance: responding to lawful requests, enforcing our Terms
• Communications: transactional emails (account confirmation, billing receipts, security alerts), and — with your consent — product updates

AI Model Training — Explicit Disclosure

Otogent AI does not use your submitted data or generated output to train, fine-tune, retrain, or evaluate any AI model. We access foundation model providers (e.g., Google Gemini, OpenAI) exclusively via their API. Under both providers' API terms, data submitted via API is not used for model training by default. We have not opted in to any data-sharing arrangement that would allow this.

5. Cookies

Otogent AI uses a small number of cookies. We do not use advertising cookies or third-party tracking pixels.

We use a cookie notice (not a consent banner) because we only use essential and analytics cookies — no advertising pixels or cross-site tracking. See our Cookie Policy for full details and browser-level opt-out instructions.

Otogent AI does not currently respond to Do Not Track (DNT) browser signals because no uniform DNT standard exists.

6. Third-Party Processors

We share data with the following processors only to the extent necessary to operate the service:

Analytics tools: We currently use Google Analytics 4 for aggregate usage measurement. We may in the future integrate additional product analytics tools (such as PostHog) to better understand how features are used. Any new analytics integration will be reflected in an updated version of this policy before activation, with appropriate notice.

7. Data Retention

8. Your Rights

GDPR (EEA/UK Residents)

You have the right to:

• Access — request a copy of personal data we hold about you (Art. 15)
• Rectification — correct inaccurate data (Art. 16)
• Erasure — request deletion ("right to be forgotten") (Art. 17)
• Restriction — limit how we process your data (Art. 18)
• Portability — receive your data in a machine-readable format (Art. 20)
• Objection — object to processing based on legitimate interest (Art. 21)
• Withdraw consent — where processing is consent-based

CCPA (California Residents)

You have the right to:

• Know what personal information is collected, used, disclosed, or sold
• Delete personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information

Otogent AI does not sell or share personal information as defined by the CCPA/CPRA.

How to Exercise Your Rights

Email privacy@otogent.ai with subject line "Privacy Rights Request." We will respond within 30 days. For account deletion, you can also use the account settings page directly. We may ask for identity verification before processing sensitive requests.

9. International Transfers

OtogentLabs operates primarily in the United States. If you access the platform from the EEA, UK, or elsewhere, your data may be transferred to and processed in the US and other countries where our processors operate.

For transfers of EEA/UK data to the US, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Agreement (IDTA). Our processors listed in §6 maintain their own transfer mechanisms.

10. Children

Otogent AI is not directed to children under 13 (US/COPPA) or under 16 (EEA/GDPR). We do not knowingly collect personal information from children under these thresholds. If you believe a child has submitted data to our platform, contact us at privacy@otogent.ai and we will delete it promptly.

11. Security

We use industry-standard measures to protect your data:

• All data in transit is encrypted via TLS 1.2+ (HTTPS enforced)
• Data at rest is encrypted by our hosting provider (Vercel / cloud infrastructure)
• We do not store payment card data — Stripe handles all card processing
• Access to production systems is restricted to authorized personnel with MFA
• We monitor for suspicious activity and security events continuously

No system is 100% secure. In the event of a data breach affecting your rights, we will notify you and relevant authorities as required by applicable law (GDPR: within 72 hours of discovery).

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted at this URL with a new "Last updated" date. For significant changes — for example, new data collection categories or new third-party processors — we will notify you by email (if you have an account) or by a banner on the site. We encourage you to review this policy periodically.

13. Contact

For privacy questions, data access requests, or complaints:

• Email: privacy@otogent.ai
• Response time: within 30 days
• EEA/UK supervisory authority complaint: Find your national DPA ↗

14. Regional Supplements

EEA / UK Supplement (GDPR)

Legal bases for processing (GDPR Art. 6):

• Contract (Art. 6(1)(b)): processing necessary to deliver the service you signed up for — account management, AI generation, workspace storage
• Legitimate interest (Art. 6(1)(f)): security monitoring, fraud prevention, aggregate analytics
• Legal obligation (Art. 6(1)(c)): payment records retention, law enforcement requests
• Consent (Art. 6(1)(a)): marketing emails (you can withdraw at any time)

Data Subject Rights (Art. 15–22): See §8. To exercise any right, email privacy@otogent.ai. Response within 30 days; may be extended to 90 days for complex requests (we will inform you).

International transfers: We rely on Standard Contractual Clauses (Module 2: Controller-to-Processor) for transfers to the US, incorporated by reference into our processor agreements.

Right to lodge a complaint: You have the right to lodge a complaint with your national Data Protection Authority (DPA). Find your DPA at edpb.europa.eu ↗.

California Supplement (CCPA / CPRA)

The following table describes the categories of personal information we have collected in the past 12 months, their business purposes, and whether we have sold or shared them:

Do Not Sell or Share My Personal Information: Otogent AI does not sell or share personal information as defined under CCPA/CPRA. No opt-out mechanism is required; however, you may contact us at privacy@otogent.ai to confirm.

Authorized agents: California residents may designate an authorized agent to submit a request on their behalf. We will require written proof of authorization.