Privacy Policy

This Privacy Policy (hereinafter this "Privacy Policy" or this "Policy") is issued by Ottomato (hereinafter "Ottomato", "we", "us", or "our"). This Policy explains what information Ottomato collects when you interact with our website located at https://ottomato.ai (the "Site"), our Super-Intelligence voice agent named Otto (the "Voice Agent"), any application Ottomato builds, distributes, or otherwise operates through a custom engagement (each, an "Application"), our electronic-mail newsletter titled The Builder's Report (the "Newsletter"), and any other service Ottomato operates (collectively, the "Services"). This Policy also explains the lawful bases Ottomato invokes as a matter of European data-protection law, with whom we share data, how long we retain it, and how you can exercise your rights.

Ottomato also operates OttoPortal, a client portal available at https://portal.ottomato.net/ (the "OttoPortal"), for authorized clients to access engagement-related resources, communications, status information, and deliverables. This Policy applies to OttoPortal where Ottomato operates it as part of the Services.

Ottomato generally acts as a controller for Site inquiries, Newsletter subscriptions, and its own business communications. When Ottomato processes personal data in Client Content solely on a client's documented instructions, Ottomato acts as that client's processor or service provider. The applicable signed Master Services Agreement, Statement of Work, or Data Processing Agreement controls those engagement-specific roles and instructions.

If any part of this Policy is unclear, contact us at info@ottomato.ai.

A. Definitions

For purposes of this Policy, the following capitalized terms have the meanings given below. Additional terms may be defined parenthetically on first use in the body of this Policy and carry that defined meaning throughout.

• "Application" means any software application Ottomato builds, distributes, or otherwise operates through a custom engagement, including applications that run on the user's own device and applications that run on third-party infrastructure.
• "Application Programming Interface" or "API" means a defined set of protocols and tools for building software and for enabling communication between software components.
• "Super Intelligence" means computational systems that perform tasks typically associated with human cognition, including language understanding, language generation, voice synthesis, and voice recognition. Super Intelligence is the term that United States federal agencies use under the Executive Order of September 29, 2026. It has the same meaning as "artificial intelligence" in 15 U.S.C. § 9401(3) and in other laws that use that term.
• "California Consumer Privacy Act of 2018" or "CCPA" means the California Consumer Privacy Act of 2018, California Civil Code Section 1798.100 et seq.
• "California Privacy Rights Act of 2020" or "CPRA" means the California Privacy Rights Act of 2020, which amended the CCPA.
• "Children's Online Privacy Protection Rule" or "COPPA" means the rule at 16 Code of Federal Regulations Part 312, which governs the online collection of personal information from children under thirteen (13) years of age.
• "Client Content" means data, documents, media, code, or other material provided to Ottomato by a client in connection with a paid engagement.
• "Data Processing Agreement" or "DPA" means a written contract that governs the processing of personal data by a processor on behalf of a controller.
• "Data Subject Access Request" or "DSAR" means a request by an individual to exercise a right granted under the General Data Protection Regulation, the California Consumer Privacy Act of 2018, or an equivalent statute.
• "Domain Name System" or "DNS" means the hierarchical and decentralized naming system that translates human-readable domain names into machine-readable network addresses.
• "European Economic Area" or "EEA" means the twenty-seven (27) Member States of the European Union together with Iceland, Liechtenstein, and Norway.
• "General Data Protection Regulation" or "GDPR" means Regulation (European Union) 2016/679 of the European Parliament and of the Council of 27 April 2016.
• "Internet Protocol address" or "IP address" means the numerical label assigned to a device connected to a network that uses the Internet Protocol for communication.
• "Newsletter" has the meaning given in the introductory paragraph of this Policy.
• "OttoPortal" means the client portal Ottomato operates at https://portal.ottomato.net/ for authorized client access to engagement-related resources, communications, status information, and deliverables.
• "Output" means content, data, or media generated by a Super-Intelligence model in the course of delivering a Service.
• "Personal Data Protection Act B.E. 2562 (2019)" or "PDPA" means the Personal Data Protection Act B.E. 2562 (2019) of the Kingdom of Thailand.
• "Personal Information Protection and Electronic Documents Act" or "PIPEDA" means the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, of Canada.
• "Services" has the meaning given in the introductory paragraph of this Policy.
• "Site" has the meaning given in the introductory paragraph of this Policy.
• "Standard Contractual Clauses" or "SCCs" means the contractual clauses approved by the European Commission pursuant to Commission Implementing Decision (European Union) 2021/914 for the transfer of personal data to third countries.
• "Third-Party Service" has the meaning given in Section 5 of this Policy.
• "Transport Layer Security" or "TLS" means the cryptographic protocol that provides secure communication over a computer network.
• "United Kingdom General Data Protection Regulation" or "UK GDPR" means the United Kingdom General Data Protection Regulation as given effect in United Kingdom law by the European Union (Withdrawal) Act 2018.
• "United States", "United States of America", or "U.S." means the United States of America.
• "Voice Agent" has the meaning given in the introductory paragraph of this Policy.

1. Scope

This Policy applies to:

• The Site at https://ottomato.ai and its staging mirrors.
• OttoPortal at https://portal.ottomato.net/, including authenticated workspaces, dashboards, resources, and deliverables Ottomato makes available through it.
• The Voice Agent, wherever it is embedded, including the inline embed on the contact page and the floating widget on other pages.
• Forms Ottomato hosts on the Site, including the contact form and any future inquiry or waitlist form.
• The Newsletter.
• Anonymous, cookieless website analytics as described in Section 7.

Applications are governed by their own individual privacy policies as described in Section 11, not by this Policy.

This Policy does not cover third-party platforms Ottomato links to but does not operate, including X, formerly known as Twitter (X Corp., available at https://x.com), YouTube (YouTube LLC, available at https://youtube.com), and LinkedIn (LinkedIn Corporation, available at https://linkedin.com).

2. Information We Collect

2.1 Information you provide to Ottomato directly

• Contact data: your name, electronic-mail address, company name, and the content of the message you submit through the contact form, support channel, or electronic mail. Ordinary contact details and a high-level description of your request are appropriate for these intake channels.
• Voice and chat data: if you speak with or type to the Voice Agent, the audio, text, transcript, and related interaction metadata are processed to generate a response and may be received by the conversational Super-Intelligence provider identified in Section 5. Ottomato may receive conversation content and summaries to classify, prioritize, route, and respond to your inquiry. See Sections 5 and 12.
• Transcript-request data: if you ask Ottomato to send a Voice Agent transcript to you, Ottomato collects your electronic-mail address, the transcript, the page where the conversation happened, and the time of the request. A transcript request does not subscribe you to the Newsletter.
• Newsletter data: if you make a separate affirmative choice to subscribe, Ottomato stores your electronic-mail address and subscription status. You may unsubscribe at any time using the link in any Newsletter message.
• OttoPortal and engagement data: if you access OttoPortal or work with Ottomato, Ottomato may collect your name, electronic-mail address, organization, portal profile details, workspace membership, messages, comments, project requests, requirements, order or quote information, uploaded files, task or status updates, support requests, deliverable-access records, and other information you submit to or access through OttoPortal. Client Content uploaded to OttoPortal remains Client Content under the Terms and any applicable signed agreement.
• Partner applications. If you apply to become an Ottomato partner, we collect your name, email address, phone number, country, whether you apply as an individual or a business, your company name, an optional website or profile link, your preferred language, and what you tell us about your network and experience. We use this information to review your application and, if we approve it, to create your partner account. Applications are stored on Ottomato's own server, a Hostinger virtual private server in Kuala Lumpur, Malaysia. Cloudflare protects the form against automated abuse. We keep an application for 24 months after our decision and then delete it. If you become a partner, we keep your account data for the duration of the partnership.
• Confidential-intake data: if you ask to arrange a confidential exchange, Ottomato initially requests only contact details and a brief request without confidential details. Ottomato uses that limited information to review existing confidentiality obligations, arrange a mutual nondisclosure agreement when appropriate, confirm the necessary data-processing terms, and identify an approved channel.

Confidential Information is business information protected by an agreement, the circumstances of disclosure, or law. Personal data is information relating to an identifiable person. Special-category or similarly sensitive personal data receives additional protection under some laws. Credentials, access tokens, private keys, and payment-card data are security or payment secrets. These categories may overlap, but they are not interchangeable. Do not send detailed Confidential Information, special-category or similarly sensitive personal data, credentials, or payment-card data through an ordinary inquiry channel unless Ottomato has confirmed that the channel and processing arrangements are appropriate.

2.2 Information we collect automatically

• Analytics: Ottomato collects anonymous page views, referrers, browser and operating-system family, and country-level geolocation using a privacy-focused, cookieless analytics tool. This tool does not identify individual users. See Section 7.
• Server logs: the third-party hosting providers identified in Section 5 record standard request metadata on Ottomato's behalf: Internet Protocol address, user agent, timestamp, path, and response code. Logs are retained for up to thirty (30) days for security and performance reasons.
• Form metadata: when you submit the contact form, Ottomato records the originating Internet Protocol address and user agent alongside your message to deter spam.
• OttoPortal access metadata: when you sign in to or use OttoPortal, Ottomato and its access-control providers may process login method, access decisions, timestamps, Internet Protocol address, user agent, requested hostname or path, session metadata, and security or audit logs.

3. How We Use Your Information and Our Lawful Bases

• To respond to and route your inquiry. Ottomato uses contact, voice, chat, support, and project-request data to classify, prioritize, route, summarize, and respond to messages, determine whether Ottomato is the right fit for your project, and, when appropriate, share a Google Calendar appointment link so you can book a conversation with Ned Malki. Lawful basis: taking steps at your request before entering a contract, performance of a contract, and Ottomato's legitimate interest in operating a business, depending on the context.
• To operate OttoPortal. Ottomato uses OttoPortal data and access metadata to authenticate authorized users, administer workspace access, communicate about engagements, coordinate work, provide support, deliver resources and deliverables, and maintain security and audit records. Lawful basis: performance of a contract and Ottomato's legitimate interest in client service delivery, access control, and platform security.
• To review partner applications. Ottomato uses partner-application data to review each application, to contact the applicant by electronic mail, and, if Ottomato approves the application, to create the partner account. Lawful basis: taking steps at your request before entering a contract.
• To operate the Voice Agent. Voice and chat data is processed to generate a response in real time, qualify and route inquiries, create a conversation summary, share a Google Calendar appointment link when appropriate, and, when you request it, send a transcript to the electronic-mail address you provide. Lawful basis: taking steps at your request before entering a contract and Ottomato's legitimate interest in handling inquiries. Where applicable law requires consent for microphone access, recording, transcription, or another specific action, Ottomato must obtain that consent before the relevant processing.
• To improve the Services. Anonymous analytics, aggregated form-intake patterns, and non-identifying feedback inform design and content decisions. Lawful basis: Ottomato's legitimate interest in improving a product it offers.
• To send the Newsletter. If you separately opted in, Ottomato sends occasional essays about building with Super Intelligence. A service request or transcript request does not by itself provide marketing consent. You can unsubscribe from any Newsletter message. Lawful basis: consent.
• To comply with legal obligations. Tax, accounting, anti-fraud, and law-enforcement requests where a valid order exists. Lawful basis: legal obligation.
• To protect the Services. Server logs, rate limits, honeypot fields, and abuse detection protect Ottomato and its users from spam, scraping, and attacks. Lawful basis: Ottomato's legitimate interest in platform integrity.

4. Where Your Data Is Stored

The Site's pages are hosted on third-party shared web hosting in the United States and delivered through a global content-delivery network. Domain-Name-System records and Transport-Layer-Security certificates are administered through third-party providers identified in Section 5.

Ottomato's self-hosted services run on third-party virtual private servers in Kuala Lumpur, Malaysia. These services include the Voice Agent runtime, the contact-form workflow, the Newsletter and electronic-mail database, lead records, and the cookieless analytics tool. Personal information that you submit through the Site, the Voice Agent, or the Newsletter is therefore processed and stored in Malaysia. Partner applications submitted through the Site are stored on the same Hostinger virtual private server in Kuala Lumpur, Malaysia. Third-party providers identified in Section 5 may process personal information in other countries, including the United States.

If you are located in the European Economic Area, the United Kingdom, or any other jurisdiction outside the United States, your personal information will be transferred to Malaysia and to the United States. For transfers from the European Economic Area and the United Kingdom, Ottomato uses the European Commission's Standard Contractual Clauses and, where the applicable third-party provider supports them, complementary safeguards. You can request a copy of the Standard Contractual Clauses by electronic mail at info@ottomato.ai.

5. Third-Party Services and Subprocessors

Certain Services interoperate with third-party services, platforms, or infrastructure providers (each a "Third-Party Service"). Your direct use of a Third-Party Service may be subject to that provider's terms, conditions, and privacy practices. Ottomato does not control a provider's independent policies, availability, performance, security, or pricing. This allocation does not limit Ottomato's obligations under applicable law or a signed agreement when Ottomato selects or uses a provider to process personal data on its behalf.

The following providers may receive personal data from the Site, the Voice Agent, the Newsletter, or OttoPortal to deliver the described function. Ottomato does not sell personal data to these providers. Ottomato may add or remove providers as the Services evolve and will update this list when a change materially affects the processing described in this Policy.

For OttoPortal, the list also includes providers that receive login, identity, access-control, or portal-use metadata to provide authorized client-portal access. OttoPortal is currently protected by Cloudflare Access and may offer Google sign-in and electronic-mail login-code flows through Cloudflare Access.

Ottomato also uses Listmonk, a self-hosted electronic-mail management system, to maintain the Newsletter list, the master electronic-mail database, lead-summary messages, and requested transcript messages. Listmonk stores electronic-mail addresses, subscription status, unsubscribe records, lead-summary data, and transcript-message delivery data for Ottomato's internal use. Ottomato does not sell this information. If you ask Ottomato to delete it, Ottomato will delete it subject to legal retention limits and unsubscribe-suppression records needed to honor your opt-out.

• Hostinger International Ltd. (hereinafter "Hostinger"), available at https://hostinger.com — web hosting for the Site in the United States, and virtual-private-server hosting in Malaysia for Ottomato's self-hosted services described in Section 4. Receives standard request metadata (Internet Protocol address, user agent, path, timestamp) for any request served, and hosts the servers that store the personal information those services hold.
• Cloudflare, Inc. (hereinafter "Cloudflare"), available at https://cloudflare.com — Domain-Name-System resolution, Transport-Layer-Security termination, and edge caching for ottomato.ai subdomains. Cloudflare acts as a processor for any request it proxies on Ottomato's behalf. On the partner application form, Cloudflare Turnstile checks that a person, not an automated program, submits the form, and receives browser and device signals, Internet Protocol address, and request metadata to make that check. For OttoPortal, Cloudflare also provides Cloudflare Access identity-aware access control and may receive login and access metadata such as electronic-mail address, identity-provider response data, Internet Protocol address, user agent, timestamps, requested hostname or path, and access decisions.
• SpaceXAI LLC (hereinafter "SpaceXAI"), available at https://x.ai — provider of the Grok conversational Super-Intelligence service that powers the current Voice Agent. Receives voice audio, text chat, conversation transcripts, and related request metadata when you interact with the Voice Agent.
• Google LLC (hereinafter "Google"), available at https://google.com — operator of Google Workspace, which Ottomato uses for electronic-mail delivery to and from info@ottomato.ai, and of Google Calendar Appointment scheduling. Receives the content of electronic-mail messages exchanged with Ottomato. When you book a conversation through a Google Calendar appointment link shared by the Voice Agent or by electronic mail, Google receives the name, electronic-mail address, and booking metadata you submit on that scheduling page. Google also receives OAuth request metadata and returns basic profile and electronic-mail data to Cloudflare Access when you choose Google sign-in for OttoPortal.

Ottomato uses self-hosted workflow-automation software to route contact-form submissions and configured internal notifications. Because the software is self-hosted, its maker does not receive the workflow content. The hosting, integration, and destination providers used by a workflow may receive data according to the route described elsewhere in this Policy.

Planned provider: Ottomato is evaluating Jev, provided by TypeSafe AI, Inc., for future Super-Intelligence-assisted classification, prioritization, routing, summaries, and response assistance. Jev is not an active recipient of customer data as of the date above. Ottomato will provide required notice and obtain any required authorization before introducing Jev as a recipient, and will update this Policy before activation if the change materially affects the processing described here.

6. How Long We Keep Data

• Contact-form submissions: up to twenty-four (24) months from receipt, then deleted unless they have matured into an active engagement.
• Partner applications: twenty-four (24) months after Ottomato's decision, then deleted. If you become a partner, Ottomato keeps your partner account data for the duration of the partnership.
• Voice Agent transcripts: up to ninety (90) days unless they are tied to an active engagement, in which case they are retained for the duration of that engagement. Transcript messages you request by electronic mail may also remain in Ottomato's electronic-mail management system until you ask for deletion, subject to legal retention limits and unsubscribe-suppression records.
• Newsletter subscribers: until you unsubscribe. Bounced electronic-mail addresses are removed automatically.
• OttoPortal account, workspace, and access records: for the duration of portal access or the relevant engagement, plus a reasonable archival period for service delivery, security, audit, legal compliance, and dispute-resolution purposes.
• Server logs: up to thirty (30) days.
• Analytics: aggregated only. No per-visitor retention.
• Electronic-mail correspondence: for the duration of the business relationship plus a reasonable archival period for reference and legal compliance, generally not exceeding seven (7) years.

7. Cookies and Tracking

The Site does not set tracking cookies. The privacy-focused analytics tool Ottomato uses is intentionally cookieless and collects anonymous page-level data. Ottomato does not integrate Google Analytics, Facebook Pixel, or any advertising network on the Site.

The Voice Agent does not use an embedded third-party widget. Browser requests are made to Ottomato's voice runtime, which proxies SpaceXAI realtime requests from Ottomato's backend.

OttoPortal may use authentication cookies, session cookies, login tokens, or equivalent security technologies that are necessary to keep authorized users signed in and enforce access controls. These technologies are used for authentication, security, and session management, not advertising.

8. Your Rights

Depending on where you live, you may have the following rights:

• Access — you may request a copy of the personal information Ottomato holds about you.
• Rectification — you may ask Ottomato to correct inaccurate or incomplete data.
• Erasure — you may ask Ottomato to delete your personal data, subject to legal retention limits.
• Portability — you may receive your data in a structured, machine-readable format.
• Restriction — you may ask Ottomato to limit how it uses your data.
• Objection — you may object to processing based on legitimate interest, including direct marketing.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time. Past processing remains lawful.

For residents of the European Economic Area or the United Kingdom: you have the above rights under the General Data Protection Regulation and the United Kingdom General Data Protection Regulation.

For California residents: you have the right to know what personal information Ottomato collects, the right to delete it, the right to correct it, and the right to non-discrimination for exercising these rights under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020. Ottomato does not sell or share personal information for cross-context behavioral advertising.

For residents of Canada, Thailand, and the wider European Economic Area: equivalent rights apply under the Personal Information Protection and Electronic Documents Act, the Personal Data Protection Act B.E. 2562 (2019), and local implementations of the General Data Protection Regulation.

To exercise any right, send a Data Subject Access Request by electronic mail to info@ottomato.ai from the address associated with your data. Ottomato responds within thirty (30) days or sooner where required.

9. Age and Children

The Services have the following minimum-age requirements:

• Free surfaces (Site, contact form, Newsletter): users must be at least thirteen (13) years of age, consistent with the Children's Online Privacy Protection Rule.
• Residents of the European Economic Area and the United Kingdom: users must be at least sixteen (16) years of age, consistent with Article 8 of the General Data Protection Regulation.
• Custom engagements: users must be at least eighteen (18) years of age and have legal contractual capacity in their jurisdiction.

Ottomato does not knowingly collect personal data from children below the applicable minimum age. If you believe Ottomato has collected data from a child below the applicable minimum age, contact info@ottomato.ai and Ottomato will delete it.

10. Security

Ottomato applies reasonable technical and organizational safeguards to protect your data. These include Transport Layer Security for data in transit, encrypted storage where supported, least-privilege access controls, content-security-policy headers and HTTP Strict Transport Security on the Site, subresource integrity on pinned third-party scripts, and audit logging of administrative actions. No system is perfectly secure, and Ottomato cannot guarantee absolute security.

OttoPortal access is protected by Cloudflare Access and limited to authorized users. Ottomato may review portal access logs and revoke access where needed to protect clients, deliverables, Confidential Information, or the Services.

To report a suspected vulnerability, send an electronic-mail message to info@ottomato.ai. Refer also to the security-contact file at /.well-known/security.txt.

11. Applications

Ottomato develops and distributes Applications through custom engagements. Each Application is governed by its own privacy policy and terms of use, which are provided with or within the Application. Some Applications are designed to run entirely on the user's own device and do not transmit data to Ottomato or to any third party. Other Applications may collect, process, or transmit data as described in their specific policies. Users are responsible for reviewing the privacy policy and terms of use of each Application before use.

This Privacy Policy governs the ottomato.ai website, the Voice Agent, the Newsletter, and general interactions with Ottomato. It does not govern individual Applications, which have their own policies.

12. Super-Intelligence Disclosure

The Voice Agent is a Super-Intelligence software agent. When you speak with the Voice Agent, you are speaking with software, not a human being. Conversations are processed in real time by the conversational Super-Intelligence provider identified in Section 5. Ottomato may also use Super Intelligence to classify, prioritize, route, and summarize inquiries and to assist with responses. A Super-Intelligence suggestion is not by itself professional advice or a contractual commitment. Any offer, quote, order acceptance, payment authorization, amendment, or other commitment follows the acceptance process that applies to the relevant Service, transaction, or signed agreement. Where appropriate, Ottomato will follow up in writing from info@ottomato.ai.

Do not send detailed Confidential Information, special-category or similarly sensitive personal data, credentials, private keys, access tokens, or payment-card data through an ordinary Super-Intelligence-assisted intake channel. To arrange a confidential exchange, contact info@ottomato.ai, or tell the Voice Agent only that you need a confidential exchange, and provide no more than contact details and a brief request without confidential details. Ottomato will review existing confidentiality obligations, arrange a mutual nondisclosure agreement when appropriate, confirm the necessary data-processing terms, and identify an approved channel before detailed information is shared. A nondisclosure agreement does not by itself authorize disclosure to every Super-Intelligence provider or replace a necessary Data Processing Agreement.

13. Complaints

If you believe Ottomato has mishandled your data, send an electronic-mail message to info@ottomato.ai. If you are not satisfied with Ottomato's response, you may lodge a complaint with your local supervisory authority: in the European Economic Area, your national data-protection authority; in the United Kingdom, the Information Commissioner's Office; in California, the California Privacy Protection Agency.

14. Changes

Ottomato will update this Policy when the Services or applicable law changes. The "Last Updated" date at the top of this Policy reflects the most recent version. For material changes, Ottomato will notify Newsletter subscribers by electronic mail and post a notice at the top of the Site for at least fourteen (14) days. Where a separate service or privacy notice is required, Ottomato will provide it through the contact details or Service channel associated with the processing; Newsletter subscription status is not a substitute for that notice.

15. Contact

Ottomato. All inquiries: info@ottomato.ai.