Privacy Policy

This policy explains what OtoDock ("we", "us") collects when you use otodock.io, your customer account, and the optional hosted services we operate — and, just as importantly, what we never collect from the software you self-host. Questions or requests: [email protected].

The short version

• Your self-hosted install is yours. Chats, files, agents, credentials, and users on an OtoDock install live on your infrastructure. We do not receive them — ever.
• We collect the minimum needed to run accounts, licensing, and billing: your email, name, optional company name, and payment state.
• License verification sends the license key and an install identifier — no user data, no usage data, no content (see License verification).
• Payments run through Stripe as merchant of record; we never see your full card details.
• When you connect Google or another service through our hosted sign-in, we pass the sign-in tokens to your install and delete our copy within minutes. We never read your data in those services.

What we collect, and why

Account data

When you create an account we store your email address, name, optional company name (used inside your signed license key), and a password hash — or, if you sign in with Google or GitHub, the identity those providers share with us. Two-factor secrets are stored encrypted. We use this data to operate your account, deliver license keys, and send transactional email (verification, password resets, purchase confirmations). Legal basis: performance of a contract.

Billing data

Purchases are processed by Stripe acting as merchant of record: Stripe collects your payment details, handles VAT/sales tax, and issues invoices. We store the resulting subscription and license state (plan, status, invoice references) — never full card numbers. Legal basis: performance of a contract and our legal obligations (tax, accounting).

License verification

Licensed installs periodically verify their license with us. The check sends the signed license key and an anonymous install identifier — nothing else. It carries no personal data about the people using your install and no content. The full mechanism, including how to run fully offline, is documented on the transparency page. Legal basis: legitimate interest (license operation) and performance of a contract.

Website analytics

We use self-hosted, cookieless Umami for aggregate audience measurement (no IP addresses stored, no cross-site tracking). Google Analytics, the Meta Pixel and the Reddit Pixel run only with your consent — see the Cookie Policy. If you complete a purchase after giving that consent, we also report the conversion to Meta and Reddit from our server, using a hashed (SHA-256) form of your email and the same identifiers your browser already sent them, so ad measurement keeps working. Legal basis: consent (GA/pixels and conversion reporting) and legitimate interest (cookieless aggregate statistics).

Support

If you email us, we keep the correspondence for as long as needed to help you and to keep a record of the resolution.

Connected accounts and Google user data

An OtoDock install can connect to services such as Google, Microsoft, Slack and Notion, so its agents can work with your data there. The install can use an OAuth app its admin registers, or our hosted sign-in, which connects through OtoDock's own registered apps.

What our hosted sign-in handles

When you connect an account through hosted sign-in, the service sends the sign-in result to api.otodock.io. Our server exchanges it for access and refresh tokens and hands them to your install with a one-time code. We keep the tokens encrypted only until your install collects them, and we delete them within minutes. When your install renews an access token, it sends us the refresh token, we ask the service for a new access token and pass it back, and we store neither. We never use these tokens to call the service's APIs, so we never see your email, files, calendar or any other content. To run and secure the service we record which service was connected, by which install and when. We also record the random user ID your install assigns to the person connecting, never a name or an email address, so we can count users against the user limit of your plan.

How an install uses Google user data

The Google data an install reads stays on that install, on infrastructure its owner runs. Depending on what you connect, the install can access Gmail, Google Calendar, Google Drive, Docs, Sheets, Slides, Forms, Contacts, Tasks, Google Chat, Apps Script and Google Analytics. It uses that data only to carry out what you ask, for example reading an email you ask about, adding a calendar event or updating a spreadsheet. To carry out a request, the install sends the content it needs to the AI model its admin has configured. That is either a model provider such as Anthropic or OpenAI, or a local model the admin runs, in which case the content stays on infrastructure the admin controls. Your Google data is never sold, never used for advertising, and never used to develop, improve or train generalized AI or machine learning models. No one at OtoDock can read it, because it never reaches us.

You can disconnect a Google account at any time in your install's settings, which revokes its access, or remove the access from your Google Account at myaccount.google.com/connections.

OtoDock's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we share

We do not sell personal data. We share it only with the processors that run the service: Stripe (payments, as merchant of record), Cloudflare (networking and security in front of our servers), our EU-based hosting providers, and our transactional email service. Each processes data only on our instructions. Where a processor is outside the EEA, transfers rely on standard contractual clauses or an adequacy decision.

Retention

Account and license data is kept while your account is active and for as long as we must retain records under tax and accounting law. You can ask us to delete your account at any time; we will remove everything not subject to a legal retention duty.

Your rights

Under the GDPR (and similar laws) you can request access, correction, deletion, portability, and restriction of your personal data, object to processing based on legitimate interest, and withdraw consent at any time. Write to [email protected] — we respond within 30 days. You may also lodge a complaint with your local data-protection authority.

Security

Secrets and tokens are encrypted at rest, staff access is gated behind zero-trust authentication with enforced multi-factor auth, and traffic is encrypted in transit. We keep the attack surface deliberately small.

Children

Our services are not directed at children under 16.

Changes

We will post any changes here and update the date above. Material changes affecting account holders are announced by email.