Privacy Policy
OtoLoom is an AI chatbot platform that helps small businesses automate customer engagement. This policy explains how we collect, use, and protect information when you use our platform — whether you are a business owner (our client) or a visitor chatting with a bot on one of our clients' websites.
1. Who We Are
OtoLoom ("we", "us", "our") operates the OtoLoom platform available at otoloom.com. We are the data controller for information collected through our platform and website.
Contact us at: privacy@otoloom.com
2. Information We Collect
2.1 From business clients (subscribers)
- Account information: Business name, email address, timezone
- Billing information: Processed by Lemon Squeezy — we do not store card numbers. We store your subscription status, plan type, and billing period.
- Bot configuration: Business details you enter such as services, opening hours, address, and phone number to configure your AI assistant
- Uploaded documents: Markdown files you upload to your knowledge base
- Usage data: Conversation counts, lead captures, API usage metrics
2.2 From website visitors (end users of our clients' bots)
When a visitor interacts with an OtoLoom-powered chat widget on a client's website, we may collect:
- Contact details voluntarily provided: Name, phone number, and email address when a visitor submits a lead enquiry form
- Conversation content: Messages exchanged with the AI assistant during a chat session
- Technical data: IP address (used for rate limiting and abuse prevention, not stored beyond the session), browser session identifier
- WhatsApp number: If the visitor contacts through WhatsApp
This data is collected on behalf of our clients who are the data controllers for their visitors' information. We act as a data processor for this data.
2.3 From our marketing website
- Contact form submissions if you reach out to us
- Basic analytics data (page views, referral source) — see our Cookie Policy
3. How We Use Your Information
| Purpose | Legal basis |
|---|---|
| Providing and operating the OtoLoom platform | Contract performance |
| Processing subscription payments | Contract performance |
| Sending service notifications (billing, bot alerts, lead notifications) | Contract performance / Legitimate interests |
| Improving the platform and AI performance | Legitimate interests |
| Preventing fraud and abuse (rate limiting, domain validation) | Legitimate interests |
| Complying with legal obligations | Legal obligation |
| Processing visitor lead data on behalf of clients | Client's instructions (data processor) |
We do not use your data for advertising. We do not sell your data to third parties.
4. AI Processing
Visitor conversations are processed by Anthropic's Claude AI. Conversation content is sent to Anthropic's API for the sole purpose of generating responses. Anthropic's privacy policy governs how they handle this data. We use Anthropic's API with prompt caching enabled — conversation context may be temporarily cached by Anthropic's infrastructure for performance purposes.
Document content uploaded to the knowledge base is processed by our embedding service (Voyage AI) to create searchable vector representations.
5. Third-Party Services
We use the following third-party services to operate OtoLoom:
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database and file storage | EU (Frankfurt) |
| Anthropic | AI conversation processing | United States |
| Voyage AI | Document embedding for knowledge base | United States |
| Lemon Squeezy | Subscription billing and payments | United States |
| Resend | Transactional email delivery | United States |
| Vercel | Platform hosting and deployment | United States / EU edge |
| Railway | AI document processing service | United States |
Where data is transferred outside the EU/EEA, we rely on the service provider's compliance mechanisms (Standard Contractual Clauses, adequacy decisions, or equivalent protections).
6. Data Retention
- Client account data: Retained for the duration of your subscription and deleted within 90 days of account closure upon request
- Conversation data: Retained according to your plan's analytics retention period (30 days for Starter, 90 days for Pro) then automatically purged
- Lead data: Retained until deleted by the client or account closure
- Billing records: Retained for 7 years for legal and accounting purposes
- Uploaded documents: Retained until deleted by the client or account closure
7. Your Rights
Depending on your location you may have the following rights regarding your personal data:
- Access: Request a copy of the data we hold about you
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your data ("right to be forgotten")
- Portability: Request your data in a machine-readable format
- Restriction: Request that we restrict processing of your data
- Objection: Object to processing based on legitimate interests
To exercise any of these rights, email privacy@otoloom.com. We will respond within 30 days.
If you are a website visitor whose data was collected by an OtoLoom client's bot, please contact that business directly as they are the data controller for your information.
8. Data Security
We implement appropriate technical and organisational measures to protect your data including:
- Encryption in transit (HTTPS/TLS) and at rest
- Row-level security on all database tables
- Access controls ensuring clients can only access their own data
- API authentication for all service-to-service communication
- Domain whitelisting to prevent unauthorised use of client bots
9. Children's Privacy
OtoLoom is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
10. Changes to This Policy
We may update this policy from time to time. We will notify registered clients by email of material changes. The updated policy will be effective from the date shown at the top of this page.
11. Contact
For privacy-related questions or to exercise your rights:
Email: privacy@otoloom.com