This Privacy Policy explains how OTTERMIND PTE. LTD. ("Ottermind," "we," "us," or "our") collects, uses, discloses, stores, and otherwise processes personal data when you access or use Ottermind's websites, applications, APIs, browser extensions, desktop tools, local access features, AI and agent features, integrations, and related products and services (collectively, the "Services").
Please read this Privacy Policy carefully. By accessing or using the Services, you acknowledge the practices described in it. If you do not agree, do not use the Services.
1. Who We Are
The Services are provided by:
OTTERMIND PTE. LTD. 9 CHIN BEE DRIVE, #05-10 INNOVATE 360 Singapore 619860
For privacy-related questions or requests, contact:
2. Scope of This Privacy Policy
This Privacy Policy applies to personal data we process when you:
- visit our website;
- create or use an Ottermind account;
- use AI, agent, automation, browser, integration, local access, or workflow features;
- connect a third-party account, application, or data source;
- contact us for support or other inquiries;
- purchase subscriptions, credits, or other paid services;
- interact with our emails, notices, or marketing communications; or
- otherwise engage with us in connection with the Services.
This Privacy Policy does not govern a third party's independent processing through a website, product, or service that it operates. The third party's terms and privacy policy apply to its own processing. Once Ottermind receives or processes data from a connected service, Ottermind's processing of that data is governed by this Privacy Policy.
3. Personal Data We Collect
The data we collect depends on the Services and integrations you use.
3.1 Information you provide directly
We may collect:
- Account data, such as your name, email address, username, avatar, profile details, and authentication information, including password hashes where password-based authentication is used.
- Contact data, such as your email address and information you provide when communicating with us.
- Billing and transaction data, such as your subscription plan, billing country, payment status, invoice information, and Ottermind purchase history.
- Support and communications data, including messages, support requests, feedback, surveys, and related attachments.
- Inputs and uploaded content, including prompts, instructions, files, text, images, audio, video, code, links, and other materials you provide.
- Connected account data, including information you authorize us to access from third-party accounts, applications, or data sources.
- Authorization Data, such as OAuth access tokens, refresh tokens, access grants, API credentials, cookies, and connection metadata used to authenticate or operate a feature you enable.
- Other information you choose to provide.
3.2 Data generated through use of the Services
We may collect or generate:
- Usage data, including features used, pages visited, actions taken, timestamps, session activity, and interaction patterns.
- Prompt and output data, including prompts, workflows, outputs, and related metadata.
- Execution and system logs, including task state, workflow logs, error records, debugging information, performance logs, and security logs.
- Device and technical data, including IP address, browser and device type, operating system, language, app version, identifiers, and approximate location inferred from IP address.
- Local access data, where enabled, including page content processed at your direction, browser actions, local execution context, and related technical logs.
- Integration activity data, including enabled integrations, authorized sources, sync activity, actions performed, and records needed to provide and secure integration functionality.
- Feedback and safety-report data, including report text, selected attachment identifiers, content identifiers, report reasons, excerpts, app version, platform, and language settings.
- Acquisition and referral data, including campaign parameters, advertising click identifiers, referring websites, and landing pages.
- Analytics data, including aggregated engagement patterns and service-performance information.
3.3 Payment data
Payments are generally processed by third-party payment providers, distributors, or payment channels. We generally do not store full payment card numbers. We may receive limited payment-related information such as:
- payment method type;
- billing and subscription status;
- transaction identifiers;
- payment confirmations; and
- limited billing details needed for accounting, fraud prevention, and support.
Transaction records accessed through a connector, such as a Stripe account connected by a user, are connected account data rather than payment-card data submitted to Ottermind for purchasing the Services.
3.4 Data from third parties
We may receive data from:
- authentication providers;
- payment processors and authorized distributors;
- analytics and attribution providers, subject to applicable law and your choices;
- third-party accounts and services you connect at your direction; and
- public sources, where relevant and lawful.
3.5 Google user data
If you connect Gmail, Google Calendar, or Google Drive, the categories of Google user data we access depend on the permissions you grant and the feature you use. They may include:
- Gmail data, such as message content, subject lines, senders, recipients, timestamps, labels, attachments, drafts, and related metadata;
- Google Calendar data, such as calendars, events, titles, descriptions, dates, times, attendees, locations, conferencing details, availability, and related metadata;
- Google Drive data, such as files and folders you select or authorize, file content, names, metadata, permissions, and revision information;
- Google account information, such as your name, email address, profile image, account identifier, and authorization details; and
- Ottermind task data, such as user-requested task conversations, results, and execution records created when you use Google user data within an Ottermind task.
Ottermind requests access only to Google data reasonably necessary for visible user-facing features. The exact permissions requested are displayed during Google's OAuth authorization process.
4. Cookies and Similar Technologies
We and our service providers may use cookies, SDKs, pixels, local storage, log files, and similar technologies to:
- operate, authenticate, and secure the Services;
- remember settings and preferences;
- measure performance and reliability;
- understand usage and improve the Services;
- support analytics and attribution; and
- where permitted, support marketing and advertising.
You can manage these technologies through browser or device settings and, where required, through our consent tools. Disabling some technologies may affect functionality.
Google user data obtained through Google APIs is not used for advertising, advertising attribution, retargeting, or interest-based marketing.
5. How We Use Personal Data
5.1 Providing and operating the Services
We may use personal data to:
- create, authenticate, and manage accounts;
- process prompts, files, data, and instructions;
- generate outputs and complete requested tasks;
- provide AI, agent, workflow, browser, local access, and integration features;
- synchronize or retrieve authorized connected account data;
- perform actions that you direct through connected services;
- maintain service functionality, reliability, and security; and
- provide customer support.
5.2 Improving and maintaining the Services
We may use appropriate service data to:
- monitor performance and system health;
- troubleshoot errors;
- analyze usage patterns;
- improve product design, safety, reliability, and user experience;
- develop and test features; and
- evaluate workflows and operational systems.
We do not use user content for training general-purpose AI or machine-learning models unless that use is clearly disclosed and, where required, supported by valid consent. Regardless of other provisions in this Privacy Policy, Google user data obtained through Google APIs is not used to train or improve general-purpose or non-personalized AI or machine-learning models.
5.3 Communications
We may use contact information to:
- send service, account, billing, and security notices;
- respond to support requests;
- notify you of updates or issues; and
- send marketing communications where permitted by law.
5.4 Payments and subscriptions
We may use billing and transaction information to process purchases, manage subscriptions and credits, issue invoices and refunds, detect payment issues, and prevent fraud.
5.5 Safety, security, and legal compliance
We may use data to detect, investigate, and prevent abuse, fraud, security incidents, and policy violations; enforce our agreements; protect rights and safety; and comply with applicable law and legal process.
5.6 Aggregated and de-identified information
We may create aggregated or de-identified information for analytics, security, research, service improvement, and business reporting, subject to applicable law and third-party data-use restrictions.
Google's Limited Use requirements apply to raw Google user data and to data aggregated, anonymized, or derived from it. We do not use such data for advertising, sale, creditworthiness decisions, unrelated research, or unrelated product development.
6. Legal Bases for Processing
Where applicable law requires a legal basis, we rely on one or more of:
- Performance of a contract, where processing is necessary to provide the Services, manage your account, or fulfill our obligations.
- Legitimate interests, where processing is reasonably necessary to secure and improve the Services, prevent fraud, handle support, administer the business, and protect users and Ottermind, provided those interests are not overridden by your rights.
- Consent, where required for optional processing, connected account permissions, certain cookies, or marketing.
- Legal obligation, where processing is necessary to comply with law, regulation, legal process, tax, accounting, or compliance requirements.
- Legal claims, where processing is necessary to establish, exercise, or defend claims.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that occurred before withdrawal.
7. AI, Integrations, and Local Access
7.1 AI and agent processing
When you submit prompts, files, instructions, or connected data, we process that information to generate outputs, perform tasks, and operate workflows. Depending on the selected feature, processing may involve Ottermind systems and service providers acting on our behalf.
7.2 Integrations and connected accounts
When you enable an integration or connect an account, we access and process only the data and permissions needed for the requested functionality, related security, support, and service operations.
You can review and disconnect available integrations through the Services. When you disconnect an integration in Ottermind, we stop accessing the connected service, delete the Authorization Data associated with that connection, and do not retain a separate copy of source data obtained from the connected service.
Tasks, conversations, and results created in Ottermind while you use a connector remain in your Ottermind account after disconnection. You may archive eligible tasks and conversations for later recovery or permanently delete them through available product controls.
If you revoke access only through the third-party provider, the authorization becomes unusable and Ottermind can no longer access the service. However, we may not receive notice of the revocation, so the connector may continue to appear connected in Ottermind. Disconnect the integration through Ottermind or contact us to delete the stored Authorization Data and update the connector's status.
7.3 Authorization Data
We use Authorization Data only to establish, maintain, secure, and revoke connections and to perform actions you authorize. We do not sell Authorization Data or use it for advertising. Access to Authorization Data is restricted to systems and personnel with a need to operate or secure the relevant feature.
7.4 Local access features
If you enable browser, desktop, or device-integrated features, the Services may process information from your local environment as needed to carry out your instructions. This may include session context, page content, browser actions, files selected by you, and technical logs.
7.5 Your choices and responsibilities
You decide whether to connect an account, enable local access, or provide data. You should connect only accounts and data that you are authorized to use.
8. Google API Services and Limited Use
Ottermind's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We use Google user data only to provide or improve user-facing features that are visible and prominent in Ottermind and that the user requests or authorizes. In particular:
- we do not sell Google user data;
- we do not use or transfer Google user data for advertising, retargeting, or personalized marketing;
- we do not use Google user data to determine creditworthiness or for lending purposes;
- we do not allow humans to read Google user data except with the user's affirmative agreement for specific data, when necessary for security or abuse investigation, to comply with applicable law, or where the data has been aggregated and anonymized for permitted internal operations;
- we do not use Google user data to train or improve general-purpose or non-personalized AI or machine-learning models; and
- we do not transfer Google user data except as necessary to provide a user-requested feature, with the user's consent, for security, or as required by law, and subject to applicable Google policies.
If a user-requested feature requires an AI model or other service provider to process Google user data, the transfer is limited to the data necessary to complete that request. The provider processes the data on our behalf under appropriate contractual restrictions and may not use it for its own advertising or unrelated model training.
You can withdraw Google access by disconnecting the relevant connector in Ottermind. When you do so, Ottermind stops accessing Google, deletes the tokens associated with the connection, and does not retain a separate copy of source Google user data obtained through that connector. Ottermind tasks, conversations, and results created at your request remain until you delete them or delete your account.
You may also remove Ottermind from your Google Account's third-party access settings. This prevents further access, but Ottermind may not receive notice of the revocation. Disconnect the connector in Ottermind or contact us to delete the stored token and update the connector's status.
9. How We Disclose Personal Data
We may disclose personal data in the following circumstances.
9.1 Service providers and subprocessors
We may disclose data to vendors, contractors, cloud and hosting providers, AI model providers, analytics providers, support tools, email providers, security providers, payment providers, and other service providers that help operate the Services. They may process data only as needed to provide services to us and under appropriate contractual restrictions.
9.2 AI, infrastructure, and integration providers
Where needed for a requested feature, we may transmit relevant data to AI, infrastructure, authentication, or integration providers. We seek to minimize the data transferred and restrict providers from using it for unrelated purposes.
The more specific limitations in Section 8 apply to Google user data and control over any broader wording in this section.
9.3 At your direction
We may disclose data when you connect a service, share or export content, select a recipient, publish an output, or authorize an external action.
9.4 Payment providers
We may share billing and transaction information with payment processors and authorized distributors for purchases, subscriptions, invoicing, fraud screening, refunds, and support.
9.5 Legal, compliance, and protection purposes
We may disclose data where reasonably necessary to comply with law or lawful requests, enforce agreements, investigate fraud or security incidents, or protect rights, property, safety, and security.
9.6 Corporate transactions
We may disclose data in connection with a proposed or completed merger, acquisition, financing, restructuring, bankruptcy, or sale of assets, subject to confidentiality safeguards, applicable law, and applicable third-party data-use restrictions.
9.7 Aggregated or de-identified information
We may disclose information that cannot reasonably identify an individual, subject to applicable law and third-party restrictions, including Google's Limited Use requirements where relevant.
10. International Data Transfers
Ottermind is based in Singapore. We and our service providers may process data in Singapore, the United States, the European Economic Area, the United Kingdom, and other jurisdictions where we or our providers operate.
Where required, we use measures designed to support lawful cross-border transfers, such as standard contractual clauses or equivalent mechanisms, transfer assessments, vendor diligence, contractual commitments, and technical and organizational safeguards.
11. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain accounts and subscriptions, preserve security and reliability, comply with legal and accounting obligations, resolve disputes, and enforce agreements.
Retention depends on the type and sensitivity of data, the feature used, user choices, operational needs, and legal requirements. In general:
- sign-in is disabled immediately after the user confirms account deletion, and account and profile data is deleted from active systems within one to three days, subject to limited legal retention exceptions;
- source data from a connected service is processed while the integration is active and is not separately retained after the user disconnects the integration in Ottermind;
- Authorization Data is retained only while the relevant connection is active and is deleted when the user disconnects the integration in Ottermind;
- tasks, conversations, and results remain after connector disconnection until the user permanently deletes them or deletes the account;
- billing and transaction records may be retained for legally required accounting, tax, audit, chargeback, and fraud-prevention periods;
- security, abuse-prevention, and technical logs are retained for a limited operational period based on their purpose and sensitivity; and
- deleted account data may remain in protected backups for up to 60 days before being overwritten or securely deleted and is not available through the Services during that period.
When retention is no longer necessary, we delete, anonymize, or securely isolate the data. Our Data Deletion Guide describes the applicable user controls and request process. We do not separately retain source data from a connected service after disconnection, but related Ottermind tasks, conversations, and results remain until the user deletes them or deletes the account.
12. Data Security
We use technical, organizational, and administrative safeguards designed to protect personal data from unauthorized access, use, loss, alteration, or disclosure. Measures may include encryption in transit and at rest where appropriate, access controls, logging, credential protection, vendor diligence, and incident-response procedures.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your account credentials and devices.
13. Your Privacy Rights and Choices
Depending on your location and applicable law, you may have rights to:
- access personal data we hold about you;
- correct inaccurate or incomplete data;
- request deletion;
- restrict or object to processing;
- withdraw consent;
- receive certain data in portable form;
- obtain information about processing; and
- complain to a data-protection authority.
13.1 Account information
You may be able to review and update account information through account settings.
13.2 Connected accounts
You may review and disconnect supported integrations through Ottermind. Disconnecting an integration stops future access, deletes its Authorization Data, and removes separately held source data obtained from the connected service. It does not automatically delete Ottermind tasks, conversations, or results created while the connector was used.
Revoking access through the connected provider prevents further access, but Ottermind may not receive notice. Complete the disconnection in Ottermind to update the connector's status and delete the stored Authorization Data.
13.3 Content and account deletion
You may archive eligible tasks and conversations for later recovery or permanently delete them through available product controls. Permanently deleted content cannot be recovered. You may delete your account using the deletion control in account settings after cancelling any active subscription. Sign-in is disabled immediately after you confirm account deletion. The Data Deletion Guide explains:
- deletion of individual tasks, files, or outputs;
- disconnection of individual connectors;
- deletion of imported connected account data;
- deletion of Authorization Data;
- account deletion;
- limited legal, security, billing, and backup exceptions.
13.4 Marketing and cookies
You may unsubscribe from marketing emails using the link provided. We may still send transactional or security messages. You can manage cookies through browser settings and available consent tools.
13.5 Submitting a request
To exercise an applicable privacy right, contact support@ottermind.ai. We may need to verify your identity. We may decline or limit a request where permitted by law, including where fulfilling it would infringe another person's rights or conflict with a legal obligation.
14. Region-Specific Disclosures
14.1 European Economic Area and United Kingdom
Individuals in the EEA or UK may have rights under applicable data-protection law, including the rights described in Section 13. Where required, we rely on the legal bases described in Section 6 and use lawful mechanisms for international transfers. You may complain to your local supervisory authority.
14.2 United States
Depending on your state, you may have rights to access, correct, delete, or obtain a copy of personal data and to opt out of certain targeted advertising, sales, sharing, or profiling where applicable.
We do not sell personal data for monetary consideration in the ordinary course of business. Some analytics or advertising activities may be treated as a "sale" or "sharing" under certain state laws; where required, we provide applicable notices and choices. Google user data is not used for these advertising activities.
14.3 Singapore
Ottermind is established in Singapore and processes personal data in accordance with applicable requirements of Singapore's Personal Data Protection Act 2012. You may contact us with access, correction, withdrawal, or other applicable requests.
14.4 Other jurisdictions
If your jurisdiction grants additional privacy rights, contact us to exercise them. We will handle the request in accordance with applicable law.
15. Children's Privacy
The Services are not intended for people under 18, and we do not knowingly collect children's personal data in a manner prohibited by law. If you believe a child has provided data unlawfully, contact us. We will take appropriate steps to delete it where required.
16. Third-Party Sites and Services
The Services may link to or connect with third-party websites, applications, and services. We do not control their independent privacy or security practices. Review their privacy policies before using or connecting them.
17. Changes to This Privacy Policy
We may update this Privacy Policy. If we make material changes, we will take reasonable steps to notify you through the Services, on our website, or by email. Unless otherwise stated, changes become effective when the updated policy is posted.
We will keep this policy and relevant in-product privacy notices current if our use of Google user data or other connected account data changes materially.
18. Contact Us
For questions, concerns, or privacy requests, contact:
Please provide enough information for us to understand your request and verify your identity where necessary.