Privacy

What we store

• Your email address and password. The password is handled by our login provider and is stored hashed. Nobody here can read it.
• The work you make. Your brands, chats, documents, codes, research files and any images or videos you upload. This is the product, so it is kept until you delete it.
• Your plan. Which plan you are on and whether it is active.
• Your Triple Whale key, if you connect one. Kept on our server with your account, one per brand, and used only to read that brand's ad results into its Growth Board. It is never sent back to your browser, and it is deleted when you disconnect it or delete your account.
• Documents you share for approval. A copy of the document at the moment you shared it, and the names and comments people leave on it. Anyone holding the link can read it and comment, so share it only with people you mean to. It is deleted when you stop sharing it or delete your account.
• A record of what happened. A log of account events, such as a sign-up, a payment or a cancellation, that is only ever added to and never edited, so billing questions can be answered.
• Anonymous usage signals. Which step of a pipeline was approved, answered, changed or stopped, what kind of change was asked for (such as shorter or a different tone), whether the work was saved or sent to the Growth Board, and whether an ad test won or lost, so the pipelines can be improved. Never the content of your work, your brand or your keys.

Signing in with Google

If you choose Continue with Google, Google shares your email address, your name, a link to your profile picture and an ID for your Google account. We ask for nothing else from your Google account: not your contacts, files, calendar or mail.

• How it is used. Your email address creates your Otto Lab account and signs you in to it. Your name, picture link and Google ID are kept with your login record by Supabase, our login provider. The app itself uses only your email address.
• Where it is kept. With your account, in the same database in Frankfurt described below.
• Who sees it. Supabase stores it for us, as listed below. If you join a team, your teammates see your email address. It is not sold, not used to train any AI model, and never sent to Meta. When you sign up with Google, our ads learn only that somebody signed up, as described under Our ads below.
• Removing it. Deleting your account deletes it straight away, and backup copies are gone within 30 days, as described under Deleting your account. You can also remove Otto Lab's access at any time from your Google account, under Security, Third-party apps and services.

Otto Lab's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Your Personal API key

Otto Lab runs on your own Anthropic key. When you save it in Settings, it is stored in our database encrypted, with a secret that lives only on our server and never in the database, so a copy of the database alone would not reveal it. Only its last 3 characters are ever shown, and only to you. It is never written to a log, each run passes it straight to Anthropic, and you can remove it at any time. Our backups hold only that encrypted copy.

A Team API key works the same way. If you own a team and choose to save a key for it in Settings, Team, it is stored encrypted in the same way, and only its last 3 characters are ever shown, and only to you.

Media keys work the same way. If you save a Kie AI, Fal AI or Higgsfield key in Settings to generate Statics, videos and voiceovers, it is stored encrypted, only its last 3 characters are ever shown, and only to you, and each generation passes it straight to that service.

Where it is kept

Accounts and work are stored in a Postgres database hosted by Supabase in Frankfurt, Germany. The app itself runs on a server in Falkenstein, Germany.

Who else touches it

• Anthropic runs the AI models. What you send a pipeline or a tool goes to Anthropic, billed to your Personal API key or your team's Team API key.
• Kie AI, Fal AI and Higgsfield, only if you save a media key and press Generate. The prompt and any pictures, clips or sound it builds on go to the service you picked, billed to your own key. What it makes is kept with your uploads.
• Supabase hosts the database and handles sign-in.
• Whop takes payments. Card details go to them and never touch our server.
• Resend sends the app's emails, such as sign-up confirmation, password resets, team invites, plan updates and the getting-started emails.
• Google, only if you choose to sign in with it.
• Triple Whale, only if you connect it. We read your ad results from it; we send it nothing but the request.
• Cloudflare carries all traffic to the site and the app, counts visits to the public pages, and checks that the sign-up and forgot-password forms are used by a person (Turnstile). It does not count visits inside the app.
• Microsoft (Clarity) records how visitors use the homepage, never the app. See Counting visits below.
• Meta (Facebook and Instagram), for our own ads only, and in the EU, the EEA, the UK and Switzerland only if you accept our ad cookies. See Our ads below.
• ntfy.sh carries a short alert to our phone when something breaks: where it happened and what went wrong, with addresses and keys taken out. Never your work.

There is nobody else. We do not sell or rent your data to anyone. The two things some US state laws count as sharing are the sign-up note to Meta, described under Our ads, and the Clarity recordings, described under Counting visits. You can turn both off under Our ads.

Counting visits

The public pages, meaning this one, the homepage and the other policies, carry a visitor counter from Cloudflare. It records that a page was opened, roughly where in the world from, and what sort of device. It sets no cookie, it does not fingerprint your browser, and it cannot follow you to another site or build a profile of you.

The homepage also runs Microsoft Clarity, which records how a visit goes: where you click, how far you scroll and how the page moved, so we can see what is hard to use. The recording shows the homepage's own words and pictures, which are the same for everyone, but not the cookie bar or anything typed. Clarity sets its own cookies to tell your visits apart, and Microsoft stores the recordings under its own privacy statement. It does not start in a browser that holds anything from the app, and it is gone before the app opens. If the homepage is already open in another tab, it stops there too once you sign in or the app saves anything in this browser, usually within seconds. In the EU, the EEA, the UK and Switzerland it runs only after you press Accept on the cookie bar, and nowhere if you decline, turn it off below, or your browser sends the Global Privacy Control signal.

The counter and Clarity are not in the app. Once you sign in, nothing on the page counts visits, because the addresses inside it name your own work and that is nobody else's business. The cookies the app sets itself are the ones that keep you signed in, one, kept for a week after you sign up, that lets the confirm link in your email sign you in on this browser only, two that last ten minutes while you sign in with Google (your time zone, for the sign-up check, and whether you started from the sign-up screen), and the ad cookies and the cookie that keeps your answer to our cookie bar, described under Our ads. The sign-up and forgot-password screens also run Cloudflare's check that you are a person, which looks at your browser, not at you.

Our ads

We advertise on Facebook and Instagram. If you reach us from one of our ads, the link carries tags saying which ad it was, and Meta adds a click number. We keep the tags in a cookie on this site for 30 days and note them next to your account when you sign up, so we know which ads bring people. We keep the click number in a second cookie for 90 days.

No page here runs any Meta script. When you sign up, our server tells Meta once, with your IP address, your browser and device type and that click number, so Meta can tell which ad brought you and show our ads to people like you. If you sign up with your email address, it also sends a coded copy of it that Meta can match to your Facebook or Instagram account; a Google sign-up never sends your Google address. Whether this happens is decided on the sign-up form, and it is sent once you confirm your address. Nothing you make or type in the app is ever sent. You can turn off ads based on this in your Facebook or Instagram ad settings.

In the EU, the EEA, the UK, Switzerland and the places that share their rules, a bar at the bottom of the page asks first. None of this, and no Clarity recording, happens unless you press Accept: decline, or ignore the bar, and there are no ad cookies, no recording and nothing is sent to Meta. Your answer is kept in a cookie for 180 days, then you are asked again.

Wherever you are, you can turn this off at any time with the button below, on this browser. It removes the ad cookies and Clarity's cookies, and nothing is recorded or sent to Meta from this browser from then on. It does not sign you out. If your browser sends the Global Privacy Control signal, we treat it the same way: no ad cookies, no recording, nothing sent to Meta, and no bar asking.

Turn off ad cookies and recording

Error reports

When something breaks, the error is written to our own server's log so it can be fixed. When it breaks in your browser, or an error message is shown to you, your browser sends us the error, the first part of the page's address (such as /app), which pipeline and stage you were on, your browser's details (its name and version, and your system's), your window width, and your account if you are signed in. Before a report is kept, anything in quotes, any email address and anything that looks like a key is taken out, so it carries the error, not what you typed or what you were reading. Reports are deleted after 30 days, and backup copies of them within 30 days after that. A crash also sends a short alert to our phone (see ntfy.sh above).

Deleting your account

You can delete your account from Settings inside the app. Your account and all your data are deleted right away: brands, chats, documents, codes, uploads, generated Statics, videos, voiceovers and songs, your Personal API key, the Team API key if you own a team, media keys, Triple Whale keys, share links, every line in our account log that names you, the error reports your browser sent, and your place on the getting-started email list with the record of which ones went out. It cannot be undone. Backup copies are kept for 30 days, so anything in them is gone within 30 days. We keep only a few things. One is a one-way fingerprint of your email address, not the address itself, so that address cannot get free runs or a free account on Otto Lab again. It can come back only by paying for a plan with it. Another is the anonymous usage signals described above, which never held your name or your work. And if you unsubscribed from our emails, the separate fingerprint described under Unsubscribing stays, so you stay unsubscribed.

On a team, the owner’s workspace belongs to the owner. If you own a team, deleting your account deletes that workspace for every member. If you are a member, what you made in the owner’s brands stays in their workspace.

To ask for a copy of what is held about you, or for anything to be corrected, write to hello@ottolab.io from the address on the account.

Getting-started emails

If you start a free account, we send a few emails over your first weeks: how to start a run, what to try next and what the paid plan adds. We keep a note of which ones went out and when, and use your email address and how many free runs you have started to pick the next one. They stop when you pay, and you can turn them off any time in Settings, under Account.

Unsubscribing

Every email we send has an Unsubscribe link. It stops getting-started emails and team invites. The ones you need, like a sign-up link, a password reset or a change to your plan, still come, so you can always sign in. To remember that you unsubscribed, we keep a one-way fingerprint of your email address, not the address itself. We keep it even if you delete your account, so you stay unsubscribed. Turning emails back on, from the page the Unsubscribe link opens or from the getting-started switch in Settings, removes it.

Checks at sign-up

New accounts are not available in Pakistan or India. When you sign up we read the country your connection comes from (as Cloudflare reports it), your device's time zone and the ending of your email address. They are used for that one check and are not stored.

Children

Otto Lab is a business tool and is not intended for anyone under 18.

Changes

If this page changes in a way that matters, the date at the top changes with it. Andrew's Ecommerce LLC is responsible for the data described here.