Privacy Policy

Effective date: October 17, 2026

Ottohand Technologies LLC (“Ottohand,” “we,” “us,” or “our”) provides a CRM and website platform for small businesses. This Privacy Policy explains how we collect, use, and protect information - both from the businesses (“Tenants”) that subscribe to Ottohand, and from those Tenants’ own customers who interact with a Tenant’s website, forms, or text messages.

1. Information we collect from Tenants (business account holders)

When you sign up for and use Ottohand as a business, we collect:

• Account information: your name, email address, phone number, business name, business address, and password (stored as a secure hash, never in plain text).
• Billing information: our payment processor, Stripe, collects and stores your payment card details directly. We don’t store your full card number.
• Business content: information and media you add to run your CRM and website - service/offering listings, page content, photos (including before/after photos), estimates and e-signature records, and similar content.
• Connected account tokens: if you connect a social media account (e.g., Facebook, Instagram, Google Business Profile) so Otto can help manage posts, we store the access and refresh tokens for that connection, encrypted at rest.
• Usage information: how you use the dashboard and website builder, to operate and improve the Service.

2. Information we collect from Tenants’ customers (end customers)

If you’re a customer of a business that uses Ottohand - for example, you booked an appointment or filled out a contact form on their site - we collect:

• Contact information you provide (such as your name, phone number, and email address).
• Information related to your interactions with that business through our platform, including appointment bookings, form submissions, and messages exchanged with the business.

3. How we use information

We use information to:

• Operate, maintain, and improve the Ottohand platform.
• Enable Tenants to manage their customer relationships and run their websites.
• Enable a Tenant to communicate with their own customers, including appointment reminders and replies to inquiries.
• Power Otto, our AI-assisted feature that drafts suggested replies and actions for a Tenant’s review. This involves sending relevant business and customer-interaction data to our AI provider, Anthropic, to generate those drafts. Otto’s drafts are never sent or published without the Tenant’s explicit approval, and this data is not used by Anthropic to train models on Ottohand’s behalf.
• Process payments (via Stripe) for Tenant subscriptions.
• Send transactional emails and text messages related to your use of the Service.

4. Who we share information with

We do not sell personal information. We share information only:

• With the specific business you’re interacting with, if you’re an end customer - that’s the point of the platform.
• With service providers who help us operate the Service, under confidentiality and data-processing obligations, including:
  • Neon - our database hosting provider
  • Vercel - our application hosting provider
  • Stripe - payment processing
  • Resend - transactional and inbound email delivery
  • Twilio - text messaging delivery
  • Anthropic - AI processing that powers Otto’s drafted suggestions
  • Social media platforms (e.g., Meta/Facebook/Instagram, Google) - only when a Tenant connects an account for posting assistance
• When required by law, or to protect the rights, safety, or property of Ottohand, our Tenants, or others.

5. Google user data

If you connect a Google Business Profile to Ottohand, we ask Google for one permission, the Google Business Profile management scope (business.manage). We use it only to:

• Find your listing: we read the Business Profile accounts and locations your Google account manages (their identifiers, location names, and addresses) so you can choose which listing Otto posts to.
• Publish posts you approve: we publish posts, with an optional photo, to the listing you chose, and only after you approve them.

We do not read your reviews, business hours, or existing posts.

What we store: the account and location identifiers of the listing you chose, that listing’s name, and the access and refresh tokens for the connection. Tokens are encrypted at rest. We also keep the identifier Google returns for each post we publish, as part of your post history. If your Google account manages more than one listing, we temporarily store the list of listing names and addresses so you can choose one, and delete that list once you choose or disconnect.

How we use it: we use Google user data only to provide the features above. We do not sell Google user data, use it for advertising, or send it to Anthropic or any other AI provider.

Disconnecting: you can disconnect Google Business Profile at any time in Settings, Connections. Disconnecting deletes from our database the stored access and refresh tokens, the chosen listing’s name, its account and location identifiers, and any list of listings still waiting for you to choose one. Your post history, including the identifiers Google returned for published posts (which contain the account and location identifiers), is kept until your account is deleted. You can also revoke Ottohand’s access at https://myaccount.google.com/permissions.

Ottohand’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. SMS / text messaging

If you provide your phone number to a business using Ottohand, that business may send you text messages, such as appointment reminders or replies to your inquiries, via our platform.

• We do not sell or share your mobile phone number with third parties or affiliates for marketing or promotional purposes. Your number is used solely to enable communication with the specific business you provided it to.
• Message frequency varies depending on your interactions with the business.
• Message and data rates may apply, depending on your mobile carrier and plan.
• You can opt out of text messages at any time by replying STOP. You can request help by replying HELP.

7. Data retention

We retain Tenant account information and end-customer interaction data for as long as needed to provide the Service, or as required by law. If a Tenant’s account is closed, we handle their data per our Data Deletion page.

8. Security

We take reasonable technical and organizational measures to protect information, including encrypting connected-account tokens at rest, hashing passwords, and verifying webhook signatures on inbound email and SMS to prevent spoofed data. No system is perfectly secure, and we can’t guarantee absolute security.

9. Children’s information

Ottohand is intended for use by business owners and their adult customers, and is not directed at children. Some Tenants (for example, daycare or childcare businesses) may collect information about a child through a form filled out by that child’s parent or guardian; that information is provided and controlled by the Tenant business, not collected by Ottohand directly from a child. If you believe a child has provided us with personal information directly, contact us at jguzik@ottohand.com and we will take appropriate steps to address it.

10. Your choices and rights

• Reply STOP to any text message to opt out of future messages from that business.
• If you’re an end customer of a Tenant, contact that business directly, or contact us at jguzik@ottohand.com, to request access to, correction of, or deletion of your information.
• If you’re a Tenant, you can update your account information directly in your dashboard settings, or contact us to request deletion - see our Data Deletion page.
• Depending on your location, you may have additional rights under laws like the CCPA/CPRA (California) to know, delete, or opt out of the sale/sharing of personal information. We do not sell personal information. Contact us to exercise any applicable rights.

11. International use

Ottohand is based in the United States and our service providers primarily process data in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S.

12. Contact us

Ottohand Technologies LLC
43 Kenneth Terr W, Middletown, NJ 07748
jguzik@ottohand.com

13. Changes to this policy

We may update this Privacy Policy from time to time. We’ll update the effective date above when we do.