Privacy Policy

1. Data controller

DOTI TECNOLOGIA LTDA, responsible for OTTO at otto.doti.gg, is the controller of personal data processed by the platform. For privacy questions or requests, write to [email protected].

2. Data we may process

• account data, such as name, email address, photo, and authentication identifiers;
• authorized data from connected X, LinkedIn, and Threads profiles, such as identifiers, usernames, public information, publications, and metrics available through the APIs;
• identifiers, messages, and audio exchanged with OTTO on Telegram, when connected;
• data submitted in waitlist applications, such as name, email address, occupation, project, networks of interest, posting frequency, challenges, website, objective, and visit attribution data; earlier forms may also have collected WhatsApp details, public profiles, and revenue ranges;
• data submitted in the Otto Enterprise form, such as name, email address, WhatsApp number, company, website, profiles, objective, content production, revenue range, and desired start time;
• conversations, drafts, images, audio, transcriptions, notes, memories, and voice profiles;
• subscription and transaction data, such as amount, status, date, and order identifiers; full card details are processed by the payment processor;
• technical data, such as IP address, browser, device, logs, and usage events;
• recordings of usage sessions, including screens visited, clicks, navigation, and content you type and attach in the editor, including post text and images.

Do not submit sensitive personal data or third-party information without a need and a legal basis.

3. How we use data

We process data to:

• create accounts, authenticate access, and provide the features you have purchased;
• personalize text according to context, niche, history, and voice profile;
• connect accounts, schedule, and publish content with your approval;
• process payments, meet legal obligations, and prevent fraud;
• maintain security, diagnose failures, and improve the product;
• send operational communications and, where permitted, commercial communications;
• internally train and evaluate OTTO's models, prompts, and user experience.
• evaluate applications for limited product cohorts and contact applicants about selection, access, and next steps;
• review Otto Enterprise contact requests and respond using the provided email address or WhatsApp number;

Training use is internal and serves to improve the tool itself. We do not sell or transfer this data to third parties for advertising.

4. AI assistants and MCP (Claude, ChatGPT)

Otto offers a remote MCP server for AI assistants such as Claude and ChatGPT. When you connect Otto to an assistant, you authorize that client to call the tools allowed by the scopes you granted.

MCP OAuth tokens

When you authorize an MCP client, Otto issues an access token and, if requested, a refresh token. On the server we store only the SHA-256 hash of those tokens, together with the OAuth client (name and redirect URIs), the linked Otto account, the granted scopes, the authorized MCP resource, and the expiration, rotation, and revocation timestamps. The cleartext token value is not stored.

You can revoke access in Settings → MCP, which marks the authorization and associated tokens as revoked. OAuth clients may also use the revocation endpoint. Access tokens expire in about one hour; refresh tokens last up to 90 days unless revoked earlier.

Data accessible through MCP tools

The tools only see the Otto account authenticated on that connection. Depending on the authorized scope, the assistant may:

• content:read — read drafts, the schedule, already collected X metrics, memories, the voice profile, and today’s Radar;
• drafts:write — create and edit drafts, attach media, save or delete memories, update or rebuild the voice profile, and interact with Radar;
• publishing:execute — publish, schedule, reschedule, cancel schedules, and delete posts on connected networks.

There may also be MCP API keys (otk_…) that you create in Settings → MCP, with the same scopes; those keys are revoked on the same screen.

X, LinkedIn, and Threads data via MCP

If the Otto account has X, LinkedIn, or Threads connected, the tools use those already authorized links to read available public information and metrics, and to publish or delete content when the publishing:execute scope is granted. MCP does not replace those network logins: the social connection remains the one made under Integrations. Social network access tokens are stored encrypted on Otto’s servers, separate from MCP OAuth tokens.

PostHog telemetry on MCP

When telemetry is configured, the MCP server sends PostHog events for tool listing and tool calls, associated with the Otto account identifier. Metadata such as tool name, duration, MCP client information, error type, and low-cardinality failure codes is sent. Tool arguments and results, error messages that contain user text, and post excerpts are not included in that telemetry. The PostHog session recording described elsewhere applies to use of the otto.doti.gg website, not to MCP calls.

Training use and MCP content

We do not use content that arrives through MCP — briefings, drafts generated or edited by the tools, memories saved via MCP, uploaded images, or tool results — to train our own or third-party language models. This clarification applies to the MCP channel; section 3 continues to describe other internal product uses outside that channel.

The client AI assistant (Claude, ChatGPT, or another) processes the conversation and tool responses under that provider’s policy. Otto does not control what the assistant client retains on its side.

5. Legal bases

Depending on the context, processing may rely on performance of a contract, compliance with a legal obligation, the regular exercise of rights, legitimate interests, or consent. Where consent is the basis used, it may be withdrawn.

6. Sharing

We do not sell personal data. We share only what is necessary with providers and integrations used to operate the product:

• Google, for authentication when you choose that option;
• X, LinkedIn, Threads, and Telegram, when you connect or use each integration;
• OpenRouter, for processing by language models and audio transcription;
• Apify, to read public posts from your LinkedIn profile when you provide the profile link;
• Stripe, for billing and subscription management;
• Resend, to send sign-in links and operational messages;
• PostHog, for product analytics, session recording, and error monitoring;
• Google Analytics, to measure visits to the public home page;
• Railway and Cloudflare, for infrastructure and storage.

Each provider processes data according to its own terms and for the contracted purpose. We may also share information where legally required or necessary to protect rights.

7. International transfers

Some providers may process data outside Brazil. This includes PostHog, which operates its cloud in the United States: some usage data, including session recordings, is processed there. Google Analytics, used only on the public home page, also processes data outside Brazil. In such cases, we adopt mechanisms and safeguards consistent with applicable law to protect the information.

8. Retention and deletion

We retain data for as long as necessary to provide the service, meet legal obligations, prevent fraud, and exercise rights. After termination, data may be deleted, anonymized, or retained where permitted or required by law.

9. Security

We apply technical and administrative measures proportionate to the risks, including HTTPS traffic, server-side protection of access tokens, and access restricted to authorized people. No system is entirely immune, so you must also protect your means of access and notify us of any suspicious activity.

10. Your rights

Under the LGPD, you may request confirmation and access, correction, anonymization, blocking or deletion where applicable, portability as regulated, information about sharing, review of automated decisions in the cases provided by law, and withdrawal of consent.

To exercise a right, write to [email protected]. We may request information to confirm your identity and protect your account. We will respond within 15 days where that deadline applies.

11. Cookies and similar technologies

We use cookies and local storage necessary for authentication, security, preferences, and product operation. PostHog, which we use for product analytics, sets its own cookies and local storage to identify sessions and link usage events to them. On the public home page, Google Analytics sets its own cookies to measure visits.

12. Children and adolescents

OTTO is intended for people aged 18 or over. We do not intentionally collect data from minors. If you identify such data, please contact us.

13. Changes to this Policy

We may update this text to reflect legal, technical, or product changes. The update date will appear at the top of the page. Material changes will be communicated by email or an in-product notice at least 7 days in advance where possible.

14. Governing law and jurisdiction

This Policy is governed by Brazilian law, particularly the LGPD. The courts of the District of São Paulo, SP, are designated where such a choice is legally valid.