Privacy Policy

1. Who we are

Otus Analytics is a privacy-first web analytics product. Website owners ("Customers") install our tracking snippet on their sites to measure traffic, and use our dashboard to view reports, manage their account, and optionally connect third-party ad platforms to send conversion events. Our registered contact for privacy matters is info@otusanalytics.com.

2. Information we collect

We collect the following categories of personal data:

• Account information: name, email address, password (stored hashed, never in plain text), and company or site details you provide when you register.
• Billing information: plan selection, billing address and transaction history. Card and payment details are collected and processed directly by our payment processor; we do not store full card numbers on our own servers.
• Dashboard usage data: pages you visit within the dashboard, actions you take (e.g. creating a site, inviting a team member), and basic device/browser information, collected to operate and secure the Service.
• Site configuration data: the domains you add, tracking settings, custom event and goal definitions, and any ad platform destination IDs you configure.
• Support communications: messages you send us by email or through in-app support, including any information you choose to include in them.
• Google user data: if you choose to connect a Google account to send conversion events, as described in detail in Section 3 below.

We do not collect this kind of personal data about the end visitors to your website. Visitor-side analytics data is aggregate and, by default, fully cookieless. See our Privacy & Compliance page for full details on how that works.

3. Google user data and OAuth connections

The Service lets you optionally connect a Google Ads or Google Analytics 4 account so that Otus can forward server-side conversion events on your behalf via Google's Data Manager API. This is entirely opt-in and only relevant if you use the ad-platform integration feature in the dashboard.

When you choose to connect Google, we:

• Redirect you to Google's own consent screen, where you decide whether to grant access.
• Request only the https://www.googleapis.com/auth/datamanager scope, the minimum permission needed to send conversion events to a destination (a Google Ads conversion action or GA4 property) that you specify yourself. We do not request, and cannot access, scopes that would let us read your Google Ads reports, GA4 analytics data, or any other Google account information.
• Exchange the authorization code Google returns for an access token and a refresh token. The refresh token is encrypted at rest; the short-lived access token is requested from Google only at the moment we need to send an event on your behalf.
• Use this access solely to transmit the conversion events you configure (e.g. a purchase or signup event tied to a click ID) to the Google destination you selected. We do not use this data to serve ads, build advertising profiles, or share it with anyone other than Google, as the recipient of the event you asked us to send.

Otus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for serving advertisements, or allow humans to read it except where necessary for security, legal compliance, or with your consent, in narrowly scoped support scenarios.

You can revoke Otus's access to your Google account at any time from the "Ad platforms" section of your dashboard settings, or directly from your Google Account permissions page. Revoking access stops all future event delivery immediately; we delete the associated refresh token once revocation is confirmed.

4. How we use your information

• To create and administer your account and provide the Service.
• To process payments, manage subscriptions, and send billing communications.
• To send conversion events to ad platforms you have explicitly connected.
• To respond to support requests and provide customer service.
• To send service-related notices (e.g. security alerts, changes to these terms).
• To detect, investigate and prevent fraud, abuse, or security incidents.
• To improve and maintain the reliability and performance of the Service.
• To comply with our legal obligations.

We do not sell your personal data, and we do not use it to serve advertising. Otus is funded entirely by subscriptions.

5. Legal basis for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Contract: processing account, billing and configuration data is necessary to provide the Service you have subscribed to.
• Consent: connecting a Google, Meta, TikTok or other third-party ad platform integration is entirely optional and based on your explicit action and consent.
• Legitimate interests: for security monitoring, fraud prevention, and improving the Service, balanced against your rights and freedoms.
• Legal obligation: for record-keeping required by tax, accounting, and other applicable laws.

6. How we share information

We do not sell your personal data. We share it only with the following categories of recipients, each acting under a data processing agreement where required:

• Payment processor: to process subscription payments and invoices.
• Cloud hosting and infrastructure providers: to run the Service, hosted within the EU.
• Email delivery provider: to send transactional emails (e.g. password resets, invoices).
• Ad platforms you connect (e.g. Google, Meta, TikTok, OpenAI): solely to deliver the conversion events you configure, to the destination account you specify.
• Professional advisors: such as accountants or legal counsel, bound by confidentiality.
• Authorities: where required to comply with a legal obligation, court order, or to protect our rights.

7. International data transfers

Our core infrastructure, including your account data, site configuration and analytics processing, is hosted within the European Union. Where a connected third-party integration you choose to enable (such as a Google, Meta, TikTok or OpenAI ad-platform connection) involves a transfer of data outside the EU/EEA, that transfer is made only for the purpose of delivering the events you configured, to the provider you selected, under appropriate safeguards such as Standard Contractual Clauses where applicable.

8. Data retention

We retain account and billing data for as long as your account is active, and for a reasonable period afterwards to comply with accounting and legal obligations, resolve disputes, and enforce our agreements. OAuth refresh tokens are deleted as soon as you disconnect an integration or close your account. You can request deletion of your account and associated personal data at any time by contacting us; see Section 13.

9. Your rights

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; restrict or object to certain processing; receive a copy of your data in a portable format; and withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at info@otusanalytics.com. If you are in the European Economic Area, you also have the right to lodge a complaint with your local data protection authority.

10. Cookies on our website and dashboard

Our marketing website and dashboard application use a minimal set of first-party cookies necessary for core functionality, such as keeping you signed in and remembering your preferences. This is separate from Otus's analytics product, which, when installed on a customer's website, runs cookieless by default. See Privacy & Compliance for details on the analytics product's cookie behaviour, including the optional cookie-enabled mode.

11. Security

We use industry-standard technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest for sensitive credentials such as OAuth refresh tokens, access controls, and regular review of our infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children's privacy

The Service is intended for businesses and professionals and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice in the dashboard before the change takes effect. The "Effective date" at the top of this page reflects the last revision.

14. Contact us

If you have any questions about this Privacy Policy or how we handle your data, contact us at info@otusanalytics.com.