Version 0.9, effective 27 September 2026
This Privacy Policy explains how Otus Analytics, a general partnership (vennootschap onder firma) whose registration with the Dutch Chamber of Commerce is in progress (KvK number to follow), with its address at Carnapstraat 112, 1062 KT Amsterdam, the Netherlands ("Otus", "we", "us"), handles personal data as a controller. You can reach us about privacy at info@otusanalytics.com.
If you're a visitor to a website that uses Otus Analytics, see Section 1 below. For more on how our tracking technology itself works, see our Privacy & Compliance page.
If you visit a website that uses Otus Analytics, that website's owner decides what is collected and why. We process that data on their behalf as a processor, under our Data Processing Agreement. For questions or requests about that data, please contact the owner of the website. If you contact us, we will forward your request to them.
Two further categories — connected advertising accounts, and the data we send to our AI features — are described in their own sections below, as is how we measure visitors to otusanalytics.com itself.
If you connect an advertising platform to use conversion forwarding (we currently support Google Ads and Meta), we receive an access token and the identifiers of the ad account or dataset you select. For Meta, this is a system user access token that you create in your Meta Business settings and enter in Otus yourself. We use these only to send the conversions you configure to that account, and for no other purpose. We store them encrypted within the EU until you disconnect the platform or close your account. Legal basis: performance of our contract with you.
For Google Ads, we request a single OAuth scope, https://www.googleapis.com/auth/datamanager, which lets us send conversions to Google Ads through Google's Data Manager API. We do not request any other Google scopes, so we have no access to your email, files, calendar or other Google account data, and we use the connection only to send conversions, never to read, change or delete other data in your Google Ads account.
When you connect Google Ads, you sign in with Google and approve this access, after which Google gives us an access token and a refresh token. We use the refresh token only to obtain new short-lived access tokens when we send conversions. You can revoke access at any time by disconnecting Google Ads in your Otus settings, or through the permissions page of your Google Account. For Meta, you can disconnect in your Otus settings or revoke the system user token in your Meta Business settings. When you disconnect in Otus, we revoke the token with Google and delete it from our systems. When you revoke access with Google or Meta directly, we delete the token as soon as the revocation is confirmed, which is at the latest when our next attempt to use it fails.
Otus's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not allow humans to read it unless you ask us to for support, it is needed for security or legal reasons, or it has been aggregated and anonymised.
The AI Analyst and AI Chat use Mistral AI to generate summaries and answers. We send Mistral aggregated statistics from your analytics data, such as visitor counts, top pages and conversion figures, and for AI Chat also the questions you type. We do not send individual events or visitor-level data. Mistral processes this data on our behalf only to generate the response, within the EU, and does not use it to train its models. Legal basis: performance of our contract with you. The analytics data itself is processed on behalf of our customers under the Data Processing Agreement.
We measure our own website with Otus Analytics. By default, we use cookieless mode: no cookies are placed, nothing is stored in your browser, and IP addresses are not stored in our analytics data. Visits within a session are grouped using an anonymous daily identifier that changes every day and cannot be used to recognise you on a later day. Legal basis: legitimate interest in understanding how our website is used.
If you give marketing consent, we switch to full tracking mode: we place a first-party session cookie and store a visitor identifier in your browser, so we can recognise returning visits and measure which campaigns bring visitors to our website. If you arrived through a Google Ads ad and later sign up for a trial or plan, we send that conversion to Google Ads from our servers, together with the click identifier Google added to the link you clicked, and we pass your consent choice along with it. We do not send your email address or any other identifier to Google. We only do this with your consent. You can withdraw your consent at any time through the "Cookie settings" link in the footer on every page. Legal basis: your consent.
Our website does not load third-party scripts, fonts or embeds. Advertising measurement runs entirely server-side.
We share personal data only where necessary:
We do not sell personal data and do not share it for advertising.
All data is stored and processed within the European Economic Area, and we do not transfer personal data outside the EEA ourselves. Google, as an independent controller of the conversion data we send to Google Ads, may transfer it to the United States. Google relies on the EU-US Data Privacy Framework for those transfers. When you, as a customer, connect an advertising platform, that platform's own terms govern what happens to the data after we forward it at your instruction.
You have the right to access, correct or delete your personal data, to object to or restrict its processing, and to receive your data in a portable format. Where we rely on your consent, you can withdraw it at any time, without affecting the lawfulness of processing before you withdrew it. For our website, you can do this through the "Cookie settings" link in the footer. You can exercise your other rights by emailing info@otusanalytics.com. We respond within one month.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.
The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact us and we will delete it.
We protect personal data with appropriate technical and organisational measures, including encryption in transit, encrypted storage of access tokens, databases that are not reachable from the public internet, restricted access to production systems and hosting exclusively within the EU, and we review these measures regularly. No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the authorities where the law requires it.
We may update this Privacy Policy. The version and date at the top show when it was last changed. We will notify customers of material changes by email.
See also our Terms of Service, Data Processing Agreement and Privacy & Compliance pages.