Privacy Policy

Last updated: 2026-04-29 — template; review with counsel before public launch.

Otto ID (“we”, “us”, “the Service”) is operated by Ottospace, based in Montreal, Quebec, Canada. This policy explains what personal information we collect, why, and your rights. If you have any question, contact us at privacy@ottospace.co.

What we collect

  • Account info — email address, display name, profile slug, language preference, time zone.
  • Auth signals — session cookies, IP address, user-agent (used for sign-in, security, abuse prevention).
  • Content you create — profiles, links, services, products, posts, NFC device pairings.
  • Customer data — when someone books, buys, or subscribes from your profile, we process their email, name, and payment metadata via Stripe.
  • Usage events — page views, link clicks, NFC taps, on an aggregated and anonymized basis where possible.

Why we collect it

  • Run the Service (sign-in, profile rendering, payments).
  • Communicate with you about your account, transactions, security alerts.
  • Detect abuse, enforce rate limits, prevent fraud.
  • Improve the product (only if analytics consent is granted).

Where data lives

  • Servers operated on a VPS in Beauharnois, Québec, Canada (OVH).
  • Payments processed by Stripe (privacy.stripe.com), crypto by NOWPayments when applicable.
  • Email by Resend (resend.com).

Your rights

You can request, at any time:

  • Access — a copy of your data (machine-readable export).
  • Correction — fix inaccuracies through your dashboard or by emailing us.
  • Deletion — close your account and erase your personal data, subject to legal retention requirements (e.g. tax records).
  • Portability — receive your data in a structured, commonly used format.
  • Withdraw consent — change cookie preferences any time via the Cookie preferences link in the footer.

We respond within 30 days (15 days under Quebec Law 25 for access/portability).

Retention

  • Account data: kept while your account is active, then 30 days after deletion (then erased), except for invoicing records (kept 6 years for tax purposes).
  • Logs: 90 days.
  • Backups: 7 daily / 4 weekly / 3 monthly snapshots; deleted on rotation.

Children

The Service is not directed at people under 14. If you believe a minor has registered, contact us and we will delete the account.

Changes

We will notify you by email and post a banner before any material change. Continued use after the effective date constitutes acceptance.