Privacy Policy

1. Introduction and scope

1.1This Policy explains how Otisbase processes personal data in connection with the Otis MCP server at mcp.otisbase.com, the website at otisbase.com and the Otis plugins (together, the “Service”). Otisbase is operated by Boon IT SRL, a company registered in Romania under CUI 45987107, with its registered office in Cluj-Napoca, Romania, and “Otisbase”, “we” and “us” refer to that company.

1.2It does not cover the AI assistant you connect to Otis, which is a third-party service governed by its own terms and privacy policy.

1.3This Policy forms part of the Terms of Service.

2. Roles

2.1For your account, sign-in, security and feedback data, Otisbase is the controller.

2.2Your Business Records can include personal data about your own clients and contacts, such as a client’s name, email and billing address. For that data, you or your business are the controller and Otisbase acts as a processor, processing it only to provide the Service on your instructions, which you give through your assistant. Our Data Processing Agreement sets out those processor terms under Article 28 GDPR and forms part of the Terms.

2.3We do not sell personal data, and we do not use your data to train any AI model. No AI model runs on Otis.

3. Personal data we process

3.1Account data. The email address you verify when you connect. We derive a pseudonymous account identifier from it, a one-way hash, which identifies you in the Service.

3.2Sign-in data. While you sign in, we hold your email address, the name and return address of the assistant requesting access, and a hash of the one-time code, for up to 10 minutes. To limit abuse we count sign-in attempts against a hash of your email address and of your IP address.

3.3Connection data. When you approve a connection, your assistant receives an access token valid for one hour and a refresh token valid for 30 days. The connection record stores your account identifier and, encrypted, your email address. Assistants that register with Otis store their name and return addresses.

3.4Business Records. What your assistant saves: business settings, invoice numbering and tax profile; clients and their billing details; work, expenses and AI usage; invoices with the business and client details they were issued with; payments; and a history of every change, including who made it and what was sent. If an owner invites someone, the invitee’s email address is stored with the invitation.

3.5Usage counts. Daily counts of requests and new records per business, used to apply the fair-use limits, and deleted after the day ends.

3.6Feedback. If you send feedback through your assistant, we store the message, its kind, the assistant’s name, your account identifier and, only if you agree to a reply, your email address.

3.7Technical data. To protect the Service, requests to public sign-in and connection endpoints are rate-limited by IP address. Our hosting provider may process request metadata such as IP addresses and timestamps to operate and secure its network.

4. Data we do not process

4.1We do not receive your conversations with your assistant. Your assistant sends Otis only the specific requests needed to save or read records.

4.2We do not collect passwords or payment card details, and the Service does not move money.

4.3The website uses no analytics, advertising or tracking tools, and loads no third-party scripts or fonts.

5. Purposes and lawful bases

5.1We process personal data for these purposes, on these lawful bases under the GDPR:

• Providing the Service (account, sign-in, connections, storing and returning Business Records): performance of our contract with you, Article 6(1)(b).
• Security and abuse prevention (sign-in limits, rate limits, fair-use limits): our legitimate interest in a secure and available service, Article 6(1)(f).
• Feedback: our legitimate interest in improving the Service, Article 6(1)(f). Your email address is included only with your consent, Article 6(1)(a).
• Service messages such as sign-in codes and notices of material changes: performance of our contract with you, Article 6(1)(b).

6. Sub-processors

6.1We use these sub-processors, each bound by data protection terms:

• Cloudflare, Inc.: hosting and storage of Service data, and sending email, including sign-in codes, security notices and feedback notifications. Business Records, accounts, sign-ins and feedback are stored in Cloudflare’s European Union jurisdiction.
• Google LLC (Google Workspace): our support, contact and privacy mailboxes, which receive the emails you send us and feedback notifications.

6.2The assistant you connect is not our sub-processor. You choose it, and it receives the results of the requests it makes to Otis under its own terms.

7. Cookies and local storage

7.1During sign-in we set one strictly necessary cookie, __Host-otis-connect, which ties your browser to the sign-in in progress. It lasts at most 10 minutes and is removed when sign-in ends.

7.2The website stores two preferences in your browser’s local storage: your light or dark theme (otisbase-theme) and whether you closed the notice bar (otisbase-notice). They never leave your device.

7.3We set no analytics or advertising cookies.

8. Retention and deletion

8.1Sign-in data is deleted within 10 minutes, sign-in attempt counts within an hour, and daily usage counts after the day ends. Access tokens expire after one hour and refresh tokens after 30 days. Registrations of assistants expire after 90 days.

8.2Your account and Business Records, including their history, are kept for as long as you use the Service. An issued invoice is never changed, because invoices must stay as they were issued.

8.3To have your account and Business Records deleted, write to privacy@otisbase.com from the email address you use with Otis. We will delete them within 30 days, except where the law requires us to keep something.

8.4Feedback is kept for as long as it helps us improve the Service. You can ask us to delete it at the same address.

9. Your rights

9.1Under data protection law you have the right to access, correct and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time.

9.2You can exercise several of these through your assistant: it can read your records, correct them, and export them with their history.

9.3For any other request, write to privacy@otisbase.com. We reply within 30 days. Where we act as processor for your business, we may refer a request from one of your clients to you, and we will help you respond.

9.4You may also complain to a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

10. Security

10.1We protect personal data with measures including:

• encryption of all traffic with TLS;
• sign-in by a one-time email code, with no passwords, and OAuth with PKCE for every connection;
• one-time codes stored only as hashes, and email addresses stored encrypted in connection records;
• a separate storage unit for each business, with owner, editor and viewer roles checked on every request;
• rate limits on sign-in and public endpoints;
• storage encrypted at rest with AES-256 for Business Records, accounts, sign-ins and feedback;
• an email to you when a new assistant connects to your account, and to an owner when they invite someone to their business.

10.2Only authorised Otisbase personnel can access stored data, and only to provide support you ask for, keep the Service secure, or comply with the law.

10.3No security measure is absolute. If a personal data breach affects you, we will tell you without undue delay, and we will notify the supervisory authority where the law requires it.

11. International transfers

11.1Business Records, accounts, sign-ins and feedback are stored and processed in the European Union, in Cloudflare’s EU jurisdiction.

11.2Connection records, which hold your account identifier and your email address in encrypted form, are also stored in Cloudflare’s EU jurisdiction, though Cloudflare may cache them outside the European Economic Area. Requests can be served by Cloudflare data centres worldwide, and Google may process our mailboxes outside the EEA.

11.3Where personal data is transferred outside the EEA or the UK, the transfer relies on the European Commission’s Standard Contractual Clauses or another lawful safeguard, as provided in our providers’ data processing terms.

12. Children

12.1The Service is for business use and is not directed at anyone under 18. We do not knowingly process children’s personal data.

13. Amendments

13.1We may amend this Policy. The date above changes with each amendment.

13.2We will tell you by email before a material amendment takes effect.

14. Contact

14.1Questions, requests and complaints about this Policy go to privacy@otisbase.com. Our address is Boon IT SRL, Cluj-Napoca, Romania.